morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1138] [MERGED] fix(update): accept npm 12 release metadata #2674

New issue

Closed

opened 2026-10-17 21:08:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1138
Author: @morluto
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @morluto

Base: main ← Head: cursor/npm12-release-metadata-815b

📝 Commits (2)

f64cbd3 fix(update): accept npm 12 release metadata
1482c93 fix(update): classify npm release metadata without a spawn mock

📊 Changes

5 files changed (+215 additions, -31 deletions)

View changed files

📝 src/application/Update.test.ts (+34 -3)
📝 src/application/Update.ts (+29 -4)
➕ src/application/UpdateRuntime.release.test.ts (+88 -0)
📝 src/application/UpdateRuntime.ts (+60 -23)
📝 src/cliLogging.test.ts (+4 -1)

📄 Description

Summary

Fixes #1123.

Cherry-picks the npm 12 release-metadata fix from #1133 (aa400d18, author Dapo Olaomo) and keeps that author on the commit. npm 12 returns dist-tags.latest as a one-element JSON array; npm 11 returns a JSON string. A successful lookup was rejected before REA could decide whether the installation was current.

The follow-up keeps that acceptance and removes the brittle parts around it.

Problem and expected behavior

rea update treated a successful npm 12 registry response as invalid release metadata, exited 1, and advised retrying when registry access was available. npm 11's scalar JSON string must still resolve. Invalid metadata and a failed npm command must remain failures, with recovery advice that matches the cause.

Change and scope

Cherry-pick: accept a nonempty JSON string or a one-element string array from npm view ... --json.
Follow-up: parse that contract in parseNpmLatestVersion instead of a Zod union whose issue dump became the user-facing error.
Follow-up: classify a failed npm command as unavailable and a bad document as invalid-metadata, so only a failed command says to retry when registry access is available.
Follow-up: delete the vi.mock("cross-spawn") process-global test. The command arguments and both response shapes are covered directly. runUpdateCommand already exercises real subprocess capture.

Not included: changes to install arguments, prefix selection, or executable verification.

Contract and boundary impact

Semantic owner and earliest changed stage: update workflow, release lookup. The internal UpdateHost.latestVersion error is now a tagged ReleaseLookupFailure instead of a string. CLI UpdateResult remains a string remediation.
CLI and MCP/tool-catalog contract: rea update JSON status values are unchanged. Invalid metadata no longer uses the registry-access remediation.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: none.
Process execution, authorization, cleanup, or containment impact: none. The npm view command is unchanged.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: src/application/UpdateRuntime.release.test.ts covers npm 11, the pretty-printed npm 12 array, rejected shapes, malformed JSON, command-versus-metadata classification, and the view arguments. src/application/Update.test.ts covers both remediation texts.
Base reproduction or other evidence: #1123 observed npm 12.0.2 returning [\n "6.0.0"\n] and npm 11 returning "6.0.0".
User-visible CLI/MCP output (if applicable): with npm 12.0.2 first on PATH, rea update --json for the already-current 6.0.0 checkout returned exit 0:

{
  "status": "current",
  "currentVersion": "6.0.0",
  "latestVersion": "6.0.0",
  "installMethod": "unknown"
}

Remaining proof gaps: an older global install was not upgraded end to end under npm 12. The current-version lookup was executed.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- src/application/Update.test.ts src/application/UpdateRuntime.release.test.ts src/cliLogging.test.ts — 57 passed.
npm run check:fast — passed, including the pre-push run.
Live npm view rea-agents dist-tags.latest --json under npm 11.16.0 and npm 12.0.2, parsed by the built lookup — both resolved to 6.0.0.
node scripts/rea.mjs update --json with npm 12.0.2 first on PATH — status: current, exit 0.

