morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4980] fix(install): resolve the latest release from npm instead of GitHub #6708

New issue

Open

opened 2026-11-01 21:42:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:42:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4980
Author: @slyfox1186
Created: 10/18/2026
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (1)

bc4fa92 fix(install): resolve the latest release from npm instead of GitHub

📊 Changes

4 files changed (+92 additions, -60 deletions)

View changed files

📝 docs/installation.md (+1 -1)
📝 docs/user-visible-errors.csv (+3 -4)
📝 install.sh (+14 -9)
📝 tests/boundary/filesystem/installScript.test.ts (+74 -46)

📄 Description

Summary

The curl installer currently fails for every default install:

Installing rea-agents@6.6.0...
npm error code ETARGET
npm error notarget No matching version found for rea-agents@6.6.0.
REA installation failed: npm could not install REA. Check registry access and npm permissions, then retry.

install.sh selected its version from the GitHub releases/latest tag, but the Release workflow creates the GitHub release before qualification and npm publication. In Release run 39094414403 the rea-agents-6.6.0 release was created, qualification failed (test shards 1, 2 and 6), and "Publish to npm" was skipped. GitHub reports 6.6.0 as latest while npm dist-tags.latest is still 6.5.0, so the installer requests a version that does not exist.

No issue is linked; I found no existing report of this failure.

Problem and expected behavior

Trigger: run the installer without --version while a GitHub release exists without its npm publication.

Violated invariant: the installer must select a version that the npm install it runs can actually resolve. rea update already resolves dist-tags.latest through npm's configured registry, and docs/installation.md states that @latest selects the npm release.

New behavior: without --version, the installer installs the version npm's latest dist-tag selects.

Change and scope

install.sh resolves npm view --global [--prefix ~/.local] rea-agents dist-tags.latest --json, with the same npm scope and prefix it installs into. It accepts npm 11 output (a JSON string) and npm 12 output (a one-element array), matching parseNpmLatestVersion in src/application/UpdateRuntime.ts. Malformed, missing and ambiguous metadata, and non-SemVer versions, fail with recovery guidance before the plan is printed.
The script no longer uses curl, so its curl prerequisite and the unused REPOSITORY variable are removed. The documented curl ... | bash usage is unchanged.
The shebang becomes #!/usr/bin/env bash; the truncation guard's brace group still opens on line 2.
docs/installation.md and docs/user-visible-errors.csv describe the new resolution and messages.

Not included: changing the Release workflow so the GitHub release is created only after npm publication. That ordering is the upstream cause of the gap; this change only stops the installer from depending on it.

Contribution scope: an ordinary fix within existing boundaries; a maintainer scope decision is not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: install.sh version resolution; npm's latest dist-tag becomes the source, as it already is for rea update.
Contribution scope fit and linked maintainer decision: not applicable (installer bug fix).
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: Linux resolves with --prefix ~/.local, macOS with npm's own global prefix, matching the install command on each.
Evidence, artifact, provenance, or reconstruction contract: none.
Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: installation only; the default install now resolves the version from the npm registry instead of the GitHub API. No generated files are committed.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated (tests/boundary/filesystem/installScript.test.ts):
- The fake npm answers view.
- New tests cover the exact lookup and install commands on Linux and on Darwin, npm 12 array output, and lookup failure.
- Failure-path tests cover malformed, missing and ambiguous metadata, a non-SemVer version, and build metadata.
- The truncated-download test allows only the complete dry runs' lookups and no install.
- The curl fixture and the missing-curl test are removed.
Base reproduction:
- On the base revision, the installer printed the ETARGET failure above (observed locally).
- npm view rea-agents dist-tags returned { latest: '6.5.0' }, while the GitHub latest release was rea-agents-6.6.0.

User-visible output: a real bash install.sh --dry-run on Linux now prints:

REA install plan
  Version: 6.5.0
  Runtime: Node.js 24.19.0
  Command: npm install --global --prefix /home/jman/.local rea-agents@6.5.0
  Binary:  /home/jman/.local/bin/rea
  Setup:   start when a terminal is available
Dry run complete; no changes made.

