morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5723] [Bug] Windows native module rea-windows-x64.node blocked by Smart App Control #3471

New issue

Closed

opened 2026-10-31 00:40:50 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:40:50 +00:00

Owner

Originally created by @jpmorris41488 on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5723

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

On Windows 11 Pro (10.0.26200, x64) with Smart App Control enabled, the Windows native controls fail to load. rea doctor reports:

jadx: REA Windows native controls are unavailable: An Application Control policy has blocked this file. ...\npm\node_modules\rea-agents\native\windows\build\rea-windows-x64.node

rea setup --client claude_code --yes returns status needs_human with plannedActions: [], so no registration is applied.

Windows Code Integrity events 3077 and 3033 show node.exe being refused the load of that file for not meeting the Enterprise signing level requirements. Get-AuthenticodeSignature on the file reports Status: NotSigned.

Reproduction

On Windows 11 with Smart App Control on, run: npm install --global rea-agents
Run: rea --version (returns 6.7.0)
Run: rea setup --dry-run --client claude_code
Run: rea doctor
Observed in each step above. Not tested on other Windows configurations.

Expected behavior

Setup should be able to plan the Claude Code registration, or the doctor should say what the user can do without disabling Smart App Control. I did not find a documented requirement for the native file to be signed on Windows.

Impact and scope

Blocks the Windows native controls, so setup can't register REA with Claude Code on this machine. Unknown whether the static JavaScript analysis works. Not tested.

REA version

6.7.0

Runtime and platform

Node.js 24.20.0; Windows 11 Pro 10.0.26200, x64; Smart App Control on

Target and artifact context

No response

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

rea doctor jadx row: "REA Windows native controls are unavailable: An Application Control policy has blocked this file." (path under \AppData\Roaming\npm\node_modules\rea-agents\native\windows\build\rea-windows-x64.node). Command output, observed directly. Get-AuthenticodeSignature on that file: Status NotSigned (observed directly). Windows Code Integrity events 3077 and 3033 for node.exe loading that file (from Event Viewer, observed directly).

Typed outcome or recovery expected

rea setup returned status needs_human with no planned actions

Analysis or suspected cause

The native module appears unsigned, and Smart App Control blocks unsigned native code. Not verified against the maintainers' build.

Additional context

No response

Originally created by @jpmorris41488 on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5723 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Setup, packaging, or upgrade ### Observed behavior On Windows 11 Pro (10.0.26200, x64) with Smart App Control enabled, the Windows native controls fail to load. `rea doctor` reports: jadx: REA Windows native controls are unavailable: An Application Control policy has blocked this file. ...\npm\node_modules\rea-agents\native\windows\build\rea-windows-x64.node `rea setup --client claude_code --yes` returns status `needs_human` with `plannedActions: []`, so no registration is applied. Windows Code Integrity events 3077 and 3033 show node.exe being refused the load of that file for not meeting the Enterprise signing level requirements. Get-AuthenticodeSignature on the file reports Status: NotSigned. ### Reproduction 1. On Windows 11 with Smart App Control on, run: npm install --global rea-agents 2. Run: rea --version (returns 6.7.0) 3. Run: rea setup --dry-run --client claude_code 4. Run: rea doctor Observed in each step above. Not tested on other Windows configurations. ### Expected behavior Setup should be able to plan the Claude Code registration, or the doctor should say what the user can do without disabling Smart App Control. I did not find a documented requirement for the native file to be signed on Windows. ### Impact and scope Blocks the Windows native controls, so setup can't register REA with Claude Code on this machine. Unknown whether the static JavaScript analysis works. Not tested. ### REA version 6.7.0 ### Runtime and platform Node.js 24.20.0; Windows 11 Pro 10.0.26200, x64; Smart App Control on ### Target and artifact context _No response_ ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence `rea doctor` jadx row: "REA Windows native controls are unavailable: An Application Control policy has blocked this file." (path under <user>\AppData\Roaming\npm\node_modules\rea-agents\native\windows\build\rea-windows-x64.node). Command output, observed directly. Get-AuthenticodeSignature on that file: Status NotSigned (observed directly). Windows Code Integrity events 3077 and 3033 for node.exe loading that file (from Event Viewer, observed directly). ### Typed outcome or recovery expected rea setup returned status needs_human with no planned actions ### Analysis or suspected cause The native module appears unsigned, and Smart App Control blocks unsigned native code. Not verified against the maintainers' build. ### Additional context _No response_

bsakaguchi

2026-10-31 00:40:50 +00:00

closed this issue
added the
bug

triage
labels

bsakaguchi commented

2026-10-31 00:40:51 +00:00

Author

Owner

@mpratsaki commented on GitHub (Oct 22, 2026):

