morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7666] [Bug] Update error catalogue marks obsolete npm recovery as unchanged and verified #4590

New issue

Closed

opened 2026-10-31 00:51:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:03 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7666

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

For a source checkout with no detected package-manager owner and a fixture release newer than the running version, node scripts/rea.mjs update --json returned reason unknown-install-method and guidance to use the owning package manager or source checkout, with an npx option for a one-off invocation.

The corresponding error-catalogue entry says the old global-npm-install recommendation is unchanged and that its focused assertion passed. That implementation/verification claim does not describe the returned guidance. The runtime correctly refused to install into an unrelated global location; the discrepancy is in the catalogue.

Reproduction

Use the stated baseline with its compiled runtime and Node 24.22.1 on PATH. Run the following shell block from the checkout root, with TMPDIR set to a disposable writable parent directory. It creates package-manager fixtures, isolates HOME/XDG, runs the unowned case, and then simulates exact npm-global ownership with an intentionally failing installer. The trap removes its fixtures.

repo_root=$PWD
node_bin=$(command -v node)
fixture_root=$(mktemp -d "${TMPDIR:?}/rea-update-verify.XXXXXX")
trap 'rm -rf "$fixture_root"' EXIT
mkdir -p "$fixture_root/bin" "$fixture_root/home" "$fixture_root/config" \
  "$fixture_root/cache" "$fixture_root/data" "$fixture_root/state" \
  "$fixture_root/runtime" "$fixture_root/global/lib/node_modules"
cat > "$fixture_root/bin/npm" <<'NPM'
#!/bin/sh
printf '%s\n' "$*" >> "$UPDATE_FIXTURE_ROOT/calls"
case "$1" in
  root) printf '%s\n' "$UPDATE_FIXTURE_ROOT/global/lib/node_modules" ;;
  prefix) printf '%s\n' "$UPDATE_FIXTURE_ROOT/global" ;;
  view) printf '"6.9.0"\n' ;;
  install) printf 'fixture npm install denied\n' >&2; exit 23 ;;
  *) printf 'blocked unexpected npm command\n' >&2; exit 97 ;;
esac
NPM
for runner in npx bun; do
  printf '#!/bin/sh\nprintf "blocked package runner\\n" >&2\nexit 97\n' \
    > "$fixture_root/bin/$runner"
done
chmod +x "$fixture_root/bin/npm" "$fixture_root/bin/npx" "$fixture_root/bin/bun"
run_rea() {
  env -i PATH="$fixture_root/bin:$(dirname "$node_bin"):/usr/bin:/bin" \
    HOME="$fixture_root/home" USERPROFILE="$fixture_root/home" \
    XDG_CONFIG_HOME="$fixture_root/config" XDG_CACHE_HOME="$fixture_root/cache" \
    XDG_DATA_HOME="$fixture_root/data" XDG_STATE_HOME="$fixture_root/state" \
    XDG_RUNTIME_DIR="$fixture_root/runtime" TMPDIR="$fixture_root" \
    BUN_INSTALL_GLOBAL_DIR="$fixture_root/bun-global" \
    UPDATE_FIXTURE_ROOT="$fixture_root" CI=1 NO_UPDATE_NOTIFIER=1 \
    node scripts/rea.mjs update --json
  printf 'exit=%s\n' "$?"
}
run_rea
ln -s "$repo_root" "$fixture_root/global/lib/node_modules/rea-agents"
run_rea
cat "$fixture_root/calls"

Compare the first result with the catalogue entry identified below. The first command exits 1 with unknown-install-method and the package-manager/source-checkout sentence. The second exits 1 with install and a version/prefix-specific repair sentence. The recorded commands show only the npm fixture was invoked.

Both branches reproduced with the initial controlled replay and the inline-shell replay. No real package-manager installation or registry request was performed.

Expected behavior

A catalogue entry marked unchanged, with a claim that its recovery assertion passed, should describe the supported current recovery or explicitly label the old guidance as superseded. This does not require changing the runtime or restoring the obsolete global-install recommendation. Historical original text can remain historical; the implementation status and verification attribution must identify that accurately.

Impact and scope

P3, supported: readers auditing update recovery receive an inaccurate implementation/verification claim. The observed CLI response still gives the intended recovery, and no consequential runtime failure or data change was established. A reader can obtain the current guidance from the command or owning workflow. Readership and frequency are unknown. Coverage is limited to a built source checkout on macOS with offline package-manager fixtures; no published-package update or other platform was tested.

REA version

Exact stdout from node scripts/rea.mjs --version was 6.8.0 followed by a newline. Baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; Darwin arm64. npm, npx and bun were fixture executables, not real package-manager clients.

