morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #660] [Bug] `rea skills add` replaces the managed `reverse-engineer-anything` skill with a `SKILL.md`-only copy #310

New issue

Closed

opened 2026-10-15 18:23:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:23:45 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 6, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/660

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

rea skills add, listed under "Integrations" in rea --help, rewrites ~/.agents/skills/reverse-engineer-anything without a plan, confirmation, or backup. After a normal rea setup has installed the managed skill as five files, rea skills add deletes the directory and recreates it with SKILL.md only, so the four references/*.md guides that SKILL.md links to are gone. On a home with no prior setup it creates the same incomplete copy. rea doctor --skill then still reports the skill as aligned.

The script under Reproduction printed the output under Relevant output or evidence with the 4.0.1 package; the main build printed identical lines.

rea skills add printed no plan, asked for no confirmation with stdin closed, and exited 0. The remaining SKILL.md is byte-identical to the packaged one; only references/ is missing.
In a separate run on an empty home with no prior setup, rea skills add created reverse-engineer-anything/ with SKILL.md only, on both builds.
Rerunning rea setup --skill --yes after skills add restored all five files in a local 4.0.1 run.

Reproduction

Run this with bash. It uses a throwaway home and unsets the configuration-directory variables that REA and its CLI framework read, so it does not touch real agent configuration. It was executed as written against the 4.0.1 package and, with REA="node scripts/rea.mjs" from a main checkout, against the main build.

set -u
# Isolate every location REA and its CLI framework read, not only HOME.
unset CLAUDE_CONFIG_DIR CODEX_HOME COPILOT_HOME OPENCODE_CONFIG XDG_CONFIG_HOME XDG_DATA_HOME
export HOME="$(mktemp -d)"
mkdir -p "$HOME/.claude"   # an existing ~/.claude makes Claude Code count as installed
cd "$(mktemp -d)"
REA="${REA:-npx -y rea-agents@4.0.1}"
SKILL="$HOME/.agents/skills/reverse-engineer-anything"
$REA setup --client claude_code --yes < /dev/null > /dev/null; echo "setup exit=$?"
echo "managed skill files after setup: $(find "$SKILL" -type f | wc -l | tr -d ' ')"
$REA skills add < /dev/null > /dev/null; echo "skills add exit=$?"
echo "managed skill files after skills add: $(find "$SKILL" -type f | wc -l | tr -d ' ')"
find "$SKILL" -type f | sed "s|$HOME|~|"
grep -o '(references/[a-z-]*\.md)' "$SKILL/SKILL.md" | tr -d '()' | while read -r ref; do test -e "$SKILL/$ref" || echo "SKILL.md links missing file: $ref"; done
echo "backup files under ~/.agents: $(find "$HOME/.agents" -name '*backup*' | wc -l | tr -d ' ')"
$REA doctor --skill --format json < /dev/null | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log("doctor skill state:",JSON.parse(s).identity.skill.state))'
echo "setup --dry-run plans install_skill: $($REA setup --client claude_code --dry-run < /dev/null | grep -c 'install_skill,install_skill')"

Expected behavior

rea setup installs the bundled skill as SKILL.md plus four references/*.md files, and the installed SKILL.md sends agents to those references under "Read only the relevant guide". REA's repository guidelines call for "additive, idempotent configuration with backups" and require setup to print its planned changes and get approval before writing files. A command REA advertises should not leave the managed skill without the files its SKILL.md links to, and should not replace it outside that reviewed, backed-up path.

Impact and scope

Impact level: P2
Assessment status: supported
Impact basis: An advertised, explicitly invoked command deletes four REA-managed reference files without a backup, leaving the installed skill linking to missing guides while doctor reports it aligned; the files are restorable from the package and no user-authored file was affected in the observed runs.
Workaround status: available
Workaround basis: Users who do not run rea skills add are unaffected, and after running it rea setup --skill --yes restored all five managed files in a local run, where its plan contained only the install_skill action.

