morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4902] [Bug] Uninstall recovery overwrites replacement configuration files #3041

New issue

Closed

opened 2026-10-31 00:35:21 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:35:21 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4902

Before submitting

Searched open and closed uninstall/publication/replacement reports.
Removed credentials and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

At main7e4eed9dd, uninstall overwrites a replacement regular file or follows a replacement symlink and overwrites its target during recovery. If the replacement parses and has no REA registration, uninstall incorrectly reports removed instead of rejecting the changed publication identity. Three new controls fail; thirteen setup recovery controls pass.

Reproduction

Executed npm run test:focused -- tests/process-global/setupConfigurationRollback.test.ts:3failed/13passed. Existing writer/readback fault seam publishes real bytes, then swaps only owned temporary config paths. Forced readback failure triggers the two overwrite cases. A third case reads the real replacement successfully and returns removed. No real agent settings changed. Each case executed once.

Expected behavior

AGENTS.md requires clear resource ownership and preservation of local evidence. Carry the exact published file through verification/recovery. A replacement pathname is not owned by the earlier write. Preserve the replacement and the verified original backup; report unresolved recovery. Reuse setup's publication owner from #4900 rather than reinterpret paths.

Impact and scope

Controlled filesystem application boundary: replacement bytes overwritten or inaccurate removed status. Real editor/publicCLI race frequency and nativeWindows/Linux occurrence:NOT_ENOUGH_INFO; not measured.

REA version

6.5.0 source7e4eed9dd48485b6a7100300aa98401811c2deb9.

Runtime and platform

Node24.18.0, macOS arm64; real inert files with deterministic fault sequencing.

Target and artifact context

Owned temporary JSON fixtures, no target/provider execution.

Interface / Earliest failure stage

Other: shared uninstall application boundary / configuration readback and recovery.

Relevant output or evidence

Expected replacement JSON, received pre-uninstall original JSON in two cases. Valid-readback replacement returned status removed, expected failed. Source Uninstall.ts uses writeText(path,contents), readText(path), then writeText(path,original) without publication identity.

Analysis

Source-derived cause: UninstallFileSystem exposes path writes, losing the published owner. The setup fix in #4900 already has ClientConfigurationPublication; change uninstall's effect contract to return this owner. Preserve failed-close ownership across both adapters and remove the superseded writeText mutation seam. In-place concurrent writer exclusion remains a separate known limitation.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4902 ### Before submitting - [x] Searched open and closed uninstall/publication/replacement reports. - [x] Removed credentials and sensitive target data. ### Area Setup, packaging, or upgrade ### Observed behavior At main7e4eed9dd, uninstall overwrites a replacement regular file or follows a replacement symlink and overwrites its target during recovery. If the replacement parses and has no REA registration, uninstall incorrectly reports removed instead of rejecting the changed publication identity. Three new controls fail; thirteen setup recovery controls pass. ### Reproduction Executed `npm run test:focused -- tests/process-global/setupConfigurationRollback.test.ts`:3failed/13passed. Existing writer/readback fault seam publishes real bytes, then swaps only owned temporary config paths. Forced readback failure triggers the two overwrite cases. A third case reads the real replacement successfully and returns removed. No real agent settings changed. Each case executed once. ### Expected behavior AGENTS.md requires clear resource ownership and preservation of local evidence. Carry the exact published file through verification/recovery. A replacement pathname is not owned by the earlier write. Preserve the replacement and the verified original backup; report unresolved recovery. Reuse setup's publication owner from #4900 rather than reinterpret paths. ### Impact and scope Controlled filesystem application boundary: replacement bytes overwritten or inaccurate removed status. Real editor/publicCLI race frequency and nativeWindows/Linux occurrence:NOT_ENOUGH_INFO; not measured. ### REA version 6.5.0 source7e4eed9dd48485b6a7100300aa98401811c2deb9. ### Runtime and platform Node24.18.0, macOS arm64; real inert files with deterministic fault sequencing. ### Target and artifact context Owned temporary JSON fixtures, no target/provider execution. ### Interface / Earliest failure stage Other: shared uninstall application boundary / configuration readback and recovery. ### Relevant output or evidence Expected replacement JSON, received pre-uninstall original JSON in two cases. Valid-readback replacement returned status removed, expected failed. Source Uninstall.ts uses writeText(path,contents), readText(path), then writeText(path,original) without publication identity. ### Analysis Source-derived cause: UninstallFileSystem exposes path writes, losing the published owner. The setup fix in #4900 already has ClientConfigurationPublication; change uninstall's effect contract to return this owner. Preserve failed-close ownership across both adapters and remove the superseded writeText mutation seam. In-place concurrent writer exclusion remains a separate known limitation.

bsakaguchi

2026-10-31 00:35:21 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:35:23 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed in 2fb5e204a on main.

