[PR #2440] [MERGED] fix(android): clean Windows workspaces after owner termination #5233

New issue

Closed

opened 2026-10-31 01:05:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2440
Author: @LcokHcak
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: codex/rea-windows-workspace

📝 Commits (5)

60688f6 fix(android): clean Windows workspaces after owner termination
f622809 fix(android): retain Windows workspace guardian on cleanup failure
92d5e8d fix(android): retain guardian cleanup through broken pipes and caller timeout
11a5b6f fix(android): preserve released guardian pipe state on cleanup retry
84b2300 fix(android): normalize extended local guardian parent paths

📊 Changes

13 files changed (+528 additions, -26 deletions)

View changed files

📝 .github/workflows/ci.yml (+1 -0)
📝 docs/android-analysis.md (+10 -6)
📝 native/windows/README.md (+8 -4)
📝 package.json (+1 -0)
📝 scripts/ci/scopes.mjs (+3 -0)
➕ scripts/rea-android-workspace-guardian.mjs (+46 -0)
📝 scripts/verify-windows-package.mjs (+2 -0)
📝 scripts/verify/android/analysis.mjs (+5 -0)
➕ scripts/verify/android/windows-guardian-isolation.mjs (+105 -0)
📝 scripts/verify/android/windows-lifecycle.mjs (+40 -4)
📝 src/android/JadxProvider.ts (+23 -12)
➕ src/android/JadxWorkspaceRoot.ts (+224 -0)
➕ tests/boundary/android/workspaceGuardianRetry.test.ts (+60 -0)

📄 Description

Summary

Clean REA-owned Android workspaces on Windows when the owner process terminates abruptly. A detached guardian retains the native workspace handle and removes that exact workspace after the owner exits.

Problem and expected behavior

In a controlled forced-owner-exit run, the native Job Object stopped Java, but the private JADX workspace remained on disk. It held only the public test APK and fixed bridge/JAR inputs in this reproduction. The intended lifecycle is to release that owned workspace even when ordinary in-process cleanup cannot run. No cross-user disclosure or other security impact has been demonstrated.

Change and scope

The guardian tracks the owner and workspace through native handles and is included in the Windows package. A failed native cleanup retains its identity lease, so the guardian keeps retrying instead of exiting after a fixed attempt count. The parent reports a bounded cleanup timeout. Real verification covers abrupt owner exit and isolation of two simultaneous owners. This changes only the existing Android provider's Windows workspace lifecycle. No issue is linked because the failure was reproduced by the controlled repository lifecycle lane.

Contract and boundary impact

Semantic owner and earliest changed stage: JadxWorkspaceRoot and JadxProvider own the private workspace and guardian lifecycle.
Contribution scope fit and linked maintainer decision: routine cleanup fix for an existing provider; separate advance scope decision is not applicable.
CLI and MCP/tool-catalog contract: no new tool or result contract.
Provider and platform compatibility: Windows-specific guardian; other platforms retain their existing lifecycle.
Evidence and provenance: guardian failure remains explicit and does not imply successful removal.
Authority and cleanup: guardian receives the exact native-owned workspace, never selects directories by name prefix.
Package impact: include scripts/rea-android-workspace-guardian.mjs; the Windows package verifier checks it and JadxWorkspaceRoot.

Known workflow effects: starts an additional local guardian process, reads the selected APK/JAR/bridge inputs, and writes then removes REA's private temporary workspace. No target APK code is executed or target service contacted.

Evidence and regression coverage

The base behavior left an owned directory after forced owner termination. The real Windows lane requires cli_abrupt_owner_exit_workspace_cleanup=true and guardian_two_owner_isolation=true, alongside cancel and disconnect cases. A controlled regression makes the guardian's native close fail 101 times before succeeding; it fails against the previous 100-attempt cap. The Android verifier writes its diagnostic report, then exits nonzero if abrupt-owner cleanup remains false. Owner and guardian both dying, or power loss, can still leave a directory; recovery would require persistent identity and native re-adoption. Name-prefix cleanup is intentionally excluded.

