morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7151] [Bug] Windows hosts advertise an absolute-path pattern that fails v-mode compilation #4287

New issue

Closed

opened 2026-10-31 00:48:32 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:48:32 +00:00

Owner

Originally created by @pablodiazjorge on GitHub (Oct 25, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7151

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

MCP or agent integration

Observed behavior

On Windows, every field built on absoluteLocalPathStringSchema advertises the pattern ^(?:[\\/]|[A-Za-z]:[\\/]) (src/domain/localPath.ts:24). The unescaped / inside a character class compiles under Annex B and u, but v mode rejects it: new RegExp(String.raw`^(?:[\\/]|[A-Za-z]:[\\/])`, "v") throws Invalid character in character class. Linux and macOS advertise ^/, which compiles in every mode.

From tools/list over stdio on Windows:

Default compact catalog: 5 of 1,569 advertised patterns fail in v mode, all this one: close_binary.snapshot_path, binary_session.expected_server_path, and path in inspect_managed_artifact, inspect_managed_members and inspect_managed_native_boundaries.
REA_MCP_INPUT_SCHEMA_PROFILE=full: 56 fields in 43 tools, including open_binary.

Reproduction

On Windows, start rea mcp (6.8.0, or a source build of 447907f28).
Call tools/list and compile each advertised pattern with new RegExp(pattern, "v").
Alternatively, run npx vitest run tests/boundary/mcp/advertisedPatternsVMode.test.ts in a Windows checkout: it fails with exactly the 5 entries above. The same test passes on Linux.

Expected behavior

Advertised patterns compile in Annex B, u and v modes on every host, as advertisedPatternsVMode.test.ts requires. The Windows grammar stays the same: it should accept exactly the paths that path.win32.isAbsolute accepts.

Impact and scope

A client that compiles advertised patterns in v mode, such as the DeepSeek Harness case in #1581, rejects the complete tools request when REA runs on Windows, before any tool executes. Only Windows hosts are affected. The full profile widens the impact from 5 tools to 43. This is the same compatibility boundary as #1212 and #1581.

REA version

6.8.0 (the published package's dist/domain/localPath.js has the same pattern) and source at 447907f28

Runtime and platform

Node 24.22.1; Windows 11 Pro x64 (10.0.26300)

Target and artifact context

Not applicable: only tools/list is needed.

Interface

MCP

Earliest failure stage

Transport or result projection

Relevant output or evidence

server rea 6.8.0, profile default, platform win32: 229 tools, 1569 advertised patterns, 5 compile failures
  inspect_managed_artifact inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class
  inspect_managed_members inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class
  inspect_managed_native_boundaries inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class
  close_binary inputSchema/properties/snapshot_path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class
  binary_session inputSchema/properties/expected_server_path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class

Typed outcome or recovery expected

Not applicable: the catalog should be accepted.

Analysis or suspected cause

Source-derived: the Windows branch of the pattern was added in 3cf620661 (fix(mcp): require absolute evidence bundle paths). advertisedPatternsVMode.test.ts cannot catch it, for two reasons:

The general source suite runs on Linux in CI, where the schema advertises ^/, and the Windows lane is curated (docs/testing.md).
The test builds the server with the default profile, which is compact, so patterns that only the full profile advertises are not checked on any host.

Spelling the separators as hex escapes ([\x5C\x2F]), as dexDescriptorSchema does for parentheses, keeps the same matches and compiles in all three modes. I have a fix ready with a unit test that also runs on Linux, if that is welcome.

Additional context

With the full profile, the same scan also reports two failures that occur on every host, in the capture_browser_scenario request action (both added in #6946):

path: ^\/(?![/\\]). It also uses a look-ahead, which the test's RE2/Rust rule excludes.
header name: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$.

They are a separate defect, so I can report them in their own issue.