REA version

4.0.1 (npm latest; tag rea-agents-4.0.1, commit feeb19b8b3172b2827b80fde8f09570ce5aeed88); also reproduced on main at 19f8cddfd6f283188567b8ff1e49b810d79952ee built from source

Runtime and platform

Node.js 24.21.0; macOS 27.0.1 arm64; no Hopper or Ghidra involved

Target and artifact context

Not applicable

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

setup exit=0
managed skill files after setup: 5
skills add exit=0
managed skill files after skills add: 1
~/.agents/skills/reverse-engineer-anything/SKILL.md
SKILL.md links missing file: references/native-and-artifacts.md
SKILL.md links missing file: references/javascript-applications.md
SKILL.md links missing file: references/runtime-observation.md
SKILL.md links missing file: references/evidence-workflows.md
backup files under ~/.agents: 0
doctor skill state: aligned
setup --dry-run plans install_skill: 1

Typed outcome or recovery expected

Run the script against a fixed build. Today it prints managed skill files after skills add: 1 and four SKILL.md links missing file lines. Restoration means the script prints managed skill files after skills add: 5 and no missing-file lines, whether skills add leaves the managed skill alone, installs it completely, or is no longer available. Control: rea setup alone must still install and report the five-file skill as aligned.

Analysis or suspected cause

Expected source: src/application/SetupSkill.ts lines 7-13 (managed file set); skills/reverse-engineer-anything/SKILL.md "Read only the relevant guide" links to the four references; AGENTS.md lines 11 and 14 (configuration with backups; setup plan and approval before writing files).
Failure source: the script output above, run locally in throwaway homes against both tested builds.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The command reaches REA because src/cli.ts lines 43-51 pass a sync option with include: ["skills/*"] to Cli.create from the incur CLI framework, which then serves its built-in skills add and skills list. In incur 0.4.13's shipped dist/SyncSkills.js and dist/internal/agents.js, an included skill directory contributes only its SKILL.md, and each destination directory is removed before the copy. Git history shows sync enabled in 97541d8d (2026-07-12) and the references/ files added in 3e3d4585 (2026-07-20). These locators explain where the write comes from; they do not prescribe a fix.

Additional context

rea doctor --skill reads the skill identity from SKILL.md, so it reports aligned here while setup's own comparison of all five files plans install_skill. That is why the loss goes unnoticed; this report does not claim a doctor contract covers the reference files. #661 covers rea uninstall leaving the 69 rea-<command> skill folders and agent links that the same command writes. Disabling or removing the skills helper would close both; routing it through setup and uninstall would also work. Hiding it from help while it still writes these files would close neither.

