morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #581] [MERGED] fix(artifacts): preserve archive entry types and host paths #2082

New issue

Closed

opened 2026-10-16 21:14:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/581
Author: @morluto
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: fix/javascript-archive-boundaries

📝 Commits (1)

0c41fd6 fix(artifacts): preserve archive entry types and host paths

📊 Changes

5 files changed (+153 additions, -5 deletions)

View changed files

📝 .github/workflows/ci.yml (+2 -0)
📝 src/application/JavaScriptArtifactFiles.ts (+4 -0)
📝 src/artifacts/AsarArtifactReader.ts (+16 -3)
📝 tests/boundary/filesystem/asarInventoryFreshness.test.ts (+79 -1)
📝 tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts (+52 -1)

📄 Description

Summary

Fix JavaScript analysis of archives containing directories such as node_modules/@zip.js, and fix ASAR inventory/extraction on Windows. Directory and unknown-file inventory remains complete; these changes correct entry-type classification and provider path translation without adding filesystem permissions or scopes.

Fixes #571
Fixes #570

Problem and expected behavior

Directory graph nodes have artifact IDs, so the JavaScript file projection previously treated any .js, .json, or similar path as content to read. Opening a directory then aborted the whole analysis. Only regular-file occurrences now become parsing candidates or nested ASAR containers; directory nodes and their children remain evidence.

Electron's ASAR library lists paths with the host separator and a leading separator, and requires host-relative lookup keys. REA stripped only /, which left Windows lookup keys rooted and unreadable. The adapter now retains a host-relative key for statFile and extractFile and exposes slash-separated logical paths. Literal backslashes in POSIX filenames are preserved.

Change and scope

Gate JavaScript content projection on inventory entry type after validating referenced graph nodes.
Separate graph-facing ASAR paths from the library's host-facing lookup keys.
Add actual packed-ASAR regressions for nested file reads, directory inventory, symlink metadata, literal POSIX backslashes, and the @zip.js directory with an analyzable entry.js child.
Run ASAR inventory and JavaScript reconstruction tests in the native Windows capability lane. POSIX symlink/backslash cases are separate and skipped on Windows; the core Windows regression does not require symlink authority.

Contract and boundary impact

Semantic owner and earliest changed stage: artifact inventory projection and the Electron ASAR provider adapter.
CLI and MCP/tool-catalog contract: input/output schemas and catalog are unchanged; both surfaces use the corrected shared workflows.
Provider, bridge, target-format, or platform compatibility: Windows ASAR lookup keys now match the official library's host-path contract. POSIX literal filename characters remain intact.
Evidence, artifact, provenance, or reconstruction contract: directories remain materialized graph nodes but no longer masquerade as file contents.
Process execution, authorization, cleanup, or containment impact: none; archive contents are parsed without execution and no filesystem access restrictions are added.
Generated metadata, package, or installation impact: none; no dependencies added.

Evidence and regression coverage

The regression builds an archive containing node_modules/@zip.js/entry.js, proves the scope directory still has a graph node, and verifies that the child appears in the JavaScript asset graph. Reader tests pack real archives with the installed official @electron/asar implementation and read their nested contents through REA.

The path change was checked against the installed library's listFiles, getFile, statFile, and extractFile implementation. No module mocks replace the provider boundary.

Validation performed

npm run check:pr — passed, 347 files and 1,957 tests passed with 1 skipped; static checks and generated-document checks passed.
After rebasing onto the latest main, npm run check:fast and five focused files — passed, 42 tests covering ASAR inventory, JavaScript reconstruction, client dialect/lifecycle, and curated Windows lane registration.
Formatting and staged diff checks — passed.
Native Windows execution is delegated to the updated CI lane; local verification ran on macOS arm64.
Real Hopper/Ghidra/browser verification was not performed; their providers are unchanged.

Compatibility, safety, and release

No breaking schema changes or added permissions. Non-file entries remain inventoried and regular files inside suffix-named directories remain analyzable. The separate doctor subprocess observation in #570 is outside this ASAR fix; the named RuntimeExecutableDiagnostics implementation is absent from current source.