Remaining proof gaps:
- No real (non-dry-run) install was performed.
- The macOS path is covered only by the fake-host test.
- npm 12 output is covered only by the fixture.

Validation performed

npm run test:focused -- tests/boundary/filesystem/installScript.test.ts: 38 passed.
npm run check:fast: passed (typecheck and lint, also via the pre-push hook).
npm run docs:check: passed.
npx oxlint tests/boundary/filesystem/installScript.test.ts, npx tsc --noEmit, bash -n install.sh, git diff --check: clean.
npm run check:test: typecheck, lint:built (0 errors), format:check, knip and metadata:check passed. test:run: 19153 passed, 4 failed, 170 skipped. Both failing files are environmental and do not touch the changed files:
- tests/boundary/process/releaseArtifactCanary.test.ts failed with EALLOWSCRIPTS, caused by allow-scripts in the local user ~/.npmrc under npm 11.17.0. It passed when rerun with NPM_CONFIG_USERCONFIG=/dev/null.
- tests/boundary/browser/cdpSvgXlinkHref.test.ts (3 tests) failed with target_not_allowed from local headless Chrome. Not investigated further; CI on the base commit b83b9caf4 is green.
shellcheck install.sh: one existing SC2015 note on an unchanged line.

Compatibility, safety, and release

Breaking changes or migration steps: none. --version behaves as before. A default install now needs npm registry access instead of GitHub API access; npm registry access was already required to install.
Real Hopper/Ghidra, browser, or OS coverage: Linux dry run against the real npm registry; macOS through the fake host only.
Package or release metadata impact: none.
Security, privacy, process, or containment review: the lookup uses the same npm configuration as the install, so registry mirrors and authentication apply consistently. The unauthenticated GitHub API request, which was subject to rate limits, is removed.

Author readiness

Human owner:

