[GH-ISSUE #5899] fix(firmware): reclassify output-directory admission failures as invalid_request #3577

New issue

Closed

opened 2026-10-31 00:42:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:42:03 +00:00

Owner

Originally created by @codeXsidd on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5899

Summary

extract-firmware destination precondition failures (existing output directory, missing parent directory) are reported with code: execution_failure attributed to the Unblob provider, instead of code: invalid_request / invalid_input with an output_directory field issue and input-contract recovery.

Problem

SafeOutputTree.create in src/artifacts/SafeOutputTree.ts (lines 107–128) throws ArtifactReaderFailure with reason "path" (already-exists or non-absolute root) or "unavailable" (missing parent) when the caller-supplied output_directory does not satisfy the contract. These propagate to the catch block in publishFirmwareExtraction (FirmwarePublication.ts:200–257), which calls firmwareFailure() with engine "unblob". The firmwareFailure function (FirmwareFailures.ts:63–141) has no branch for destination-admission ArtifactReaderFailure, so both cases fall through to the catch-all at line 135 and become a ProviderAdapterError attributed to Unblob.

This misattribution causes callers to receive doctor-advice remediation with provider_id: unblob, discarding machine-readable output_directory field correction and the input-contract recovery already returned by the out-of-file-range control.

Expected behavior

Both refused destinations should produce invalid_request / invalid_input, an issue identifying output_directory, and inspect_input_contract recovery—matching the range-validation control already applied before extraction begins (FirmwareProvider.ts:429–436).

Root cause

The firmwareFailure classifier has no branch for ArtifactReaderFailure with reason "path" or "unavailable" before the generic ProviderAdapterError fallback. These are deterministic caller-input failures and must be classified as AnalysisInputError with field ["output_directory"].

Scope

src/firmware/FirmwareFailures.ts — add one branch before the catch-all for destination-admission failures; import AnalysisInputError from the domain error core.

Verified at source baseline d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f. Relates to #5746.

Originally created by @codeXsidd on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5899 ## Summary `extract-firmware` destination precondition failures (existing output directory, missing parent directory) are reported with `code: execution_failure` attributed to the Unblob provider, instead of `code: invalid_request` / `invalid_input` with an `output_directory` field issue and input-contract recovery. ## Problem `SafeOutputTree.create` in `src/artifacts/SafeOutputTree.ts` (lines 107–128) throws `ArtifactReaderFailure` with reason `"path"` (already-exists or non-absolute root) or `"unavailable"` (missing parent) when the caller-supplied `output_directory` does not satisfy the contract. These propagate to the `catch` block in `publishFirmwareExtraction` (FirmwarePublication.ts:200–257), which calls `firmwareFailure()` with engine `"unblob"`. The `firmwareFailure` function (FirmwareFailures.ts:63–141) has no branch for destination-admission `ArtifactReaderFailure`, so both cases fall through to the catch-all at line 135 and become a `ProviderAdapterError` attributed to Unblob. This misattribution causes callers to receive doctor-advice remediation with `provider_id: unblob`, discarding machine-readable `output_directory` field correction and the input-contract recovery already returned by the out-of-file-range control. ## Expected behavior Both refused destinations should produce `invalid_request` / `invalid_input`, an issue identifying `output_directory`, and `inspect_input_contract` recovery—matching the range-validation control already applied before extraction begins (FirmwareProvider.ts:429–436). ## Root cause The `firmwareFailure` classifier has no branch for `ArtifactReaderFailure` with reason `"path"` or `"unavailable"` before the generic `ProviderAdapterError` fallback. These are deterministic caller-input failures and must be classified as `AnalysisInputError` with field `["output_directory"]`. ## Scope `src/firmware/FirmwareFailures.ts` — add one branch before the catch-all for destination-admission failures; import `AnalysisInputError` from the domain error core. Verified at source baseline `d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f`. Relates to #5746.

bsakaguchi closed this issue

2026-10-31 00:42:03 +00:00

bsakaguchi referenced this issue

2026-10-31 01:09:51 +00:00

[PR #3590] [MERGED] fix(hopper)!: verify current Linux releases with the publisher key #5842