morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #791] [MERGED] fix(windows): accept ordinary drive path separators #2242

New issue

Closed

opened 2026-10-16 21:16:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/791
Author: @N0zoM1z0
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/786-windows-drive-separators

📝 Commits (1)

a29c652 fix(windows): accept ordinary drive path separators

📊 Changes

8 files changed (+94 additions, -10 deletions)

View changed files

📝 native/windows/README.md (+5 -0)
📝 native/windows/src/authority.hpp (+10 -0)
📝 native/windows/src/filesystem.cc (+1 -0)
📝 native/windows/src/process.cc (+3 -2)
📝 scripts/verify-packaged-ghidra-windows.mjs (+11 -3)
📝 scripts/verify-windows-native.mjs (+51 -3)
📝 src/ghidra/GhidraLauncher.ts (+10 -1)
📝 src/windows/WindowsOwnedProcess.ts (+3 -1)

📄 Description

Summary

Fixes #786. Windows Ghidra startup failed when TEMP/TMP or the selected executable used ordinary forward-slash drive paths. REA now translates those separators at the native consumer boundary and writes the executable token in the representation required by cmd.exe.

Problem and expected behavior

D:/scratch/rea is an ordinary absolute local drive path, but the native runtime rejected it as unsupported. Owned-process startup similarly rejected forward-slash executables. Accept equivalent separator spellings without resolving components, widening namespaces, or asking users to rewrite configuration.

Change and scope

Translate separators only for ordinary drive-absolute coordinates before existing native filesystem/process admission. Retain the original file coordinate in identity and snapshot metadata.
Encode the owned process's executable token with native separators; leave its selected arguments intact. Give Ghidra's child batch interpreter the same selected ComSpec in that representation, including nested FOR /F launches.
Extend real native conformance with forward/mixed paths, identity and byte oracles, snapshots, unsupported-coordinate rejection, and owned process exit/output.
Run packaged Ghidra acceptance with forward-slash TEMP/TMP and ComSpec. Filter duplicate case variants only in the verifier's scoped child environment.

Contract and boundary impact

Semantic owner and earliest changed stage: Windows native path admission and process command-line serialization.
CLI and MCP/tool-catalog contract: unchanged names and schemas; valid ordinary Windows path spellings now work.
Provider, bridge, target-format, or platform compatibility: Windows x64 native controls; Ghidra P0 target/operation coverage unchanged.
Evidence, artifact, provenance, or reconstruction contract: original requested file/snapshot coordinates and final handle identities remain distinct.
Process execution, authorization, cleanup, or containment impact: existing native Job Object, DACL, reparse, NTFS and cleanup checks remain enforced; no new permission field.
Generated metadata, package, or installation impact: rebuild matching bundled native artifact; no catalog/count change or unrelated installation.

Evidence and regression coverage

Before-fix public Windows CLI with forward-slash TEMP/TMP failed before Ghidra launch. Independent native runtime and owned-process probes reproduced the rejected path spellings.
Before-fix native adapter probes independently failed for forward-slash runtime roots and executable paths; the expanded verifier exercises those same consumers.
Real ordinary-user conformance checks DACL readback, locked ancestor/reparse behavior, snapshot cancellation, breakaway denial, child ownership, environment semantics, descendant cleanup and unrelated fixture preservation.
Real packaged CLI and MCP acceptance uses the original fixture byte/digest oracle and verifies every admitted read-only operation plus runtime cleanup.
Remaining proof gaps: broader namespace aliases and other provider/platform combinations remain outside the existing P0 claim; no real Hopper execution was performed.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run build:windows-native and npm run verify:windows-native:artifact — passed; artifact remains approximately 963 KiB.
npm pack --json --pack-destination <isolated-directory> and Windows-native production dependency installation — passed.
npm run test:focused -- src/windows/WindowsNativeLoader.test.ts tests/boundary/process/providerProcess.test.ts tests/boundary/providers/ghidra/ghidraLauncher.test.ts — 42 tests passed.
npm run check:fast, npm run docs:check, formatting and git diff --check — passed.
Windows verify-windows-native.mjs <installed-package> <independent-fixture> <private-report> on an ordinary-user token — passed.
Windows verify-packaged-ghidra-windows.mjs <installed-package> <owned-PE> <private-report> on an ordinary-user token, Ghidra 12.1.4 / JDK 21 — passed.

