[PR #613] [MERGED] fix(cli): reject invalid UTF-8 JSON file bytes #2113

New issue

Closed

opened 2026-10-16 21:14:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:14:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/613
Author: @rudycelekli
Created: 10/5/2026
Status: ✅ Merged
Merged: 10/5/2026
Merged by: @morluto

Base: main ← Head: campaign/rea-json-utf8-input-20261005

📝 Commits (3)

e602bbf fix(cli): reject invalid UTF-8 JSON file bytes
cf5cef8 test(browser): preserve unknown with-scope loader bindings
b1740bf Merge remote-tracking branch 'origin/main' into campaign/rea-json-utf8-input-20261005

📊 Changes

3 files changed (+57 additions, -4 deletions)

View changed files

📝 src/application/JsonFiles.ts (+5 -1)
📝 src/cliJsonInput.ts (+9 -3)
➕ tests/boundary/filesystem/jsonUtf8Input.test.ts (+43 -0)

📄 Description

Summary

Both shared evidence JSON file reads and CLI JSON file input reject undecodable UTF-8 with the existing invalid-json error. Valid U+FFFD, accents, emoji remain accepted. ignoreBOM:true preserves previous BOM handling rather than silently changing it.

No tracking issue: this is a focused correctness regression found through production-seam reproduction.

Problem and expected behavior

Undecodable bytes return existing invalid-json errors rather than altered input values; valid U+FFFD, accents, emoji and prior BOM handling remain supported.

Change and scope

The change stays in the owning adapter/application stage and corrects existing behavior without adding tools or broadening provider coverage.

Contract and boundary impact

Semantic owner and earliest changed stage: Shared application JSON-file decoding and CLI JSON-file input, before JSON.parse.
CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation.
Provider, bridge, target-format, or platform compatibility: Actual Node 24.18.0 file decoding and CLI/shared production adapters ran. Representative result: invalid byte input now returns the existing invalid-json classification instead of a successful altered message.
Evidence, artifact, provenance, or reconstruction contract: Undecodable bytes return existing invalid-json errors rather than altered input values; valid U+FFFD, accents, emoji and prior BOM handling remain supported.
Process execution, authorization, cleanup, or containment impact: Existing execution authority, cleanup and containment remain preserved.
Generated metadata, package, or installation impact: no metadata or dependency changes.

Evidence and regression coverage

Three malformed-byte fixtures were incorrectly accepted before; five focused file/CLI tests pass. Native compiled shared/CLI adapters changed an invalid byte from accepted message=U+FFFD to invalid-json.

Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly.

Validation performed

Passed on signed head b1740bf403434a657428e7779e4d7766adf27868 under the current ordinary-fix guidelines:

npm run test:focused -- tests/boundary/filesystem/jsonUtf8Input.test.ts tests/boundary/filesystem/cliJsonInput.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts — 28 tests passed; boundary build included
npm run check
npm run check:fast

The current main branch, including the maintainer’s fixture correction in #609, was merged normally. Its source-map recovery fixture is preserved exactly: a require inside with remains unknown, while an unbound require outside it and a static import still produce recovered dependencies. This update changes no production code in the PR’s own fix.

Full check:pr is optional for routine fixes under the current guidelines; no current-head full-suite pass is claimed. Package smoke and pack verification are not applicable because package/install outputs and dependencies are unchanged. Hosted CI is tracked separately.

Development runtime: Node.js 24.18.0 and npm 11.16.0.

Compatibility, safety, and release

No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only.

Prepared with AI assistance.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/613 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/5/2026 **Status:** ✅ Merged **Merged:** 10/5/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `campaign/rea-json-utf8-input-20261005` --- ### 📝 Commits (3) - [`e602bbf`](https://github.com/morluto/rea/commit/e602bbf69b8972dcd913c4a70a8fcbca2b9bc3ab) fix(cli): reject invalid UTF-8 JSON file bytes - [`cf5cef8`](https://github.com/morluto/rea/commit/cf5cef86959c63cdbae8571a6d9a1a996f40d995) test(browser): preserve unknown with-scope loader bindings - [`b1740bf`](https://github.com/morluto/rea/commit/b1740bf403434a657428e7779e4d7766adf27868) Merge remote-tracking branch 'origin/main' into campaign/rea-json-utf8-input-20261005 ### 📊 Changes **3 files changed** (+57 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `src/application/JsonFiles.ts` (+5 -1) 📝 `src/cliJsonInput.ts` (+9 -3) ➕ `tests/boundary/filesystem/jsonUtf8Input.test.ts` (+43 -0) </details> ### 📄 Description ## Summary Both shared evidence JSON file reads and CLI JSON file input reject undecodable UTF-8 with the existing invalid-json error. Valid U+FFFD, accents, emoji remain accepted. ignoreBOM:true preserves previous BOM handling rather than silently changing it. No tracking issue: this is a focused correctness regression found through production-seam reproduction. ## Problem and expected behavior Undecodable bytes return existing invalid-json errors rather than altered input values; valid U+FFFD, accents, emoji and prior BOM handling remain supported. ## Change and scope The change stays in the owning adapter/application stage and corrects existing behavior without adding tools or broadening provider coverage. ## Contract and boundary impact - Semantic owner and earliest changed stage: Shared application JSON-file decoding and CLI JSON-file input, before JSON.parse. - CLI and MCP/tool-catalog contract: existing schemas and tool inventory remain intact; corrected results flow through the owning operation. - Provider, bridge, target-format, or platform compatibility: Actual Node 24.18.0 file decoding and CLI/shared production adapters ran. Representative result: invalid byte input now returns the existing invalid-json classification instead of a successful altered message. - Evidence, artifact, provenance, or reconstruction contract: Undecodable bytes return existing invalid-json errors rather than altered input values; valid U+FFFD, accents, emoji and prior BOM handling remain supported. - Process execution, authorization, cleanup, or containment impact: Existing execution authority, cleanup and containment remain preserved. - Generated metadata, package, or installation impact: no metadata or dependency changes. ## Evidence and regression coverage Three malformed-byte fixtures were incorrectly accepted before; five focused file/CLI tests pass. Native compiled shared/CLI adapters changed an invalid byte from accepted message=U+FFFD to invalid-json. Tests exercise production parsing, filesystem, HTTP, or browser seams, without module mocks. Evidence above is executed; unverified platform/provider coverage is stated explicitly. ## Validation performed Passed on signed head `b1740bf403434a657428e7779e4d7766adf27868` under the current ordinary-fix guidelines: - `npm run test:focused -- tests/boundary/filesystem/jsonUtf8Input.test.ts tests/boundary/filesystem/cliJsonInput.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts` — 28 tests passed; boundary build included - `npm run check` - `npm run check:fast` The current main branch, including the maintainer’s fixture correction in #609, was merged normally. Its source-map recovery fixture is preserved exactly: a require inside `with` remains unknown, while an unbound require outside it and a static import still produce recovered dependencies. This update changes no production code in the PR’s own fix. Full `check:pr` is optional for routine fixes under the current guidelines; no current-head full-suite pass is claimed. Package smoke and pack verification are not applicable because package/install outputs and dependencies are unchanged. Hosted CI is tracked separately. Development runtime: Node.js 24.18.0 and npm 11.16.0. ## Compatibility, safety, and release No migration or package dependency changes. Real Hopper/Ghidra verification was not run; this patch does not change those providers. Remaining proof limits are stated above. The final diff contains source and tests only. Prepared with AI assistance. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:14:26 +00:00