[GH-ISSUE #2524] fix(javascript): Windows reconciliation folds recorded POSIX root case #841

New issue

Closed

opened 2026-10-15 18:28:55 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:55 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2524

Summary

Source inspection establishes that offline JavaScript runtime reconciliation on Windows can align a recorded POSIX script path with a different POSIX root that differs only in case. With one corresponding static asset and no captured source bytes, the result incorrectly reports a match, adds an inferred graph edge and marks the asset loaded. This concerns supplied Evidence, without new file reads or provider authorization.

Steps to reproduce

On Windows, use the baseline described under Runtime or environment and complete identity-bound static and runtime Evidence accepted by reconcile_javascript_runtime.
Supply one directory-format application layer containing exactly one compatible JavaScript asset at artifact path mapped/renderer.js. Use an unrelated automatic input root and the explicit mapping {"kind":"file-root","root":"/runtime/App","artifact_prefix":"mapped"}.
Supply a recorded inspect_electron_page script at /runtime/app/renderer.js with source bytes not included. Keep the Evidence subject, result digests and graph identities consistent and provide no other mappings or content-match candidates.
Run reconciliation and inspect the script status, inferred observed_as edges and the asset load state.

The Windows service-level reproduction was not run locally. The missing fact is an end-to-end Windows execution of these complete Evidence inputs; the path discriminator and all relevant source branches were checked.

Expected behavior

The case-different POSIX script path falls outside the mapped POSIX root, so it receives status unknown with reason no-authorized-location-mapping. It creates no correspondence edge, and this observation does not mark the static asset loaded or activate that mapping's scope.

Actual behavior

The source-established Windows branch computes the relative suffix renderer.js even though the POSIX roots differ. With the specified unique candidate and no source digest, that suffix produces a medium-confidence matched item with basis operator-file-mapping, an inferred observed_as edge and a loaded asset state. The same root calculation can also activate scope for other assets. Locally, win32.relative returned this suffix while posix.relative returned ../app/renderer.js, which the existing escape guard rejects.

Evidence

Expected source: docs/javascript-runtime-reconciliation.md:58 defines canonical root mappings on already-authorized locations, and line 96 requires conservative location matching; AGENTS.md requires format-aware path semantics and preservation of unresolved identity.
Failure source: src/domain/javascript/javascriptRuntimeStaticCandidates.ts:212 selects host-default relative for POSIX roots; src/application/javascript/JavaScriptRuntimeReconciliationService.ts:82 preserves the absolute root. Candidate matching at src/domain/javascript/javascriptRuntimeReconciliationMatching.ts:129 and load-state projection at src/domain/javascript/javascriptRuntimeLoadState.ts:70 turn the resulting unique suffix into the reported correspondence.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: incomplete
Missing fact: End-to-end execution on a Windows host using the specified complete static and source-free runtime Evidence.

Runtime reproduction was not run. Static reachability checks covered mapping validation, absolute-root preservation, Evidence identity binding, POSIX syntax classification, escape guards, the null runtime digest and single-candidate match. The executed Node discriminator returned renderer.js under Windows path semantics and ../app/renderer.js under POSIX semantics. These premises establish the branch error independently of the missing Windows rerun.

An existing open fix and its author's Windows service and CLI verification are reference-only: https://github.com/morluto/rea/pull/2422. The proposed change is not present in the tested source baseline.

Restoration check

On Windows, the case-mismatched fixture stays unknown, creates no inferred correspondence edge and leaves the asset outside the exercised mapping's scope. An exact POSIX-root control still matches, and an actual Windows-style root remains case-insensitive. Check both explicit mappings and automatic directory-root mapping, which share the same path comparison.