Compatibility, safety, and release

Breaking changes or migration steps: none; rebuilt native artifact is version-bound as before.
Real Hopper/Ghidra, browser, or OS coverage: real Windows x64 native conformance and packaged Ghidra CLI/MCP; no Hopper run for this change.
Package or release metadata impact: no version or generated catalog edits; CI rebuilds the bundled artifact.
Security, privacy, process, or containment review: ordinary separator translation preserves ambiguous-component, stream and namespace rejection. File identity retains the selected spelling; only owned fixtures/processes were touched. Heavy runs were serial, two-CPU-affined and used bounded heaps; raw diagnostics remain private.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked.
Tests cover changed observable behavior and meaningful failure paths.
Owning documentation and verification lanes are updated; schemas/generated metadata unchanged.
CLI/MCP behavior change has a concrete before/after reproduction above.
Final diff checked for credentials, private paths, unrelated cleanup and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/791 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/786-windows-drive-separators` --- ### 📝 Commits (1) - [`a29c652`](https://github.com/morluto/rea/commit/a29c652c8aa96061b4684cd9a050101af8c4d0cd) fix(windows): accept ordinary drive path separators ### 📊 Changes **8 files changed** (+94 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `native/windows/README.md` (+5 -0) 📝 `native/windows/src/authority.hpp` (+10 -0) 📝 `native/windows/src/filesystem.cc` (+1 -0) 📝 `native/windows/src/process.cc` (+3 -2) 📝 `scripts/verify-packaged-ghidra-windows.mjs` (+11 -3) 📝 `scripts/verify-windows-native.mjs` (+51 -3) 📝 `src/ghidra/GhidraLauncher.ts` (+10 -1) 📝 `src/windows/WindowsOwnedProcess.ts` (+3 -1) </details> ### 📄 Description ## Summary Fixes #786. Windows Ghidra startup failed when TEMP/TMP or the selected executable used ordinary forward-slash drive paths. REA now translates those separators at the native consumer boundary and writes the executable token in the representation required by cmd.exe. ## Problem and expected behavior `D:/scratch/rea` is an ordinary absolute local drive path, but the native runtime rejected it as unsupported. Owned-process startup similarly rejected forward-slash executables. Accept equivalent separator spellings without resolving components, widening namespaces, or asking users to rewrite configuration. ## Change and scope - Translate separators only for ordinary drive-absolute coordinates before existing native filesystem/process admission. Retain the original file coordinate in identity and snapshot metadata. - Encode the owned process's executable token with native separators; leave its selected arguments intact. Give Ghidra's child batch interpreter the same selected ComSpec in that representation, including nested FOR /F launches. - Extend real native conformance with forward/mixed paths, identity and byte oracles, snapshots, unsupported-coordinate rejection, and owned process exit/output. - Run packaged Ghidra acceptance with forward-slash TEMP/TMP and ComSpec. Filter duplicate case variants only in the verifier's scoped child environment. ## Contract and boundary impact - Semantic owner and earliest changed stage: Windows native path admission and process command-line serialization. - CLI and MCP/tool-catalog contract: unchanged names and schemas; valid ordinary Windows path spellings now work. - Provider, bridge, target-format, or platform compatibility: Windows x64 native controls; Ghidra P0 target/operation coverage unchanged. - Evidence, artifact, provenance, or reconstruction contract: original requested file/snapshot coordinates and final handle identities remain distinct. - Process execution, authorization, cleanup, or containment impact: existing native Job Object, DACL, reparse, NTFS and cleanup checks remain enforced; no new permission field. - Generated metadata, package, or installation impact: rebuild matching bundled native artifact; no catalog/count change or unrelated installation. ## Evidence and regression coverage - Before-fix public Windows CLI with forward-slash TEMP/TMP failed before Ghidra launch. Independent native runtime and owned-process probes reproduced the rejected path spellings. - Before-fix native adapter probes independently failed for forward-slash runtime roots and executable paths; the expanded verifier exercises those same consumers. - Real ordinary-user conformance checks DACL readback, locked ancestor/reparse behavior, snapshot cancellation, breakaway denial, child ownership, environment semantics, descendant cleanup and unrelated fixture preservation. - Real packaged CLI and MCP acceptance uses the original fixture byte/digest oracle and verifies every admitted read-only operation plus runtime cleanup. - Remaining proof gaps: broader namespace aliases and other provider/platform combinations remain outside the existing P0 claim; no real Hopper execution was performed. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run build:windows-native` and `npm run verify:windows-native:artifact` — passed; artifact remains approximately 963 KiB. - `npm pack --json --pack-destination <isolated-directory>` and Windows-native production dependency installation — passed. - `npm run test:focused -- src/windows/WindowsNativeLoader.test.ts tests/boundary/process/providerProcess.test.ts tests/boundary/providers/ghidra/ghidraLauncher.test.ts` — 42 tests passed. - `npm run check:fast`, `npm run docs:check`, formatting and `git diff --check` — passed. - Windows `verify-windows-native.mjs <installed-package> <independent-fixture> <private-report>` on an ordinary-user token — passed. - Windows `verify-packaged-ghidra-windows.mjs <installed-package> <owned-PE> <private-report>` on an ordinary-user token, Ghidra 12.1.4 / JDK 21 — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none; rebuilt native artifact is version-bound as before. - Real Hopper/Ghidra, browser, or OS coverage: real Windows x64 native conformance and packaged Ghidra CLI/MCP; no Hopper run for this change. - Package or release metadata impact: no version or generated catalog edits; CI rebuilds the bundled artifact. - Security, privacy, process, or containment review: ordinary separator translation preserves ambiguous-component, stream and namespace rejection. File identity retains the selected spelling; only owned fixtures/processes were touched. Heavy runs were serial, two-CPU-affined and used bounded heaps; raw diagnostics remain private. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning documentation and verification lanes are updated; schemas/generated metadata unchanged. - [x] CLI/MCP behavior change has a concrete before/after reproduction above. - [x] Final diff checked for credentials, private paths, unrelated cleanup and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:09 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:04:01 +00:00

[PR #2242] [MERGED] ci: summarize static checks and retain complete reports #5109

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2242

No description provided.

Rows
Columns