morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7093] [Bug] environment-serve accepts an empty or non-decimal --port and serves on another port #4271

New issue

Open

opened 2026-10-31 00:48:21 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:48:21 +00:00

Owner

Originally created by @Adolanium on GitHub (Oct 25, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7093

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

rea environment-serve <manifest> --evidence <file> --port= (an empty value, for example from an unset $PORT) starts serving on an ephemeral port instead of failing. --port=0x1F90 and --port=1e3 are accepted as 8080 and 1000, and --host=" " is accepted. rea mcp --http refuses all of these.

Reproduction

Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main 80673b22a, through the CLI in a boundary test with valid serve files: --port= and --port=0x1F90 start the listener; --port=1e3 and --host= are not refused as invalid flags.

Expected behavior

A validation error for each value, before any listener starts, as docs/cli.md describes ("--host and --port resolve like rea mcp --http").

Impact and scope

A script with an empty or mistyped port silently serves on a different port, so clients configured for the intended port fail without an error from REA.

REA version

6.7.0, revision 80673b22a

Runtime and platform

Linux (WSL Ubuntu), Node 24.22.1

Target and artifact context

Fixture environment manifest and Evidence files.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Root cause and fix are in #7092, with the regression test.

Typed outcome or recovery expected

A CLI validation error naming the flag.

Analysis or suspected cause

Root cause and fix are in #7092.

Additional context

Fixed by #7092.

Originally created by @Adolanium on GitHub (Oct 25, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7093 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area CLI ### Observed behavior `rea environment-serve <manifest> --evidence <file> --port=` (an empty value, for example from an unset `$PORT`) starts serving on an ephemeral port instead of failing. `--port=0x1F90` and `--port=1e3` are accepted as 8080 and 1000, and `--host=" "` is accepted. `rea mcp --http` refuses all of these. ### Reproduction Ran on Linux (WSL Ubuntu, Node 24.22.1) at upstream/main 80673b22a, through the CLI in a boundary test with valid serve files: `--port=` and `--port=0x1F90` start the listener; `--port=1e3` and `--host= ` are not refused as invalid flags. ### Expected behavior A validation error for each value, before any listener starts, as `docs/cli.md` describes ("`--host` and `--port` resolve like `rea mcp --http`"). ### Impact and scope A script with an empty or mistyped port silently serves on a different port, so clients configured for the intended port fail without an error from REA. ### REA version 6.7.0, revision `80673b22a` ### Runtime and platform Linux (WSL Ubuntu), Node 24.22.1 ### Target and artifact context Fixture environment manifest and Evidence files. ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence Root cause and fix are in #7092, with the regression test. ### Typed outcome or recovery expected A CLI validation error naming the flag. ### Analysis or suspected cause Root cause and fix are in #7092. ### Additional context Fixed by #7092.

bsakaguchi commented

2026-10-31 00:48:22 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 25, 2026):

这个 bug 确认是真实的：静默把空值/非十进制值解析成另一个端口，会让按预期端口配置的客户端直接连接失败，而 REA 端完全不报错，排查成本很高。与 rea mcp --http 保持一致的校验语义是对的，而且 #7092 带回归测试就更有保障了。多谢修复。

@XinwangTao commented on GitHub (Oct 25, 2026): 这个 bug 确认是真实的：静默把空值/非十进制值解析成另一个端口，会让按预期端口配置的客户端直接连接失败，而 REA 端完全不报错，排查成本很高。与 rea mcp --http 保持一致的校验语义是对的，而且 #7092 带回归测试就更有保障了。多谢修复。

bsakaguchi commented

2026-10-31 00:48:22 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 25, 2026):

Good inconsistency catch — the CLI accepts sloppy input (empty string, hex, scientific notation, whitespace host) while the MCP --http path validates strictly. That divergence is exactly how scripts with unset $PORT silently bind to a random port, which is a real footgun. Recommend aligning on the strict parser: reject empty/non-decimal --port with the same error style as rea mcp --http, and apply the same trimming/validation to --host. A shared validation helper would prevent the two paths from drifting again.

@XinwangTao commented on GitHub (Oct 25, 2026): Good inconsistency catch — the CLI accepts sloppy input (empty string, hex, scientific notation, whitespace host) while the MCP --http path validates strictly. That divergence is exactly how scripts with unset $PORT silently bind to a random port, which is a real footgun. Recommend aligning on the strict parser: reject empty/non-decimal --port with the same error style as rea mcp --http, and apply the same trimming/validation to --host. A shared validation helper would prevent the two paths from drifting again.

bsakaguchi commented

2026-10-31 00:48:22 +00:00

Author

Owner

@Adolanium commented on GitHub (Oct 25, 2026):

Thanks. #7092 now uses the shared owners directly: --port parses with mcpHttpPortSchema and --host with mcpHttpHostSchema, the same schemas behind MCP_PORT, MCP_HOST and rea mcp --http, so the two paths cannot drift.

@Adolanium commented on GitHub (Oct 25, 2026): Thanks. #7092 now uses the shared owners directly: `--port` parses with `mcpHttpPortSchema` and `--host` with `mcpHttpHostSchema`, the same schemas behind `MCP_PORT`, `MCP_HOST` and `rea mcp --http`, so the two paths cannot drift.

bsakaguchi referenced this issue

2026-10-31 01:12:16 +00:00

[PR #4273] [CLOSED] fix(artifacts): diagnose colliding extraction paths #6151

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4271

No description provided.

Rows
Columns