morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1067] [Bug] Web script tools reject forward-slash Windows manifest paths ("no containing manifest directory") #391

New issue

Closed

opened 2026-10-15 18:24:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:42 +00:00

Owner

Originally created by @vinay121314 on GitHub (Oct 8, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1067

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Tools that read a selected exported script (web module trace, web source-location) fail when manifest_path is a Windows path written with forward slashes, e.g. D:/exports/manifest.json:

Selected source has no containing manifest directory.

The same manifest written as D:\exports\manifest.json works. A relative manifest_path (./exports/manifest.json) fails the same way on every OS.

Reproduction

On native Windows, export captured scripts with export_web_scripts into D:\exports.
Run the web module trace (or web source-location) CLI command with --manifest-path "D:/exports/manifest.json" and --script-index 0.
Observe the path error above.
Repeat with "D:\exports\manifest.json"; it succeeds.

Expected behavior

Both spellings resolve to the same manifest and are accepted. The README itself suggests "D:/apps/example"-style paths on Windows, and agents commonly emit forward slashes.

Impact and scope

Affects trace_web_module_imports and web source-location on Windows whenever forward-slash drive paths are passed, plus relative paths on all platforms (the schema describes the field as absolute but does not enforce it). Fails closed: no evidence integrity impact.

REA version

5.0.0 (source revision 5ccb924)

Runtime and platform

Windows 11 x64, Node 22/24 (found by source review + path.win32 simulation)

Target and artifact context

export_web_scripts manifest

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Simulation of the containment walk with Node path.win32 / path.posix:
D:/exports/manifest.json  | root: D:/exports | walk: D:\exports\files -> D:\exports -> D:\ | THROWS
D:\exports\manifest.json  | root: D:\exports | walk: D:\exports\files -> D:\exports       | OK
./exports/manifest.json   | root: ./exports  | walk: exports/files -> exports -> .         | THROWS

Typed outcome or recovery expected

No response

Analysis or suspected cause

Source-derived:

src/browser/assets/LocalWebScriptArtifacts.ts:58: root = dirname(input.manifest_path) is never normalized, while sourcePath = join(root, "files", portable) is (on Windows join converts / to \).
assertContained (~line 124) walks up with while (directory !== root). Because D:\exports and D:/exports are compared as raw strings, the walk passes the root, reaches the drive root and throws.

Additional context

Proposed fix: const root = resolve(dirname(input.manifest_path)), and move the walk into a small helper that resolves both paths before comparing, unit-tested with path.win32. Optionally enforce isAbsolute on manifest_path for a clearer validation error. Happy to open a PR for this.

Originally created by @vinay121314 on GitHub (Oct 8, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1067 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Tools that read a selected exported script (web module trace, web source-location) fail when `manifest_path` is a Windows path written with forward slashes, e.g. `D:/exports/manifest.json`: `Selected source has no containing manifest directory.` The same manifest written as `D:\exports\manifest.json` works. A relative `manifest_path` (`./exports/manifest.json`) fails the same way on every OS. ### Reproduction 1. On native Windows, export captured scripts with `export_web_scripts` into `D:\exports`. 2. Run the web module trace (or web source-location) CLI command with `--manifest-path "D:/exports/manifest.json"` and `--script-index 0`. 3. Observe the path error above. 4. Repeat with `"D:\exports\manifest.json"`; it succeeds. ### Expected behavior Both spellings resolve to the same manifest and are accepted. The README itself suggests `"D:/apps/example"`-style paths on Windows, and agents commonly emit forward slashes. ### Impact and scope Affects `trace_web_module_imports` and web source-location on Windows whenever forward-slash drive paths are passed, plus relative paths on all platforms (the schema describes the field as absolute but does not enforce it). Fails closed: no evidence integrity impact. ### REA version 5.0.0 (source revision 5ccb924) ### Runtime and platform Windows 11 x64, Node 22/24 (found by source review + path.win32 simulation) ### Target and artifact context export_web_scripts manifest ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence ```text Simulation of the containment walk with Node path.win32 / path.posix: D:/exports/manifest.json | root: D:/exports | walk: D:\exports\files -> D:\exports -> D:\ | THROWS D:\exports\manifest.json | root: D:\exports | walk: D:\exports\files -> D:\exports | OK ./exports/manifest.json | root: ./exports | walk: exports/files -> exports -> . | THROWS ``` ### Typed outcome or recovery expected _No response_ ### Analysis or suspected cause Source-derived: - `src/browser/assets/LocalWebScriptArtifacts.ts:58`: `root = dirname(input.manifest_path)` is never normalized, while `sourcePath = join(root, "files", portable)` is (on Windows `join` converts `/` to `\`). - `assertContained` (~line 124) walks up with `while (directory !== root)`. Because `D:\exports` and `D:/exports` are compared as raw strings, the walk passes the root, reaches the drive root and throws. ### Additional context Proposed fix: `const root = resolve(dirname(input.manifest_path))`, and move the walk into a small helper that resolves both paths before comparing, unit-tested with `path.win32`. Optionally enforce `isAbsolute` on `manifest_path` for a clearer validation error. Happy to open a PR for this.

bsakaguchi

2026-10-15 18:24:42 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi referenced this issue

2026-10-31 00:37:58 +00:00

[GH-ISSUE #5273] [Bug] MCP tool calls backgrounded by the client after 120 s fail with "missing required resultType" (protocol 2026-07-28) #3217

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#391

No description provided.

Rows
Columns