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4980 **Author:** [@slyfox1186](https://github.com/slyfox1186) **Created:** 10/18/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (1) - [`bc4fa92`](https://github.com/morluto/rea/commit/bc4fa92e67752105c97d67934967626d2a76f673) fix(install): resolve the latest release from npm instead of GitHub ### 📊 Changes **4 files changed** (+92 additions, -60 deletions) <details> <summary>View changed files</summary> 📝 `docs/installation.md` (+1 -1) 📝 `docs/user-visible-errors.csv` (+3 -4) 📝 `install.sh` (+14 -9) 📝 `tests/boundary/filesystem/installScript.test.ts` (+74 -46) </details> ### 📄 Description ## Summary The curl installer currently fails for every default install: ```text Installing rea-agents@6.6.0... npm error code ETARGET npm error notarget No matching version found for rea-agents@6.6.0. REA installation failed: npm could not install REA. Check registry access and npm permissions, then retry. ``` `install.sh` selected its version from the GitHub `releases/latest` tag, but the Release workflow creates the GitHub release before qualification and npm publication. In [Release run 39094414403](https://github.com/morluto/rea/actions/runs/39094414403) the `rea-agents-6.6.0` release was created, qualification failed (test shards 1, 2 and 6), and "Publish to npm" was skipped. GitHub reports 6.6.0 as latest while npm `dist-tags.latest` is still 6.5.0, so the installer requests a version that does not exist. No issue is linked; I found no existing report of this failure. ## Problem and expected behavior Trigger: run the installer without `--version` while a GitHub release exists without its npm publication. Violated invariant: the installer must select a version that the npm install it runs can actually resolve. `rea update` already resolves `dist-tags.latest` through npm's configured registry, and `docs/installation.md` states that `@latest` selects the npm release. New behavior: without `--version`, the installer installs the version npm's `latest` dist-tag selects. ## Change and scope - `install.sh` resolves `npm view --global [--prefix ~/.local] rea-agents dist-tags.latest --json`, with the same npm scope and prefix it installs into. It accepts npm 11 output (a JSON string) and npm 12 output (a one-element array), matching `parseNpmLatestVersion` in `src/application/UpdateRuntime.ts`. Malformed, missing and ambiguous metadata, and non-SemVer versions, fail with recovery guidance before the plan is printed. - The script no longer uses curl, so its curl prerequisite and the unused `REPOSITORY` variable are removed. The documented `curl ... | bash` usage is unchanged. - The shebang becomes `#!/usr/bin/env bash`; the truncation guard's brace group still opens on line 2. - `docs/installation.md` and `docs/user-visible-errors.csv` describe the new resolution and messages. Not included: changing the Release workflow so the GitHub release is created only after npm publication. That ordering is the upstream cause of the gap; this change only stops the installer from depending on it. Contribution scope: an ordinary fix within existing boundaries; a maintainer scope decision is not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: `install.sh` version resolution; npm's `latest` dist-tag becomes the source, as it already is for `rea update`. - Contribution scope fit and linked maintainer decision: not applicable (installer bug fix). - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: Linux resolves with `--prefix ~/.local`, macOS with npm's own global prefix, matching the install command on each. - Evidence, artifact, provenance, or reconstruction contract: none. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: installation only; the default install now resolves the version from the npm registry instead of the GitHub API. No generated files are committed. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [x] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated (`tests/boundary/filesystem/installScript.test.ts`): - The fake `npm` answers `view`. - New tests cover the exact lookup and install commands on Linux and on Darwin, npm 12 array output, and lookup failure. - Failure-path tests cover malformed, missing and ambiguous metadata, a non-SemVer version, and build metadata. - The truncated-download test allows only the complete dry runs' lookups and no install. - The curl fixture and the missing-curl test are removed. - Base reproduction: - On the base revision, the installer printed the ETARGET failure above (observed locally). - `npm view rea-agents dist-tags` returned `{ latest: '6.5.0' }`, while the GitHub latest release was `rea-agents-6.6.0`. - User-visible output: a real `bash install.sh --dry-run` on Linux now prints: ```text REA install plan Version: 6.5.0 Runtime: Node.js 24.19.0 Command: npm install --global --prefix /home/jman/.local rea-agents@6.5.0 Binary: /home/jman/.local/bin/rea Setup: start when a terminal is available Dry run complete; no changes made. ``` - Remaining proof gaps: - No real (non-dry-run) install was performed. - The macOS path is covered only by the fake-host test. - npm 12 output is covered only by the fixture. ## Validation performed - `npm run test:focused -- tests/boundary/filesystem/installScript.test.ts`: 38 passed. - `npm run check:fast`: passed (typecheck and lint, also via the pre-push hook). - `npm run docs:check`: passed. - `npx oxlint tests/boundary/filesystem/installScript.test.ts`, `npx tsc --noEmit`, `bash -n install.sh`, `git diff --check`: clean. - `npm run check:test`: typecheck, lint:built (0 errors), format:check, knip and metadata:check passed. `test:run`: 19153 passed, 4 failed, 170 skipped. Both failing files are environmental and do not touch the changed files: - `tests/boundary/process/releaseArtifactCanary.test.ts` failed with `EALLOWSCRIPTS`, caused by `allow-scripts` in the local user `~/.npmrc` under npm 11.17.0. It passed when rerun with `NPM_CONFIG_USERCONFIG=/dev/null`. - `tests/boundary/browser/cdpSvgXlinkHref.test.ts` (3 tests) failed with `target_not_allowed` from local headless Chrome. Not investigated further; CI on the base commit `b83b9caf4` is green. - `shellcheck install.sh`: one existing SC2015 note on an unchanged line. ## Compatibility, safety, and release - Breaking changes or migration steps: none. `--version` behaves as before. A default install now needs npm registry access instead of GitHub API access; npm registry access was already required to install. - Real Hopper/Ghidra, browser, or OS coverage: Linux dry run against the real npm registry; macOS through the fake host only. - Package or release metadata impact: none. - Security, privacy, process, or containment review: the lookup uses the same npm configuration as the install, so registry mirrors and authentication apply consistently. The unauthenticated GitHub API request, which was subject to rate limits, is removed. ## Author readiness  Human owner:  - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-01 21:42:26 +00:00

bsakaguchi referenced this issue

2026-11-01 21:47:35 +00:00

[PR #6728] feat(ci): require live dependency security evidence for releases #7400

bsakaguchi referenced this issue

2026-11-03 00:29:32 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

bsakaguchi referenced this issue

2026-11-03 00:29:32 +00:00