[GH-ISSUE #2325] [Bug] An empty HOME makes rea setup write client configs and the skill into the working directory #771

New issue

Closed

opened 2026-10-15 18:28:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:28:11 +00:00

Owner

Originally created by @kaoru0822-kitauji on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2325

Observed behavior

With HOME set to an empty string, rea setup writes client registrations and the REA skill relative to the current working directory, then reports ready:

$ mkdir /tmp/cwdtest && cd /tmp/cwdtest
$ env -i PATH="$PATH" HOME="" rea setup --client cursor --yes --json
status: ready
$ find /tmp/cwdtest
/tmp/cwdtest/.cursor/mcp.json
/tmp/cwdtest/.agents/skills/reverse-engineer-anything/SKILL.md
/tmp/cwdtest/.agents/skills/reverse-engineer-anything/references/…

--dry-run shows the relative targets (configure_client:cursor → .cursor/mcp.json, install_skill → .agents/skills/reverse-engineer-anything). Run from a project checkout, this writes REA configuration into the repository, and the real client configuration is never registered. The same home value feeds doctor, uninstall and configuration parsing, so they look in the working directory too.

This is the HOME counterpart of #2168 (empty XDG_CONFIG_HOME for OpenCode, being fixed in #2189). That fix does not cover HOME, which applies to every client and the skill.

Reproduction

Current main a97b713f7, macOS: run the commands above in an empty directory. An unset HOME falls back to the account home. An empty one does not.

Expected behavior

An empty HOME (or an empty USERPROFILE on Windows) is treated like an unset one, falling back to the host account's home directory, as most shells and tools do.

Cause

homeDirectoryFromEnvironment (src/config/homeDirectory.ts) chooses with ??, so an empty string counts as "selected". Every path joined onto "" (join("", ".cursor", "mcp.json")) becomes relative to the working directory.

A non-empty relative HOME (e.g. HOME=relative/home) also produces cwd-relative targets. Unlike an empty value, that is an explicit caller selection, so this issue only covers the empty case.

Originally created by @kaoru0822-kitauji on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2325 ### Observed behavior With `HOME` set to an empty string, `rea setup` writes client registrations and the REA skill relative to the **current working directory**, then reports `ready`: ```text $ mkdir /tmp/cwdtest && cd /tmp/cwdtest $ env -i PATH="$PATH" HOME="" rea setup --client cursor --yes --json status: ready $ find /tmp/cwdtest /tmp/cwdtest/.cursor/mcp.json /tmp/cwdtest/.agents/skills/reverse-engineer-anything/SKILL.md /tmp/cwdtest/.agents/skills/reverse-engineer-anything/references/… ``` `--dry-run` shows the relative targets (`configure_client:cursor → .cursor/mcp.json`, `install_skill → .agents/skills/reverse-engineer-anything`). Run from a project checkout, this writes REA configuration into the repository, and the real client configuration is never registered. The same home value feeds `doctor`, `uninstall` and configuration parsing, so they look in the working directory too. This is the `HOME` counterpart of #2168 (empty `XDG_CONFIG_HOME` for OpenCode, being fixed in #2189). That fix does not cover `HOME`, which applies to every client and the skill. ### Reproduction Current main a97b713f7, macOS: run the commands above in an empty directory. An unset `HOME` falls back to the account home. An empty one does not. ### Expected behavior An empty `HOME` (or an empty `USERPROFILE` on Windows) is treated like an unset one, falling back to the host account's home directory, as most shells and tools do. ### Cause `homeDirectoryFromEnvironment` (`src/config/homeDirectory.ts`) chooses with `??`, so an empty string counts as "selected". Every path joined onto `""` (`join("", ".cursor", "mcp.json")`) becomes relative to the working directory. A non-empty *relative* `HOME` (e.g. `HOME=relative/home`) also produces cwd-relative targets. Unlike an empty value, that is an explicit caller selection, so this issue only covers the empty case.

bsakaguchi

2026-10-15 18:28:11 +00:00