Originally created by @coygeek on GitHub (Oct 6, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/660 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Setup, packaging, or upgrade ### Observed behavior `rea skills add`, listed under "Integrations" in `rea --help`, rewrites `~/.agents/skills/reverse-engineer-anything` without a plan, confirmation, or backup. After a normal `rea setup` has installed the managed skill as five files, `rea skills add` deletes the directory and recreates it with `SKILL.md` only, so the four `references/*.md` guides that `SKILL.md` links to are gone. On a home with no prior setup it creates the same incomplete copy. `rea doctor --skill` then still reports the skill as `aligned`. The script under Reproduction printed the output under Relevant output or evidence with the 4.0.1 package; the `main` build printed identical lines. - `rea skills add` printed no plan, asked for no confirmation with stdin closed, and exited 0. The remaining `SKILL.md` is byte-identical to the packaged one; only `references/` is missing. - In a separate run on an empty home with no prior setup, `rea skills add` created `reverse-engineer-anything/` with `SKILL.md` only, on both builds. - Rerunning `rea setup --skill --yes` after `skills add` restored all five files in a local 4.0.1 run. ### Reproduction Run this with `bash`. It uses a throwaway home and unsets the configuration-directory variables that REA and its CLI framework read, so it does not touch real agent configuration. It was executed as written against the 4.0.1 package and, with `REA="node scripts/rea.mjs"` from a `main` checkout, against the `main` build. ```bash set -u # Isolate every location REA and its CLI framework read, not only HOME. unset CLAUDE_CONFIG_DIR CODEX_HOME COPILOT_HOME OPENCODE_CONFIG XDG_CONFIG_HOME XDG_DATA_HOME export HOME="$(mktemp -d)" mkdir -p "$HOME/.claude" # an existing ~/.claude makes Claude Code count as installed cd "$(mktemp -d)" REA="${REA:-npx -y rea-agents@4.0.1}" SKILL="$HOME/.agents/skills/reverse-engineer-anything" $REA setup --client claude_code --yes < /dev/null > /dev/null; echo "setup exit=$?" echo "managed skill files after setup: $(find "$SKILL" -type f | wc -l | tr -d ' ')" $REA skills add < /dev/null > /dev/null; echo "skills add exit=$?" echo "managed skill files after skills add: $(find "$SKILL" -type f | wc -l | tr -d ' ')" find "$SKILL" -type f | sed "s|$HOME|~|" grep -o '(references/[a-z-]*\.md)' "$SKILL/SKILL.md" | tr -d '()' | while read -r ref; do test -e "$SKILL/$ref" || echo "SKILL.md links missing file: $ref"; done echo "backup files under ~/.agents: $(find "$HOME/.agents" -name '*backup*' | wc -l | tr -d ' ')" $REA doctor --skill --format json < /dev/null | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log("doctor skill state:",JSON.parse(s).identity.skill.state))' echo "setup --dry-run plans install_skill: $($REA setup --client claude_code --dry-run < /dev/null | grep -c 'install_skill,install_skill')" ``` ### Expected behavior `rea setup` installs the bundled skill as `SKILL.md` plus four `references/*.md` files, and the installed `SKILL.md` sends agents to those references under "Read only the relevant guide". REA's repository guidelines call for "additive, idempotent configuration with backups" and require setup to print its planned changes and get approval before writing files. A command REA advertises should not leave the managed skill without the files its `SKILL.md` links to, and should not replace it outside that reviewed, backed-up path. ### Impact and scope - Impact level: P2 - Assessment status: supported - Impact basis: An advertised, explicitly invoked command deletes four REA-managed reference files without a backup, leaving the installed skill linking to missing guides while doctor reports it aligned; the files are restorable from the package and no user-authored file was affected in the observed runs. - Workaround status: available - Workaround basis: Users who do not run `rea skills add` are unaffected, and after running it `rea setup --skill --yes` restored all five managed files in a local run, where its plan contained only the `install_skill` action. ### REA version 4.0.1 (npm `latest`; tag `rea-agents-4.0.1`, commit `feeb19b8b3172b2827b80fde8f09570ce5aeed88`); also reproduced on `main` at `19f8cddfd6f283188567b8ff1e49b810d79952ee` built from source ### Runtime and platform Node.js 24.21.0; macOS 27.0.1 arm64; no Hopper or Ghidra involved ### Target and artifact context Not applicable ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence ```text setup exit=0 managed skill files after setup: 5 skills add exit=0 managed skill files after skills add: 1 ~/.agents/skills/reverse-engineer-anything/SKILL.md SKILL.md links missing file: references/native-and-artifacts.md SKILL.md links missing file: references/javascript-applications.md SKILL.md links missing file: references/runtime-observation.md SKILL.md links missing file: references/evidence-workflows.md backup files under ~/.agents: 0 doctor skill state: aligned setup --dry-run plans install_skill: 1 ``` ### Typed outcome or recovery expected Run the script against a fixed build. Today it prints `managed skill files after skills add: 1` and four `SKILL.md links missing file` lines. Restoration means the script prints `managed skill files after skills add: 5` and no missing-file lines, whether `skills add` leaves the managed skill alone, installs it completely, or is no longer available. Control: `rea setup` alone must still install and report the five-file skill as aligned. ### Analysis or suspected cause - Expected source: src/application/SetupSkill.ts lines 7-13 (managed file set); skills/reverse-engineer-anything/SKILL.md "Read only the relevant guide" links to the four references; AGENTS.md lines 11 and 14 (configuration with backups; setup plan and approval before writing files). - Failure source: the script output above, run locally in throwaway homes against both tested builds. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The command reaches REA because src/cli.ts lines 43-51 pass a `sync` option with `include: ["skills/*"]` to `Cli.create` from the `incur` CLI framework, which then serves its built-in `skills add` and `skills list`. In incur 0.4.13's shipped `dist/SyncSkills.js` and `dist/internal/agents.js`, an included skill directory contributes only its `SKILL.md`, and each destination directory is removed before the copy. Git history shows `sync` enabled in 97541d8d (2026-07-12) and the `references/` files added in 3e3d4585 (2026-07-20). These locators explain where the write comes from; they do not prescribe a fix. ### Additional context `rea doctor --skill` reads the skill identity from `SKILL.md`, so it reports `aligned` here while setup's own comparison of all five files plans `install_skill`. That is why the loss goes unnoticed; this report does not claim a doctor contract covers the reference files. #661 covers `rea uninstall` leaving the 69 `rea-<command>` skill folders and agent links that the same command writes. Disabling or removing the `skills` helper would close both; routing it through setup and uninstall would also work. Hiding it from help while it still writes these files would close neither.

bsakaguchi

2026-10-15 18:23:45 +00:00

closed this issue
added the
area: setup

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:12:45 +00:00

[PR #310] [MERGED] chore(main): release rea-agents 2.2.0 #1946

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#310

No description provided.

Rows
Columns

[GH-ISSUE #660] [Bug] rea skills add replaces the managed reverse-engineer-anything skill with a SKILL.md-only copy #310