Uninstall now reuses the configuration publication owner instead of reopening a pathname for recovery. It rejects a different file even when that replacement passes registration readback, restores through the exact retained descriptor, and preserves original backups and file permissions. Initial-read, readback, publication-close and temporary permission-restoration failures retain exact owners for cleanup retry. Host admission is separate from nested file cleanup, so close joins active publication without peer-cleanup self-deadlock. The superseded writeText effect contract is removed.

Executed:206 focused checks in9 files, check:fast, formatting, docs:check including5 consistency checks, and pre-push gate. The initial3 uninstall controls fail on baseline7e4eed9dd while13 setup recovery controls pass. Additional controls cover mode0400/0640, actual read-only recovery, staging descriptor substitution, denied mode restoration and retry, mixed descriptor closes, initial-read ownership, opaque cancellation reasons, host-close joining, and peer cleanup. Two source reviews are clear after their findings were addressed.

Twelve completed isolated public CLI uninstall tasks compare baseline/candidate with identical config/backups/modes and equal filtered status replies. Warm2repeat medians:

Mode	Elapsed s	CPU s	Sampled peak family MB	Request/reply/progress cl100k estimates
0400	0.3671→0.3676	0.5495→0.5516	349.9→348.3	12/3/0 both
0640	0.3660→0.3700	0.5496→0.5623	348.0→348.7	12/3/0 both

First processes are separate; no true-cold, statistical or speedup claim. wait4 CPU and10ms PPID-family RSS sampling can miss transient/reparented peaks. Whole-agent, catalog and unfiltered-reply costs are unmeasured.

Scope:macOS arm64 / Node24.18.0, owned inert temporary files and deterministic seams. No real external settings, nativeWindows/Linux, GUI app, provider or target execution. Pre-publication writer path authority and exclusion of another in-place writer remain separate audit candidates; no full transaction race-freedom claim. Installation guidance documents detected-replacement recovery and the concurrency limitation.

@morluto commented on GitHub (Oct 17, 2026): Fixed in 2fb5e204a on main. Uninstall now reuses the configuration publication owner instead of reopening a pathname for recovery. It rejects a different file even when that replacement passes registration readback, restores through the exact retained descriptor, and preserves original backups and file permissions. Initial-read, readback, publication-close and temporary permission-restoration failures retain exact owners for cleanup retry. Host admission is separate from nested file cleanup, so close joins active publication without peer-cleanup self-deadlock. The superseded writeText effect contract is removed. Executed:206 focused checks in9 files, check:fast, formatting, docs:check including5 consistency checks, and pre-push gate. The initial3 uninstall controls fail on baseline7e4eed9dd while13 setup recovery controls pass. Additional controls cover mode0400/0640, actual read-only recovery, staging descriptor substitution, denied mode restoration and retry, mixed descriptor closes, initial-read ownership, opaque cancellation reasons, host-close joining, and peer cleanup. Two source reviews are clear after their findings were addressed. Twelve completed isolated public CLI uninstall tasks compare baseline/candidate with identical config/backups/modes and equal filtered status replies. Warm2repeat medians: | Mode | Elapsed s | CPU s | Sampled peak family MB | Request/reply/progress cl100k estimates | | --- | --- | --- | --- | --- | |0400|0.3671→0.3676|0.5495→0.5516|349.9→348.3|12/3/0 both| |0640|0.3660→0.3700|0.5496→0.5623|348.0→348.7|12/3/0 both| First processes are separate; no true-cold, statistical or speedup claim. wait4 CPU and10ms PPID-family RSS sampling can miss transient/reparented peaks. Whole-agent, catalog and unfiltered-reply costs are unmeasured. Scope:macOS arm64 / Node24.18.0, owned inert temporary files and deterministic seams. No real external settings, nativeWindows/Linux, GUI app, provider or target execution. Pre-publication writer path authority and exclusion of another in-place writer remain separate audit candidates; no full transaction race-freedom claim. Installation guidance documents detected-replacement recovery and the concurrency limitation.

bsakaguchi referenced this issue

2026-10-31 01:07:41 +00:00

[PR #3041] [MERGED] feat(setup): add WorkBuddy client support #5575

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3041

No description provided.

Rows
Columns