[PR #5577] [MERGED] fix(desktop): classify rejected desktop roots as target failures #6975

Closed
opened 2026-11-01 21:44:26 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5577
Author: @kaoru0822-kitauji
Created: 10/20/2026
Status: ✅ Merged
Merged: 10/21/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/desktop-target-error-classes


📝 Commits (2)

  • abffa40 fix(desktop): classify rejected desktop roots as target failures
  • dfc41a0 Merge remote-tracking branch 'origin/main' into fix/desktop-target-error-classes

📊 Changes

4 files changed (+125 additions, -9 deletions)

View changed files

📝 src/artifacts/ArtifactOperationFailure.ts (+5 -3)
📝 src/artifacts/DesktopApplicationReader.ts (+39 -1)
📝 src/artifacts/DirectoryArtifactReader.ts (+23 -4)
📝 tests/boundary/cli/desktopApplicationCli.test.ts (+58 -1)

📄 Description

What broke: desktop inspection reported a non-directory, missing or unreadable selected root as an execution/I-O failure (#5513).
Fix: the selected-root failure is classified once in DesktopApplicationReader (non-directory → unsupported_target, host failures → target unavailable/access denied), and BinaryTargetError keeps its typed classification through the artifact failure mapper.
Risk: low; error codes change only for selected-root failures; nested-entry I/O failures keep their previous code.

Summary

Fixes #5513.

rea inspect-desktop-application reported a regular-file root, a missing root and a read-denied (mode 000) root all as artifact_operation_failed / execution_failure. The ENOTDIR, ENOENT or EACCES cause showed up only in the message text. With this change, root selection failures get typed classifications. A regular file is unsupported_target. A missing root is target_unavailable. A read-denied root is access_denied / unavailable with read-access remediation, system_code and boundary: filesystem-read. These match the classifications inspect-artifact already gives for missing and denied targets.

Problem and expected behavior

DirectoryArtifactReader raised root-admission and root-open failures as plain ArtifactReaderFailure("path" | "io"). Consumers could not tell these apart from child-entry I/O, so translateArtifactFailure turned them into a generic ArtifactOperationError. Callers had to parse nested diagnostics to choose a recovery.

Change and scope

  • DirectoryArtifactReader (the code that produces these failures) now marks root failures with a DirectoryArtifactRootFailure subclass. This covers a root that is not a directory, failures resolving the root, and a failed opendir of the canonical root. The subclass still extends ArtifactReaderFailure, so other consumers see the same behavior as before.
  • DesktopApplicationReader owns the caller's path selection, and it is where these failures are classified:
    • a non-directory root becomes AnalysisUnsupportedTargetError with installation-directory remediation;
    • a host failure becomes the shared domain BinaryTargetError, which derives target_unavailable vs access_denied from the errno.
    • Any retained partial observation is kept.
  • translateArtifactFailure now passes an already-typed BinaryTargetError through unchanged instead of collapsing it to io.
  • Not included: classification for other DirectoryArtifactReader consumers (inventory, Apple bundle readers, apktool, etc.), and unreadable child entries (#5229/#5230).
  • Scope: an ordinary fix within existing boundaries, so no maintainer scope decision is needed.

Contract and boundary impact

  • Semantic owner and earliest changed stage: DirectoryArtifactReader root admission/open (it produces the failure); DesktopApplicationReader classifies it.

  • Contribution scope fit and linked maintainer decision: existing read-only lane; not applicable.

  • CLI and MCP/tool-catalog contract: same error codes, now chosen per failure. No schema change.

  • Provider, bridge, target-format, or platform compatibility: none.

  • Evidence, artifact, provenance, or reconstruction contract: the partial observation on a denied root is still retained.

  • Target selection, authority, upstream behavior, and cleanup details: no change to traversal or cleanup.

  • Generated metadata, package, or installation impact: none.

  • Read existing files or captured data.

Evidence and regression coverage

  • Tests added or updated: tests/boundary/cli/desktopApplicationCli.test.ts adds two public-CLI tests. One covers a regular file (unsupported_target) and a missing root (target_unavailable). The other covers a mode-000 root (access_denied / unavailable, read-access remediation, system_code: EACCES, partial_observation retained); it is skipped on Windows or when running as root.
  • Base reproduction: with the src/ changes reverted and the new tests kept, both new tests fail and receive code: "artifact_operation_failed".
  • Remaining proof gaps: MCP reaches the same service, but that path was not exercised with these specific inputs. No Windows ACL or EPERM run.

Validation performed

  • npm run test:focused -- tests/boundary/cli/desktopApplicationCli.test.ts with the source fix reverted: 2 failed, 1 passed (as expected).
  • npm run test:focused -- tests/boundary/cli/desktopApplicationCli.test.ts tests/boundary/filesystem/desktopApplication.test.ts tests/boundary/mcp/desktopApplicationMcp.test.ts tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts tests/boundary/filesystem/directoryArtifactReaderOwnership.test.ts tests/boundary/providers/native/artifactProvider.directoryErrors.test.ts tests/evaluation/moduleBoundaries.test.ts tests/boundary/filesystem/keyedArchiveSelection.test.ts: 8 files passed, 206 tests passed, 1 skipped (macOS arm64, non-root).
  • npm run check:fast: typecheck and lint passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. These three root failures now carry more specific codes than artifact_operation_failed.
  • Real Hopper/Ghidra, browser, or OS coverage: macOS only; no provider involved.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new reads. Paths are reported the same way as before.

