morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2517] fix(verify-package-setup): cancellation check accepts disabled terminal modes #834

New issue

Closed

opened 2026-10-15 18:28:51 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:51 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2517

Summary

The package verification lane can accept a cancelled setup run even when its terminal has canonical input or echo disabled. Its check treats the presence of each setting name in the terminal report as evidence that the setting is enabled. Normal terminal reports also include those names when the settings are disabled, so this assertion cannot distinguish a restored terminal from these unrestored states. This verification defect is established from source; it is not evidence that the current setup wizard damages terminal state.

Steps to reproduce

Use the source baseline under Runtime or environment on a non-Windows host. Follow the package verification command to its interactive setup cancellation helper. The following steps retrace a source-based proof; the complete package verification command was not executed locally.
Consider the helper's post-cancellation transcript with the agent-selection prompt, the cursor-show escape sequence, the message "No changes were made.", and the final exit-marker JSON containing status 0. Let the PTY exit code also be 0 and the monitored files remain unchanged. These satisfy the helper's cancellation, cursor, exit-status, and file-preservation guards.
Set the JSON termios field to a successful terminal listing whose local-flags line is the fixture below. This line was observed from a disposable macOS PTY after disabling canonical input and echo. A complete listing contains the other terminal settings too; those do not change either substring result.

lflags: -icanon isig iexten -echo echoe -echok echoke -echonl echoctl

Follow the terminal-state clause. Both substring checks return true because the disabled tokens contain the setting names. The clause therefore does not reject, and the helper resolves successfully after the unchanged-file check. Disabling just canonical input or just echo has the same source-established result.

Expected behavior

When setup is cancelled at the agent-selection prompt, the package verification lane should require canonical input and echo to be enabled before it accepts the terminal as restored. It should reject a cancellation transcript with either setting disabled even when the child exits successfully, shows the cursor, reports no changes, and preserves all monitored files.

Actual behavior

The terminal clause accepts ordinary successful terminal listings containing disabled canonical input or disabled echo. The other cancellation guards and the subsequent file-preservation assertion do not inspect the state of these flags. With those other conditions satisfied, the helper reports success. This result follows from the current source; runtime reproduction of the helper and the full package lane was not run. Only the terminal listing representation was observed directly in disposable PTYs.

Evidence

Expected source: scripts/verify-package-setup.mjs:128-147 requires cancellation with a restored terminal and exit 0; docs/installation.md:44-45 documents cancellation at any prompt.
Failure source: scripts/verify-package-setup.mjs:82-97 captures the terminal listing, :119-137 parses it and tests setting-name substrings, and :145-147 accepts unchanged files without further terminal-state validation.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: complete

The supported entry point is package.json:215, which invokes scripts/verify-package.mjs. Its setup stage at scripts/verify-package.mjs:157-173 calls the package setup verifier, which invokes the interactive cancellation helper unconditionally at scripts/verify-package-setup.mjs:733-738. On non-Windows hosts the wrapper queries terminal settings through its inherited PTY input. The transcript in the reproduction satisfies every relevant rejection guard and the later unchanged-file requirement. The Windows branch skips this terminal-flag clause and is outside the finding's scope.

Direct terminal observations provide a discriminating representation control. An enabled PTY listed "icanon" and "echo"; a separate PTY with both settings disabled listed "-icanon" and "-echo". The disabled PTY's saved mode was restored after observation. Each disabled token still contains the setting name that the verifier searches for.

Restoration check

Use otherwise identical cancellation transcripts and unchanged-file snapshots with canonical input and echo both enabled, canonical input alone disabled, echo alone disabled, and both disabled. The helper must accept the enabled control and reject all three disabled cases with its terminal-restoration error. Keep its existing cancellation, exit-status, cursor, message, and file-preservation checks effective so success cannot result from weakening those contracts.