Observed cleanup and conditional impact are distinguished.
Native ownership identity and failure outcomes remain explicit.
Remaining double-death/power-loss gap is stated.

Validation performed

On the standalone Windows branch at 37b7550: npm run check and the complete real Android/JADX lifecycle lane passed. The report records cli_abrupt_owner_exit_workspace_cleanup=true and guardian_two_owner_isolation=true.
On the combined branch at 37b7550: npm run check, test discovery and the guardian retry regression passed. The complete real Android lane passed with both Windows cleanup fields true. npm run verify:package:windows returned ok=true, 187 tools. npm pack --dry-run --json included the guardian and compiled workspace module among 1508 files.
The branch was rebased without conflict onto 4773c15; npm run check passed on the combined branch at that base. The four intervening upstream commits did not change the guardian or Android lifecycle files.

Compatibility, safety, and release

Breaking changes or migration steps: none intended.
Real-provider coverage: Windows x64 with JDK 21/JADX 0.7.1/public ApiDemos. Linux/macOS and power-loss recovery were not verified.
Security/privacy: fixes resource lifetime for an owned temporary workspace; no confirmed vulnerability is claimed.

Before merge

Concrete reproduced problem and focused outcome.
Scope and authority reviewed against CONTRIBUTING.md.
No issue linked; controlled failure and expected behavior are described above.
Real cleanup and two-owner isolation paths covered.
Owning documentation and package files updated.
Diff checked for secrets, unrelated cleanup and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2440 **Author:** [@LcokHcak](https://github.com/LcokHcak) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/rea-windows-workspace` --- ### 📝 Commits (5) - [`60688f6`](https://github.com/morluto/rea/commit/60688f660e9e0b8d7688364e89389f73d35b8d26) fix(android): clean Windows workspaces after owner termination - [`f622809`](https://github.com/morluto/rea/commit/f6228094c3ce9080f2e8d855b5b9cbc2d7da2455) fix(android): retain Windows workspace guardian on cleanup failure - [`92d5e8d`](https://github.com/morluto/rea/commit/92d5e8dcfbfd6db680c19a383a86f639e26c5972) fix(android): retain guardian cleanup through broken pipes and caller timeout - [`11a5b6f`](https://github.com/morluto/rea/commit/11a5b6f3eed210bdee8133a6fb9a74d8128cb332) fix(android): preserve released guardian pipe state on cleanup retry - [`84b2300`](https://github.com/morluto/rea/commit/84b2300a45296b245f804382634702ace822e493) fix(android): normalize extended local guardian parent paths ### 📊 Changes **13 files changed** (+528 additions, -26 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+1 -0) 📝 `docs/android-analysis.md` (+10 -6) 📝 `native/windows/README.md` (+8 -4) 📝 `package.json` (+1 -0) 📝 `scripts/ci/scopes.mjs` (+3 -0) ➕ `scripts/rea-android-workspace-guardian.mjs` (+46 -0) 📝 `scripts/verify-windows-package.mjs` (+2 -0) 📝 `scripts/verify/android/analysis.mjs` (+5 -0) ➕ `scripts/verify/android/windows-guardian-isolation.mjs` (+105 -0) 📝 `scripts/verify/android/windows-lifecycle.mjs` (+40 -4) 📝 `src/android/JadxProvider.ts` (+23 -12) ➕ `src/android/JadxWorkspaceRoot.ts` (+224 -0) ➕ `tests/boundary/android/workspaceGuardianRetry.test.ts` (+60 -0) </details> ### 📄 Description ## Summary Clean REA-owned Android workspaces on Windows when the owner process terminates abruptly. A detached guardian retains the native workspace handle and removes that exact workspace after the owner exits. ## Problem and expected behavior In a controlled forced-owner-exit run, the native Job Object stopped Java, but the private JADX workspace remained on disk. It held only the public test APK and fixed bridge/JAR inputs in this reproduction. The intended lifecycle is to release that owned workspace even when ordinary in-process cleanup cannot run. No cross-user disclosure or other security impact has been demonstrated. ## Change and scope The guardian tracks the owner and workspace through native