morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5408] [Bug] inspect-artifact suggests overwrite recovery but rejects --overwrite #3278

New issue

Closed

opened 2026-10-31 00:38:42 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:38:42 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5408

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Repeating inspect-artifact with the same --evidence_output destination fails safely, but both its message and remediation.action say "Evidence file already exists. Choose another path or allow overwrite." The command advertises "Never overwrites" and rejects --overwrite with "Unknown flag: --overwrite".

An independent verifier reproduced this through the public CLI with a local ZIP containing one text file. The existing Evidence bundle stayed byte-for-byte unchanged after both failures.

Reproduction

From a built source checkout, create the disposable fixture and isolated writable directories. These are generic equivalents of the paths used by the verifier:

case_dir="$(mktemp -d "$PWD/evidence-guidance.XXXXXX")"
mkdir -p "$case_dir/home" "$case_dir/config" "$case_dir/data" "$case_dir/cache" "$case_dir/state"
python3 - "$case_dir/sample.zip" <<'PYZIP'
import sys, zipfile
with zipfile.ZipFile(sys.argv[1], "w") as archive:
    archive.writestr("sample.txt", "sample\n")
PYZIP
run_rea() {
  env HOME="$case_dir/home" XDG_CONFIG_HOME="$case_dir/config" \
    XDG_DATA_HOME="$case_dir/data" XDG_CACHE_HOME="$case_dir/cache" \
    XDG_STATE_HOME="$case_dir/state" node scripts/rea.mjs "$@"
}
run_rea inspect-artifact --help
run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --json
# Repeat unchanged to trigger the collision.
run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --json
# Try the suggested overwrite recovery.
run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --overwrite --json
# Verify the available recovery.
run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence-new.json" --json

The verifier ran each collision and overwrite attempt once. Initial inspection and inspection to a fresh destination exited 0; both failing attempts exited 1.

Expected behavior

Keep the existing file protected and suggest recovery actions available to inspect-artifact, such as choosing another destination. Do not suggest an unavailable overwrite action.

The command's help and src/cli/analysisEvidenceDelivery.ts:15-26 promise "Never overwrites". docs/user-visible-errors.csv:16 calls for reason-specific plain messages with a safe recovery step.

Impact and scope

This is a wording defect with a verified workaround: choosing a fresh Evidence output path succeeds. No data loss or consequential behavior change was observed. Runtime coverage is limited to inspect-artifact and the evidence-export control below; other callers of the shared delivery helper were not exercised.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node.js v24.22.0; macOS arm64. No external analysis provider required.

Target and artifact context

Local ZIP containing sample.txt with contents sample\n; Evidence bundle JSON output.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

The verifier retained the command outputs. The relevant collision fields were:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "message": "Evidence file already exists. Choose another path or allow overwrite.",
  "remediation": {
    "action": "Evidence file already exists. Choose another path or allow overwrite."
  }
}

details.reason was exists. Adding --overwrite returned:

{
  "code": "UNKNOWN",
  "message": "Unknown flag: --overwrite"
}

The initial bundle was 7,093 bytes and remained byte-for-byte unchanged after both failures. The fresh destination also produced a 7,093-byte bundle.

Typed outcome or recovery expected

Retain the existing-file refusal and give applicable recovery guidance in both message and remediation.action.

Analysis or suspected cause

Source-derived reasoning: src/cli/artifactCommands.ts:229-270 invokes the shared delivery helper. src/cli/analysisEvidenceDelivery.ts:117-122 passes false for overwrite, while src/domain/analysisErrorPresentation.ts:467-468 supplies the shared existing-file message. The CLI observations confirm the mismatch for this command.

Additional context

This report was prepared with AI assistance and independently reproduced by a separate verifier. Before submission, the cited files had no changes between the tested source revision and fetched origin/main at e84468c0bb0476412ac0c8161f7c2ecc9a6864ca. Searches covered open and closed issues and PRs by command, exact message, overwrite behavior, and source modules; no matching report was found.

