Skip to content

docs: require() in admin-created imposters needs --scripts-dir from rift#1611 #340

Closed

Description

@EtaCassiopeia

Release note (no code change). From the rift engine release carrying achird-labs/rift#1611 (PR #1644, merged 2026-10-18), a spawned or served rift whose admin API creates imposters that require() modules must be started with --scripts-dir, and the modules must sit under it. A require outside that directory, or with no --scripts-dir set, now fails. Host C-ABI calls are unaffected; they stay trusted. Update any docs or examples that use require in a decorate or inject.

Activity

  1. added
    agent-foundFinding discovered by automated agent review
    needs-triageIssue awaiting triage and prioritization
    on Oct 18, 2026
  2. EtaCassiopeia commented on Oct 21, 2026

    @EtaCassiopeia
    CollaboratorAuthor

    Follow-up from rift#1617 (PR rift#1653, merged a24b627b; it ships in the rift release after v0.23.0). Required when the SDK bumps to that engine:

    • lookup CSV paths are now confined like require(). An engine started without --scripts-dir answers 400 to any admin-API lookup (lookup CSV path '…' cannot be read: no --scripts-dir is configured), and relative paths resolve from --scripts-dir.
    • Conformance replay: the sdk-conformance fixtures 03-behaviors and 16-behaviors-advanced post lookups on data/products.csv. Start the engine with --scripts-dir <corpus root> (spawn/container), or pass the new rift_serve_admin option "scriptsDir": "<corpus root>" (embedded/C-ABI). Feature-detect the option by its presence in serveOptions.
    • Docs: state that a lookup's path is relative to the server's --scripts-dir.
  3. EtaCassiopeia commented on Oct 22, 2026

    @EtaCassiopeia
    CollaboratorAuthor

    Correction: embedded mode does need a code change, because EmbeddedOptions cannot pass scriptsDir. Tracked in #343.

  4. EtaCassiopeia commented on Oct 27, 2026

    @EtaCassiopeia
    CollaboratorAuthor

    Triage: already done. Covered by #346 and #348 (merged 2026-10-27)

    Every item in this issue and its rift#1617 follow-up is on master:

    Closing as completed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent-foundFinding discovered by automated agent review

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions