[PR #574] [MERGED] fix(artifacts): refresh cached ASAR headers for each inventory #2075

New issue

Closed

opened 2026-10-16 21:13:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:13:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/574
Author: @kaoru0822-kitauji
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: fix/asar-refresh-archive-metadata

📝 Commits (1)

ff48b59 fix(artifacts): refresh cached ASAR headers for each inventory

📊 Changes

2 files changed (+145 additions, -1 deletions)

View changed files

📝 src/artifacts/AsarArtifactReader.ts (+4 -1)
➕ tests/boundary/filesystem/asarInventoryFreshness.test.ts (+141 -0)

📄 Description

Summary

Refresh ASAR metadata between inventory operations so replacing an archive at the same path cannot attach stale filenames to the new archive digest.

Found during a repository audit; no existing issue describes this cache-lifecycle error.

Problem and expected behavior

@electron/asar caches archive headers by path. REA retained that cache across inventories even when app.asar had been rebuilt or replaced.

A real ASAR containing old.js, followed by a replacement containing new.js with identical bytes, reproduces a successful second inventory with the new archive digest but the old filename and no integrity contradiction. Hashing the root before and after the scan does not expose the older cached header.

Each fresh inventory must read metadata belonging to the archive it is scanning.

Change and scope

Invalidate only the selected archive's upstream cache before listing entries.
Release that archive's cached header on reader close, including failure cleanup.
Keep the existing per-entry integrity checks and public ASAR implementation.
Cover direct and nested archive replacement, unchanged rescans, metadata cached by another caller, overlapping readers, repeated close, and cancellation cleanup.

This affects repeated inspection in long-lived processes such as MCP. Separate one-shot CLI processes do not retain the cross-operation cache.

Contract and boundary impact

Semantic owner: the ASAR reader's metadata-cache lifecycle.
CLI/MCP schemas, tool inventory, and generated metadata: unchanged.
Provider/format support: existing ASAR support only; no platform claims added.
Evidence/provenance: child paths and metadata now reflect the current archive digest; existing identity and integrity checks remain.
Execution, authorization, and filesystem containment: unchanged. Invalidation is scoped to this.path; no global cache flush is used.

Evidence and regression coverage

Five real-filesystem tests use actual packages written by @electron/asar. Four fail on unchanged base e07b81649e96668e5ce166cfc6db3b59a7777697: direct replacement, nested replacement, pre-existing cache, and cache release after cancellation. The overlapping-reader control passes on the base.

The final overlapping-reader test verifies both extraction and resumed metadata iteration for a second member after another reader closes twice. Independent review found no blocking issue.

Latest main eba709e only changes docs/roadmap.md relative to the tested base.

Validation performed

Focused ASAR freshness, archive inventory/safety, and JavaScript artifact reconstruction suites: 20 tests passed.
npm run check:ci: all seven static tasks passed.
npm run docs:check: passed; TypeDoc reported 202 existing warnings and no errors.
npm run verify:package: Linux package/install, CLI, and MCP verifier passed.
npm pack --dry-run --json: passed.
git diff --check: passed.
npm run check:pr: static stages passed; full suite reported 1,775 passed, 40 failed, and 1 skipped. All 40 failures in the same seven native bridge suites reproduce on unchanged e07b816. This environment rejects Unix-domain socket listeners with EPERM, producing startup failures/timeouts. The final focused suites and static checks were rerun after strengthening the overlapping-reader control.

Compatibility, safety, and release

No breaking schemas or migration steps. Real ASAR read/write workflows were exercised on Linux. No real Hopper/Ghidra verification was performed because those providers are unchanged. No tests or permission checks were relaxed.

Review checklist

Focused Conventional Commit outcome.
Real baseline reproduction and regression tests.
Concurrent-reader, repeated-close, and failure-cleanup controls.
Independent review completed.
Diff checked for unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/574 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/asar-refresh-archive-metadata` --- ### 📝 Commits (1) - [`ff48b59`](https://github.com/morluto/rea/commit/ff48b5977e35c7dab10d4caac9d5ac2bc327ff1d) fix(artifacts): refresh cached ASAR headers for each inventory ### 📊 Changes **2 files changed** (+145 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/artifacts/AsarArtifactReader.ts` (+4 -1) ➕ `tests/boundary/filesystem/asarInventoryFreshness.test.ts` (+141 -0) </details> ### 📄 Description ## Summary Refresh ASAR metadata between inventory operations so replacing an archive at the same path cannot attach stale filenames to the new archive digest. Found during a repository audit; no existing issue describes this cache-lifecycle error. ## Problem and expected behavior `@electron/asar` caches archive headers by path. REA retained that cache across inventories even when `app.asar` had been rebuilt or replaced. A real ASAR containing `old.js`, followed by a replacement containing `new.js` with identical bytes, reproduces a successful second inventory with the new archive digest but the old filename and no integrity contradiction. Hashing the root before and after the scan does not expose the older cached header. Each fresh inventory must read metadata belonging to the archive it is scanning. ## Change and scope - Invalidate only the selected archive's upstream cache before listing entries. - Release that archive's cached header on reader close, including failure cleanup. - Keep the existing per-entry integrity checks and public ASAR implementation. - Cover direct and nested archive replacement, unchanged rescans, metadata cached by another caller, overlapping readers, repeated close, and cancellation cleanup. This affects repeated inspection in long-lived processes such as MCP. Separate one-shot CLI processes do not retain the cross-operation cache. ## Contract and boundary impact - Semantic owner: the ASAR reader's metadata-cache lifecycle. - CLI/MCP schemas, tool inventory, and generated metadata: unchanged. - Provider/format support: existing ASAR support only; no platform claims added. - Evidence/provenance: child paths and metadata now reflect the current archive digest; existing identity and integrity checks remain. - Execution, authorization, and filesystem containment: unchanged. Invalidation is scoped to `this.path`; no global cache flush is used. ## Evidence and regression coverage Five real-filesystem tests use actual packages written by `@electron/asar`. Four fail on unchanged base `e07b81649e96668e5ce166cfc6db3b59a7777697`: direct replacement, nested replacement, pre-existing cache, and cache release after cancellation. The overlapping-reader control passes on the base. The final overlapping-reader test verifies both extraction and resumed metadata iteration for a second member after another reader closes twice. Independent review found no blocking issue. Latest main `eba709e` only changes `docs/roadmap.md` relative to the tested base. ## Validation performed - Focused ASAR freshness, archive inventory/safety, and JavaScript artifact reconstruction suites: 20 tests passed. - `npm run check:ci`: all seven static tasks passed. - `npm run docs:check`: passed; TypeDoc reported 202 existing warnings and no errors. - `npm run verify:package`: Linux package/install, CLI, and MCP verifier passed. - `npm pack --dry-run --json`: passed. - `git diff --check`: passed. - `npm run check:pr`: static stages passed; full suite reported 1,775 passed, 40 failed, and 1 skipped. All 40 failures in the same seven native bridge suites reproduce on unchanged `e07b816`. This environment rejects Unix-domain socket listeners with `EPERM`, producing startup failures/timeouts. The final focused suites and static checks were rerun after strengthening the overlapping-reader control. ## Compatibility, safety, and release No breaking schemas or migration steps. Real ASAR read/write workflows were exercised on Linux. No real Hopper/Ghidra verification was performed because those providers are unchanged. No tests or permission checks were relaxed. ## Review checklist - [x] Focused Conventional Commit outcome. - [x] Real baseline reproduction and regression tests. - [x] Concurrent-reader, repeated-close, and failure-cleanup controls. - [x] Independent review completed. - [x] Diff checked for unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:13:59 +00:00