morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5439] [Bug] uninstall reports valid Cordis YAML as invalid when an entry ID is an expression #3298

New issue

Closed

opened 2026-10-31 00:38:55 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:38:55 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5439

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

node scripts/rea.mjs uninstall --json reports Configuration is not valid YAML and was not changed. Repair it, then rerun uninstall. for a DeepSeek Harness Cordis patch whose entry ID is an expression. The same bytes pass REA's YAML parser with zero errors/warnings. Setup and doctor instead explain that expression-backed IDs have unknown ownership and require literal IDs.

This report was prepared with AI assistance from an independent verifier's executed CLI reproduction and parser probes. The submitter checked upstream source changes and related reports; the runtime observations below are the verifier's results.

Reproduction

From the source checkout and prepared build at the revision below, the verifier ran this fixture and these CLI requests in an isolated environment:

probe=$(mktemp -d)
env -i PATH="$PATH" VERIFY_SCRATCH="$probe" sh <<'SH'
export HOME="$VERIFY_SCRATCH/home" USERPROFILE="$VERIFY_SCRATCH/home"
export XDG_CONFIG_HOME="$VERIFY_SCRATCH/config" XDG_DATA_HOME="$VERIFY_SCRATCH/data"
export XDG_CACHE_HOME="$VERIFY_SCRATCH/cache" XDG_STATE_HOME="$VERIFY_SCRATCH/state"
export DSH_HOME="$VERIFY_SCRATCH/dsh" DSH_AGENTS_HOME="$VERIFY_SCRATCH/agents"
export TMPDIR="$VERIFY_SCRATCH/temp" NO_COLOR=1
export GEMINI_CLI_SYSTEM_SETTINGS_PATH="$VERIFY_SCRATCH/config/gemini-system.json"
export GEMINI_CLI_SYSTEM_DEFAULTS_PATH="$VERIFY_SCRATCH/config/gemini-defaults.json"
mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$DSH_HOME" "$DSH_AGENTS_HOME" "$TMPDIR"
cat > "$DSH_HOME/cordis.patch.yml" <<'YAML'
- insert:
    - id: !!js 'process.env.DSH_PROFILE ? "rea-mcp" : "other"'
      name: "@deepseek-ai/dsh-mcp-client"
      config:
        serverName: rea
        transport: stdio
        command: /usr/bin/true
        args: [mcp]
YAML
cp "$DSH_HOME/cordis.patch.yml" "$VERIFY_SCRATCH/before.yml"
node scripts/rea.mjs setup --client dsh --skill=false --dry-run --json
printf 'setup exit=%s\n' "$?"
node scripts/rea.mjs doctor --client dsh --json
printf 'doctor exit=%s\n' "$?"
node scripts/rea.mjs uninstall --json
printf 'uninstall exit=%s\n' "$?"
cmp "$VERIFY_SCRATCH/before.yml" "$DSH_HOME/cordis.patch.yml"
printf 'comparison exit=%s\n' "$?"
test ! -e "$DSH_HOME/cordis.patch.yml.rea.backup"
printf 'no backup exit=%s\n' "$?"
SH

The verifier also repeated the commands in a fresh environment with only the ID line replaced by - id: [unterminated as a syntax-error control. Both cases reproduced with Node 24.18.0 and an initial Node 26.12.0 replay.

Expected behavior

Keep uninstall blocked, preserve the file, and report the ownership constraint with the literal-ID remediation. Reserve the YAML syntax diagnosis for actual syntax failures. AGENTS.md separates ownership from validity and requires meaningful failure reasons to survive boundaries. docs/client-configuration.md:365-373 documents this DSH patch and the lifecycle commands. tests/boundary/filesystem/dshClientConfiguration.test.ts:2067-2090 requires refusal and preservation for unknown ID ownership.

Impact and scope

P3: misleading wording and recovery advice for the demonstrated expression-ID input. Uninstall exited 1 before removals; the file remained byte-identical and no backup was created. No expression execution or data loss was observed. The read-only workaround, executed on the same bytes, is node scripts/rea.mjs doctor --client dsh --json, which identifies the ownership constraint and literal-ID remediation. Other semantic errors and platforms were not replayed.

REA version

6.7.0; source commit 074768901f3cdc8205b61773fb1faf6f6c7b3ca8.

Runtime and platform

Node 24.18.0 (repository pin); also reproduced with Node 26.12.0. macOS. Architecture: NOT_ENOUGH_INFO — the verifier did not record it. Native analysis engines are not needed for this configuration diagnosis.

Target and artifact context

Local DeepSeek Harness cordis.patch.yml containing an expression-backed entry ID; no binary target or external service.

Interface

CLI

Earliest failure stage

Cleanup, cancellation, or lifecycle

Relevant output or evidence

Independent verifier's observed results for the expression-ID fixture:

Setup: exit 1, status: needs_human.
Setup and doctor diagnosis: Expression-backed Cordis IDs have unknown ownership; use literal IDs before changing registrations. Doctor also exited 1.
Uninstall: exit 1, status: failed; failed dsh item: Configuration is not valid YAML and was not changed. Repair it, then rerun uninstall.
Aggregate uninstall item: skipped, with No REA registration, skill, or data was removed. Repair each failed configuration, then rerun uninstall.
Byte comparison succeeded; no backup existed.