Interface

CLI

Earliest failure stage

Unknown

Relevant output or evidence

The unowned case returned exit 1, empty stderr, and this JSON:

{"status":"failed","currentVersion":"6.8.0","latestVersion":"6.9.0","reason":"unknown-install-method","remediation":"Update this installation with the package manager or source checkout that owns it. For a one-off latest invocation, use npx rea-agents@latest."}

At the baseline:

docs/user-visible-errors.csv:52, harm_rank 40, names the unknown-install-method entry. It records Update manually with: npm install --global rea-agents@latest, Keep current copy, unchanged, and existing focused assertion passed.
src/application/Update.ts:179-205 selects the unknown-owner result after release comparison and supplies the observed recovery. The built dist/application/Update.js has the same guidance.
src/application/Update.test.ts:321-335 intentionally requires this case not to recommend npm install --global and not to attempt installation. This assertion was inspected, not executed as a test suite.
src/main/messages.test.ts:15-26 reads the CSV and checks four canonical recovery messages. It establishes selected catalogue consistency checks, but does not validate these update entries.
docs/testing.md:399-407 leaves documentation wording to review and favors structured recovery assertions over frozen prose. docs/tool-design.md:327-330 requires relevant documentation to accompany contract changes. The catalogue is maintained documentation, not an immutable runtime string API.

Corroborating comparison: docs/user-visible-errors.csv:53, harm_rank 41, marks the proposed npm-registry/permissions/manual-install sentence as implemented and verified. In the simulated npm-global failure, the CLI instead returned REA could not install 6.9.0 in <fixture>/global: fixture npm install denied. Repair this npm installation, then rerun rea update. The fixture prefix is normalized here. src/application/Update.ts:208-218 supplies that sentence. Its historical current_copy differing from runtime is not itself the defect.

Analysis or suspected cause

The catalogue's update status and verification descriptions have not followed the current recovery policy. Source inspection establishes the disagreement; the exact change that introduced it was not bisected. Reconciling these documentation claims with the supported runtime resolves the reported discrepancy.

Additional context

Closed issue #5077 corrected a different obsolete process-input catalogue row; its owner explicitly treated source/documentation consistency as the closure criterion. It does not cover this update entry.

Open PR #7163 fixes stale source-owner paths, including the two update rows, while explicitly preserving other columns and excluding stale wording. Its body already mentions the install-failure wording as deferred work. This report keeps the unknown-install-method entry primary and does not duplicate that PR's path correction.

Read-only searches covered open and closed issues, issue comments, and open, closed and merged PRs using the exact reason, old recovery sentence, CSV filename, and update/catalogue combinations. No issue reporting this same row and implementation/verification discrepancy was found. No GitHub object was created or changed during verification.