Compatibility, safety, and release

Breaking changes or migration steps: none for the CLI. UpdateHost.latestVersion callers inside this repo now return ReleaseLookupFailure.
Real Hopper/Ghidra, browser, or OS coverage: not applicable. npm 12.0.2 and npm 11.16.0 were executed on Linux x64.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none. No new process authority.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1138 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `cursor/npm12-release-metadata-815b` --- ### 📝 Commits (2) - [`f64cbd3`](https://github.com/morluto/rea/commit/f64cbd3d91f7a88c08d2b4a87211a27385657ef4) fix(update): accept npm 12 release metadata - [`1482c93`](https://github.com/morluto/rea/commit/1482c936147036ad164d726ea89d3262085330b4) fix(update): classify npm release metadata without a spawn mock ### 📊 Changes **5 files changed** (+215 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `src/application/Update.test.ts` (+34 -3) 📝 `src/application/Update.ts` (+29 -4) ➕ `src/application/UpdateRuntime.release.test.ts` (+88 -0) 📝 `src/application/UpdateRuntime.ts` (+60 -23) 📝 `src/cliLogging.test.ts` (+4 -1) </details> ### 📄 Description  ## Summary Fixes #1123. Cherry-picks the npm 12 release-metadata fix from #1133 (`aa400d18`, author Dapo Olaomo) and keeps that author on the commit. npm 12 returns `dist-tags.latest` as a one-element JSON array; npm 11 returns a JSON string. A successful lookup was rejected before REA could decide whether the installation was current. The follow-up keeps that acceptance and removes the brittle parts around it. ## Problem and expected behavior `rea update` treated a successful npm 12 registry response as invalid release metadata, exited 1, and advised retrying when registry access was available. npm 11's scalar JSON string must still resolve. Invalid metadata and a failed npm command must remain failures, with recovery advice that matches the cause. ## Change and scope - Cherry-pick: accept a nonempty JSON string or a one-element string array from `npm view ... --json`. - Follow-up: parse that contract in `parseNpmLatestVersion` instead of a Zod union whose issue dump became the user-facing error. - Follow-up: classify a failed npm command as `unavailable` and a bad document as `invalid-metadata`, so only a failed command says to retry when registry access is available. - Follow-up: delete the `vi.mock("cross-spawn")` process-global test. The command arguments and both response shapes are covered directly. `runUpdateCommand` already exercises real subprocess capture. Not included: changes to install arguments, prefix selection, or executable verification. ## Contract and boundary impact - Semantic owner and earliest changed stage: update workflow, release lookup. The internal `UpdateHost.latestVersion` error is now a tagged `ReleaseLookupFailure` instead of a string. CLI `UpdateResult` remains a string remediation. - CLI and MCP/tool-catalog contract: `rea update` JSON status values are unchanged. Invalid metadata no longer uses the registry-access remediation. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: none. - Process execution, authorization, cleanup, or containment impact: none. The npm view command is unchanged. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: `src/application/UpdateRuntime.release.test.ts` covers npm 11, the pretty-printed npm 12 array, rejected shapes, malformed JSON, command-versus-metadata classification, and the view arguments. `src/application/Update.test.ts` covers both remediation texts. - Base reproduction or other evidence: #1123 observed npm 12.0.2 returning `[\n "6.0.0"\n]` and npm 11 returning `"6.0.0"`. - User-visible CLI/MCP output (if applicable): with npm 12.0.2 first on `PATH`, `rea update --json` for the already-current 6.0.0 checkout returned exit 0: ```json { "status": "current", "currentVersion": "6.0.0", "latestVersion": "6.0.0", "installMethod": "unknown" } ``` - Remaining proof gaps: an older global install was not upgraded end to end under npm 12. The current-version lookup was executed. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- src/application/Update.test.ts src/application/UpdateRuntime.release.test.ts src/cliLogging.test.ts` — 57 passed. - `npm run check:fast` — passed, including the pre-push run. - Live `npm view rea-agents dist-tags.latest --json` under npm 11.16.0 and npm 12.0.2, parsed by the built lookup — both resolved to `6.0.0`. - `node scripts/rea.mjs update --json` with npm 12.0.2 first on `PATH` — `status: current`, exit 0. ## Compatibility, safety, and release - Breaking changes or migration steps: none for the CLI. `UpdateHost.latestVersion` callers inside this repo now return `ReleaseLookupFailure`. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. npm 12.0.2 and npm 11.16.0 were executed on Linux x64. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none. No new process authority. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims.  <div><a href="https://cursor.com/agents/bc-2b720fd2-e8fd-4f13-9827-5b7ac599815b?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-2b720fd2-e8fd-4f13-9827-5b7ac599815b&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:54 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:05:49 +00:00

[PR #2712] [MERGED] fix(cli): refuse scenario steps on passive native UI observation #5335

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2674

No description provided.

Rows
Columns