morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5184] [Bug] ASAR target authorization swallows descriptor close failures and loses cleanup ownership #3180

New issue

Closed

opened 2026-10-31 00:37:33 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:37:33 +00:00

Owner

Originally created by @morluto on GitHub (Oct 19, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5184

Before submitting

Searched open and closed issues for ASAR close and ElectronFileScope cleanup.
Removed credentials and sensitive target data.

Area

Process capture or runtime observation

Observed behavior

SOURCE-ONLY finding at main 9aca543f46085f502dbc5445002e129e5d2974e9: Electron/Inspector file authorization opens an ASAR descriptor, closes it in finally, then catches every archive failure and returns undefined. A close rejection therefore becomes an ordinary unauthorized-path result; the exact handle has no retained cleanup owner. A simultaneous read failure is replaced by the close rejection before that rejection is swallowed.

Reproduction

Inspect src/browser/ElectronFileScope.ts at the revision above: asarFiles opens at line 105 and awaits close at lines 134–135; authorizedAsarMember catches the rejection at lines 73–76. NOT_ENOUGH_INFO: no unmodified-baseline runtime reproduction or naturally occurring OS close failure was executed. Controlled regressions for the proposed fix use real inert ASAR bytes and a descriptor-close denial seam; they do not establish real Electron behavior.

Expected behavior

Retain the exact failed descriptor owner, surface typed incomplete cleanup, preserve the primary read/cancellation failure, and retry only that owner before admitting replacement authorization. Provider shutdown must also join/retry retained descriptor cleanup, following docs/tool-design.md#own-the-lifecycle.

Impact and scope

Source-derived: affected file-backed Electron and V8 Inspector authorization paths can report absence while descriptor cleanup is unresolved. NOT_ENOUGH_INFO: real-world frequency, sustained descriptor growth, and OS-specific failure behavior. No target execution or mutation is involved.

REA version

Source main 9aca543f46085f502dbc5445002e129e5d2974e9, package 6.7.0.

Runtime and platform

Source inspection on Darwin arm64; proposed regression validation uses pinned Node 24.18.0. No native Electron runtime qualification.

Target and artifact context

Local ASAR member file URL; authored inert archive for controlled regression tests.

Interface

Other — shared authorization producer used by Electron and Inspector workflows.

Earliest failure stage

Cleanup, cancellation, or lifecycle.

Relevant output or evidence

Archive catch and descriptor lifetime. These establish the missing owner and swallowed outcome from source; runtime leak measurements are unavailable.

Typed outcome or recovery expected

A cleanup-bearing typed outcome linked to an exact retryable descriptor lease; cancellation keeps its original reason and a late abort cannot replace an earlier read failure.

Analysis or suspected cause

Authorization denial and resource-finalization failure share a broad catch, while a raw finally owns the descriptor only until its first rejected close. Reuse the existing artifact file-operation/resource-scope owner rather than adding a downstream error-string repair.

Additional context

Found while following #5084's target-authorization cancellation pattern. #5083 concerns Inspector WebSocket close ownership; #3574 concerns ASAR JSON header admission. Neither covers this descriptor failure boundary.

