[PR #1638] [MERGED] fix(tests): bind HOME in native client and deepseek verifiers #4718

New issue

Closed

opened 2026-10-31 00:54:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:19 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1638
Author: @Totopo27
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: fix/unbound-home-verifier

📝 Commits (1)

e41b479 fix(tests): bind HOME in native client and deepseek verifiers

📊 Changes

2 files changed (+2 additions, -7 deletions)

View changed files

📝 scripts/verify-deepseek-client.mjs (+1 -0)
📝 scripts/verify-native-agent-client.mjs (+1 -7)

📄 Description

Summary

Fixes #1625

Bind HOME alongside USERPROFILE to the isolated test account directory in scripts/verify-native-agent-client.mjs and scripts/verify-deepseek-client.mjs, and remove the compensating explicit settings.json skill directory setting for Pi.

Problem and expected behavior

verify-native-agent-client.mjs and verify-deepseek-client.mjs constructed replacement child environments with USERPROFILE but omitted HOME. On POSIX platforms (such as Linux), Node's os.homedir() fell back to the ambient OS account directory rather than the disposable account. The Pi native client verifier had to compensate by writing an explicit settings.json skill directory override, which bypassed testing the documented default ~/.agents/skills discovery mechanism.

Expected behavior: Disposable accounts bind both HOME and USERPROFILE. Native clients (such as Pi) discover bundled skills installed in ~/.agents/skills via their default search path without requiring an explicit settings override.

Change and scope

Added HOME: account to the isolated child environment in scripts/verify-native-agent-client.mjs.
Removed the compensating settings.json write in scripts/verify-native-agent-client.mjs so Pi exercises default discovery path ~/.agents/skills.
Added HOME: account to the isolated child environment in scripts/verify-deepseek-client.mjs.

Contract and boundary impact

Semantic owner and earliest changed stage: Test verifier environments (scripts/verify-*.mjs)
CLI and MCP/tool-catalog contract: none
Provider, bridge, target-format, or platform compatibility: improves POSIX/Linux verifier account isolation
Evidence, artifact, provenance, or reconstruction contract: none
Process execution, authorization, cleanup, or containment impact: ensures child processes resolve the isolated temporary home directory via os.homedir() / POSIX conventions
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none

Evidence and regression coverage

Tests added or updated: scripts/verify-native-agent-client.mjs, scripts/verify-deepseek-client.mjs
Base reproduction or other evidence: Observed in Issue #1625 analysis and verified in script source
User-visible CLI/MCP output: none
Remaining proof gaps: none

Validation performed

git diff scripts/ — verified exact 9-line diff across the 2 scripts.
gentle-ai review assess — evaluated diff risk: medium (executable_change), under budget.

Compatibility, safety, and release

Breaking changes or migration steps: none
Real Hopper/Ghidra, browser, or OS coverage: none
Package or release metadata impact: none
Security, privacy, process, or containment review: none

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1638 **Author:** [@Totopo27](https://github.com/Totopo27) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/unbound-home-verifier` --- ### 📝 Commits (1) - [`e41b479`](https://github.com/morluto/rea/commit/e41b479ad1a9a2bbd183b3481ed614d08e43039d) fix(tests): bind HOME in native client and deepseek verifiers ### 📊 Changes **2 files changed** (+2 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `scripts/verify-deepseek-client.mjs` (+1 -0) 📝 `scripts/verify-native-agent-client.mjs` (+1 -7) </details> ### 📄 Description ## Summary Fixes #1625 Bind `HOME` alongside `USERPROFILE` to the isolated test account directory in `scripts/verify-native-agent-client.mjs` and `scripts/verify-deepseek-client.mjs`, and remove the compensating explicit `settings.json` skill directory setting for Pi. ## Problem and expected behavior `verify-native-agent-client.mjs` and `verify-deepseek-client.mjs` constructed replacement child environments with `USERPROFILE` but omitted `HOME`. On POSIX platforms (such as Linux), Node's `os.homedir()` fell back to the ambient OS account directory rather than the disposable account. The Pi native client verifier had to compensate by writing an explicit `settings.json` skill directory override, which bypassed testing the documented default `~/.agents/skills` discovery mechanism. Expected behavior: Disposable accounts bind both `HOME` and `USERPROFILE`. Native clients (such as Pi) discover bundled skills installed in `~/.agents/skills` via their default search path without requiring an explicit settings override. ## Change and scope - Added `HOME: account` to the isolated child environment in `scripts/verify-native-agent-client.mjs`. - Removed the compensating `settings.json` write in `scripts/verify-native-agent-client.mjs` so Pi exercises default discovery path `~/.agents/skills`. - Added `HOME: account` to the isolated child environment in `scripts/verify-deepseek-client.mjs`. ## Contract and boundary impact - Semantic owner and earliest changed stage: Test verifier environments (`scripts/verify-*.mjs`) - CLI and MCP/tool-catalog contract: none - Provider, bridge, target-format, or platform compatibility: improves POSIX/Linux verifier account isolation - Evidence, artifact, provenance, or reconstruction contract: none - Process execution, authorization, cleanup, or containment impact: ensures child processes resolve the isolated temporary home directory via `os.homedir()` / POSIX conventions - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none ## Evidence and regression coverage - Tests added or updated: `scripts/verify-native-agent-client.mjs`, `scripts/verify-deepseek-client.mjs` - Base reproduction or other evidence: Observed in Issue #1625 analysis and verified in script source - User-visible CLI/MCP output: none - Remaining proof gaps: none ## Validation performed - `git diff scripts/` — verified exact 9-line diff across the 2 scripts. - `gentle-ai review assess` — evaluated diff risk: medium (`executable_change`), under budget. ## Compatibility, safety, and release - Breaking changes or migration steps: none - Real Hopper/Ghidra, browser, or OS coverage: none - Package or release metadata impact: none - Security, privacy, process, or containment review: none ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:19 +00:00