A direct runtime probe of the built DshCordisYaml accepted this fixture with zero errors/warnings; DshCordisDocument then raised the unknown-ownership ConfigurationError. For the syntax-error control, the YAML parser rejected it as Invalid or unsupported Cordis YAML, while uninstall emitted the same invalid-YAML diagnosis. These observations distinguish semantic ownership rejection from syntax failure.

Typed outcome or recovery expected

Retain the existing unsuccessful exit, failed DSH item, unchanged bytes and no-removal behavior. Preserve the specific unknown-ownership reason and tell the caller to use literal IDs. Keep an accurate syntax diagnosis for the syntax-error control.

Analysis or suspected cause

Source-derived: src/application/DshCordisYaml.ts:28-54 admits the expression tag and checks YAML diagnostics. src/application/DshCordisPatch.ts:144-149 raises the semantic ownership error. The catch at src/application/Uninstall.ts:443-453 preserves shape errors but replaces this other exception with the format-error message.

Upstream source check: fetched main at 052956af3416fa01d93837e54fdec3ad2739f6d1; the later Cordis changes in e84468c0bb0476412ac0c8161f7c2ecc9a6864ca concern environment overrides/YAML key edits and leave the ID ownership check and uninstall error mapping unchanged. No runtime replay on that newer revision is claimed.

Additional context

Related but distinct: #2152 / #2153 concern non-object configuration roots/server tables and the shape-error diagnostic path. This report concerns an admitted Cordis expression whose ID ownership cannot be proven. The existing structural-error regression in tests/boundary/filesystem/clientLifecycle.test.ts:1901-1930 likewise distinguishes semantic problems from valid syntax. No last-known-good version is established.

