[PR #4749] [MERGED] fix(verifiers): read packed bridge without extraction #6386

New issue

Closed

opened 2026-10-31 01:14:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:14:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4749
Author: @N0zoM1z0
Created: 10/17/2026
Status: ✅ Merged
Merged: 10/17/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/4134-packed-bridge-read-only-20261017

📝 Commits (3)

e13c308 fix(verifiers): parse packed bridge without extracting files
b80eab4 fix(verifiers): validate packed bridge member identity
03f2746 fix(ci): select package lanes for packed bridge verification

📊 Changes

9 files changed (+216 additions, -9 deletions)

View changed files

📝 .github/workflows/ci.yml (+1 -0)
📝 scripts/ci/scopes.mjs (+2 -0)
📝 scripts/verify-package-pack.mjs (+1 -1)
➕ scripts/verify-packed-bridge.d.mts (+5 -0)
📝 scripts/verify-packed-bridge.mjs (+13 -7)
📝 tests/boundary/filesystem/ciChangeScope.test.ts (+33 -0)
📝 tests/boundary/filesystem/ghidraBridgeSources.test.ts (+1 -1)
➕ tests/boundary/process/packedBridgeVerification.test.ts (+154 -0)
📝 tests/process-global/curatedWindowsLane.test.ts (+6 -0)

📄 Description

Summary

Fixes #4134. Packed-bridge verification extracts the entire archive into its caller's workspace. A retained Windows private-root lease prevents tar -C from opening that directory, so packaged-WASM verification fails before analysis. Read the exact regular Python member through Python's tarfile API and parse it without extraction, execution or releasing the caller's lease.

The initial fix preserves Abdooo2235's original commit and author. The follow-up rejects linked/directory members, removes the obsolete workspace parameter from every caller, adds the exact typed contract, and uses the canonical Ghidra source inventory in fixtures. Native-lease success/failure cases run in curated Windows CI, with shared package-scope ownership for the helper, declaration and test. Missing native authority fails rather than silently skipping coverage.

Scope: internal verification; CLI/MCP, Evidence, target execution and native sharing/delete policies are unchanged. A new maintainer scope decision is not applicable. Other package reads use stdout or owned child directories; no alternate extraction root or permission relaxation is needed.

Executed validation

Pinned main 2092f90b7e: three real tar/Python workspace-mutation assertions fail for the intended extraction behavior. The original Windows sharing failure is recorded in #4134.
263/263 focused checks passed: 224 CI selection/ownership, 20 packed bridge, 12 Ghidra bridge and seven Windows lane checks. Coverage includes real archives, required/missing members, Unicode/non-execution, syntax errors, malformed/linked/non-file members, archive preservation and owned-root cleanup after success/failure.
Official SHA-256-verified WABT 1.0.42: complete npm run verify:wasm:package 42/42 passed, including real pack/install and CLI/MCP analysis; no verifier descendants remained. 162.76 s wall / 128.34 s reaped CPU / 1.73 GiB sampled family RSS. Scope-only follow-up leaves verifier/runtime bytes unchanged.
Complete npm run check:ci, pre-push check:fast, actionlint 1.7.12 and git diff --check passed; latest full static peak 4.69 GiB.
Current-head CI 39024661913: real Windows native-lease file 20/20 passed, zero skipped, plus full Windows package, Linux x64/arm64 and macOS arm64 package, Apple E2E and all eight Linux real-system workflows. Exact-head Greptile review found no actionable issues; no unresolved threads. Remaining gate results are available in the linked run. Automatic Codex review was unavailable because repository review credits were exhausted.

The initial CI run caught this PR's missing shared package-scope registration for the newly listed Windows test. The follow-up fixes the producing registry and adds three actual changed-path cases, retaining the original ownership assertion. That previously failing shard now passes; the failed record is retained.

Performance and limits

Four alternating process-fresh baseline/fixed/fixed/baseline tasks used one real 1,738-member / 5,868,425-byte package, including listing, verification and cleanup. Warm-filesystem medians: 0.731 → 0.692 s wall, 0.879 → 0.746 s CPU, peak sampled family RSS 89.9 → 88.1 MiB. Wall samples overlap; no broad speedup is claimed. The fixed task leaves no extracted files. Archive SHA-256: 832d4a89ea64acf4b3d83d56505de8e73f594a5eaaff8eea359b4cb1cf6e71fc.

Local jobs ran serially on two CPUs with a 3 GiB default Node heap. RSS sampling: 50 ms for the short benchmark, 200 ms otherwise; shared pages can be double-counted and peaks missed. CPU excludes unreaped descendants. Machine-cold, Windows performance and agent token costs are unmeasured. The complete ordinary-user Windows packaged-WASM workflow was not rerun on this branch; current hosted native cases verify the changed lease boundary. Hopper/Ghidra engine runtime coverage is unverified here.

