You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
docs: require() in admin-created imposters needs --scripts-dir from rift#1611 #340
Release note (no code change). From the rift engine release carrying achird-labs/rift#1611 (PR #1644, merged 2026-10-18), a spawned or served rift whose admin API creates imposters that require() modules must be started with --scripts-dir, and the modules must sit under it. A require outside that directory, or with no --scripts-dir set, now fails. Host C-ABI calls are unaffected; they stay trusted. Update any docs or examples that use require in a decorate or inject.
Follow-up from rift#1617 (PR rift#1653, merged a24b627b; it ships in the rift release after v0.23.0). Required when the SDK bumps to that engine:
lookup CSV paths are now confined like require(). An engine started without --scripts-dir answers 400 to any admin-API lookup (lookup CSV path '…' cannot be read: no --scripts-dir is configured), and relative paths resolve from --scripts-dir.
Conformance replay: the sdk-conformance fixtures 03-behaviors and 16-behaviors-advanced post lookups on data/products.csv. Start the engine with --scripts-dir <corpus root> (spawn/container), or pass the new rift_serve_admin option "scriptsDir": "<corpus root>" (embedded/C-ABI). Feature-detect the option by its presence in serveOptions.
Docs: state that a lookup's path is relative to the server's --scripts-dir.
Docs: README §"scripts directory" (README.md:243-248) states that admin-API imposters read lookup CSVs and require() modules only under the scripts dir, and that a relative lookup path resolves against it. It also states that embedded create/addStub stay unconfined. docs/design/sdk-api.md:227-231 says the same.
Examples audit: no example or test in the repo require()s a module from an admin-created imposter.
Activity
EtaCassiopeia commentedon Oct 21, 2026
Follow-up from rift#1617 (PR rift#1653, merged a24b627b; it ships in the rift release after v0.23.0). Required when the SDK bumps to that engine:
lookupCSV paths are now confined likerequire(). An engine started without--scripts-diranswers 400 to any admin-API lookup (lookup CSV path '…' cannot be read: no --scripts-dir is configured), and relative paths resolve from--scripts-dir.03-behaviorsand16-behaviors-advancedpost lookups ondata/products.csv. Start the engine with--scripts-dir <corpus root>(spawn/container), or pass the newrift_serve_adminoption"scriptsDir": "<corpus root>"(embedded/C-ABI). Feature-detect the option by its presence inserveOptions.pathis relative to the server's--scripts-dir.EtaCassiopeia commentedon Oct 22, 2026
Correction: embedded mode does need a code change, because
EmbeddedOptionscannot passscriptsDir. Tracked in #343.EtaCassiopeia commentedon Oct 27, 2026
Triage: already done. Covered by #346 and #348 (merged 2026-10-27)
Every item in this issue and its rift#1617 follow-up is on
master:SpawnOptions.scriptsDir(Path)→--scripts-dir(chore(deps): bump rift engine to 0.24.0 and write behaviors the way it admits them #346).EmbeddedOptions.scriptsDir(Path)→rift_serve_adminscriptsDir, feature-detected viaserveOptions(feat(embedded): EmbeddedOptions has no scriptsDir, so require()/lookup are refused in admin-created imposters (rift#1617) #348, which closed feat(embedded): EmbeddedOptions has no scriptsDir, so require()/lookup are refused in admin-created imposters (rift#1617) #343).ConformanceTransport.SPAWNpasses the corpus payload root as scripts dir.LookupGrammarITuses a temp scripts dir (chore(deps): bump rift engine to 0.24.0 and write behaviors the way it admits them #346).README.md:243-248) states that admin-API imposters readlookupCSVs andrequire()modules only under the scripts dir, and that a relativelookuppath resolves against it. It also states that embeddedcreate/addStubstay unconfined.docs/design/sdk-api.md:227-231says the same.require()s a module from an admin-created imposter.Closing as completed.