Originally created by @morluto on GitHub (Oct 19, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5184 ## Before submitting - [x] Searched open and closed issues for ASAR close and ElectronFileScope cleanup. - [x] Removed credentials and sensitive target data. ## Area Process capture or runtime observation ## Observed behavior SOURCE-ONLY finding at main `9aca543f46085f502dbc5445002e129e5d2974e9`: Electron/Inspector file authorization opens an ASAR descriptor, closes it in `finally`, then catches every archive failure and returns `undefined`. A close rejection therefore becomes an ordinary unauthorized-path result; the exact handle has no retained cleanup owner. A simultaneous read failure is replaced by the close rejection before that rejection is swallowed. ## Reproduction Inspect `src/browser/ElectronFileScope.ts` at the revision above: `asarFiles` opens at line 105 and awaits close at lines 134–135; `authorizedAsarMember` catches the rejection at lines 73–76. NOT_ENOUGH_INFO: no unmodified-baseline runtime reproduction or naturally occurring OS close failure was executed. Controlled regressions for the proposed fix use real inert ASAR bytes and a descriptor-close denial seam; they do not establish real Electron behavior. ## Expected behavior Retain the exact failed descriptor owner, surface typed incomplete cleanup, preserve the primary read/cancellation failure, and retry only that owner before admitting replacement authorization. Provider shutdown must also join/retry retained descriptor cleanup, following `docs/tool-design.md#own-the-lifecycle`. ## Impact and scope Source-derived: affected file-backed Electron and V8 Inspector authorization paths can report absence while descriptor cleanup is unresolved. NOT_ENOUGH_INFO: real-world frequency, sustained descriptor growth, and OS-specific failure behavior. No target execution or mutation is involved. ## REA version Source main `9aca543f46085f502dbc5445002e129e5d2974e9`, package 6.7.0. ## Runtime and platform Source inspection on Darwin arm64; proposed regression validation uses pinned Node 24.18.0. No native Electron runtime qualification. ## Target and artifact context Local ASAR member file URL; authored inert archive for controlled regression tests. ## Interface Other — shared authorization producer used by Electron and Inspector workflows. ## Earliest failure stage Cleanup, cancellation, or lifecycle. ## Relevant output or evidence [Archive catch](https://github.com/morluto/rea/blob/9aca543f46085f502dbc5445002e129e5d2974e9/src/browser/ElectronFileScope.ts#L65-L77) and [descriptor lifetime](https://github.com/morluto/rea/blob/9aca543f46085f502dbc5445002e129e5d2974e9/src/browser/ElectronFileScope.ts#L98-L136). These establish the missing owner and swallowed outcome from source; runtime leak measurements are unavailable. ## Typed outcome or recovery expected A cleanup-bearing typed outcome linked to an exact retryable descriptor lease; cancellation keeps its original reason and a late abort cannot replace an earlier read failure. ## Analysis or suspected cause Authorization denial and resource-finalization failure share a broad catch, while a raw `finally` owns the descriptor only until its first rejected close. Reuse the existing artifact file-operation/resource-scope owner rather than adding a downstream error-string repair. ## Additional context Found while following #5084's target-authorization cancellation pattern. #5083 concerns Inspector WebSocket close ownership; #3574 concerns ASAR JSON header admission. Neither covers this descriptor failure boundary.

bsakaguchi

2026-10-31 00:37:33 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:37:34 +00:00

Author

Owner

@morluto commented on GitHub (Oct 19, 2026):

Fixed on main in 87ab054ea3.

ASAR authorization now admits the whole read into the existing artifact resource scope and transfers descriptors through the existing file-operation owner. Broad authorization-denial catches preserve cleanup-bearing failures. Cleanup-only errors remain cleanup-only; simultaneous cancellation/read failure retains its original typed primary and reason. The returned error is bound to the exact descriptor lease, later authorization retries before new work, and provider shutdown joins transport/file cleanup after draining admitted operations. A closed provider rejects admission without inventing an owned transport.

Real inert ASAR regressions control descriptor stat/read/final close, including opaque cancellation, failed close after cancellation or earlier physical failure, same-handle retry, and shutdown retry. These are controlled production-boundary tests, not an unmodified-baseline or natural OS-failure reproduction.

Validation on pinned Node 24.18.0: 696 passed, 5 skipped across 67 selected files; full npm run check, npm run docs:check, and test discovery passed (1,632 files discovered exactly once). Controlled filesystem/final-close seams and loopback HTTP/WebSocket peers establish the described boundaries; no real Chrome/Electron target, natural OS close failure, Windows, or Bun qualification is claimed.

@morluto commented on GitHub (Oct 19, 2026): Fixed on main in 87ab054ea384b3fcbae2998b1f94685edcd5f624. ASAR authorization now admits the whole read into the existing artifact resource scope and transfers descriptors through the existing file-operation owner. Broad authorization-denial catches preserve cleanup-bearing failures. Cleanup-only errors remain cleanup-only; simultaneous cancellation/read failure retains its original typed primary and reason. The returned error is bound to the exact descriptor lease, later authorization retries before new work, and provider shutdown joins transport/file cleanup after draining admitted operations. A closed provider rejects admission without inventing an owned transport. Real inert ASAR regressions control descriptor stat/read/final close, including opaque cancellation, failed close after cancellation or earlier physical failure, same-handle retry, and shutdown retry. These are controlled production-boundary tests, not an unmodified-baseline or natural OS-failure reproduction. Validation on pinned Node 24.18.0: 696 passed, 5 skipped across 67 selected files; full `npm run check`, `npm run docs:check`, and test discovery passed (1,632 files discovered exactly once). Controlled filesystem/final-close seams and loopback HTTP/WebSocket peers establish the described boundaries; no real Chrome/Electron target, natural OS close failure, Windows, or Bun qualification is claimed.

bsakaguchi referenced this issue

2026-10-31 00:42:16 +00:00

[GH-ISSUE #5923] [Bug] Trace comparisons report no first divergence for ordering failures and missing journals #3600

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3180

No description provided.

Rows
Columns