[PR #1068] [MERGED] fix(cli): preserve blank JSON paths for input validation #2617

New issue

Closed

opened 2026-10-17 21:08:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1068
Author: @ASVLCII
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/cli-validation-20261008

📝 Commits (3)

14a1e8a fix(cli): preserve blank JSON paths for input validation
3e175db Merge remote-tracking branch 'origin/main' into maintain/pr-1068
5c5b779 test(cli): avoid unchecked path field assertions

📊 Changes

3 files changed (+100 additions, -4 deletions)

View changed files

📝 src/cliJsonInput.ts (+9 -4)
➕ src/cliJsonPaths.test.ts (+59 -0)
➕ tests/acceptance/applications/electronBlankPathCli.test.ts (+32 -0)

📄 Description

Summary

Keep blank CLI JSON paths intact until shared input validation rejects them, rather than turning them into the working directory.

No existing issue is linked: this defect was found during CLI validation investigation. The normalization introduced in #1004 is retained for nonblank paths. #1029 addresses a separate JSON depth/payload boundary.

Problem and expected behavior

Passing application_root: "" to capture-electron-scenario previously resolved the empty string to the operator's working directory before schema validation. That hid the invalid root and allowed the command to proceed to filesystem checks for other fields.

Blank and whitespace-only paths should reach the existing schema unchanged and produce field-specific input errors. Nonblank relative paths should still resolve normally.

Change and scope

Resolve only nonblank string values in resolveCliJsonPaths. Add schema-boundary regressions for Electron executable/application/root fields and compiled CLI acceptance coverage for blank roots. Nested resolution and preservation of nonblank path spelling remain covered.

Contract and boundary impact

Semantic owner and earliest changed stage: CLI JSON path normalization, before shared-schema validation.
CLI and MCP/tool-catalog contract: no schema or catalog changes; CLI now rejects blank input consistently with the existing shared schema. MCP unchanged.
Provider, bridge, target-format, or platform compatibility: no provider or format changes; nonblank relative paths retain resolution behavior.
Evidence, artifact, provenance, or reconstruction contract: unchanged.
Process execution, authorization, cleanup, or containment impact: blank roots are rejected before filesystem or provider work.
Generated metadata, package, or installation impact: none.

Evidence and regression coverage

Executed in the remote cloud environment on Node 24.18.0 and npm 11.16.0.

New regression selection against original production code: eight failures and one pass. Fixed focused selection: 12 passes.
Compiled CLI with application_root set to "" or " \t ": exit 1, invalid_request, with diagnostics naming application_root, including out_of_range and minimum 1.
Compiled CLI with application_root: ".": passes root validation and reaches the expected missing-application filesystem error.
Compiled normalization helper: nonblank relative paths resolve; spaces in nonblank names are preserved by normalization.
Remaining proof gaps: full deterministic suite and real-provider workflows were not run.

Validation performed

Final verification used commit 14a1e8a200e42ab51fffa288e74188ddee6bde68, based on upstream 8a31508c8958800364e255540ded1586298d7008.

npm run build:cached: passed using a valid cached build.
npm run test:focused -- src/cliJsonPaths.test.ts tests/acceptance/applications/electronBlankPathCli.test.ts tests/boundary/filesystem/cliJsonInput.test.ts tests/boundary/cli/scenarioCliInputDiagnostics.test.ts: 12 passed, no skips.
npm run check: passed, six tasks satisfied from cache.
npm run verify:test-discovery: all 581 test files discovered exactly once.
git diff upstream/main...HEAD --check: passed.

Compatibility, safety, and release

Breaking changes or migration steps: none intended; invalid blank paths are rejected by existing validation. Omit the optional root to derive it, rather than supplying an empty value.
Real Hopper/Ghidra, browser, or OS coverage: not run; this change is CLI normalization and synthetic validation coverage, not a real-provider behavior claim.
Package or release metadata impact: no package or metadata changes.
Security, privacy, process, or containment review: no credentials, binaries, generated output, or unrelated cleanup added.

AI assistance: Codex prepared and verified the patch in the cloud. The final diff and commit identity were also reviewed before submission.