Review checklist

Conventional Commit title and linked issues.
Production ASAR boundary and meaningful analysis regressions covered.
No generated contracts or installation changes required.
Native Windows coverage added; local platform limitation stated.
Diff checked for unrelated changes and secrets.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/581 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/javascript-archive-boundaries` --- ### 📝 Commits (1) - [`0c41fd6`](https://github.com/morluto/rea/commit/0c41fd6b4c494181bf48fc78020c0abf07242770) fix(artifacts): preserve archive entry types and host paths ### 📊 Changes **5 files changed** (+153 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+2 -0) 📝 `src/application/JavaScriptArtifactFiles.ts` (+4 -0) 📝 `src/artifacts/AsarArtifactReader.ts` (+16 -3) 📝 `tests/boundary/filesystem/asarInventoryFreshness.test.ts` (+79 -1) 📝 `tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts` (+52 -1) </details> ### 📄 Description ## Summary Fix JavaScript analysis of archives containing directories such as `node_modules/@zip.js`, and fix ASAR inventory/extraction on Windows. Directory and unknown-file inventory remains complete; these changes correct entry-type classification and provider path translation without adding filesystem permissions or scopes. Fixes #571 Fixes #570 ## Problem and expected behavior Directory graph nodes have artifact IDs, so the JavaScript file projection previously treated any `.js`, `.json`, or similar path as content to read. Opening a directory then aborted the whole analysis. Only regular-file occurrences now become parsing candidates or nested ASAR containers; directory nodes and their children remain evidence. Electron's ASAR library lists paths with the host separator and a leading separator, and requires host-relative lookup keys. REA stripped only `/`, which left Windows lookup keys rooted and unreadable. The adapter now retains a host-relative key for `statFile` and `extractFile` and exposes slash-separated logical paths. Literal backslashes in POSIX filenames are preserved. ## Change and scope - Gate JavaScript content projection on inventory entry type after validating referenced graph nodes. - Separate graph-facing ASAR paths from the library's host-facing lookup keys. - Add actual packed-ASAR regressions for nested file reads, directory inventory, symlink metadata, literal POSIX backslashes, and the `@zip.js` directory with an analyzable `entry.js` child. - Run ASAR inventory and JavaScript reconstruction tests in the native Windows capability lane. POSIX symlink/backslash cases are separate and skipped on Windows; the core Windows regression does not require symlink authority. ## Contract and boundary impact - Semantic owner and earliest changed stage: artifact inventory projection and the Electron ASAR provider adapter. - CLI and MCP/tool-catalog contract: input/output schemas and catalog are unchanged; both surfaces use the corrected shared workflows. - Provider, bridge, target-format, or platform compatibility: Windows ASAR lookup keys now match the official library's host-path contract. POSIX literal filename characters remain intact. - Evidence, artifact, provenance, or reconstruction contract: directories remain materialized graph nodes but no longer masquerade as file contents. - Process execution, authorization, cleanup, or containment impact: none; archive contents are parsed without execution and no filesystem access restrictions are added. - Generated metadata, package, or installation impact: none; no dependencies added. ## Evidence and regression coverage The regression builds an archive containing `node_modules/@zip.js/entry.js`, proves the scope directory still has a graph node, and verifies that the child appears in the JavaScript asset graph. Reader tests pack real archives with the installed official `@electron/asar` implementation and read their nested contents through REA. The path change was checked against the installed library's `listFiles`, `getFile`, `statFile`, and `extractFile` implementation. No module mocks replace the provider boundary. ## Validation performed - `npm run check:pr` — passed, 347 files and 1,957 tests passed with 1 skipped; static checks and generated-document checks passed. - After rebasing onto the latest main, `npm run check:fast` and five focused files — passed, 42 tests covering ASAR inventory, JavaScript reconstruction, client dialect/lifecycle, and curated Windows lane registration. - Formatting and staged diff checks — passed. - Native Windows execution is delegated to the updated CI lane; local verification ran on macOS arm64. - Real Hopper/Ghidra/browser verification was not performed; their providers are unchanged. ## Compatibility, safety, and release No breaking schema changes or added permissions. Non-file entries remain inventoried and regular files inside suffix-named directories remain analyzable. The separate doctor subprocess observation in #570 is outside this ASAR fix; the named `RuntimeExecutableDiagnostics` implementation is absent from current source. ## Review checklist - [x] Conventional Commit title and linked issues. - [x] Production ASAR boundary and meaningful analysis regressions covered. - [x] No generated contracts or installation changes required. - [x] Native Windows coverage added; local platform limitation stated. - [x] Diff checked for unrelated changes and secrets. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:01 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:57:59 +00:00

[PR #2082] [MERGED] docs: clarify responsible use and preserve third-party notices #5012

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2082

No description provided.

Rows
Columns