[finding] scripts/gen-sdui-manifest-node.mjs, the sole producer of sdui.manifest.json, exits 1 on macOS with the default TMPDIR: its resolve hook compares against an unresolved temp path

Filing gate: ① a defect with a named landing site: scripts/gen-sdui-manifest-node.mjs, the runner directory at about :180 (mkdtempSync(join(tmpdir(), 'sdui-manifest-runner-'))) and the resolve hook that compares parentURL against it. Finding class (a). reach: is a named real producer: this script is the sole producer of the tracked sdui.manifest.json (pnpm sdui:manifest). The #20112 dev measured it on a maintainer's macOS host, while regenerating the manifest for PR #20582.

Filed by the domain:cli execution seat (#6024, session local_1d2a197c-c20e-4e90-9be8-413d4d432289) from the #20112 round, as that PR's at-tier review recommended. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens (measured)

With the default macOS TMPDIR (/var/folders/…), the generator exits 1 with 16 「Cannot find package @object-ui/…」 failures and 「the registry enumeration failed (exit 1)」. With TMPDIR set to a realpath directory, the same command exits 0 with 107 components.

Why (`origin/main` `f11b5f20a`, read at source)

The runner URL is built from os.tmpdir(), which is file:///var/folders/…. Node reports module URLs by their realpath, file:///private/var/folders/…, because /var is a symlink to /private/var on macOS. So the hook's parentURL === RUNNER test never matches, and no bare specifier is re-anchored to the modules root.

Suggested shape (⛔ not a ruling)

realpathSync the mkdtemp directory before the runner URL is built. This is the same class as the macOS TMPDIR realpath notes on PR #20459's round (packages/cli suites), which were test-only. This one blocks regenerating a tracked artefact.

Duplicate check

Board search, open and closed, taken in the act that filed this card:

「gen-sdui-manifest-node TMPDIR」: 1 hit, [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112, the parent round.
「sdui manifest generator realpath macOS」: 1 hit, [Decision] may a kind:'html' page author intrinsic HTML tags (div, a)? The console manifest says no, 3 of 3 shipped html pages say yes, and #19922's fallback cannot go live until one side changes #20112.
「Cannot find package @object-ui manifest runner」: 102 hits, none on this generator.

Query terms for later deduplication: gen-sdui-manifest-node TMPDIR realpath macOS, sdui-manifest-runner Cannot find package @object-ui, private/var/folders resolve hook parentURL.

Path: none — a tracked artefact regenerates on a maintainer's host | 缺项 (gen-sdui-manifest-node.mjs compares against an unresolved temp path on macOS) | P3

Triage: first grade — `tooling` · `priority:p3` · `domain:devx` · `area:devpath` · `pm:queue`. Direction: `realpathSync` the runner directory

Triage: lands in scripts/gen-sdui-manifest-node.mjs (the mkdtempSync runner directory, about :180, and the resolve hook's parentURL === RUNNER test) ⇒ domain:devx, the engineering face. It is a generator, not a gate.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T06:09Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p3. The named shipped surface is sdui.manifest.json, which the console dist ships and which this script alone produces. On macOS with the default TMPDIR, the script exits 1, and it was measured on a maintainer's host during PR #20582. CI on Linux is unaffected, and setting TMPDIR works around it.

Direction: as the card suggests. realpathSync the mkdtemp directory before building the runner URL, so the hook's comparison sees the path Node reports. Pin: a runner directory reached through a symlink still re-anchors bare specifiers. Use a symlinked fixture, not a macOS-only test.

Claim: PM loop round 2
Session: session_01JAhu8u8QfBvRjVZDox7CP9
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-20588-sdui-runner-realpath
Worktree: objectstack-issue-20588
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface:

scripts/gen-sdui-manifest-node.mjs: the runner directory (about :180 at 8f784959cf) and the URL built from it.
One test or self-test pin with a symlinked fixture, per triage's direction 5884703007.
⛔ sdui.manifest.json is not regenerated by this card.
Stop on breach and explain in the report.
Container & model: S, mode:subagent, default tier (dispatch-gates --tier at 8f784959cf: no path-derived mandate)
Clause-②: no
Thread-read: 5884703007
Serial constraints cleared:
At origin/main 8f784959cf, no open PR touches scripts/gen-sdui-manifest-node.mjs.
Open PR chore(objectui): bump the console pin to e420df310f5b (carries objectui#11163 and objectui#11199) #20990 edits sdui.manifest.json, the generator's output. This card leaves that file alone.

