morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5258] [Bug] JavaScript application Evidence loses the caller-selected path after symlink resolution #3211

New issue

Closed

opened 2026-10-31 00:37:54 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:37:54 +00:00

Owner

Originally created by @morluto on GitHub (Oct 19, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5258

Before submitting

Searched open/closed JavaScript path/Evidence and symlink reports.
Synthetic fixture only; local common path prefix omitted below.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application succeeds on an explicitly selected absolute directory symlink, but the serialized Evidence contains only the resolved physical directory path. The caller-selected alias is absent from both parameters and the complete Evidence JSON. This loses the original input spelling while correctly retaining the analyzed artifact identity.

Executed on main 49b4edfe77 with unrelated byte-pattern changes in the workspace. No JavaScript analysis/Evidence source changes were present.

Reproduction

Executed once through the compiled CLI: create a synthetic directory js-path-physical/index.mjs containing export const result = () => ({ ok: true });, and an absolute directory symlink js-path-selected pointing at that directory. Then run:

node scripts/rea.mjs analyze-javascript-application <absolute-audit-root>/js-path-selected --artifact-format directory --format json

<absolute-audit-root> replaces only this machine's common local path prefix. The real fixture and invocation were executed; no target was executed, only source analysis.

Observed reduced fields:

{
  "subject": {"local_path": "<absolute-audit-root>/js-path-physical"},
  "parameters": {"format": "directory", "integrity_policy": "fail"},
  "normalized_result": {"input_path": "<absolute-audit-root>/js-path-physical"}
}

A full serialized-Evidence search for the exact absolute selected alias returns false.

Expected behavior

Keep the resolved artifact path as identity where required, and retain the caller-selected input_path separately, such as in Evidence parameters. The repository guidelines require preserving caller-selected inputs including paths. Do not replace the stable artifact identity with display spelling or re-resolve old Evidence from the live filesystem.

Impact and scope

Observed: the explicit selected alias cannot be recovered from the returned Evidence. The native Gemini CLI loopback verifier also failed its lexical subject-path equality when macOS /var/... resolved to /private/var/...; source review shows that verifier assumption conflates caller spelling and resolved identity. That verifier failure is not a live Google API or analysis failure. No Windows/Linux, race, cancellation, or other provider claim is made here.

REA version

Package 6.7.0; main 49b4edfe77, compiled local checkout.

Runtime and platform

Node 24.18.0; macOS 26.3 arm64. Optional native verifier used installed Gemini CLI 0.29.5 with its local model fixture.

Target and artifact context

One synthetic ECMAScript file in a symlink-selected directory; no deep provider or target execution required.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

CLI exited 0 and emitted valid application graph Evidence. Subject and normalized result use the resolved physical path, while parameters omit input_path; the complete serialized Evidence does not contain the selected alias. The same distinction was observed in the native Gemini loopback tool response.

Analysis or suspected cause

Source-derived: JavaScriptArtifactReconstruction.resolveSelectedInput correctly resolves the analyzed path, but JavaScriptApplicationEvidence.parameters omits the original input.input_path. Consumers must distinguish that caller input from subject identity. The application Evidence parser already accepts an input_path parameter and falls back to the normalized path for older records. Several native-client verifiers compare the canonical subject path to a lexical fixture path and should check the two meanings independently.

#3924 / active PR #4576 concern rejection of relative MCP paths; they do not preserve a valid absolute caller-selected alias in Evidence.