Author readiness

Human owner: @kaoru0822-kitauji

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5577 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/20/2026 **Status:** ✅ Merged **Merged:** 10/21/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/desktop-target-error-classes` --- ### 📝 Commits (2) - [`abffa40`](https://github.com/morluto/rea/commit/abffa4043fb0d2cf48715f9ce381adabf1cc6c36) fix(desktop): classify rejected desktop roots as target failures - [`dfc41a0`](https://github.com/morluto/rea/commit/dfc41a0ee6de1e3f104bf8eecf5fd955d06c4cd3) Merge remote-tracking branch 'origin/main' into fix/desktop-target-error-classes ### 📊 Changes **4 files changed** (+125 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `src/artifacts/ArtifactOperationFailure.ts` (+5 -3) 📝 `src/artifacts/DesktopApplicationReader.ts` (+39 -1) 📝 `src/artifacts/DirectoryArtifactReader.ts` (+23 -4) 📝 `tests/boundary/cli/desktopApplicationCli.test.ts` (+58 -1) </details> ### 📄 Description **What broke:** desktop inspection reported a non-directory, missing or unreadable selected root as an execution/I-O failure (#5513). **Fix:** the selected-root failure is classified once in `DesktopApplicationReader` (non-directory → `unsupported_target`, host failures → target unavailable/access denied), and `BinaryTargetError` keeps its typed classification through the artifact failure mapper. **Risk:** low; error codes change only for selected-root failures; nested-entry I/O failures keep their previous code. ## Summary Fixes #5513. `rea inspect-desktop-application` reported a regular-file root, a missing root and a read-denied (mode `000`) root all as `artifact_operation_failed` / `execution_failure`. The ENOTDIR, ENOENT or EACCES cause showed up only in the message text. With this change, root selection failures get typed classifications. A regular file is `unsupported_target`. A missing root is `target_unavailable`. A read-denied root is `access_denied` / `unavailable` with read-access remediation, `system_code` and `boundary: filesystem-read`. These match the classifications `inspect-artifact` already gives for missing and denied targets. ## Problem and expected behavior `DirectoryArtifactReader` raised root-admission and root-open failures as plain `ArtifactReaderFailure("path" | "io")`. Consumers could not tell these apart from child-entry I/O, so `translateArtifactFailure` turned them into a generic `ArtifactOperationError`. Callers had to parse nested diagnostics to choose a recovery. ## Change and scope - `DirectoryArtifactReader` (the code that produces these failures) now marks root failures with a `DirectoryArtifactRootFailure` subclass. This covers a root that is not a directory, failures resolving the root, and a failed `opendir` of the canonical root. The subclass still extends `ArtifactReaderFailure`, so other consumers see the same behavior as before. - `DesktopApplicationReader` owns the caller's `path` selection, and it is where these failures are classified: - a non-directory root becomes `AnalysisUnsupportedTargetError` with installation-directory remediation; - a host failure becomes the shared domain `BinaryTargetError`, which derives `target_unavailable` vs `access_denied` from the errno. - Any retained partial observation is kept. - `translateArtifactFailure` now passes an already-typed `BinaryTargetError` through unchanged instead of collapsing it to `io`. - Not included: classification for other `DirectoryArtifactReader` consumers (inventory, Apple bundle readers, apktool, etc.), and unreadable child entries (#5229/#5230). - Scope: an ordinary fix within existing boundaries, so no maintainer scope decision is needed. ## Contract and boundary impact - Semantic owner and earliest changed stage: `DirectoryArtifactReader` root admission/open (it produces the failure); `DesktopApplicationReader` classifies it. - Contribution scope fit and linked maintainer decision: existing read-only lane; not applicable. - CLI and MCP/tool-catalog contract: same error codes, now chosen per failure. No schema change. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: the partial observation on a denied root is still retained. - Target selection, authority, upstream behavior, and cleanup details: no change to traversal or cleanup. - Generated metadata, package, or installation impact: none. - [x] Read existing files or captured data. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/cli/desktopApplicationCli.test.ts` adds two public-CLI tests. One covers a regular file (`unsupported_target`) and a missing root (`target_unavailable`). The other covers a mode-`000` root (`access_denied` / `unavailable`, read-access remediation, `system_code: EACCES`, `partial_observation` retained); it is skipped on Windows or when running as root. - Base reproduction: with the `src/` changes reverted and the new tests kept, both new tests fail and receive `code: "artifact_operation_failed"`. - Remaining proof gaps: MCP reaches the same service, but that path was not exercised with these specific inputs. No Windows ACL or EPERM run. ## Validation performed - `npm run test:focused -- tests/boundary/cli/desktopApplicationCli.test.ts` with the source fix reverted: 2 failed, 1 passed (as expected). - `npm run test:focused -- tests/boundary/cli/desktopApplicationCli.test.ts tests/boundary/filesystem/desktopApplication.test.ts tests/boundary/mcp/desktopApplicationMcp.test.ts tests/boundary/filesystem/directoryArtifactReaderOpen.test.ts tests/boundary/filesystem/directoryArtifactReaderOwnership.test.ts tests/boundary/providers/native/artifactProvider.directoryErrors.test.ts tests/evaluation/moduleBoundaries.test.ts tests/boundary/filesystem/keyedArchiveSelection.test.ts`: 8 files passed, 206 tests passed, 1 skipped (macOS arm64, non-root). - `npm run check:fast`: typecheck and lint passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. These three root failures now carry more specific codes than `artifact_operation_failed`. - Real Hopper/Ghidra, browser, or OS coverage: macOS only; no provider involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new reads. Paths are reported the same way as before. ## Author readiness Human owner: @kaoru0822-kitauji - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:44:26 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6975
No description provided.