Originally created by @coygeek on GitHub (Oct 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5439 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Setup, packaging, or upgrade ### Observed behavior `node scripts/rea.mjs uninstall --json` reports `Configuration is not valid YAML and was not changed. Repair it, then rerun uninstall.` for a DeepSeek Harness Cordis patch whose entry ID is an expression. The same bytes pass REA's YAML parser with zero errors/warnings. Setup and doctor instead explain that expression-backed IDs have unknown ownership and require literal IDs. This report was prepared with AI assistance from an independent verifier's executed CLI reproduction and parser probes. The submitter checked upstream source changes and related reports; the runtime observations below are the verifier's results. ### Reproduction From the source checkout and prepared build at the revision below, the verifier ran this fixture and these CLI requests in an isolated environment: ```sh probe=$(mktemp -d) env -i PATH="$PATH" VERIFY_SCRATCH="$probe" sh <<'SH' export HOME="$VERIFY_SCRATCH/home" USERPROFILE="$VERIFY_SCRATCH/home" export XDG_CONFIG_HOME="$VERIFY_SCRATCH/config" XDG_DATA_HOME="$VERIFY_SCRATCH/data" export XDG_CACHE_HOME="$VERIFY_SCRATCH/cache" XDG_STATE_HOME="$VERIFY_SCRATCH/state" export DSH_HOME="$VERIFY_SCRATCH/dsh" DSH_AGENTS_HOME="$VERIFY_SCRATCH/agents" export TMPDIR="$VERIFY_SCRATCH/temp" NO_COLOR=1 export GEMINI_CLI_SYSTEM_SETTINGS_PATH="$VERIFY_SCRATCH/config/gemini-system.json" export GEMINI_CLI_SYSTEM_DEFAULTS_PATH="$VERIFY_SCRATCH/config/gemini-defaults.json" mkdir -p "$HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME" "$DSH_HOME" "$DSH_AGENTS_HOME" "$TMPDIR" cat > "$DSH_HOME/cordis.patch.yml" <<'YAML' - insert: - id: !!js 'process.env.DSH_PROFILE ? "rea-mcp" : "other"' name: "@deepseek-ai/dsh-mcp-client" config: serverName: rea transport: stdio command: /usr/bin/true args: [mcp] YAML cp "$DSH_HOME/cordis.patch.yml" "$VERIFY_SCRATCH/before.yml" node scripts/rea.mjs setup --client dsh --skill=false --dry-run --json printf 'setup exit=%s\n' "$?" node scripts/rea.mjs doctor --client dsh --json printf 'doctor exit=%s\n' "$?" node scripts/rea.mjs uninstall --json printf 'uninstall exit=%s\n' "$?" cmp "$VERIFY_SCRATCH/before.yml" "$DSH_HOME/cordis.patch.yml" printf 'comparison exit=%s\n' "$?" test ! -e "$DSH_HOME/cordis.patch.yml.rea.backup" printf 'no backup exit=%s\n' "$?" SH ``` The verifier also repeated the commands in a fresh environment with only the ID line replaced by ` - id: [unterminated` as a syntax-error control. Both cases reproduced with Node 24.18.0 and an initial Node 26.12.0 replay. ### Expected behavior Keep uninstall blocked, preserve the file, and report the ownership constraint with the literal-ID remediation. Reserve the YAML syntax diagnosis for actual syntax failures. `AGENTS.md` separates ownership from validity and requires meaningful failure reasons to survive boundaries. `docs/client-configuration.md:365-373` documents this DSH patch and the lifecycle commands. `tests/boundary/filesystem/dshClientConfiguration.test.ts:2067-2090` requires refusal and preservation for unknown ID ownership. ### Impact and scope P3: misleading wording and recovery advice for the demonstrated expression-ID input. Uninstall exited 1 before removals; the file remained byte-identical and no backup was created. No expression execution or data loss was observed. The read-only workaround, executed on the same bytes, is `node scripts/rea.mjs doctor --client dsh --json`, which identifies the ownership constraint and literal-ID remediation. Other semantic errors and platforms were not replayed. ### REA version 6.7.0; source commit `074768901f3cdc8205b61773fb1faf6f6c7b3ca8`. ### Runtime and platform Node 24.18.0 (repository pin); also reproduced with Node 26.12.0. macOS. Architecture: NOT_ENOUGH_INFO — the verifier did not record it. Native analysis engines are not needed for this configuration diagnosis. ### Target and artifact context Local DeepSeek Harness `cordis.patch.yml` containing an expression-backed entry ID; no binary target or external service. ### Interface CLI ### Earliest failure stage Cleanup, cancellation, or lifecycle ### Relevant output or evidence Independent verifier's observed results for the expression-ID fixture: - Setup: exit 1, `status: needs_human`. - Setup and doctor diagnosis: `Expression-backed Cordis IDs have unknown ownership; use literal IDs before changing registrations`. Doctor also exited 1. - Uninstall: exit 1, `status: failed`; failed `dsh` item: `Configuration is not valid YAML and was not changed. Repair it, then rerun uninstall.` - Aggregate uninstall item: `skipped`, with `No REA registration, skill, or data was removed. Repair each failed configuration, then rerun uninstall.` - Byte comparison succeeded; no backup existed. A direct runtime probe of the built `DshCordisYaml` accepted this fixture with zero errors/warnings; `DshCordisDocument` then raised the unknown-ownership `ConfigurationError`. For the syntax-error control, the YAML parser rejected it as `Invalid or unsupported Cordis YAML`, while uninstall emitted the same invalid-YAML diagnosis. These observations distinguish semantic ownership rejection from syntax failure. ### Typed outcome or recovery expected Retain the existing unsuccessful exit, failed DSH item, unchanged bytes and no-removal behavior. Preserve the specific unknown-ownership reason and tell the caller to use literal IDs. Keep an accurate syntax diagnosis for the syntax-error control. ### Analysis or suspected cause Source-derived: `src/application/DshCordisYaml.ts:28-54` admits the expression tag and checks YAML diagnostics. `src/application/DshCordisPatch.ts:144-149` raises the semantic ownership error. The catch at `src/application/Uninstall.ts:443-453` preserves shape errors but replaces this other exception with the format-error message. Upstream source check: fetched `main` at `052956af3416fa01d93837e54fdec3ad2739f6d1`; the later Cordis changes in `e84468c0bb0476412ac0c8161f7c2ecc9a6864ca` concern environment overrides/YAML key edits and leave the ID ownership check and uninstall error mapping unchanged. No runtime replay on that newer revision is claimed. ### Additional context Related but distinct: #2152 / #2153 concern non-object configuration roots/server tables and the shape-error diagnostic path. This report concerns an admitted Cordis expression whose ID ownership cannot be proven. The existing structural-error regression in `tests/boundary/filesystem/clientLifecycle.test.ts:1901-1930` likewise distinguishes semantic problems from valid syntax. No last-known-good version is established.

bsakaguchi closed this issue

2026-10-31 00:38:55 +00:00

bsakaguchi commented

2026-10-31 00:38:56 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

The uninstall parser now preserves ConfigurationError messages alongside shape errors instead of replacing every other parse failure with invalid-YAML wording. Expression-backed ID parsing raises the specific unknown-ownership/literal-ID ConfigurationError; the same catch now carries it into uninstall detail. Inspected assertions cover expression IDs in insert/direct/alias forms: inspect and removal both fail with the literal-ID reason, bytes remain unchanged, and no backup is created.

Implementation: DshCordisPatch.ts, Uninstall.ts.

The relevant regression checks in dshClientConfiguration.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The uninstall parser now preserves ConfigurationError messages alongside shape errors instead of replacing every other parse failure with invalid-YAML wording. Expression-backed ID parsing raises the specific unknown-ownership/literal-ID ConfigurationError; the same catch now carries it into uninstall detail. Inspected assertions cover expression IDs in insert/direct/alias forms: inspect and removal both fail with the literal-ID reason, bytes remain unchanged, and no backup is created. Implementation: [DshCordisPatch.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/DshCordisPatch.ts#L149), [Uninstall.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/application/Uninstall.ts#L453). The relevant regression checks in [dshClientConfiguration.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/filesystem/dshClientConfiguration.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 01:08:49 +00:00

[PR #3298] [CLOSED] fix(javascript): honor node-ID seed matching options #5710

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3298

No description provided.

Rows
Columns