Originally created by @coygeek on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7666 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior For a source checkout with no detected package-manager owner and a fixture release newer than the running version, `node scripts/rea.mjs update --json` returned reason `unknown-install-method` and guidance to use the owning package manager or source checkout, with an npx option for a one-off invocation. The corresponding error-catalogue entry says the old global-npm-install recommendation is unchanged and that its focused assertion passed. That implementation/verification claim does not describe the returned guidance. The runtime correctly refused to install into an unrelated global location; the discrepancy is in the catalogue. ### Reproduction 1. Use the stated baseline with its compiled runtime and Node 24.22.1 on PATH. Run the following shell block from the checkout root, with TMPDIR set to a disposable writable parent directory. It creates package-manager fixtures, isolates HOME/XDG, runs the unowned case, and then simulates exact npm-global ownership with an intentionally failing installer. The trap removes its fixtures. ```sh repo_root=$PWD node_bin=$(command -v node) fixture_root=$(mktemp -d "${TMPDIR:?}/rea-update-verify.XXXXXX") trap 'rm -rf "$fixture_root"' EXIT mkdir -p "$fixture_root/bin" "$fixture_root/home" "$fixture_root/config" \ "$fixture_root/cache" "$fixture_root/data" "$fixture_root/state" \ "$fixture_root/runtime" "$fixture_root/global/lib/node_modules" cat > "$fixture_root/bin/npm" <<'NPM' #!/bin/sh printf '%s\n' "$*" >> "$UPDATE_FIXTURE_ROOT/calls" case "$1" in root) printf '%s\n' "$UPDATE_FIXTURE_ROOT/global/lib/node_modules" ;; prefix) printf '%s\n' "$UPDATE_FIXTURE_ROOT/global" ;; view) printf '"6.9.0"\n' ;; install) printf 'fixture npm install denied\n' >&2; exit 23 ;; *) printf 'blocked unexpected npm command\n' >&2; exit 97 ;; esac NPM for runner in npx bun; do printf '#!/bin/sh\nprintf "blocked package runner\\n" >&2\nexit 97\n' \ > "$fixture_root/bin/$runner" done chmod +x "$fixture_root/bin/npm" "$fixture_root/bin/npx" "$fixture_root/bin/bun" run_rea() { env -i PATH="$fixture_root/bin:$(dirname "$node_bin"):/usr/bin:/bin" \ HOME="$fixture_root/home" USERPROFILE="$fixture_root/home" \ XDG_CONFIG_HOME="$fixture_root/config" XDG_CACHE_HOME="$fixture_root/cache" \ XDG_DATA_HOME="$fixture_root/data" XDG_STATE_HOME="$fixture_root/state" \ XDG_RUNTIME_DIR="$fixture_root/runtime" TMPDIR="$fixture_root" \ BUN_INSTALL_GLOBAL_DIR="$fixture_root/bun-global" \ UPDATE_FIXTURE_ROOT="$fixture_root" CI=1 NO_UPDATE_NOTIFIER=1 \ node scripts/rea.mjs update --json printf 'exit=%s\n' "$?" } run_rea ln -s "$repo_root" "$fixture_root/global/lib/node_modules/rea-agents" run_rea cat "$fixture_root/calls" ``` 2. Compare the first result with the catalogue entry identified below. The first command exits 1 with `unknown-install-method` and the package-manager/source-checkout sentence. The second exits 1 with `install` and a version/prefix-specific repair sentence. The recorded commands show only the npm fixture was invoked. Both branches reproduced with the initial controlled replay and the inline-shell replay. No real package-manager installation or registry request was performed. ### Expected behavior A catalogue entry marked unchanged, with a claim that its recovery assertion passed, should describe the supported current recovery or explicitly label the old guidance as superseded. This does not require changing the runtime or restoring the obsolete global-install recommendation. Historical original text can remain historical; the implementation status and verification attribution must identify that accurately. ### Impact and scope P3, supported: readers auditing update recovery receive an inaccurate implementation/verification claim. The observed CLI response still gives the intended recovery, and no consequential runtime failure or data change was established. A reader can obtain the current guidance from the command or owning workflow. Readership and frequency are unknown. Coverage is limited to a built source checkout on macOS with offline package-manager fixtures; no published-package update or other platform was tested. ### REA version Exact stdout from `node scripts/rea.mjs --version` was `6.8.0` followed by a newline. Baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; Darwin arm64. npm, npx and bun were fixture executables, not real package-manager clients. ### Interface CLI ### Earliest failure stage Unknown ### Relevant output or evidence The unowned case returned exit 1, empty stderr, and this JSON: ```json {"status":"failed","currentVersion":"6.8.0","latestVersion":"6.9.0","reason":"unknown-install-method","remediation":"Update this installation with the package manager or source checkout that owns it. For a one-off latest invocation, use npx rea-agents@latest."} ``` At the baseline: - `docs/user-visible-errors.csv:52`, harm_rank 40, names the unknown-install-method entry. It records `Update manually with: npm install --global rea-agents@latest`, `Keep current copy`, `unchanged`, and `existing focused assertion passed`. - `src/application/Update.ts:179-205` selects the unknown-owner result after release comparison and supplies the observed recovery. The built `dist/application/Update.js` has the same guidance. - `src/application/Update.test.ts:321-335` intentionally requires this case not to recommend `npm install --global` and not to attempt installation. This assertion was inspected, not executed as a test suite. - `src/main/messages.test.ts:15-26` reads the CSV and checks four canonical recovery messages. It establishes selected catalogue consistency checks, but does not validate these update entries. - `docs/testing.md:399-407` leaves documentation wording to review and favors structured recovery assertions over frozen prose. `docs/tool-design.md:327-330` requires relevant documentation to accompany contract changes. The catalogue is maintained documentation, not an immutable runtime string API. Corroborating comparison: `docs/user-visible-errors.csv:53`, harm_rank 41, marks the proposed npm-registry/permissions/manual-install sentence as implemented and verified. In the simulated npm-global failure, the CLI instead returned `REA could not install 6.9.0 in <fixture>/global: fixture npm install denied. Repair this npm installation, then rerun rea update.` The fixture prefix is normalized here. `src/application/Update.ts:208-218` supplies that sentence. Its historical `current_copy` differing from runtime is not itself the defect. ### Analysis or suspected cause The catalogue's update status and verification descriptions have not followed the current recovery policy. Source inspection establishes the disagreement; the exact change that introduced it was not bisected. Reconciling these documentation claims with the supported runtime resolves the reported discrepancy. ### Additional context Closed issue [#5077](https://github.com/morluto/rea/issues/5077) corrected a different obsolete process-input catalogue row; its owner explicitly treated source/documentation consistency as the closure criterion. It does not cover this update entry. Open PR [#7163](https://github.com/morluto/rea/pull/7163) fixes stale source-owner paths, including the two update rows, while explicitly preserving other columns and excluding stale wording. Its body already mentions the install-failure wording as deferred work. This report keeps the unknown-install-method entry primary and does not duplicate that PR's path correction. Read-only searches covered open and closed issues, issue comments, and open, closed and merged PRs using the exact reason, old recovery sentence, CSV filename, and update/catalogue combinations. No issue reporting this same row and implementation/verification discrepancy was found. No GitHub object was created or changed during verification.

bsakaguchi closed this issue

2026-10-31 00:51:03 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:32 +00:00

[PR #4343] [MERGED] fix(kuna): name the setting that owns a timed-out Kuna run #6188

bsakaguchi referenced this issue

2026-10-31 01:13:36 +00:00

[PR #4590] [MERGED] fix(ghidra): name the startup deadline setting when startup times out #6327

bsakaguchi referenced this issue

2026-11-01 21:45:48 +00:00

[PR #6142] fix(ghidra): add structured startup-timeout diagnostics #7156