[PR #3561] [CLOSED] fix(evidence): preserve filesystem-selected JSON paths #5825

New issue

Closed

opened 2026-10-31 01:09:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:09:42 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3561
Author: @shoyann
Created: 10/14/2026
Status: ❌ Closed

Base: main ← Head: fix/evidence-selected-path

📝 Commits (5)

641a6dc fix(evidence): preserve filesystem-selected JSON paths
9d69beb Merge remote-tracking branch 'origin/main' into fix/evidence-selected-path
b0da7c5 fix(evidence): reuse shared caller path selection
bea3099 chore: sync main into evidence path fix
02f3cb7 chore: sync main into evidence path fix

📊 Changes

5 files changed (+184 additions, -11 deletions)

View changed files

📝 src/application/EvidenceBundleFiles.ts (+2 -3)
📝 src/application/JsonFiles.ts (+14 -5)
📝 tests/boundary/cli/evidenceBundleCommands.test.ts (+96 -2)
📝 tests/boundary/filesystem/analysisSnapshotInput.test.ts (+27 -1)
📝 tests/boundary/filesystem/evidenceBundleFiles.test.ts (+45 -0)

📄 Description

Summary

Fix Evidence/JSON reads and atomic exports selecting the wrong file when a POSIX path contains a directory symlink followed by ... With alias -> actual/child, alias/../source.json selects actual/source.json; lexical normalization instead selected the unrelated sibling, which evidence-export --overwrite could replace.

This completes the JSON/Evidence scope left out of merged #4067. Reads, writes, and wrong-kind diagnostics use the shared absoluteCallerPath owner. Writes preserve directory requirements, canonicalize the selected parent, and retain atomic publication, overwrite refusal, leaf-symlink refusal, and cleanup behavior. Snapshot readers inherit the correction. CLI/MCP schemas are unchanged.

Verification

Validated commit 02f3cb7d0f90614a4e3a4ff3a525ccef5493a193 after merging main b83b9caf4a5f0241a5fd370792f1aed1bffbb2cf, on Ubuntu/WSL with Node 24.18.0 and npm 11.16.0:

npm ci — passed.
npm run test:focused -- tests/boundary/cli/evidenceBundleCommands.test.ts tests/boundary/filesystem/evidenceBundleFiles.test.ts tests/boundary/filesystem/analysisSnapshotInput.test.ts tests/boundary/filesystem/jsonFileResourceOwnership.test.ts tests/boundary/filesystem/jsonOutputOwnership.test.ts tests/boundary/filesystem/jsonUtf8Input.test.ts tests/boundary/filesystem/analysisSnapshot.test.ts tests/boundary/filesystem/callerPath.test.ts — 8 files, 75 tests passed.
npm run check — passed, including formatting, typecheck, lint/module boundaries, unused-code checks, metadata, and architecture guards.
npm run docs:check — passed, including all 5 README consistency tests.
git diff --check — passed. The sync retains the same five-file PR diff.

Coverage includes public CLI import/export through absolute and relative symlink-parent paths, refusal without overwrite, replacement, creation, selected-path diagnostics, preservation of unrelated siblings, missing components, directory suffixes, resource ownership, and native/streamed snapshot reads.

The full test suite and live providers were not run locally. Native Windows/macOS execution was not tested; the shared helper's win32 case ran on Linux. Windows continues to use the shared owner's existing win32.resolve behavior.

Author readiness

Human owner: @shoyann

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3561 **Author:** [@shoyann](https://github.com/shoyann) **Created:** 10/14/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/evidence-selected-path` --- ### 📝 Commits (5) - [`641a6dc`](https://github.com/morluto/rea/commit/641a6dc356af30443f644652cc27d158e8f2abdf) fix(evidence): preserve filesystem-selected JSON paths - [`9d69beb`](https://github.com/morluto/rea/commit/9d69beb25a2e61ea3f49d2aef7d29ed398c779cd) Merge remote-tracking branch 'origin/main' into fix/evidence-selected-path - [`b0da7c5`](https://github.com/morluto/rea/commit/b0da7c5c8fece492e3a2e29dd2e2e80ee3041ce3) fix(evidence): reuse shared caller path selection - [`bea3099`](https://github.com/morluto/rea/commit/bea309943118a23ec92d68a85339599c298691de) chore: sync main into evidence path fix - [`02f3cb7`](https://github.com/morluto/rea/commit/02f3cb7d0f90614a4e3a4ff3a525ccef5493a193) chore: sync main into evidence path fix ### 📊 Changes **5 files changed** (+184 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `src/application/EvidenceBundleFiles.ts` (+2 -3) 📝 `src/application/JsonFiles.ts` (+14 -5) 📝 `tests/boundary/cli/evidenceBundleCommands.test.ts` (+96 -2) 📝 `tests/boundary/filesystem/analysisSnapshotInput.test.ts` (+27 -1) 📝 `tests/boundary/filesystem/evidenceBundleFiles.test.ts` (+45 -0) </details> ### 📄 Description ## Summary Fix Evidence/JSON reads and atomic exports selecting the wrong file when a POSIX path contains a directory symlink followed by `..`. With `alias -> actual/child`, `alias/../source.json` selects `actual/source.json`; lexical normalization instead selected the unrelated sibling, which `evidence-export --overwrite` could replace. This completes the JSON/Evidence scope left out of merged #4067. Reads, writes, and wrong-kind diagnostics use the shared `absoluteCallerPath` owner. Writes preserve directory requirements, canonicalize the selected parent, and retain atomic publication, overwrite refusal, leaf-symlink refusal, and cleanup behavior. Snapshot readers inherit the correction. CLI/MCP schemas are unchanged. ## Verification Validated commit `02f3cb7d0f90614a4e3a4ff3a525ccef5493a193` after merging main `b83b9caf4a5f0241a5fd370792f1aed1bffbb2cf`, on Ubuntu/WSL with Node 24.18.0 and npm 11.16.0: - `npm ci` — passed. - `npm run test:focused -- tests/boundary/cli/evidenceBundleCommands.test.ts tests/boundary/filesystem/evidenceBundleFiles.test.ts tests/boundary/filesystem/analysisSnapshotInput.test.ts tests/boundary/filesystem/jsonFileResourceOwnership.test.ts tests/boundary/filesystem/jsonOutputOwnership.test.ts tests/boundary/filesystem/jsonUtf8Input.test.ts tests/boundary/filesystem/analysisSnapshot.test.ts tests/boundary/filesystem/callerPath.test.ts` — **8 files, 75 tests passed**. - `npm run check` — passed, including formatting, typecheck, lint/module boundaries, unused-code checks, metadata, and architecture guards. - `npm run docs:check` — passed, including all 5 README consistency tests. - `git diff --check` — passed. The sync retains the same five-file PR diff. Coverage includes public CLI import/export through absolute and relative symlink-parent paths, refusal without overwrite, replacement, creation, selected-path diagnostics, preservation of unrelated siblings, missing components, directory suffixes, resource ownership, and native/streamed snapshot reads. The full test suite and live providers were not run locally. Native Windows/macOS execution was not tested; the shared helper's win32 case ran on Linux. Windows continues to use the shared owner's existing `win32.resolve` behavior. ## Author readiness Human owner: @shoyann - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:09:42 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5825

No description provided.

Rows
Columns