morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7230] [MERGED] fix(deps): upgrade zod without narrowing timestamp inputs #7730

New issue

Closed

opened 2026-11-03 13:39:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:39:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7230
Author: @gensokyo-dev
Created: 10/26/2026
Status: ✅ Merged
Merged: 10/26/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix/7173-zod-validation

📝 Commits (4)

9a364b3 fix(deps): upgrade zod without narrowing timestamp inputs
712bd39 chore(contracts): refresh generated nullable schema spelling
22a2bdf test(cli): derive oversized stdin from the child heap capacity
2991130 fix(verification): preserve admitted completion timestamps

📊 Changes

22 files changed (+205 additions, -87 deletions)

View changed files

📝 docs/error-contract.schema.json (+2 -6)
📝 licenses/npm-dependencies.txt (+4 -4)
📝 licenses/npm-runtime-notices.txt (+4 -4)
📝 package-lock.json (+4 -4)
📝 package.json (+1 -1)
📝 scripts/lib/completion-ledger-generation.mts (+3 -2)
📝 src/contracts/toolOutputSchemaPrimitives.ts (+3 -2)
📝 src/domain/browserObservationSchemas.ts (+5 -4)
📝 src/domain/browserScenarioCaptureValues.ts (+3 -4)
📝 src/domain/browserSession.ts (+3 -2)
📝 src/domain/javascript/electronObservation.ts (+3 -2)
📝 src/domain/offsetDateTime.test.ts (+28 -30)
📝 src/domain/offsetDateTime.ts (+17 -12)
📝 src/domain/process/processCapture.ts (+3 -2)
📝 src/domain/webEventListeners.ts (+2 -1)
📝 src/domain/webExecution.ts (+3 -2)
📝 src/domain/webScreenshot.ts (+2 -1)
📝 src/kuna/KunaProjectCache.ts (+2 -1)
📝 tests/boundary/cli/cliJsonStdinCli.test.ts (+27 -2)
📝 tests/conformance/completionLedgerGeneration.test.ts (+37 -0)

...and 2 more files

📄 Description

Summary

Fixes #7173. Upgrade Zod to 4.6.6 with the dependency/license changes from #7184 (credited to @tijo95), while preserving REA's existing timestamp inputs.

The original upgrade's CI exposed a real compatibility change: Zod 4.6.6 rejects 2026-10-09T04:00Z. REA previously admitted that value, including in recorded screenshot/capture contracts. Define UTC and offset timestamps in their shared domain owner, preserve optional seconds and exact fractional spelling, and reuse that owner throughout the affected contracts. Replace the dependency-version-dependent test oracle with explicit accepted/rejected cases and actual advertised-schema checks. Refresh the generated nullable-schema spelling.

No provider execution/mutation capability is added. CLI and MCP consume the same contracts; complete Evidence remains available.

Validation

Original upgrade: reproduced the failing offset datetime test and the screenshot timestamp rejection locally; original PR CI source-test failure is recorded in run 40251160223.
Final source/contract selection: 226 tests passed, plus the related browser/process selection (163 tests, overlapping timestamp coverage).
Completion-ledger follow-up: both lineage states failed on minute-precision UTC before migration to the same owner; 15 completion tests pass afterward (119 in the selected timestamp/completion set). A full REA-owned source search finds no remaining .datetime() producers.
npm run check:fast, pre-push typecheck/lint, and npm run docs:check: passed.
npm run licenses:check and npm pack --dry-run --json: passed.
Final npm run verify:package: passed, including packaged CLI/MCP/setup/update/Evidence paths and verified empty final lineage (302.7 s wall, 290.2 s CPU, sampled family RSS 1.24 GiB; two CPUs). The earlier final-tree attempt stopped at its 360 s outer guard and is retained as incomplete; the isolated finalization profile passed 10/10 before the serial rerun.
Real npm picocolors module on the final runtime: CLI and stdio MCP both analyze four JS files, zero parse failures, matching statistics and artifact digest 9f128e80…6942. Fresh-process CLI: 7.1 s wall / 8.5 s CPU / 494 MiB sampled family RSS; MCP including discovery: 30.9 s / 35.2 s CPU / 1.31 GiB. Runtime/OS cache state is uncontrolled; these are observations, not a before/after application benchmark. Complete replies are retained locally; no model-token reduction is claimed.

