[PR #205] [MERGED] fix(permission): defer cache write grants #1856

New issue

Closed

opened 2026-10-16 21:11:51 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:11:51 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/205
Author: @N0zoM1z0
Created: 7/14/2026
Status: ✅ Merged
Merged: 7/14/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/fix-cache-hit-permissions

📝 Commits (1)

f840e70 fix(permission): defer cache write grants

📊 Changes

8 files changed (+463 additions, -117 deletions)

View changed files

📝 src/application/CrossVersionInvestigation.ts (+9 -0)
➕ src/application/DeferredFileAuthorization.ts (+105 -0)
📝 src/application/DirectAnalysis.ts (+74 -25)
📝 src/cliInvestigationCommands.ts (+21 -42)
📝 src/server/registerInvestigationTools.ts (+39 -44)
➕ tests/directAnalysisPermissions.test.ts (+80 -0)
➕ tests/fixtures/permissionAuthority.ts (+44 -0)
📝 tests/investigationMcp.test.ts (+91 -6)

📄 Description

Summary

authorize snapshot and investigation workspace reads with read access
defer snapshot/workspace write grants until a cache miss or incomplete investigation actually needs persistence
preserve creation of missing snapshot/workspace files by requesting write authority after a read-side not_found
add regressions for read-only snapshot cache hits and complete investigation workspace replay

Root cause and impact

Snapshot and investigation adapters requested write permissions before determining whether cached results were complete. This prevented valid read-only cache replays and exposed a broader permission requirement than the operation needed.

The new shared authorization helper keeps path canonicalization fail-closed, requests write immediately only for a missing destination, and memoizes deferred write authorization for active runs.

Verification

npm run check
npm run knip
npm run jscpd
npm run scan:todos
targeted snapshot and investigation permission tests

Real Hopper verification was not performed; these changes affect permission and cache orchestration and are covered by production-seam and MCP tests.

Closes #192
Closes #200

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/205 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/14/2026 **Status:** ✅ Merged **Merged:** 7/14/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/fix-cache-hit-permissions` --- ### 📝 Commits (1) - [`f840e70`](https://github.com/morluto/rea/commit/f840e70749ffadfe34cf8b7e464b54e8ffebd816) fix(permission): defer cache write grants ### 📊 Changes **8 files changed** (+463 additions, -117 deletions) <details> <summary>View changed files</summary> 📝 `src/application/CrossVersionInvestigation.ts` (+9 -0) ➕ `src/application/DeferredFileAuthorization.ts` (+105 -0) 📝 `src/application/DirectAnalysis.ts` (+74 -25) 📝 `src/cliInvestigationCommands.ts` (+21 -42) 📝 `src/server/registerInvestigationTools.ts` (+39 -44) ➕ `tests/directAnalysisPermissions.test.ts` (+80 -0) ➕ `tests/fixtures/permissionAuthority.ts` (+44 -0) 📝 `tests/investigationMcp.test.ts` (+91 -6) </details> ### 📄 Description ## Summary - authorize snapshot and investigation workspace reads with read access - defer snapshot/workspace write grants until a cache miss or incomplete investigation actually needs persistence - preserve creation of missing snapshot/workspace files by requesting write authority after a read-side `not_found` - add regressions for read-only snapshot cache hits and complete investigation workspace replay ## Root cause and impact Snapshot and investigation adapters requested write permissions before determining whether cached results were complete. This prevented valid read-only cache replays and exposed a broader permission requirement than the operation needed. The new shared authorization helper keeps path canonicalization fail-closed, requests write immediately only for a missing destination, and memoizes deferred write authorization for active runs. ## Verification - `npm run check` - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - targeted snapshot and investigation permission tests Real Hopper verification was not performed; these changes affect permission and cache orchestration and are covered by production-seam and MCP tests. Closes #192 Closes #200 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:11:51 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:56:33 +00:00

[PR #1907] [MERGED] fix(process): retain owned command cleanup diagnostics #4899

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1856

No description provided.

Rows
Columns