Originally created by @pablodiazjorge on GitHub (Oct 25, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7151 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area MCP or agent integration ### Observed behavior On Windows, every field built on `absoluteLocalPathStringSchema` advertises the pattern `^(?:[\\/]|[A-Za-z]:[\\/])` (`src/domain/localPath.ts:24`). The unescaped `/` inside a character class compiles under Annex B and `u`, but `v` mode rejects it: ``new RegExp(String.raw`^(?:[\\/]|[A-Za-z]:[\\/])`, "v")`` throws `Invalid character in character class`. Linux and macOS advertise `^/`, which compiles in every mode. From `tools/list` over stdio on Windows: - Default compact catalog: 5 of 1,569 advertised patterns fail in `v` mode, all this one: `close_binary.snapshot_path`, `binary_session.expected_server_path`, and `path` in `inspect_managed_artifact`, `inspect_managed_members` and `inspect_managed_native_boundaries`. - `REA_MCP_INPUT_SCHEMA_PROFILE=full`: 56 fields in 43 tools, including `open_binary`. ### Reproduction 1. On Windows, start `rea mcp` (6.8.0, or a source build of `447907f28`). 2. Call `tools/list` and compile each advertised `pattern` with `new RegExp(pattern, "v")`. 3. Alternatively, run `npx vitest run tests/boundary/mcp/advertisedPatternsVMode.test.ts` in a Windows checkout: it fails with exactly the 5 entries above. The same test passes on Linux. ### Expected behavior Advertised patterns compile in Annex B, `u` and `v` modes on every host, as `advertisedPatternsVMode.test.ts` requires. The Windows grammar stays the same: it should accept exactly the paths that `path.win32.isAbsolute` accepts. ### Impact and scope A client that compiles advertised patterns in `v` mode, such as the DeepSeek Harness case in #1581, rejects the complete tools request when REA runs on Windows, before any tool executes. Only Windows hosts are affected. The full profile widens the impact from 5 tools to 43. This is the same compatibility boundary as #1212 and #1581. ### REA version 6.8.0 (the published package's `dist/domain/localPath.js` has the same pattern) and source at `447907f28` ### Runtime and platform Node 24.22.1; Windows 11 Pro x64 (10.0.26300) ### Target and artifact context Not applicable: only `tools/list` is needed. ### Interface MCP ### Earliest failure stage Transport or result projection ### Relevant output or evidence ```text server rea 6.8.0, profile default, platform win32: 229 tools, 1569 advertised patterns, 5 compile failures inspect_managed_artifact inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class inspect_managed_members inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class inspect_managed_native_boundaries inputSchema/properties/path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class close_binary inputSchema/properties/snapshot_path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class binary_session inputSchema/properties/expected_server_path/allOf[1]/pattern /^(?:[\\/]|[A-Za-z]:[\\/])/v: Invalid character in character class ``` ### Typed outcome or recovery expected Not applicable: the catalog should be accepted. ### Analysis or suspected cause Source-derived: the Windows branch of the pattern was added in 3cf620661 (`fix(mcp): require absolute evidence bundle paths`). `advertisedPatternsVMode.test.ts` cannot catch it, for two reasons: - The general source suite runs on Linux in CI, where the schema advertises `^/`, and the Windows lane is curated (`docs/testing.md`). - The test builds the server with the default profile, which is compact, so patterns that only the full profile advertises are not checked on any host. Spelling the separators as hex escapes (`[\x5C\x2F]`), as `dexDescriptorSchema` does for parentheses, keeps the same matches and compiles in all three modes. I have a fix ready with a unit test that also runs on Linux, if that is welcome. ### Additional context With the full profile, the same scan also reports two failures that occur on every host, in the `capture_browser_scenario` request action (both added in #6946): - `path`: `^\/(?![/\\])`. It also uses a look-ahead, which the test's RE2/Rust rule excludes. - header `name`: ``^[!#$%&'*+.^_`|~0-9A-Za-z-]+$``. They are a separate defect, so I can report them in their own issue.

bsakaguchi closed this issue

2026-10-31 00:48:32 +00:00

bsakaguchi commented

2026-10-31 00:48:32 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 25, 2026):

Nice catch — the unescaped / inside the character class only slips through because Annex B tolerates it, and that's exactly the kind of thing v mode was designed to reject. Confirming the failure is realistic: any client compiling advertised patterns with v (or with u plus strict tooling) will break on Windows-only fields, so this is a correctness issue, not just a cosmetic one. The PR direction (portable pattern like a [\\\\/]-avoiding form or explicit escape) looks right; worth also scanning other advertised patterns for the same class of escaping mistakes before release.

@XinwangTao commented on GitHub (Oct 25, 2026): Nice catch — the unescaped `/` inside the character class only slips through because Annex B tolerates it, and that's exactly the kind of thing `v` mode was designed to reject. Confirming the failure is realistic: any client compiling advertised patterns with `v` (or with `u` plus strict tooling) will break on Windows-only fields, so this is a correctness issue, not just a cosmetic one. The PR direction (portable pattern like a `[\\\\/]`-avoiding form or explicit escape) looks right; worth also scanning other advertised patterns for the same class of escaping mistakes before release.

bsakaguchi commented

2026-10-31 00:48:32 +00:00

Author

Owner

@pablodiazjorge commented on GitHub (Oct 25, 2026):

Thanks. I ran that audit before opening #7152: it compiles every pattern the built server advertises over stdio on Windows, in Annex B, u and v modes, for both profiles. With the fix, the default compact catalog has no failures. The full profile still has two, both in capture_browser_scenario request actions from #6946 and independent of the host (see Additional context above). I've reported them separately in #7168.

@pablodiazjorge commented on GitHub (Oct 25, 2026): Thanks. I ran that audit before opening #7152: it compiles every pattern the built server advertises over stdio on Windows, in Annex B, `u` and `v` modes, for both profiles. With the fix, the default compact catalog has no failures. The full profile still has two, both in `capture_browser_scenario` request actions from #6946 and independent of the host (see Additional context above). I've reported them separately in #7168.

bsakaguchi referenced this issue

2026-10-31 01:12:19 +00:00

[PR #4287] [CLOSED] fix(native): keep undecoded swift-demangle echoes out of demangled status #6160

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4287

No description provided.

Rows
Columns