morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5928] [Bug] Skill installation rollback can overwrite concurrent user edits #3603

New issue

Closed

opened 2026-10-31 00:42:18 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:42:18 +00:00

Owner

Originally created by @dakjdakd on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5928

Summary

Skill installation currently treats every managed file as a pathname that can be rewritten during rollback. That is unsafe when an operator or another setup process changes a file after REA has prepared or published the new bundle.

Background

rea setup installs the canonical managed skill bundle and keeps a recovery backup for existing files. The operation can touch several files in one transaction. A later write, readback, or cleanup step may require the earlier files to be restored, so rollback must distinguish the file REA published from whatever happens to be at the same pathname when rollback runs.

Problem

The current skill writer restores an earlier snapshot by pathname. If a user edits a published skill file while the transaction is still in progress, rollback writes the old snapshot over that edit. On a first installation, where no original file exists, pathname-based cleanup can also remove a file that the user created after REA published the new file.

The previous implementation also retained text snapshots for recovery. That representation cannot guarantee byte-exact restoration for files containing invalid UTF-8 bytes, and it does not carry the file identity needed to establish ownership across a replacement at the same path.

Expected behavior

Detect a file that changed after REA published it and leave the current user-owned contents untouched.
Restore an original file only while the published inode is still the one owned by this installation attempt.
Never delete a first-install file merely because the pathname is still present.
Preserve the original bytes and mode when recovery is safe, including invalid UTF-8 and UTF-8 BOM content.
Retain cleanup ownership when staging cleanup is incomplete so the operation can be retried without losing the original installation result.

Scope

This issue covers the managed skill bundle transaction in SetupSkill. It does not change client registration semantics or add new setup capabilities.

Originally created by @dakjdakd on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5928 ## Summary Skill installation currently treats every managed file as a pathname that can be rewritten during rollback. That is unsafe when an operator or another setup process changes a file after REA has prepared or published the new bundle. ## Background `rea setup` installs the canonical managed skill bundle and keeps a recovery backup for existing files. The operation can touch several files in one transaction. A later write, readback, or cleanup step may require the earlier files to be restored, so rollback must distinguish the file REA published from whatever happens to be at the same pathname when rollback runs. ## Problem The current skill writer restores an earlier snapshot by pathname. If a user edits a published skill file while the transaction is still in progress, rollback writes the old snapshot over that edit. On a first installation, where no original file exists, pathname-based cleanup can also remove a file that the user created after REA published the new file. The previous implementation also retained text snapshots for recovery. That representation cannot guarantee byte-exact restoration for files containing invalid UTF-8 bytes, and it does not carry the file identity needed to establish ownership across a replacement at the same path. ## Expected behavior - Detect a file that changed after REA published it and leave the current user-owned contents untouched. - Restore an original file only while the published inode is still the one owned by this installation attempt. - Never delete a first-install file merely because the pathname is still present. - Preserve the original bytes and mode when recovery is safe, including invalid UTF-8 and UTF-8 BOM content. - Retain cleanup ownership when staging cleanup is incomplete so the operation can be retried without losing the original installation result. ## Scope This issue covers the managed skill bundle transaction in `SetupSkill`. It does not change client registration semantics or add new setup capabilities.

bsakaguchi closed this issue

2026-10-31 00:42:18 +00:00

bsakaguchi commented

2026-10-31 00:42:18 +00:00

Author

Owner

@dakjdakd commented on GitHub (Oct 21, 2026):

The focused implementation is ready on dakjdakd/rea:fix/setup-skill-rollback-ownership at commit 111fc5b68b. The corresponding draft PR body is prepared and will be submitted as soon as pull-request creation is available for this account.

@dakjdakd commented on GitHub (Oct 21, 2026): The focused implementation is ready on dakjdakd/rea:fix/setup-skill-rollback-ownership at commit 111fc5b68b14a96778aa49dc0aeb81c37d05935f. The corresponding draft PR body is prepared and will be submitted as soon as pull-request creation is available for this account.

bsakaguchi commented

2026-10-31 00:42:19 +00:00

Author

Owner

@morluto commented on GitHub (Oct 26, 2026):

Thanks for documenting the rollback ownership problem. Main now publishes skill files through a retained file owner and checks the current identity and bytes before restoration (211e3533b). The boundary tests cover concurrent edits and replacements, first-install conflicts, byte-exact invalid UTF-8/BOM recovery, and retained cleanup retry. I am closing the reported behavior as addressed. #5936 remains open for its additional path-alias and cleanup-composition cases; please reopen if the original acceptance criteria are not met. This assessment is source-derived; I did not rerun the tests.

@morluto commented on GitHub (Oct 26, 2026): Thanks for documenting the rollback ownership problem. Main now publishes skill files through a retained file owner and checks the current identity and bytes before restoration (211e3533b). The boundary tests cover concurrent edits and replacements, first-install conflicts, byte-exact invalid UTF-8/BOM recovery, and retained cleanup retry. I am closing the reported behavior as addressed. #5936 remains open for its additional path-alias and cleanup-composition cases; please reopen if the original acceptance criteria are not met. This assessment is source-derived; I did not rerun the tests.

bsakaguchi referenced this issue

2026-10-31 01:09:54 +00:00

[PR #3603] [CLOSED] fix(cutter): expand ~ and ignore empty REA_CUTTER_BRIDGE_DIR #5850

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3603

No description provided.

Rows
Columns