The verifier also ran run_rea evidence-export "$case_dir/evidence.json" "$case_dir/canonical.json" --json, then repeated it with --overwrite --json. Both succeeded. That command supports overwrite, so its applicable recovery guidance should remain intact.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5408 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Repeating `inspect-artifact` with the same `--evidence_output` destination fails safely, but both its message and `remediation.action` say "Evidence file already exists. Choose another path or allow overwrite." The command advertises "Never overwrites" and rejects `--overwrite` with "Unknown flag: --overwrite". An independent verifier reproduced this through the public CLI with a local ZIP containing one text file. The existing Evidence bundle stayed byte-for-byte unchanged after both failures. ### Reproduction From a built source checkout, create the disposable fixture and isolated writable directories. These are generic equivalents of the paths used by the verifier: ```sh case_dir="$(mktemp -d "$PWD/evidence-guidance.XXXXXX")" mkdir -p "$case_dir/home" "$case_dir/config" "$case_dir/data" "$case_dir/cache" "$case_dir/state" python3 - "$case_dir/sample.zip" <<'PYZIP' import sys, zipfile with zipfile.ZipFile(sys.argv[1], "w") as archive: archive.writestr("sample.txt", "sample\n") PYZIP run_rea() { env HOME="$case_dir/home" XDG_CONFIG_HOME="$case_dir/config" \ XDG_DATA_HOME="$case_dir/data" XDG_CACHE_HOME="$case_dir/cache" \ XDG_STATE_HOME="$case_dir/state" node scripts/rea.mjs "$@" } run_rea inspect-artifact --help run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --json # Repeat unchanged to trigger the collision. run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --json # Try the suggested overwrite recovery. run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence.json" --overwrite --json # Verify the available recovery. run_rea inspect-artifact "$case_dir/sample.zip" --detail summary --evidence_output "$case_dir/evidence-new.json" --json ``` The verifier ran each collision and overwrite attempt once. Initial inspection and inspection to a fresh destination exited 0; both failing attempts exited 1. ### Expected behavior Keep the existing file protected and suggest recovery actions available to `inspect-artifact`, such as choosing another destination. Do not suggest an unavailable overwrite action. The command's help and `src/cli/analysisEvidenceDelivery.ts:15-26` promise "Never overwrites". `docs/user-visible-errors.csv:16` calls for reason-specific plain messages with a safe recovery step. ### Impact and scope This is a wording defect with a verified workaround: choosing a fresh Evidence output path succeeds. No data loss or consequential behavior change was observed. Runtime coverage is limited to `inspect-artifact` and the `evidence-export` control below; other callers of the shared delivery helper were not exercised. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node.js v24.22.0; macOS arm64. No external analysis provider required. ### Target and artifact context Local ZIP containing `sample.txt` with contents `sample\n`; Evidence bundle JSON output. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence The verifier retained the command outputs. The relevant collision fields were: ```json { "code": "invalid_request", "category": "invalid_input", "message": "Evidence file already exists. Choose another path or allow overwrite.", "remediation": { "action": "Evidence file already exists. Choose another path or allow overwrite." } } ``` `details.reason` was `exists`. Adding `--overwrite` returned: ```json { "code": "UNKNOWN", "message": "Unknown flag: --overwrite" } ``` The initial bundle was 7,093 bytes and remained byte-for-byte unchanged after both failures. The fresh destination also produced a 7,093-byte bundle. ### Typed outcome or recovery expected Retain the existing-file refusal and give applicable recovery guidance in both `message` and `remediation.action`. ### Analysis or suspected cause Source-derived reasoning: `src/cli/artifactCommands.ts:229-270` invokes the shared delivery helper. `src/cli/analysisEvidenceDelivery.ts:117-122` passes `false` for overwrite, while `src/domain/analysisErrorPresentation.ts:467-468` supplies the shared existing-file message. The CLI observations confirm the mismatch for this command. ### Additional context This report was prepared with AI assistance and independently reproduced by a separate verifier. Before submission, the cited files had no changes between the tested source revision and fetched `origin/main` at `e84468c0bb0476412ac0c8161f7c2ecc9a6864ca`. Searches covered open and closed issues and PRs by command, exact message, overwrite behavior, and source modules; no matching report was found. The verifier also ran `run_rea evidence-export "$case_dir/evidence.json" "$case_dir/canonical.json" --json`, then repeated it with `--overwrite --json`. Both succeeded. That command supports overwrite, so its applicable recovery guidance should remain intact.

bsakaguchi closed this issue

2026-10-31 00:38:43 +00:00

bsakaguchi commented

2026-10-31 00:38:43 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 20, 2026):

TL;DR: This still happens on main on Linux. The error suggests allowing overwrite, but --overwrite is rejected.

Checked on main b3aadaf47 (Node 24.18.0). A second inspect-artifact with the same --evidence_output exits 1 with "Evidence file already exists. Choose another path or allow overwrite." Adding --overwrite exits 1 with Unknown flag: --overwrite. The help text says "Never overwrites."

Not run

A byte-for-byte check of the existing Evidence file. A control run to a new path.

Thanks, coygeek, for the clear report.

Commands

Fixture: a ZIP with one text file, sample.txt. Isolated HOME, XDG and TMPDIR.

node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --json   # exit 0
node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --json   # exit 1
node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --overwrite --json   # exit 1

Second run: "message":"Evidence file already exists. Choose another path or allow overwrite.", remediation.action the same text, details.reason: "exists". Third run: {"code":"UNKNOWN","message":"Unknown flag: --overwrite"}.