Originally created by @morluto on GitHub (Oct 19, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5258 ### Before submitting - [x] Searched open/closed JavaScript path/Evidence and symlink reports. - [x] Synthetic fixture only; local common path prefix omitted below. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze-javascript-application` succeeds on an explicitly selected absolute directory symlink, but the serialized Evidence contains only the resolved physical directory path. The caller-selected alias is absent from both parameters and the complete Evidence JSON. This loses the original input spelling while correctly retaining the analyzed artifact identity. Executed on main 49b4edfe7788495ba548e423c9c3b82dc14cca03 with unrelated byte-pattern changes in the workspace. No JavaScript analysis/Evidence source changes were present. ### Reproduction Executed once through the compiled CLI: create a synthetic directory `js-path-physical/index.mjs` containing `export const result = () => ({ ok: true });`, and an absolute directory symlink `js-path-selected` pointing at that directory. Then run: ```sh node scripts/rea.mjs analyze-javascript-application <absolute-audit-root>/js-path-selected --artifact-format directory --format json ``` `<absolute-audit-root>` replaces only this machine's common local path prefix. The real fixture and invocation were executed; no target was executed, only source analysis. Observed reduced fields: ```json { "subject": {"local_path": "<absolute-audit-root>/js-path-physical"}, "parameters": {"format": "directory", "integrity_policy": "fail"}, "normalized_result": {"input_path": "<absolute-audit-root>/js-path-physical"} } ``` A full serialized-Evidence search for the exact absolute selected alias returns false. ### Expected behavior Keep the resolved artifact path as identity where required, and retain the caller-selected `input_path` separately, such as in Evidence parameters. The repository guidelines require preserving caller-selected inputs including paths. Do not replace the stable artifact identity with display spelling or re-resolve old Evidence from the live filesystem. ### Impact and scope Observed: the explicit selected alias cannot be recovered from the returned Evidence. The native Gemini CLI loopback verifier also failed its lexical subject-path equality when macOS `/var/...` resolved to `/private/var/...`; source review shows that verifier assumption conflates caller spelling and resolved identity. That verifier failure is not a live Google API or analysis failure. No Windows/Linux, race, cancellation, or other provider claim is made here. ### REA version Package 6.7.0; main 49b4edfe7788495ba548e423c9c3b82dc14cca03, compiled local checkout. ### Runtime and platform Node 24.18.0; macOS 26.3 arm64. Optional native verifier used installed Gemini CLI 0.29.5 with its local model fixture. ### Target and artifact context One synthetic ECMAScript file in a symlink-selected directory; no deep provider or target execution required. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence CLI exited 0 and emitted valid application graph Evidence. Subject and normalized result use the resolved physical path, while parameters omit `input_path`; the complete serialized Evidence does not contain the selected alias. The same distinction was observed in the native Gemini loopback tool response. ### Analysis or suspected cause Source-derived: `JavaScriptArtifactReconstruction.resolveSelectedInput` correctly resolves the analyzed path, but `JavaScriptApplicationEvidence.parameters` omits the original `input.input_path`. Consumers must distinguish that caller input from subject identity. The application Evidence parser already accepts an `input_path` parameter and falls back to the normalized path for older records. Several native-client verifiers compare the canonical subject path to a lexical fixture path and should check the two meanings independently. #3924 / active PR #4576 concern rejection of relative MCP paths; they do not preserve a valid absolute caller-selected alias in Evidence.

bsakaguchi

2026-10-31 00:37:54 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:37:55 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 19, 2026):

Cross-referencing with sibling path normalization issue #5103 ([Bug] Electron scenario CLI rejects an existing application path after symlink/..). Both issues isolate the boundary where resolving symlinks or collapsing .. discards the caller-selected input path or produces spurious resolution errors.

Consolidated under Cluster X (Application Target Path Symlink Resolution & Caller-Selected Path Loss) in tracker #4330.

@matbrgz commented on GitHub (Oct 19, 2026): Cross-referencing with sibling path normalization issue #5103 (`[Bug] Electron scenario CLI rejects an existing application path after symlink/..`). Both issues isolate the boundary where resolving symlinks or collapsing `..` discards the caller-selected input path or produces spurious resolution errors. Consolidated under **Cluster X (Application Target Path Symlink Resolution & Caller-Selected Path Loss)** in tracker #4330.

bsakaguchi commented

2026-10-31 00:37:55 +00:00

Author

Owner

@morluto commented on GitHub (Oct 19, 2026):

Fixed on main in c4aaf813e. The Evidence producer omitted the selected path while artifact reconstruction correctly retained canonical identity. New records now keep the admitted selection in parameters.input_path; subject/result stay canonical, and historical records require no filesystem lookup. Both CLI routes anchor relative selections without resolving symlinks. The client verifiers use shared assertions for the separate selected and canonical facts.

Validation: 118 focused tests passed across eight files; npm run check, docs:check, and discovery passed. The installed Gemini CLI 0.29.5 loopback verifier also passed on macOS, including the /var alias case (synthetic model fixture, no live Google API claim). Full current-main CI is still running. Thanks to @kwakhyun and @vishal-tambi; both are credited in the commit.

@morluto commented on GitHub (Oct 19, 2026): Fixed on main in c4aaf813e. The Evidence producer omitted the selected path while artifact reconstruction correctly retained canonical identity. New records now keep the admitted selection in `parameters.input_path`; subject/result stay canonical, and historical records require no filesystem lookup. Both CLI routes anchor relative selections without resolving symlinks. The client verifiers use shared assertions for the separate selected and canonical facts. Validation: 118 focused tests passed across eight files; `npm run check`, `docs:check`, and discovery passed. The installed Gemini CLI 0.29.5 loopback verifier also passed on macOS, including the `/var` alias case (synthetic model fixture, no live Google API claim). Full current-main CI is still running. Thanks to @kwakhyun and @vishal-tambi; both are credited in the commit.

bsakaguchi referenced this issue

2026-10-31 01:08:21 +00:00

[PR #3231] [CLOSED] fix(cli): advertise the nonnegative outline depth the parser enforces #5660

bsakaguchi referenced this issue

2026-10-31 01:08:24 +00:00

[PR #3233] [CLOSED] fix(cli): advertise the outline-depth minimum the parser enforces #5662