A bounded 20,000-element invalid collection probe produced 20,001 issues on 4.4.3 and one too_big issue on 4.6.6. Single cold parse: 65.43 -> 0.92 ms; command wall time 0.346 -> 0.237 s, CPU 0.247 -> 0.134 s, sampled RSS 76.2 -> 60.4 MiB. These are one small paired observation, not an application-wide speedup. Work ran on two CPUs with process-family memory guards. Model token usage was not measured.

Limits: full npm run check was stopped at its 300 s guard during typed lint (not a pass; peak sampled group RSS 6.8 GiB). No real Hopper/Ghidra/IDA or native macOS/Windows provider run is claimed. The fixed-size heap-headroom fixture was invalidated by lower startup allocation after the upgrade (main rejects it 3/3; upgraded runtime fits it 3/3). The stdin fixture now reports the child heap capacity; the test derives a payload that exceeds that capacity using the production expansion estimator, retaining cancellation, malformed-input and resource-error checks. All 11 public CLI cases pass both with the upgrade and against unchanged main production code using the same revised tests.

Author readiness

Human owner: @gensokyo-dev

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Independent CI baseline

The SQLite Node 22 descriptor-cleanup failures also occur on exact base e54bf1006, main run 40307610780, job 121521635983. They are outside this dependency/timestamp fix. The pcapWorkspaceAllocation ENOTDIR assertion also fails on that same base (job 121521508991), matching the first PR run (job 121547176291). These independent failures are not modified here.

