morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1902] [MERGED] fix(install): describe automatic setup and guard truncated downloads #4894

New issue

Closed

opened 2026-10-31 00:56:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:31 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1902
Author: @larinyo
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: pr/install-script-hardening

📝 Commits (3)

e7d0605 fix(install): describe automatic setup and guard truncated downloads
4d92e65 fix(install): require the closing token before running main
677cad7 fix(install): wrap the whole script in the truncation guard

📊 Changes

2 files changed (+251 additions, -100 deletions)

View changed files

📝 install.sh (+114 -98)
📝 tests/boundary/filesystem/installScript.test.ts (+137 -2)

📄 Description

Summary

This PR fixes two problems in install.sh:

The --help text says the installer only installs the CLI and that rea setup must be run separately. In fact, the installer starts rea setup interactively whenever a terminal is available.
The script runs top to bottom as it streams through curl … | bash. If the download is cut off, bash runs a partial script.

Problem and expected behavior

Truncation trigger: the connection drops right after the npm install line. Bash then runs a prefix of the installer with whatever state that prefix leaves behind.
New behavior: the whole body is wrapped in main(), and main "$@" is the last line. A truncated download no longer parses, so nothing runs. The help text now describes the automatic interactive rea setup and the --no-setup/--no-prompt opt-outs.

Change and scope

install.sh: the main wrapper (the diff is mostly re-indentation) and the help text. Behavior is otherwise unchanged.
tests/boundary/filesystem/installScript.test.ts: a new scenario runs a copy truncated right after the npm install line. It requires that the copy prints nothing and never invokes npm.

Contract and boundary impact

Semantic owner and earliest changed stage: installer script.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: same supported platforms.
Evidence, artifact, provenance, or reconstruction contract: none.
Process execution, authorization, cleanup, or containment impact: a partial download never executes.
Generated metadata, package, or installation impact: installer only. docs/user-visible-errors.csv messages are unchanged.

Evidence and regression coverage

Tests added or updated: the truncated-download scenario.
Base reproduction: with the base install.sh in place, the new test fails (× runs nothing from a download truncated after the npm install line; 1 failed, 28 passed). With this change, all 29 pass.

Validation performed

bash -n install.sh: OK.
npx vitest run tests/boundary/filesystem/installScript.test.ts: 29 passed. Against the base script: 1 failed, as expected.
npx tsc --noEmit: clean. npx oxlint: 0 errors. npm run verify:module-boundaries: passed. npm run format: no changes.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real OS coverage: the installer was not run end to end on macOS or a real Linux distribution here. The boundary tests use stubs.
Package or release metadata impact: none.
Security review: this hardens the curl | bash path against partial execution.

Limits / not verified

shellcheck was not available on this host for this rebase. It was run (0.10.0, clean) on the same change when it was originally written.
npm run verify:package was not run.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1902 **Author:** [@larinyo](https://github.com/larinyo) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `pr/install-script-hardening` --- ### 📝 Commits (3) - [`e7d0605`](https://github.com/morluto/rea/commit/e7d0605853d6674f2057343db21cf10e258dede0) fix(install): describe automatic setup and guard truncated downloads - [`4d92e65`](https://github.com/morluto/rea/commit/4d92e65479e375ba5773eccdf2c17c63ee461bb7) fix(install): require the closing token before running main - [`677cad7`](https://github.com/morluto/rea/commit/677cad7bc40ff03a71bf1aafbbb86c451103f776) fix(install): wrap the whole script in the truncation guard ### 📊 Changes **2 files changed** (+251 additions, -100 deletions) <details> <summary>View changed files</summary> 📝 `install.sh` (+114 -98) 📝 `tests/boundary/filesystem/installScript.test.ts` (+137 -2) </details> ### 📄 Description ## Summary This PR fixes two problems in `install.sh`: 1. The `--help` text says the installer only installs the CLI and that `rea setup` must be run separately. In fact, the installer starts `rea setup` interactively whenever a terminal is available. 2. The script runs top to bottom as it streams through `curl … | bash`. If the download is cut off, bash runs a partial script. ## Problem and expected behavior - Truncation trigger: the connection drops right after the `npm install` line. Bash then runs a prefix of the installer with whatever state that prefix leaves behind. - New behavior: the whole body is wrapped in `main()`, and `main "$@"` is the last line. A truncated download no longer parses, so nothing runs. The help text now describes the automatic interactive `rea setup` and the `--no-setup`/`--no-prompt` opt-outs. ## Change and scope - `install.sh`: the `main` wrapper (the diff is mostly re-indentation) and the help text. Behavior is otherwise unchanged. - `tests/boundary/filesystem/installScript.test.ts`: a new scenario runs a copy truncated right after the npm install line. It requires that the copy prints nothing and never invokes npm. ## Contract and boundary impact - Semantic owner and earliest changed stage: installer script. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: same supported platforms. - Evidence, artifact, provenance, or reconstruction contract: none. - Process execution, authorization, cleanup, or containment impact: a partial download never executes. - Generated metadata, package, or installation impact: installer only. `docs/user-visible-errors.csv` messages are unchanged. ## Evidence and regression coverage - Tests added or updated: the truncated-download scenario. - Base reproduction: with the base `install.sh` in place, the new test fails (`× runs nothing from a download truncated after the npm install line`; 1 failed, 28 passed). With this change, all 29 pass. ## Validation performed - `bash -n install.sh`: OK. - `npx vitest run tests/boundary/filesystem/installScript.test.ts`: 29 passed. Against the base script: 1 failed, as expected. - `npx tsc --noEmit`: clean. `npx oxlint`: 0 errors. `npm run verify:module-boundaries`: passed. `npm run format`: no changes. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real OS coverage: the installer was not run end to end on macOS or a real Linux distribution here. The boundary tests use stubs. - Package or release metadata impact: none. - Security review: this hardens the `curl | bash` path against partial execution. ## Limits / not verified - `shellcheck` was not available on this host for this rebase. It was run (0.10.0, clean) on the same change when it was originally written. - `npm run verify:package` was not run. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:31 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:38 +00:00

[PR #4894] fix(update): drain output after progress destination closes #6461

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4894

No description provided.

Rows
Columns