[PR #779] [CLOSED] fix(artifacts): verify opaque bytes before reusing inventory identities #2236

New issue

Closed

opened 2026-10-16 21:16:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/779
Author: @rudycelekli
Created: 10/6/2026
Status: ❌ Closed

Base: main ← Head: fix/rea-ingestion-opaque-content-identities-20261006

📝 Commits (1)

197b510 fix(artifacts): verify opaque bytes before reusing inventory identities

📊 Changes

3 files changed (+194 additions, -1 deletions)

View changed files

📝 src/application/JavaScriptArtifactFiles.ts (+46 -1)
📝 src/artifacts/AsarArtifactReader.ts (+7 -0)
➕ tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts (+141 -0)

📄 Description

Summary

Verify opaque ASAR/container and native-addon bytes before reusing their inventoried SHA/size during JavaScript reconstruction. Self-contained correctness regression; no separate issue linked.

Problem and expected behavior

Rebuilding an ASAR with changed non-JavaScript assets leaves its source text unchanged. Reconstruction previously accepted the stale container identity. Changed opaque .node bytes also bypassed verification because their text is intentionally not applicable. All projected inventory identities must describe bytes actually read.

Change and scope

Stream and compare raw root/nested ASAR and opaque native-addon SHA/size against the existing inventory. Text omission remains unchanged. Normalize native filesystem-stream aborts through the existing typed cancellation guard; unrelated native IO errors retain their code for outer IO classification.

Contract and boundary impact

Semantic owner and earliest changed stage: inventoried byte identities at JavaScript artifact ingestion, before reconstruction.
CLI and MCP/tool-catalog contract: unchanged schemas/tools; changed bytes now return an integrity failure instead of stale evidence.
Provider, bridge, target-format, or platform compatibility: local directory/ASAR readers and opaque addon files; readonly internal ASAR stream method added.
Evidence, artifact, provenance, or reconstruction contract: verifies SHA and size for previously skipped opaque bytes; unchanged archive/addon text scope retained.
Process execution, authorization, cleanup, or containment impact: no production addon execution or expanded authority; streams remain bounded and cancellation stays typed.
Generated metadata (docs/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: root/nested ASAR changed/added non-JS assets, same-size addon change, unchanged nested/direct archives/addon, native stream abort and deleted-container IO controls.
Base reproduction or other evidence: 5 failing regressions and one passing control before the fix. Actual ASAR SDK builds and actual Clang-built Node24 N-API addons with independently verified exports demonstrate three stale accepted identities before and three integrity failures after. During review, the new native root stream exposed raw ABORT_ERR; the failing cancellation regression now returns typed cancelled.
User-visible CLI/MCP output: reconstruction reports integrity failure for changed bytes rather than an old SHA; no output schema changes.
Remaining proof gaps: native macOS arm64/Node24 only; extra read pass, not a claim that all concurrent pathname/content races are eliminated. Native addons are executed only as an owned test oracle, never by production ingestion.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Actual ASAR SDK/root/nested and compiled Node24 N-API fixture — 3 stale accepts before, 3 integrity failures after.
Focused filesystem content identity, existing ASAR freshness, boundary and composition reconstruction — 33 passed across 4 files.
Native root stream cancellation regression — failed with raw AbortError before normalization; passes with typed cancellation after. Direct unchanged ASAR and native ENOENT controls pass.
npm run check — 5 tasks successful, 125 existing warnings, zero errors.
npm run check:fast — 2 tasks successful.
Oxfmt and git diff --check — passed; SSH signature and DCO verified. Reused exact Node24.18.0/Vitest5.0.3/TypeScript7.0.2 without dependency edits.

Hosted full coverage tracked separately. External binary/browser provider verification is not applicable to passive local byte ingestion.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: macOS native filesystem, ASAR SDK and owned native addon oracle only.
Package or release metadata impact: none.
Security, privacy, process, or containment review: passive reads of caller-selected artifacts; no execution in production, new transport, or extraction authority. Additional opaque-byte read is bounded in memory.