Current head 2991130: source tests, static checks, docs and automated review pass. In run 40318200837, the five SQLite Node 22 failures and the pcap ENOTDIR failure exactly match the pinned main failure names. The pcap failure triggers fail-fast; cancelled boundary shards are unverified, not passes.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7230 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 10/26/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix/7173-zod-validation` --- ### 📝 Commits (4) - [`9a364b3`](https://github.com/morluto/rea/commit/9a364b37ac907d1f5e0279d2bdc0b2894c2b32a0) fix(deps): upgrade zod without narrowing timestamp inputs - [`712bd39`](https://github.com/morluto/rea/commit/712bd39cb064d1512d6bdb5be000f1fcc03273b8) chore(contracts): refresh generated nullable schema spelling - [`22a2bdf`](https://github.com/morluto/rea/commit/22a2bdf5782428652675c4d8a5786de80ba3669f) test(cli): derive oversized stdin from the child heap capacity - [`2991130`](https://github.com/morluto/rea/commit/2991130c079a22ac8b552b7e72db4df18488de07) fix(verification): preserve admitted completion timestamps ### 📊 Changes **22 files changed** (+205 additions, -87 deletions) <details> <summary>View changed files</summary> 📝 `docs/error-contract.schema.json` (+2 -6) 📝 `licenses/npm-dependencies.txt` (+4 -4) 📝 `licenses/npm-runtime-notices.txt` (+4 -4) 📝 `package-lock.json` (+4 -4) 📝 `package.json` (+1 -1) 📝 `scripts/lib/completion-ledger-generation.mts` (+3 -2) 📝 `src/contracts/toolOutputSchemaPrimitives.ts` (+3 -2) 📝 `src/domain/browserObservationSchemas.ts` (+5 -4) 📝 `src/domain/browserScenarioCaptureValues.ts` (+3 -4) 📝 `src/domain/browserSession.ts` (+3 -2) 📝 `src/domain/javascript/electronObservation.ts` (+3 -2) 📝 `src/domain/offsetDateTime.test.ts` (+28 -30) 📝 `src/domain/offsetDateTime.ts` (+17 -12) 📝 `src/domain/process/processCapture.ts` (+3 -2) 📝 `src/domain/webEventListeners.ts` (+2 -1) 📝 `src/domain/webExecution.ts` (+3 -2) 📝 `src/domain/webScreenshot.ts` (+2 -1) 📝 `src/kuna/KunaProjectCache.ts` (+2 -1) 📝 `tests/boundary/cli/cliJsonStdinCli.test.ts` (+27 -2) 📝 `tests/conformance/completionLedgerGeneration.test.ts` (+37 -0) _...and 2 more files_ </details> ### 📄 Description ## Summary Fixes #7173. Upgrade Zod to 4.6.6 with the dependency/license changes from #7184 (credited to @tijo95), while preserving REA's existing timestamp inputs. The original upgrade's CI exposed a real compatibility change: Zod 4.6.6 rejects `2026-10-09T04:00Z`. REA previously admitted that value, including in recorded screenshot/capture contracts. Define UTC and offset timestamps in their shared domain owner, preserve optional seconds and exact fractional spelling, and reuse that owner throughout the affected contracts. Replace the dependency-version-dependent test oracle with explicit accepted/rejected cases and actual advertised-schema checks. Refresh the generated nullable-schema spelling. No provider execution/mutation capability is added. CLI and MCP consume the same contracts; complete Evidence remains available. ## Validation - Original upgrade: reproduced the failing offset datetime test and the screenshot timestamp rejection locally; original PR CI source-test failure is recorded in [run 40251160223](https://github.com/morluto/rea/actions/runs/40251160223). - Final source/contract selection: 226 tests passed, plus the related browser/process selection (163 tests, overlapping timestamp coverage). - Completion-ledger follow-up: both lineage states failed on minute-precision UTC before migration to the same owner; 15 completion tests pass afterward (119 in the selected timestamp/completion set). A full REA-owned source search finds no remaining `.datetime()` producers. - `npm run check:fast`, pre-push typecheck/lint, and `npm run docs:check`: passed. - `npm run licenses:check` and `npm pack --dry-run --json`: passed. - Final `npm run verify:package`: passed, including packaged CLI/MCP/setup/update/Evidence paths and verified empty final lineage (302.7 s wall, 290.2 s CPU, sampled family RSS 1.24 GiB; two CPUs). The earlier final-tree attempt stopped at its 360 s outer guard and is retained as incomplete; the isolated finalization profile passed 10/10 before the serial rerun. - Real npm `picocolors` module on the final runtime: CLI and stdio MCP both analyze four JS files, zero parse failures, matching statistics and artifact digest `9f128e80…6942`. Fresh-process CLI: 7.1 s wall / 8.5 s CPU / 494 MiB sampled family RSS; MCP including discovery: 30.9 s / 35.2 s CPU / 1.31 GiB. Runtime/OS cache state is uncontrolled; these are observations, not a before/after application benchmark. Complete replies are retained locally; no model-token reduction is claimed. A bounded 20,000-element invalid collection probe produced 20,001 issues on 4.4.3 and one `too_big` issue on 4.6.6. Single cold parse: 65.43 -> 0.92 ms; command wall time 0.346 -> 0.237 s, CPU 0.247 -> 0.134 s, sampled RSS 76.2 -> 60.4 MiB. These are one small paired observation, not an application-wide speedup. Work ran on two CPUs with process-family memory guards. Model token usage was not measured. Limits: full `npm run check` was stopped at its 300 s guard during typed lint (not a pass; peak sampled group RSS 6.8 GiB). No real Hopper/Ghidra/IDA or native macOS/Windows provider run is claimed. The fixed-size heap-headroom fixture was invalidated by lower startup allocation after the upgrade (main rejects it 3/3; upgraded runtime fits it 3/3). The stdin fixture now reports the child heap capacity; the test derives a payload that exceeds that capacity using the production expansion estimator, retaining cancellation, malformed-input and resource-error checks. All 11 public CLI cases pass both with the upgrade and against unchanged main production code using the same revised tests. ## Author readiness Human owner: @gensokyo-dev - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Independent CI baseline The SQLite Node 22 descriptor-cleanup failures also occur on exact base `e54bf1006`, [main run 40307610780](https://github.com/morluto/rea/actions/runs/40307610780), job 121521635983. They are outside this dependency/timestamp fix. The `pcapWorkspaceAllocation` ENOTDIR assertion also fails on that same base (job 121521508991), matching the first PR run (job 121547176291). These independent failures are not modified here. Current head `2991130`: source tests, static checks, docs and automated review pass. In [run 40318200837](https://github.com/morluto/rea/actions/runs/40318200837), the five SQLite Node 22 failures and the pcap ENOTDIR failure exactly match the pinned main failure names. The pcap failure triggers fail-fast; cancelled boundary shards are unverified, not passes. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:39:57 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7730

No description provided.

Rows
Columns