[GH-ISSUE #2580] fix(install): reject an explicitly empty version request #896

New issue

Closed

opened 2026-10-15 18:29:23 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:29:23 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2580

Summary

Supplying an empty argument to the installer's version option selects the latest release instead of rejecting the invalid request. The dry-run plan demonstrates that an explicit version request can silently turn into a different selection.

Steps to reproduce

From the repository root on a supported host with supported Node.js and npm, run this dry-run fixture. The substituted curl response makes release selection deterministic and performs no installation.

unset REA_VERSION
fixture=$(mktemp -d)
mkdir -p "$fixture/bin"
cat > "$fixture/bin/curl" <<'SH'
#!/bin/sh
printf '%s' '{"tag_name":"rea-agents-0.3.0"}'
SH
chmod +x "$fixture/bin/curl"
PATH="$fixture/bin:$PATH" bash install.sh --version "" --dry-run
PATH="$fixture/bin:$PATH" bash install.sh --version not-a-version --dry-run
PATH="$fixture/bin:$PATH" bash install.sh --version 0.3.0 --dry-run
PATH="$fixture/bin:$PATH" bash install.sh --dry-run
rm -rf "$fixture"

Expected behavior

The installer accepts exact semantic versions and rejects explicit values that are not semantic versions. An explicit empty argument should report the semantic-version error before resolving a release or printing an install plan. Omitting the option should continue selecting the latest release when REA_VERSION is unset or empty.

Actual behavior

The empty argument exits 0 and prints Version: 0.3.0 and Dry run complete; no changes made. The nonempty invalid argument exits 1 with REA installation failed: version must be an exact semantic version. Both the valid explicit version and omitted-option controls exit 0. These observations concern the dry-run path; source inspection establishes that the same resolved selection would be passed to npm during installation.

Evidence

Expected source: docs/installation.md:879 documents --version <semver>; docs/user-visible-errors.csv:105 requires rejection of explicit versions that are not exact semantic versions.
Failure source: install.sh:81-84 consumes the supplied empty argument, and install.sh:124-130 treats it as omission; install.sh:147 and install.sh:164 pass the resulting release to npm.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

Four dry-run invocations establish the empty-value failure and the invalid, valid, and omitted-option controls. No global package installation was performed.

Restoration check

The empty argument and the nonempty invalid argument must both fail validation without an install plan. A valid explicit version must still produce its requested plan, and omission with REA_VERSION unset or empty must still resolve the supplied latest-release tag.

Runtime or environment

Source baseline 8b181716ac, macOS, Bash 5.3.20, Node.js 26.10.0, npm 11.19.1, and a deterministic curl fixture.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The installer silently substitutes a release for an explicit invalid version request. The dry-run selection is observed, and the corresponding installation argument is established from source. The failure is bounded to explicitly empty input.
Workaround status: available
Workaround basis: Callers can supply a nonempty exact semantic version to preserve their intended selection; this control succeeds without a code change.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2580 ## Summary Supplying an empty argument to the installer's version option selects the latest release instead of rejecting the invalid request. The dry-run plan demonstrates that an explicit version request can silently turn into a different selection. ## Steps to reproduce From the repository root on a supported host with supported Node.js and npm, run this dry-run fixture. The substituted curl response makes release selection deterministic and performs no installation. ```bash unset REA_VERSION fixture=$(mktemp -d) mkdir -p "$fixture/bin" cat > "$fixture/bin/curl" <<'SH' #!/bin/sh printf '%s' '{"tag_name":"rea-agents-0.3.0"}' SH chmod +x "$fixture/bin/curl" PATH="$fixture/bin:$PATH" bash install.sh --version "" --dry-run PATH="$fixture/bin:$PATH" bash install.sh --version not-a-version --dry-run PATH="$fixture/bin:$PATH" bash install.sh --version 0.3.0 --dry-run PATH="$fixture/bin:$PATH" bash install.sh --dry-run rm -rf "$fixture" ``` ## Expected behavior The installer accepts exact semantic versions and rejects explicit values that are not semantic versions. An explicit empty argument should report the semantic-version error before resolving a release or printing an install plan. Omitting the option should continue selecting the latest release when `REA_VERSION` is unset or empty. ## Actual behavior The empty argument exits 0 and prints `Version: 0.3.0` and `Dry run complete; no changes made.` The nonempty invalid argument exits 1 with `REA installation failed: version must be an exact semantic version.` Both the valid explicit version and omitted-option controls exit 0. These observations concern the dry-run path; source inspection establishes that the same resolved selection would be passed to npm during installation. ## Evidence - Expected source: docs/installation.md:879 documents `--version <semver>`; docs/user-visible-errors.csv:105 requires rejection of explicit versions that are not exact semantic versions. - Failure source: install.sh:81-84 consumes the supplied empty argument, and install.sh:124-130 treats it as omission; install.sh:147 and install.sh:164 pass the resulting release to npm. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete Four dry-run invocations establish the empty-value failure and the invalid, valid, and omitted-option controls. No global package installation was performed. ## Restoration check The empty argument and the nonempty invalid argument must both fail validation without an install plan. A valid explicit version must still produce its requested plan, and omission with `REA_VERSION` unset or empty must still resolve the supplied latest-release tag. ## Runtime or environment Source baseline 8b181716aca2cb467be499cba226abfb5ae19141, macOS, Bash 5.3.20, Node.js 26.10.0, npm 11.19.1, and a deterministic curl fixture. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The installer silently substitutes a release for an explicit invalid version request. The dry-run selection is observed, and the corresponding installation argument is established from source. The failure is bounded to explicitly empty input. - Workaround status: available - Workaround basis: Callers can supply a nonempty exact semantic version to preserve their intended selection; this control succeeds without a code change.

bsakaguchi

2026-10-15 18:29:23 +00:00

closed this issue
added the
area: setup

bug
labels

bsakaguchi commented

2026-10-15 18:29:24 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Addressed on main in ec56c1da0.

An explicitly empty --version request fails semantic-version validation before release lookup; omission retains its existing latest-release behavior.

Validation: Installer boundary regression and valid/omitted-option controls passed.

Verification scope: No package publication was performed.

@morluto commented on GitHub (Oct 14, 2026): Addressed on main in [ec56c1da0](https://github.com/morluto/rea/commit/ec56c1da0). An explicitly empty --version request fails semantic-version validation before release lookup; omission retains its existing latest-release behavior. Validation: Installer boundary regression and valid/omitted-option controls passed. Verification scope: No package publication was performed.

bsakaguchi referenced this issue

2026-10-16 21:02:34 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:17:20 +00:00

[PR #896] [MERGED] refactor(javascript): group application workflows and verification #2327

bsakaguchi referenced this issue

2026-10-16 21:17:29 +00:00

[PR #907] [MERGED] refactor(javascript): group domain semantics and contracts #2337