Runtime or environment

Failure verified at a2d8b94dd5 and still present at 8b181716ac; Node v26.10.0; npm 11.19.1. Terminal representation controls ran in disposable macOS PTYs. Dependencies were already installed. The package lane was not executed.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The package cancellation gate can report success for terminal states it is meant to reject. This removes useful regression detection for canonical input and echo restoration; no current end-user terminal-restoration failure was established.
Workaround status: available
Workaround basis: A maintainer can inspect the exact enabled or disabled flag tokens in a terminal report after a controlled cancellation, independently of this automated assertion. Disposable PTY observations confirmed that the two states have distinguishable flag tokens.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2517 ## Summary The package verification lane can accept a cancelled setup run even when its terminal has canonical input or echo disabled. Its check treats the presence of each setting name in the terminal report as evidence that the setting is enabled. Normal terminal reports also include those names when the settings are disabled, so this assertion cannot distinguish a restored terminal from these unrestored states. This verification defect is established from source; it is not evidence that the current setup wizard damages terminal state. ## Steps to reproduce 1. Use the source baseline under Runtime or environment on a non-Windows host. Follow the package verification command to its interactive setup cancellation helper. The following steps retrace a source-based proof; the complete package verification command was not executed locally. 2. Consider the helper's post-cancellation transcript with the agent-selection prompt, the cursor-show escape sequence, the message "No changes were made.", and the final exit-marker JSON containing status 0. Let the PTY exit code also be 0 and the monitored files remain unchanged. These satisfy the helper's cancellation, cursor, exit-status, and file-preservation guards. 3. Set the JSON termios field to a successful terminal listing whose local-flags line is the fixture below. This line was observed from a disposable macOS PTY after disabling canonical input and echo. A complete listing contains the other terminal settings too; those do not change either substring result. ```text lflags: -icanon isig iexten -echo echoe -echok echoke -echonl echoctl ``` 4. Follow the terminal-state clause. Both substring checks return true because the disabled tokens contain the setting names. The clause therefore does not reject, and the helper resolves successfully after the unchanged-file check. Disabling just canonical input or just echo has the same source-established result. ## Expected behavior When setup is cancelled at the agent-selection prompt, the package verification lane should require canonical input and echo to be enabled before it accepts the terminal as restored. It should reject a cancellation transcript with either setting disabled even when the child exits successfully, shows the cursor, reports no changes, and preserves all monitored files. ## Actual behavior The terminal clause accepts ordinary successful terminal listings containing disabled canonical input or disabled echo. The other cancellation guards and the subsequent file-preservation assertion do not inspect the state of these flags. With those other conditions satisfied, the helper reports success. This result follows from the current source; runtime reproduction of the helper and the full package lane was not run. Only the terminal listing representation was observed directly in disposable PTYs. ## Evidence - Expected source: scripts/verify-package-setup.mjs:128-147 requires cancellation with a restored terminal and exit 0; docs/installation.md:44-45 documents cancellation at any prompt. - Failure source: scripts/verify-package-setup.mjs:82-97 captures the terminal listing, :119-137 parses it and tests setting-name substrings, and :145-147 accepts unchanged files without further terminal-state validation. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: complete The supported entry point is package.json:215, which invokes scripts/verify-package.mjs. Its setup stage at scripts/verify-package.mjs:157-173 calls the package setup verifier, which invokes the interactive cancellation helper unconditionally at scripts/verify-package-setup.mjs:733-738. On non-Windows hosts the wrapper queries terminal settings through its inherited PTY input. The transcript in the reproduction satisfies every relevant rejection guard and the later unchanged-file requirement. The Windows branch skips this terminal-flag clause and is outside the finding's scope. Direct terminal observations provide a discriminating representation control. An enabled PTY listed "icanon" and "echo"; a separate PTY with both settings disabled listed "-icanon" and "-echo". The disabled PTY's saved mode was restored after observation. Each disabled token still contains the setting name that the verifier searches for. ## Restoration check Use otherwise identical cancellation transcripts and unchanged-file snapshots with canonical input and echo both enabled, canonical input alone disabled, echo alone disabled, and both disabled. The helper must accept the enabled control and reject all three disabled cases with its terminal-restoration error. Keep its existing cancellation, exit-status, cursor, message, and file-preservation checks effective so success cannot result from weakening those contracts. ## Runtime or environment Failure verified at a2d8b94dd50dab8d966239dd63ab84718aa8b4b4 and still present at 8b181716aca2cb467be499cba226abfb5ae19141; Node v26.10.0; npm 11.19.1. Terminal representation controls ran in disposable macOS PTYs. Dependencies were already installed. The package lane was not executed. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The package cancellation gate can report success for terminal states it is meant to reject. This removes useful regression detection for canonical input and echo restoration; no current end-user terminal-restoration failure was established. - Workaround status: available - Workaround basis: A maintainer can inspect the exact enabled or disabled flag tokens in a terminal report after a controlled cancellation, independently of this automated assertion. Disposable PTY observations confirmed that the two states have distinguishable flag tokens.

bsakaguchi

2026-10-15 18:28:51 +00:00

closed this issue
added the
area: setup

bug
labels

bsakaguchi commented

2026-10-15 18:28:51 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in eca18e08ac80ac838eef78788bf82429bbb30673.

Interactive setup cancellation checks exact positive icanon and echo mode tokens, rejecting disabled and mixed controls.

Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verifier trust-boundary controls cover unavailable lineage, terminal modes, idle TCP teardown, and shared fixture cleanup; no real-provider verifier success is inferred.

Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [eca18e08ac80ac838eef78788bf82429bbb30673](https://github.com/morluto/rea/commit/eca18e08ac80ac838eef78788bf82429bbb30673). Interactive setup cancellation checks exact positive icanon and echo mode tokens, rejecting disabled and mixed controls. Validation: Affected suites passed in the merged 65-file run (1169 passed, 2 explicit skips), with full static/architecture checks and documentation checks passing. Final installed-package verification is recorded separately in the audit. Verifier trust-boundary controls cover unavailable lineage, terminal modes, idle TCP teardown, and shared fixture cleanup; no real-provider verifier success is inferred. Verification scope: Controlled source and production-boundary verification on macOS with pinned Node 24.18.0; real external engines and Windows hosts were not independently rerun. Closure covers the described source defect, not broader provider conformance or performance.

bsakaguchi referenced this issue

2026-10-16 21:16:34 +00:00

[PR #834] [MERGED] refactor(browser): align inspector exclusions with canonical vocabulary #2272

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#834

No description provided.

Rows
Columns