handles and is included in the Windows package. A failed native cleanup retains its identity lease, so the guardian keeps retrying instead of exiting after a fixed attempt count. The parent reports a bounded cleanup timeout. Real verification covers abrupt owner exit and isolation of two simultaneous owners. This changes only the existing Android provider's Windows workspace lifecycle. No issue is linked because the failure was reproduced by the controlled repository lifecycle lane. ## Contract and boundary impact - Semantic owner and earliest changed stage: `JadxWorkspaceRoot` and `JadxProvider` own the private workspace and guardian lifecycle. - Contribution scope fit and linked maintainer decision: routine cleanup fix for an existing provider; separate advance scope decision is not applicable. - CLI and MCP/tool-catalog contract: no new tool or result contract. - Provider and platform compatibility: Windows-specific guardian; other platforms retain their existing lifecycle. - Evidence and provenance: guardian failure remains explicit and does not imply successful removal. - Authority and cleanup: guardian receives the exact native-owned workspace, never selects directories by name prefix. - Package impact: include `scripts/rea-android-workspace-guardian.mjs`; the Windows package verifier checks it and `JadxWorkspaceRoot`. Known workflow effects: starts an additional local guardian process, reads the selected APK/JAR/bridge inputs, and writes then removes REA's private temporary workspace. No target APK code is executed or target service contacted. ## Evidence and regression coverage The base behavior left an owned directory after forced owner termination. The real Windows lane requires `cli_abrupt_owner_exit_workspace_cleanup=true` and `guardian_two_owner_isolation=true`, alongside cancel and disconnect cases. A controlled regression makes the guardian's native close fail 101 times before succeeding; it fails against the previous 100-attempt cap. The Android verifier writes its diagnostic report, then exits nonzero if abrupt-owner cleanup remains false. Owner and guardian both dying, or power loss, can still leave a directory; recovery would require persistent identity and native re-adoption. Name-prefix cleanup is intentionally excluded. - [x] Observed cleanup and conditional impact are distinguished. - [x] Native ownership identity and failure outcomes remain explicit. - [x] Remaining double-death/power-loss gap is stated. ## Validation performed - On the standalone Windows branch at `37b7550`: `npm run check` and the complete real Android/JADX lifecycle lane passed. The report records `cli_abrupt_owner_exit_workspace_cleanup=true` and `guardian_two_owner_isolation=true`. - On the combined branch at `37b7550`: `npm run check`, test discovery and the guardian retry regression passed. The complete real Android lane passed with both Windows cleanup fields true. `npm run verify:package:windows` returned `ok=true`, 187 tools. `npm pack --dry-run --json` included the guardian and compiled workspace module among 1508 files. - The branch was rebased without conflict onto `4773c15`; `npm run check` passed on the combined branch at that base. The four intervening upstream commits did not change the guardian or Android lifecycle files. ## Compatibility, safety, and release - Breaking changes or migration steps: none intended. - Real-provider coverage: Windows x64 with JDK 21/JADX 0.7.1/public ApiDemos. Linux/macOS and power-loss recovery were not verified. - Security/privacy: fixes resource lifetime for an owned temporary workspace; no confirmed vulnerability is claimed. ## Before merge - [x] Concrete reproduced problem and focused outcome. - [x] Scope and authority reviewed against `CONTRIBUTING.md`. - [x] No issue linked; controlled failure and expected behavior are described above. - [x] Real cleanup and two-owner isolation paths covered. - [x] Owning documentation and package files updated. - [x] Diff checked for secrets, unrelated cleanup and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:01 +00:00