Runtime or environment

Source baseline 8b181716aca2cb467be499cba226abfb5ae19141, Node v26.10.0 and npm 11.19.1. Local inspection and path discrimination ran on macOS; the affected reconciliation host is Windows.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Source establishes false match and load-state facts for Windows-hosted reconciliation of recorded POSIX roots with case differences. The defect is bounded to this path syntax and spelling combination; it does not authorize target access.
Workaround status: unverified
Workaround basis: The POSIX-host branch rejects the mismatched root in the executed discriminator, but access to a practical POSIX reconciliation environment for an affected Windows caller was not established.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2524 ## Summary Source inspection establishes that offline JavaScript runtime reconciliation on Windows can align a recorded POSIX script path with a different POSIX root that differs only in case. With one corresponding static asset and no captured source bytes, the result incorrectly reports a match, adds an inferred graph edge and marks the asset loaded. This concerns supplied Evidence, without new file reads or provider authorization. ## Steps to reproduce 1. On Windows, use the baseline described under Runtime or environment and complete identity-bound static and runtime Evidence accepted by `reconcile_javascript_runtime`. 2. Supply one directory-format application layer containing exactly one compatible JavaScript asset at artifact path `mapped/renderer.js`. Use an unrelated automatic input root and the explicit mapping `{"kind":"file-root","root":"/runtime/App","artifact_prefix":"mapped"}`. 3. Supply a recorded `inspect_electron_page` script at `/runtime/app/renderer.js` with source bytes not included. Keep the Evidence subject, result digests and graph identities consistent and provide no other mappings or content-match candidates. 4. Run reconciliation and inspect the script status, inferred `observed_as` edges and the asset load state. The Windows service-level reproduction was not run locally. The missing fact is an end-to-end Windows execution of these complete Evidence inputs; the path discriminator and all relevant source branches were checked. ## Expected behavior The case-different POSIX script path falls outside the mapped POSIX root, so it receives status `unknown` with reason `no-authorized-location-mapping`. It creates no correspondence edge, and this observation does not mark the static asset loaded or activate that mapping's scope. ## Actual behavior The source-established Windows branch computes the relative suffix `renderer.js` even though the POSIX roots differ. With the specified unique candidate and no source digest, that suffix produces a medium-confidence `matched` item with basis `operator-file-mapping`, an inferred `observed_as` edge and a `loaded` asset state. The same root calculation can also activate scope for other assets. Locally, `win32.relative` returned this suffix while `posix.relative` returned `../app/renderer.js`, which the existing escape guard rejects. ## Evidence - Expected source: `docs/javascript-runtime-reconciliation.md:58` defines canonical root mappings on already-authorized locations, and line 96 requires conservative location matching; `AGENTS.md` requires format-aware path semantics and preservation of unresolved identity. - Failure source: `src/domain/javascript/javascriptRuntimeStaticCandidates.ts:212` selects host-default relative for POSIX roots; `src/application/javascript/JavaScriptRuntimeReconciliationService.ts:82` preserves the absolute root. Candidate matching at `src/domain/javascript/javascriptRuntimeReconciliationMatching.ts:129` and load-state projection at `src/domain/javascript/javascriptRuntimeLoadState.ts:70` turn the resulting unique suffix into the reported correspondence. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: incomplete - Missing fact: End-to-end execution on a Windows host using the specified complete static and source-free runtime Evidence. Runtime reproduction was not run. Static reachability checks covered mapping validation, absolute-root preservation, Evidence identity binding, POSIX syntax classification, escape guards, the null runtime digest and single-candidate match. The executed Node discriminator returned `renderer.js` under Windows path semantics and `../app/renderer.js` under POSIX semantics. These premises establish the branch error independently of the missing Windows rerun. An existing open fix and its author's Windows service and CLI verification are reference-only: https://github.com/morluto/rea/pull/2422. The proposed change is not present in the tested source baseline. ## Restoration check On Windows, the case-mismatched fixture stays unknown, creates no inferred correspondence edge and leaves the asset outside the exercised mapping's scope. An exact POSIX-root control still matches, and an actual Windows-style root remains case-insensitive. Check both explicit mappings and automatic directory-root mapping, which share the same path comparison. ## Runtime or environment Source baseline `8b181716aca2cb467be499cba226abfb5ae19141`, Node v26.10.0 and npm 11.19.1. Local inspection and path discrimination ran on macOS; the affected reconciliation host is Windows. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Source establishes false match and load-state facts for Windows-hosted reconciliation of recorded POSIX roots with case differences. The defect is bounded to this path syntax and spelling combination; it does not authorize target access. - Workaround status: unverified - Workaround basis: The POSIX-host branch rejects the mismatched root in the executed discriminator, but access to a practical POSIX reconciliation environment for an affected Windows caller was not established.

bsakaguchi

2026-10-15 18:28:55 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:28:56 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Runtime reconciliation now compares POSIX roots with POSIX case semantics even on Windows, while retaining case-insensitive comparison for Windows paths. The boundary regression checks the result status and load-state projection for both path syntaxes.

Root cause: Windows-host path.relative was used for recorded POSIX roots, folding case and fabricating a relative suffix.

Validation: tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts: 'uses case-sensitive POSIX mapping root on every host' and table controls for auto-root POSIX, exact POSIX, and case-insensitive Windows mapping. These assertions passed in CI at 500e32399; the reviewed implementation is present on current main. Fix: 1a1b67c88, 2f3dee3fc.

Verification scope: Asserts reconciliation status and static load-state; it does not directly assert absence of an observed_as edge, though the unmatched status and producer path make that branch unreachable. No Windows service run claimed.

@morluto commented on GitHub (Oct 14, 2026): Runtime reconciliation now compares POSIX roots with POSIX case semantics even on Windows, while retaining case-insensitive comparison for Windows paths. The boundary regression checks the result status and load-state projection for both path syntaxes. Root cause: Windows-host path.relative was used for recorded POSIX roots, folding case and fabricating a relative suffix. Validation: tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts: 'uses case-sensitive POSIX mapping root on every host' and table controls for auto-root POSIX, exact POSIX, and case-insensitive Windows mapping. These assertions passed in [CI at 500e32399](https://github.com/morluto/rea/actions/runs/38514789942); the reviewed implementation is present on current main. Fix: [1a1b67c88](https://github.com/morluto/rea/commit/1a1b67c88), [2f3dee3fc](https://github.com/morluto/rea/commit/2f3dee3fc). Verification scope: Asserts reconciliation status and static load-state; it does not directly assert absence of an observed_as edge, though the unmatched status and producer path make that branch unreachable. No Windows service run claimed.

bsakaguchi referenced this issue

2026-10-16 21:16:39 +00:00

[PR #841] [MERGED] fix(native): inspect plists containing data, dates, and non-finite reals #2279

bsakaguchi referenced this issue

2026-10-16 21:16:43 +00:00

[PR #846] [MERGED] fix(native): report exact plist integers beyond the JSON number range #2284

bsakaguchi referenced this issue

2026-10-31 00:35:24 +00:00

[GH-ISSUE #4906] [Bug] XML plist reals spelled +infinity, -infinity or nan are reported as unknown reals #3045

bsakaguchi referenced this issue

2026-10-31 00:40:38 +00:00

[GH-ISSUE #5701] [Bug] inspect-plist rejects a valid binary plist containing a control character and data #3451