Data point from Windows 11 Home 10.0.26200 with Smart App Control off (VerifiedAndReputablePolicyState = 0), so I could not reproduce the block itself. I checked the official artifact instead: native/windows/build/rea-windows-x64.node from the rea-agents@6.7.0 npm tarball (npm pack, registry integrity verified) has SHA-256 28e0a01f…029856, matching artifactSha256 in the package's manifest.json, and Get-AuthenticodeSignature reports NotSigned. So the published addon itself is unsigned, consistent with Smart App Control refusing it. With SAC off, the same file loads (a source build that loads it through run-exclusive succeeds).

🤖 Drafted with Claude Code, posted with my OK

@mpratsaki commented on GitHub (Oct 22, 2026): Data point from Windows 11 Home 10.0.26200 with Smart App Control **off** (`VerifiedAndReputablePolicyState` = 0), so I could not reproduce the block itself. I checked the official artifact instead: `native/windows/build/rea-windows-x64.node` from the `rea-agents@6.7.0` npm tarball (`npm pack`, registry integrity verified) has SHA-256 `28e0a01f…029856`, matching `artifactSha256` in the package's `manifest.json`, and `Get-AuthenticodeSignature` reports `NotSigned`. So the published addon itself is unsigned, consistent with Smart App Control refusing it. With SAC off, the same file loads (a source build that loads it through `run-exclusive` succeeds). 🤖 Drafted with Claude Code, posted with my OK

bsakaguchi commented

2026-10-31 00:40:52 +00:00

Author

Owner

@jpmorris41488 commented on GitHub (Oct 22, 2026):

Thanks for confirming the cause, mpratsaki. I also hit this on Windows 11 Pro (10.0.26200) with Smart App Control on.

Is there a plan to code-sign rea-windows-x64.node or the Windows native build? If not, is there a documented workaround for Windows users who keep Smart App Control on?

@jpmorris41488 commented on GitHub (Oct 22, 2026): Thanks for confirming the cause, mpratsaki. I also hit this on Windows 11 Pro (10.0.26200) with Smart App Control on. Is there a plan to code-sign rea-windows-x64.node or the Windows native build? If not, is there a documented workaround for Windows users who keep Smart App Control on?

bsakaguchi commented

2026-10-31 00:40:52 +00:00

Author

Owner

@dark13b commented on GitHub (Oct 23, 2026):

I'd like to take this one.

Plan: make rea doctor and rea setup recognize the Application Control block, say what it means and what the user can do about it, and check whether setup can still plan the client registration when the Windows native controls are unavailable. Signing rea-windows-x64.node is a release decision for the maintainers, so I will not change that.

I am on Windows 11 (10.0.26200) with Smart App Control off, so I cannot reproduce the block itself. I will cover it with a simulated load failure and say so in the PR.

@dark13b commented on GitHub (Oct 23, 2026): I'd like to take this one. Plan: make `rea doctor` and `rea setup` recognize the Application Control block, say what it means and what the user can do about it, and check whether setup can still plan the client registration when the Windows native controls are unavailable. Signing `rea-windows-x64.node` is a release decision for the maintainers, so I will not change that. I am on Windows 11 (10.0.26200) with Smart App Control off, so I cannot reproduce the block itself. I will cover it with a simulated load failure and say so in the PR.

bsakaguchi referenced this issue

2026-10-31 01:09:12 +00:00

[PR #3466] [CLOSED] fix(electron): block app.moveToApplicationsFolder during capture #5757

bsakaguchi referenced this issue

2026-10-31 01:09:14 +00:00

[PR #3471] [MERGED] fix(electron): block moveToApplicationsFolder during active capture #5761