morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1625] [Bug] Native client verifiers leave HOME unbound and bypass Pi default skill discovery #549

New issue

Closed

opened 2026-10-15 18:26:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:03 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1625

Before submitting

Searched open and closed issues for related native-client HOME/verifier reports.
Removed credentials, private account paths and target data.

Area

MCP or agent integration / test verification

Observed behavior

verify-native-agent-client.mjs and verify-deepseek-client.mjs pass a replacement child environment with USERPROFILE but no HOME. On Linux, Node os.homedir() then resolves the real OS account home, rather than the disposable account. The Pi verifier compensates by writing an explicit settings.json skill directory; consequently it cannot establish the documented default ~/.agents/skills discovery path.

Reproduction

On Linux, run Node twice with an environment containing PATH, USERPROFILE pointing to a disposable account, and PI_CODING_AGENT_DIR pointing to a separate profile, but without HOME.
Print process.env.HOME, process.env.USERPROFILE, and os.homedir().
Both runs resolve the real account home. Compare this environment with the two REA native-client verifier scripts at revision 2653b194b695879dcb1d290feca56301282594bc.

Expected behavior

Disposable native-client accounts bind both HOME and USERPROFILE. Pi discovers the installed shared personal skill through its ordinary search path, with no extra skill setting. The model fixture must confirm that the installed path reaches the native prompt and is actually read.

Impact and scope

This is a REA-owned verifier isolation/coverage defect, not evidence of broken REA production setup or a native provider failure. Ambient personal resources may participate in client discovery despite replacement environment variables. Existing successful loopback runs remain integration evidence within their explicitly documented narrower discovery scope.

REA version

Source revision 2653b194b695879dcb1d290feca56301282594bc (skill 37); released package remains 6.3.0.

Runtime and platform

Node 24.18.0, Linux x64; Pi 1.1.0, DeepSeek Harness 0.2.0-rc.2, Hermes source 66605471e9f0b0832abbefaf625ce08e948ca540 / Python 3.14.7.

Target and artifact context

Disposable two-module JavaScript fixture; no native engine or target execution.

Interface

Package or setup (optional native CLI/MCP verifier)

Earliest failure stage

Setup or provider admission (child environment construction)

Relevant output or evidence

Two independent reduced probes returned HOME unset, USERPROFILE equal to the temporary account, and homedir equal to the real OS account home. Full native call runs passed twice per client under the existing narrower fixture settings.

Analysis or suspected cause

Confirmed in REA verifier source: replacement env omits HOME; Node’s POSIX fallback is not controlled by USERPROFILE. Fix that producing environment, remove Pi’s compensating explicit skill setting, and verify native default discovery.

Additional context

Follow-up to #1587. Proposed validation: repeat public setup plan/apply/doctor/idempotence, native skill loading and 170-tool discovery on Pi/Hermes/DeepSeek, including Hermes sticky profile. Windows, other client families and live analysis providers remain TODO. Deterministic model fixtures do not establish live-model understanding.

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1625 ### Before submitting - [x] Searched open and closed issues for related native-client HOME/verifier reports. - [x] Removed credentials, private account paths and target data. ### Area MCP or agent integration / test verification ### Observed behavior `verify-native-agent-client.mjs` and `verify-deepseek-client.mjs` pass a replacement child environment with `USERPROFILE` but no `HOME`. On Linux, Node `os.homedir()` then resolves the real OS account home, rather than the disposable account. The Pi verifier compensates by writing an explicit `settings.json` skill directory; consequently it cannot establish the documented default `~/.agents/skills` discovery path. ### Reproduction 1. On Linux, run Node twice with an environment containing PATH, USERPROFILE pointing to a disposable account, and PI_CODING_AGENT_DIR pointing to a separate profile, but without HOME. 2. Print `process.env.HOME`, `process.env.USERPROFILE`, and `os.homedir()`. 3. Both runs resolve the real account home. Compare this environment with the two REA native-client verifier scripts at revision `2653b194b695879dcb1d290feca56301282594bc`. ### Expected behavior Disposable native-client accounts bind both HOME and USERPROFILE. Pi discovers the installed shared personal skill through its ordinary search path, with no extra skill setting. The model fixture must confirm that the installed path reaches the native prompt and is actually read. ### Impact and scope This is a REA-owned verifier isolation/coverage defect, not evidence of broken REA production setup or a native provider failure. Ambient personal resources may participate in client discovery despite replacement environment variables. Existing successful loopback runs remain integration evidence within their explicitly documented narrower discovery scope. ### REA version Source revision `2653b194b695879dcb1d290feca56301282594bc` (skill 37); released package remains 6.3.0. ### Runtime and platform Node 24.18.0, Linux x64; Pi 1.1.0, DeepSeek Harness 0.2.0-rc.2, Hermes source `66605471e9f0b0832abbefaf625ce08e948ca540` / Python 3.14.7. ### Target and artifact context Disposable two-module JavaScript fixture; no native engine or target execution. ### Interface Package or setup (optional native CLI/MCP verifier) ### Earliest failure stage Setup or provider admission (child environment construction) ### Relevant output or evidence Two independent reduced probes returned HOME unset, USERPROFILE equal to the temporary account, and homedir equal to the real OS account home. Full native call runs passed twice per client under the existing narrower fixture settings. ### Analysis or suspected cause Confirmed in REA verifier source: replacement `env` omits HOME; Node’s POSIX fallback is not controlled by USERPROFILE. Fix that producing environment, remove Pi’s compensating explicit skill setting, and verify native default discovery. ### Additional context Follow-up to #1587. Proposed validation: repeat public setup plan/apply/doctor/idempotence, native skill loading and 170-tool discovery on Pi/Hermes/DeepSeek, including Hermes sticky profile. Windows, other client families and live analysis providers remain TODO. Deterministic model fixtures do not establish live-model understanding.

bsakaguchi

2026-10-15 18:26:03 +00:00

closed this issue
added the
triage

bug

area: tests
labels

bsakaguchi referenced this issue

2026-10-16 21:13:53 +00:00

[PR #549] [MERGED] refactor(host): inject platform and environment instead of reading them ambiently #2066

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#549

No description provided.

Rows
Columns