AI assistance: implemented and independently source reviewed with Codex on behalf of @rudycelekli before publication.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/779 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/rea-ingestion-opaque-content-identities-20261006` --- ### 📝 Commits (1) - [`197b510`](https://github.com/morluto/rea/commit/197b51018d420990f42fc2d774a32925e24675f7) fix(artifacts): verify opaque bytes before reusing inventory identities ### 📊 Changes **3 files changed** (+194 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/application/JavaScriptArtifactFiles.ts` (+46 -1) 📝 `src/artifacts/AsarArtifactReader.ts` (+7 -0) ➕ `tests/boundary/filesystem/javascriptArtifactContentIdentity.test.ts` (+141 -0) </details> ### 📄 Description ## Summary Verify opaque ASAR/container and native-addon bytes before reusing their inventoried SHA/size during JavaScript reconstruction. Self-contained correctness regression; no separate issue linked. ## Problem and expected behavior Rebuilding an ASAR with changed non-JavaScript assets leaves its source text unchanged. Reconstruction previously accepted the stale container identity. Changed opaque `.node` bytes also bypassed verification because their text is intentionally not applicable. All projected inventory identities must describe bytes actually read. ## Change and scope Stream and compare raw root/nested ASAR and opaque native-addon SHA/size against the existing inventory. Text omission remains unchanged. Normalize native filesystem-stream aborts through the existing typed cancellation guard; unrelated native IO errors retain their code for outer IO classification. ## Contract and boundary impact - Semantic owner and earliest changed stage: inventoried byte identities at JavaScript artifact ingestion, before reconstruction. - CLI and MCP/tool-catalog contract: unchanged schemas/tools; changed bytes now return an integrity failure instead of stale evidence. - Provider, bridge, target-format, or platform compatibility: local directory/ASAR readers and opaque addon files; readonly internal ASAR stream method added. - Evidence, artifact, provenance, or reconstruction contract: verifies SHA and size for previously skipped opaque bytes; unchanged archive/addon text scope retained. - Process execution, authorization, cleanup, or containment impact: no production addon execution or expanded authority; streams remain bounded and cancellation stays typed. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: root/nested ASAR changed/added non-JS assets, same-size addon change, unchanged nested/direct archives/addon, native stream abort and deleted-container IO controls. - Base reproduction or other evidence: 5 failing regressions and one passing control before the fix. Actual ASAR SDK builds and actual Clang-built Node24 N-API addons with independently verified exports demonstrate three stale accepted identities before and three integrity failures after. During review, the new native root stream exposed raw `ABORT_ERR`; the failing cancellation regression now returns typed `cancelled`. - User-visible CLI/MCP output: reconstruction reports integrity failure for changed bytes rather than an old SHA; no output schema changes. - Remaining proof gaps: native macOS arm64/Node24 only; extra read pass, not a claim that all concurrent pathname/content races are eliminated. Native addons are executed only as an owned test oracle, never by production ingestion. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Actual ASAR SDK/root/nested and compiled Node24 N-API fixture — 3 stale accepts before, 3 integrity failures after. - Focused filesystem content identity, existing ASAR freshness, boundary and composition reconstruction — 33 passed across 4 files. - Native root stream cancellation regression — failed with raw AbortError before normalization; passes with typed cancellation after. Direct unchanged ASAR and native ENOENT controls pass. - `npm run check` — 5 tasks successful, 125 existing warnings, zero errors. - `npm run check:fast` — 2 tasks successful. - Oxfmt and `git diff --check` — passed; SSH signature and DCO verified. Reused exact Node24.18.0/Vitest5.0.3/TypeScript7.0.2 without dependency edits. Hosted full coverage tracked separately. External binary/browser provider verification is not applicable to passive local byte ingestion. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: macOS native filesystem, ASAR SDK and owned native addon oracle only. - Package or release metadata impact: none. - Security, privacy, process, or containment review: passive reads of caller-selected artifacts; no execution in production, new transport, or extraction authority. Additional opaque-byte read is bounded in memory. AI assistance: implemented and independently source reviewed with Codex on behalf of @rudycelekli before publication. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:04 +00:00