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.11
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 24.18.0
Head: b3aadaf47
Other: another job shared the box during the run

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 20, 2026): **TL;DR:** This still happens on main on Linux. The error suggests allowing overwrite, but `--overwrite` is rejected. Checked on main b3aadaf47 (Node 24.18.0). A second `inspect-artifact` with the same `--evidence_output` exits 1 with "Evidence file already exists. Choose another path or allow overwrite." Adding `--overwrite` exits 1 with `Unknown flag: --overwrite`. The help text says "Never overwrites." ### Not run - A byte-for-byte check of the existing Evidence file. A control run to a new path. Thanks, coygeek, for the clear report. <details> <summary>Commands</summary> Fixture: a ZIP with one text file, `sample.txt`. Isolated HOME, XDG and TMPDIR. ```sh node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --json # exit 0 node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --json # exit 1 node scripts/rea.mjs inspect-artifact sample.zip --detail summary --evidence_output evidence.json --overwrite --json # exit 1 ``` Second run: `"message":"Evidence file already exists. Choose another path or allow overwrite."`, `remediation.action` the same text, `details.reason: "exists"`. Third run: `{"code":"UNKNOWN","message":"Unknown flag: --overwrite"}`. </details> <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.11 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 24.18.0 - Head: b3aadaf47 - Other: another job shared the box during the run </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-31 00:38:44 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 21, 2026):

Independently verified an additional command with the same root cause: inspect-il2cpp-metadata also uses the shared Evidence delivery helper with overwrite disabled. On REA 6.7.0 at 9d8e7803326a382cbbb3ffdb900f5e93e5442d68 (Node 24.18.0, macOS arm64), using a newly generated 256-byte version 29 global-metadata.dat with 31 empty sections, node scripts/rea.mjs inspect-il2cpp-metadata global-metadata.dat --evidence_output evidence.json --json exits 0 initially; repeating it exits 1 with code: invalid_request, details.reason: exists, and both message and remediation.action saying “Evidence file already exists. Choose another path or allow overwrite.” Adding --overwrite to that command exits 1 with code: UNKNOWN and message: Unknown flag: --overwrite. The existing bundle's SHA-256 remained unchanged after both failures. Fetched main at d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f includes changes to src/application/EvidenceBundleFiles.ts: verified at baseline; main not re-run.

@coygeek commented on GitHub (Oct 21, 2026): Independently verified an additional command with the same root cause: `inspect-il2cpp-metadata` also uses the shared Evidence delivery helper with overwrite disabled. On REA 6.7.0 at `9d8e7803326a382cbbb3ffdb900f5e93e5442d68` (Node 24.18.0, macOS arm64), using a newly generated 256-byte version 29 `global-metadata.dat` with 31 empty sections, `node scripts/rea.mjs inspect-il2cpp-metadata global-metadata.dat --evidence_output evidence.json --json` exits 0 initially; repeating it exits 1 with `code: invalid_request`, `details.reason: exists`, and both `message` and `remediation.action` saying “Evidence file already exists. Choose another path or allow overwrite.” Adding `--overwrite` to that command exits 1 with `code: UNKNOWN` and `message: Unknown flag: --overwrite`. The existing bundle's SHA-256 remained unchanged after both failures. Fetched main at `d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f` includes changes to `src/application/EvidenceBundleFiles.ts`: verified at baseline; main not re-run.

bsakaguchi commented

2026-10-31 00:38:44 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

publishEvidenceDelivery now replaces an exists error with a no-overwrite-specific message and retains its path/cause/cleanup. That shared path covers inspect-artifact and inspect-il2cpp-metadata; standalone export retains the overwrite-capable generic guidance. The boundary regression asserts both message and remediation omit overwrite and checks preservation of the existing bundle.

Implementation: EvidenceBundleCommands.ts, artifactCallerSelection.test.ts.

The relevant regression checks in artifactCallerSelection.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. publishEvidenceDelivery now replaces an exists error with a no-overwrite-specific message and retains its path/cause/cleanup. That shared path covers inspect-artifact and inspect-il2cpp-metadata; standalone export retains the overwrite-capable generic guidance. The boundary regression asserts both message and remediation omit overwrite and checks preservation of the existing bundle. Implementation: [EvidenceBundleCommands.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/EvidenceBundleCommands.ts#L165), [artifactCallerSelection.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/artifactCallerSelection.test.ts#L60). The relevant regression checks in [artifactCallerSelection.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/cli/artifactCallerSelection.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:08:42 +00:00

[PR #3278] [CLOSED] fix(javascript): report missing ASAR companions as unavailable instead of not-found #5695

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3278

No description provided.

Rows
Columns