Author readiness

Human owner: @N0zoM1z0. These declarations are transcribed under the owner's explicit standing instruction on 2026-10-17: “後續審閱，承擔，聲明都同意！不用問我了”. This records that direction, rather than a separate agent assertion that a new human-review event occurred.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4749 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/17/2026 **Status:** ✅ Merged **Merged:** 10/17/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/4134-packed-bridge-read-only-20261017` --- ### 📝 Commits (3) - [`e13c308`](https://github.com/morluto/rea/commit/e13c3087ff6aec498cbc519cbb60581ae46c577a) fix(verifiers): parse packed bridge without extracting files - [`b80eab4`](https://github.com/morluto/rea/commit/b80eab46996f8acf0d28f986a3f612390627558a) fix(verifiers): validate packed bridge member identity - [`03f2746`](https://github.com/morluto/rea/commit/03f27461942bac8ee0b2ede07c265abc9cf75e6d) fix(ci): select package lanes for packed bridge verification ### 📊 Changes **9 files changed** (+216 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+1 -0) 📝 `scripts/ci/scopes.mjs` (+2 -0) 📝 `scripts/verify-package-pack.mjs` (+1 -1) ➕ `scripts/verify-packed-bridge.d.mts` (+5 -0) 📝 `scripts/verify-packed-bridge.mjs` (+13 -7) 📝 `tests/boundary/filesystem/ciChangeScope.test.ts` (+33 -0) 📝 `tests/boundary/filesystem/ghidraBridgeSources.test.ts` (+1 -1) ➕ `tests/boundary/process/packedBridgeVerification.test.ts` (+154 -0) 📝 `tests/process-global/curatedWindowsLane.test.ts` (+6 -0) </details> ### 📄 Description ## Summary Fixes #4134. Packed-bridge verification extracts the entire archive into its caller's workspace. A retained Windows private-root lease prevents `tar -C` from opening that directory, so packaged-WASM verification fails before analysis. Read the exact regular Python member through Python's `tarfile` API and parse it without extraction, execution or releasing the caller's lease. The initial fix preserves [Abdooo2235's original commit and author](https://github.com/Abdooo2235/rea/commit/e30ce8bd85804f01b6cb37bb4b4bc42beb5692cd). The follow-up rejects linked/directory members, removes the obsolete workspace parameter from every caller, adds the exact typed contract, and uses the canonical Ghidra source inventory in fixtures. Native-lease success/failure cases run in curated Windows CI, with shared package-scope ownership for the helper, declaration and test. Missing native authority fails rather than silently skipping coverage. Scope: internal verification; CLI/MCP, Evidence, target execution and native sharing/delete policies are unchanged. A new maintainer scope decision is not applicable. Other package reads use stdout or owned child directories; no alternate extraction root or permission relaxation is needed. ## Executed validation - Pinned main `2092f90b7e`: three real tar/Python workspace-mutation assertions fail for the intended extraction behavior. The original Windows sharing failure is recorded in #4134. - **263/263 focused checks** passed: 224 CI selection/ownership, 20 packed bridge, 12 Ghidra bridge and seven Windows lane checks. Coverage includes real archives, required/missing members, Unicode/non-execution, syntax errors, malformed/linked/non-file members, archive preservation and owned-root cleanup after success/failure. - Official SHA-256-verified **WABT 1.0.42**: complete `npm run verify:wasm:package` **42/42 passed**, including real pack/install and CLI/MCP analysis; no verifier descendants remained. **162.76 s wall / 128.34 s reaped CPU / 1.73 GiB sampled family RSS**. Scope-only follow-up leaves verifier/runtime bytes unchanged. - Complete `npm run check:ci`, pre-push `check:fast`, `actionlint` 1.7.12 and `git diff --check` passed; latest full static peak **4.69 GiB**. - [Current-head CI 39024661913](https://github.com/morluto/rea/actions/runs/39024661913): real Windows native-lease file **20/20 passed, zero skipped**, plus full Windows package, Linux x64/arm64 and macOS arm64 package, Apple E2E and all eight Linux real-system workflows. Exact-head Greptile review found no actionable issues; no unresolved threads. Remaining gate results are available in the linked run. Automatic Codex review was unavailable because repository review credits were exhausted. The [initial CI run](https://github.com/morluto/rea/actions/runs/39023372104) caught this PR's missing shared package-scope registration for the newly listed Windows test. The follow-up fixes the producing registry and adds three actual changed-path cases, retaining the original ownership assertion. That previously failing shard now passes; the failed record is retained. ## Performance and limits Four alternating process-fresh baseline/fixed/fixed/baseline tasks used one real **1,738-member / 5,868,425-byte** package, including listing, verification and cleanup. Warm-filesystem medians: **0.731 → 0.692 s wall**, **0.879 → 0.746 s CPU**, peak sampled family RSS **89.9 → 88.1 MiB**. Wall samples overlap; no broad speedup is claimed. The fixed task leaves no extracted files. Archive SHA-256: `832d4a89ea64acf4b3d83d56505de8e73f594a5eaaff8eea359b4cb1cf6e71fc`. Local jobs ran serially on two CPUs with a 3 GiB default Node heap. RSS sampling: 50 ms for the short benchmark, 200 ms otherwise; shared pages can be double-counted and peaks missed. CPU excludes unreaped descendants. Machine-cold, Windows performance and agent token costs are unmeasured. The complete ordinary-user Windows packaged-WASM workflow was not rerun on this branch; current hosted native cases verify the changed lease boundary. Hopper/Ghidra engine runtime coverage is unverified here. ## Author readiness Human owner: @N0zoM1z0. These declarations are transcribed under the owner's explicit standing instruction on 2026-10-17: “後續審閱，承擔，聲明都同意！不用問我了”. This records that direction, rather than a separate agent assertion that a new human-review event occurred. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:14:05 +00:00