Review checklist

One focused outcome; Conventional Commit title.
Reason for no linked issue stated above.
Tests cover observable behavior and invalid-input paths.
No contract or generated-metadata changes needed; helper documentation updated.
Representative CLI diagnostics included.
Final diff checked for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1068 **Author:** [@ASVLCII](https://github.com/ASVLCII) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/cli-validation-20261008` --- ### 📝 Commits (3) - [`14a1e8a`](https://github.com/morluto/rea/commit/14a1e8a200e42ab51fffa288e74188ddee6bde68) fix(cli): preserve blank JSON paths for input validation - [`3e175db`](https://github.com/morluto/rea/commit/3e175db6dbcd855e495bc3f12eeae911894b0ad4) Merge remote-tracking branch 'origin/main' into maintain/pr-1068 - [`5c5b779`](https://github.com/morluto/rea/commit/5c5b77939fbd55009d9a45c7d7ba4470cbb4b48e) test(cli): avoid unchecked path field assertions ### 📊 Changes **3 files changed** (+100 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `src/cliJsonInput.ts` (+9 -4) ➕ `src/cliJsonPaths.test.ts` (+59 -0) ➕ `tests/acceptance/applications/electronBlankPathCli.test.ts` (+32 -0) </details> ### 📄 Description ## Summary Keep blank CLI JSON paths intact until shared input validation rejects them, rather than turning them into the working directory. No existing issue is linked: this defect was found during CLI validation investigation. The normalization introduced in #1004 is retained for nonblank paths. #1029 addresses a separate JSON depth/payload boundary. ## Problem and expected behavior Passing `application_root: ""` to `capture-electron-scenario` previously resolved the empty string to the operator's working directory before schema validation. That hid the invalid root and allowed the command to proceed to filesystem checks for other fields. Blank and whitespace-only paths should reach the existing schema unchanged and produce field-specific input errors. Nonblank relative paths should still resolve normally. ## Change and scope Resolve only nonblank string values in `resolveCliJsonPaths`. Add schema-boundary regressions for Electron executable/application/root fields and compiled CLI acceptance coverage for blank roots. Nested resolution and preservation of nonblank path spelling remain covered. ## Contract and boundary impact * Semantic owner and earliest changed stage: CLI JSON path normalization, before shared-schema validation. * CLI and MCP/tool-catalog contract: no schema or catalog changes; CLI now rejects blank input consistently with the existing shared schema. MCP unchanged. * Provider, bridge, target-format, or platform compatibility: no provider or format changes; nonblank relative paths retain resolution behavior. * Evidence, artifact, provenance, or reconstruction contract: unchanged. * Process execution, authorization, cleanup, or containment impact: blank roots are rejected before filesystem or provider work. * Generated metadata, package, or installation impact: none. ## Evidence and regression coverage Executed in the remote cloud environment on Node 24.18.0 and npm 11.16.0. * New regression selection against original production code: eight failures and one pass. Fixed focused selection: 12 passes. * Compiled CLI with `application_root` set to `""` or `" \t "`: exit 1, `invalid_request`, with diagnostics naming `application_root`, including `out_of_range` and minimum 1. * Compiled CLI with `application_root: "."`: passes root validation and reaches the expected missing-application filesystem error. * Compiled normalization helper: nonblank relative paths resolve; spaces in nonblank names are preserved by normalization. * Remaining proof gaps: full deterministic suite and real-provider workflows were not run. ## Validation performed Final verification used commit `14a1e8a200e42ab51fffa288e74188ddee6bde68`, based on upstream `8a31508c8958800364e255540ded1586298d7008`. * `npm run build:cached`: passed using a valid cached build. * `npm run test:focused -- src/cliJsonPaths.test.ts tests/acceptance/applications/electronBlankPathCli.test.ts tests/boundary/filesystem/cliJsonInput.test.ts tests/boundary/cli/scenarioCliInputDiagnostics.test.ts`: 12 passed, no skips. * `npm run check`: passed, six tasks satisfied from cache. * `npm run verify:test-discovery`: all 581 test files discovered exactly once. * `git diff upstream/main...HEAD --check`: passed. ## Compatibility, safety, and release * Breaking changes or migration steps: none intended; invalid blank paths are rejected by existing validation. Omit the optional root to derive it, rather than supplying an empty value. * Real Hopper/Ghidra, browser, or OS coverage: not run; this change is CLI normalization and synthetic validation coverage, not a real-provider behavior claim. * Package or release metadata impact: no package or metadata changes. * Security, privacy, process, or containment review: no credentials, binaries, generated output, or unrelated cleanup added. AI assistance: Codex prepared and verified the patch in the cloud. The final diff and commit identity were also reviewed before submission. ## Review checklist * [x] One focused outcome; Conventional Commit title. * [x] Reason for no linked issue stated above. * [x] Tests cover observable behavior and invalid-input paths. * [x] No contract or generated-metadata changes needed; helper documentation updated. * [x] Representative CLI diagnostics included. * [x] Final diff checked for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:16 +00:00