[GH-ISSUE #291] [Bug] npm entry points can select stale local REA versions and leave install scripts blocked #164

New issue

Closed

opened 2026-10-15 18:21:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:55 +00:00

Owner

Originally created by @morluto on GitHub (Jul 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/291

Bug Description

REA's no-install commands and npx-generated MCP registrations use the unversioned package specifier rea-agents. When a project already contains an older local dependency, npm selects that local version instead of the current release.

A bare npm install rea-agents also installs rea only in the project's node_modules/.bin, so running rea directly still reports command not found. The documentation clearly distinguishes npx from global installation, but it does not explicitly warn about this local-install behavior.

npm 11 additionally leaves two lifecycle scripts pending approval during installation: REA's postinstall and node-pty's install scripts. Removing only REA's chmod hook would therefore not fully remove the warning.

Steps to Reproduce

Run with a current npm release in a temporary project:

npm init -y
npm install rea-agents@1.7.0 --no-audit --no-fund
command -v rea
npx -y rea-agents --version
npx -y rea-agents@latest --version

Observed on Node.js 24.18.0 and npm 11.16.0:

npm warn allow-scripts 2 packages have install scripts not yet covered by allowScripts:
npm warn allow-scripts   rea-agents@1.7.0 (postinstall: node scripts/prepare-node-pty.mjs)
npm warn allow-scripts   node-pty@1.1.0 (install: node scripts/prebuild.js || node-gyp rebuild; postinstall: node scripts/post-install.js)

command -v rea:             no result
npx -y rea-agents:          1.7.0
npx -y rea-agents@latest:   2.0.0

Registry metadata for the current rea-agents@2.0.0 release still declares the same REA postinstall and node-pty@1.1.0 dependency.

Expected Behavior

Canonical one-off commands and npx-generated MCP registrations should request rea-agents@latest, so an unrelated project-local version cannot silently pin the runtime.
Documentation should state that npm install rea-agents is project-local and does not place rea on the shell PATH; global installation should remain an explicit separate path.
npm installation should not leave required REA functionality dependent on blocked lifecycle scripts. Any solution must account for both REA's chmod hook and node-pty's native install scripts.

Existing registrations using the unversioned form should be recognized and migrated by setup/diagnostics without disturbing unrelated client configuration.

Actual Behavior

README commands, PRODUCT_IDENTITY.mcpCommand, npx-driven setup registration, registration alignment, and the printed MCP example use unversioned rea-agents.
An older project-local package is selected by those commands.
Local installation creates node_modules/.bin/rea but no shell-visible rea command.
npm reports pending install scripts for both REA and node-pty.

Environment

REA versions: local 1.7.0; npm latest 2.0.0
Node.js: 24.18.0
npm: 11.16.0
Platform: Linux x64

Additional Context

Relevant ownership points:

src/application/Setup.ts: npx-generated registration
src/application/ClientRegistrationStatus.ts: registration alignment
src/identity.ts: canonical MCP command
scripts/print-mcp-config.mjs: printed MCP configuration
scripts/prepare-node-pty.mjs and package.json: lifecycle-script behavior
README command examples and consistency tests

Originally created by @morluto on GitHub (Jul 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/291 ## Bug Description REA's no-install commands and npx-generated MCP registrations use the unversioned package specifier `rea-agents`. When a project already contains an older local dependency, npm selects that local version instead of the current release. A bare `npm install rea-agents` also installs `rea` only in the project's `node_modules/.bin`, so running `rea` directly still reports `command not found`. The documentation clearly distinguishes npx from global installation, but it does not explicitly warn about this local-install behavior. npm 11 additionally leaves two lifecycle scripts pending approval during installation: REA's `postinstall` and `node-pty`'s install scripts. Removing only REA's chmod hook would therefore not fully remove the warning. ## Steps to Reproduce Run with a current npm release in a temporary project: ```bash npm init -y npm install rea-agents@1.7.0 --no-audit --no-fund command -v rea npx -y rea-agents --version npx -y rea-agents@latest --version ``` Observed on Node.js 24.18.0 and npm 11.16.0: ```text npm warn allow-scripts 2 packages have install scripts not yet covered by allowScripts: npm warn allow-scripts rea-agents@1.7.0 (postinstall: node scripts/prepare-node-pty.mjs) npm warn allow-scripts node-pty@1.1.0 (install: node scripts/prebuild.js || node-gyp rebuild; postinstall: node scripts/post-install.js) command -v rea: no result npx -y rea-agents: 1.7.0 npx -y rea-agents@latest: 2.0.0 ``` Registry metadata for the current `rea-agents@2.0.0` release still declares the same REA `postinstall` and `node-pty@1.1.0` dependency. ## Expected Behavior - Canonical one-off commands and npx-generated MCP registrations should request `rea-agents@latest`, so an unrelated project-local version cannot silently pin the runtime. - Documentation should state that `npm install rea-agents` is project-local and does not place `rea` on the shell PATH; global installation should remain an explicit separate path. - npm installation should not leave required REA functionality dependent on blocked lifecycle scripts. Any solution must account for both REA's chmod hook and `node-pty`'s native install scripts. Existing registrations using the unversioned form should be recognized and migrated by setup/diagnostics without disturbing unrelated client configuration. ## Actual Behavior - README commands, `PRODUCT_IDENTITY.mcpCommand`, npx-driven setup registration, registration alignment, and the printed MCP example use unversioned `rea-agents`. - An older project-local package is selected by those commands. - Local installation creates `node_modules/.bin/rea` but no shell-visible `rea` command. - npm reports pending install scripts for both REA and `node-pty`. ## Environment - REA versions: local 1.7.0; npm `latest` 2.0.0 - Node.js: 24.18.0 - npm: 11.16.0 - Platform: Linux x64 ## Additional Context Relevant ownership points: - `src/application/Setup.ts`: npx-generated registration - `src/application/ClientRegistrationStatus.ts`: registration alignment - `src/identity.ts`: canonical MCP command - `scripts/print-mcp-config.mjs`: printed MCP configuration - `scripts/prepare-node-pty.mjs` and `package.json`: lifecycle-script behavior - README command examples and consistency tests

bsakaguchi

2026-10-15 18:21:55 +00:00