morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1338] [Bug] Bundled skill tells agents to run rea-agents@latest, and pinning it fails doctor --skill #471

New issue

Closed

opened 2026-10-15 18:25:19 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:25:19 +00:00

Owner

Originally created by @CassieFox23 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1338

TL;DR: The packaged skill hard-codes rea-agents@latest. Pinning it to the installed version is the safe fix, but then doctor --skill calls the skill stale.

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

The packaged SKILL.md has npx -y rea-agents@latest … four times (doctor, the setup dry run, setup --yes, and the JS CLI fallback). On a pinned install, an agent following the skill pulls whatever is newest and may run a newer setup against the current config. If I change those lines to the installed version, doctor --skill reports config_drift "Installed REA skill identity is stale".

Reproduction

Install rea-agents@6.1.0 pinned and put its skill in place.
Replace rea-agents@latest with rea-agents@6.1.0 in SKILL.md.
Run rea doctor --skill --json.

Expected behavior

The packaged skill names the package's own version (rea-agents@6.1.0), the way the registration does, so a pinned install needs no edits and doctor --skill stays aligned.

Impact and scope

Pinned installs and the agents that follow the skill. No effect on analysis.

REA version

6.1.0

Runtime and platform

Node.js 22.22.2, Linux x86-64

Target and artifact context

No response

Interface

Package or setup

Earliest failure stage

Setup or provider admission

Relevant output or evidence

{"name":"skill:identity","ok":false,"classification":"config_drift","detail":"Installed REA skill identity is stale.","remediation":"Run rea setup to update the installed REA skill."}

Typed outcome or recovery expected

No response

Analysis or suspected cause

Source-derived: the identity check compares the skill files byte for byte with the bundled copy (canonicalSkillFiles in dist/application/SetupSkill.js), so any local edit reads as stale, and the remediation (rea setup) would undo the pin.

Additional context

#653 raised the same @latest problem for the docs' MCP example, and docs/installation.md on main still shows npx -y rea-agents@latest analyze-javascript-application (line 111).

🤖 Generated with Claude Code (Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1338 **TL;DR:** The packaged skill hard-codes `rea-agents@latest`. Pinning it to the installed version is the safe fix, but then `doctor --skill` calls the skill stale. ### Before submitting - [X] I searched the open and closed issues for a related report. - [X] I removed credentials, tokens, private paths, and sensitive target data. ### Area Setup, packaging, or upgrade ### Observed behavior The packaged `SKILL.md` has `npx -y rea-agents@latest …` four times (doctor, the setup dry run, setup `--yes`, and the JS CLI fallback). On a pinned install, an agent following the skill pulls whatever is newest and may run a newer `setup` against the current config. If I change those lines to the installed version, `doctor --skill` reports `config_drift` "Installed REA skill identity is stale". ### Reproduction 1. Install `rea-agents@6.1.0` pinned and put its skill in place. 2. Replace `rea-agents@latest` with `rea-agents@6.1.0` in `SKILL.md`. 3. Run `rea doctor --skill --json`. ### Expected behavior The packaged skill names the package's own version (`rea-agents@6.1.0`), the way the registration does, so a pinned install needs no edits and `doctor --skill` stays aligned. ### Impact and scope Pinned installs and the agents that follow the skill. No effect on analysis. ### REA version 6.1.0 ### Runtime and platform Node.js 22.22.2, Linux x86-64 ### Target and artifact context _No response_ ### Interface Package or setup ### Earliest failure stage Setup or provider admission ### Relevant output or evidence ```json {"name":"skill:identity","ok":false,"classification":"config_drift","detail":"Installed REA skill identity is stale.","remediation":"Run rea setup to update the installed REA skill."} ``` ### Typed outcome or recovery expected _No response_ ### Analysis or suspected cause Source-derived: the identity check compares the skill files byte for byte with the bundled copy (`canonicalSkillFiles` in `dist/application/SetupSkill.js`), so any local edit reads as stale, and the remediation (`rea setup`) would undo the pin. ### Additional context #653 raised the same `@latest` problem for the docs' MCP example, and `docs/installation.md` on main still shows `npx -y rea-agents@latest analyze-javascript-application` (line 111). 🤖 Generated with Claude Code (Opus 5.5) 🦊

bsakaguchi

2026-10-15 18:25:19 +00:00

closed this issue
added the
area: build

P1: high

bug
labels

bsakaguchi commented

2026-10-15 18:25:20 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 9, 2026):

TL;DR: This is fixed on main, so I'm closing it. Thanks Yi-111-a for writing the fix in #1346! And thanks morluto for landing it in 2793672ee.

Edit: removed the user tags.

I built main at 9c4a68b, which includes 2793672ee. The generated skills/reverse-engineer-anything/SKILL.md now says rea-agents@6.2.0 in all four places, and @latest nowhere. That matches my hand-pinned copy, apart from newer text. So a pinned install won't need the hand edit that doctor --skill flagged. I didn't run doctor --skill against this build.

It isn't in a release yet (6.2.0 is the latest), so I'll keep my local pin until it ships. #1346 is still open; I'll leave that one to you.

🤖 Generated with Claude Code (Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 9, 2026): **TL;DR:** This is fixed on main, so I'm closing it. Thanks Yi-111-a for writing the fix in #1346! And thanks morluto for landing it in 2793672ee. Edit: removed the user tags. I built main at 9c4a68b, which includes 2793672ee. The generated `skills/reverse-engineer-anything/SKILL.md` now says `rea-agents@6.2.0` in all four places, and `@latest` nowhere. That matches my hand-pinned copy, apart from newer text. So a pinned install won't need the hand edit that `doctor --skill` flagged. I didn't run `doctor --skill` against this build. It isn't in a release yet (6.2.0 is the latest), so I'll keep my local pin until it ships. #1346 is still open; I'll leave that one to you. 🤖 Generated with Claude Code (Opus 5.5) 🦊

bsakaguchi referenced this issue

2026-10-16 21:13:24 +00:00

[PR #471] [MERGED] refactor(test): colocate pure-domain tests and reduce test debt #2017

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#471

No description provided.

Rows
Columns