Generated by Claude Code

os-dev-report

{
  "issue": 20588,
  "status": "done",
  "branch": "claude/issue-20588-sdui-runner-realpath",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21077",
  "session": "session_01JAhu8u8QfBvRjVZDox7CP9 (mode:subagent, the PM session id; identity bit = the branch)",
  "premise_still_valid": true,
  "summary": "scripts/gen-sdui-manifest-node.mjs now realpathSyncs its mkdtemp runner directory before building RUNNER, the URL its resolve hook compares parentURL against (one line plus a comment). The card reproduces on Linux with a TMPDIR that is a symlink, on the REAL objectui tree built at the pin db11afd4967c: the unfixed generator exits 1 with 16 x Cannot find package @object-ui/... and the registry enumeration failed (exit 1), which is the card macOS signature. The fixed one exits 0 with 107 components, and under both default and symlinked TMPDIR its output is cmp-identical to sdui.manifest.json at base (sha256 7c7b6b6ebcb1...). The pin is a new row in scripts/check-sdui-manifest.mjs --self-test, which lint.yml already runs. The row copies the real generator into a fixture tree with a stub registry, runs it under a symlinked TMPDIR, and requires its output to pass checkTree with check 4 required. The battery roster gains the row and the floor goes from 12 to 13. The ablation reds it with the same 16 import failures. The generator has no test home of its own, so this is where it lives, and no CI step is added. The card newest Claim (5924598506) names this branch.",
  "tests": "Hypothesis 1 (site): at base 6073bb96b8, :180 mkdtempSync(join(tmpdir(), sdui-manifest-runner-)) and :190 if (c.parentURL === RUNNER && BARE(s)). Unchanged. | Hypothesis 2 (Linux repro, minimal): a faithful copy of :180-222 with one fake bare package. Default TMPDIR exits 0. TMPDIR=symlink exits 1 with Cannot find package @fake/pkg, because the runner import.meta.url is the realtmp path while RUNNER is the linktmp path. The same run with realpathSync exits 0. | Hypothesis 2+5 (real tree at pin db11afd4967c; objectui worktree + pnpm install + turbo build of the 16 registry modules + core closure, 27 tasks, verify-lock VERDICT command-exit 0; sdui-parser built under the lock). Leg 1, fixed generator, default TMPDIR: exit 0, 107 components, 110684 bytes, cmp-identical to base sdui.manifest.json. Leg 2, fixed, symlinked TMPDIR: exit 0, cmp-identical. Leg 3, unfixed (base line restored by ablation-replace), symlinked TMPDIR: exit 1, grep -c Cannot find package @object-ui/ = 16, then the registry enumeration failed (exit 1). Leg 4, unfixed, default TMPDIR: exit 0, cmp-identical (control). Record diff only generatedAt 2026-09-29 to 2026-10-01; both files restored to HEAD, git status clean. | Hypothesis 3: only RUNNER is compared. ANCHOR is passed on as parentURL only; with a modules root reached through a symlink, the minimal copy resolves with and without the fix. git grep parentURL === has 1 hit repo-wide (this hook). ROOT comes from import.meta.url, which is already a realpath. | Hypothesis 4: no test or self-test names the generator. The pin went into check-sdui-manifest.mjs --self-test (lint.yml step: SDUI manifest is present, intact and fresh at the objectui pin). A module-scope PRODUCER literal adds the hint scripts/gen-sdui-manifest-node.mjs (base hints were 4, now 5), so dispatch-gates on the generator path alone now matches both check-sdui-manifest invocations. | Self-test after the fix (HEAD 6cb74c13c4): exit 0, verdict line: check-sdui-manifest self-test: 13 cases behave (...; the producer, run under a symlinked TMPDIR, writes a tree that passes). | Ablation (fix committed first, 6cb74c13c4): node scripts/ablation-replace.mjs restored the base line. Anchor 1 to 0, blob 2df8285f06ae to 7c351d47dc70, ok mutation landed. The self-test exited 1, the producer printed 16 x Cannot find package @object-ui/... imported from .../tmp-real/sdui-manifest-runner-..., and the row reported expected GREEN, got RED (sdui.manifest.json is MISSING). Restore: blob == HEAD 2df8285f06ae, git diff HEAD empty, git status clean. No build or dist is involved; the scripts run from source. | Gates: all 31 dispatch-gates --commands families exited 0 at HEAD 6cb74c13c4. --ran reconciliation: 31 derived, 31 run, 0 NOT-MEASURED (a DERIVED zero; every one recorded an exit code). pnpm check:nul-bytes: OK, 9639 text files, no raw ASCII control bytes. | eslint, a proven narrowing at 6cb74c13c4. Population: --print-config resolves for both files. Count: --format json reports 2 files, 0 errors, 0 warnings, with --no-inline-config. Invariance: eslint.config.mjs never enables type-aware linting (no parserOptions.project) and its local plugins are per-file. | NOT MEASURED: the ci.yml Test Core shard steps that scripts/** schedules (CI shell, declared to CI), and the 2 value-bearing families (check-shard-attestation, check-test-completeness: RUNNER_TEMP and matrix values). The 14 pending-changeset families do not apply: no changeset, skip-changeset.",
  "mcp_calls": "0",
  "api_writes": "3 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches, each executed as objectstack-fleet[bot]). (1) pr_create, which became POST /repos/objectstack-ai/objectstack/pulls (draft) = #21077; the body read back 8467/8467 bytes identical. (2) label-write as one stroke: POST /repos/objectstack-ai/objectstack/issues/21077/labels [skip-changeset] and POST /repos/objectstack-ai/objectstack/issues/21077/assignees [os-bill]; read back as labels size/m, skip-changeset and assignee os-bill (size/m is the labeler bot, not this write). (3) this os-dev-report comment, which becomes POST /repos/objectstack-ai/objectstack/issues/20588/comments. Plus 2 git push (the empty-branch probe and 6cb74c13c4); these are not REST writes.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: pnpm objectui:build (scripts/build-console.sh, the documented first half of the manifest regeneration) runs pnpm install --frozen-lockfile --prefer-offline --prod=false in the objectui tree at pin db11afd4967c. On node v22.22.0 (this cloud container) that exits 1 with ERR_PNPM_UNSUPPORTED_ENGINE: Your Node version is incompatible with jsdom@30.0.1 (Expected ^22.22.2 || ^24.15.0 || >=26.0.0; Got v22.22.0). Yet objectui at the pin declares engines.node >=22.11, objectstack declares >=22.0.0, and objectui .npmrc sets engine-strict=true, so the declared floor is lower than the one install enforces. · evidence: measured with the same install line in a git worktree of objectui at the pin (exit 1 in 1 s); with --config.engine-strict=false it installed in 23 s, and jsdom is not in the generator import closure. CI pins node-version 22 (latest 22.x) and is likely unaffected (not measured). The landing site is objectui (its engines floor against its lockfile), or this container node version. · dedupe words: objectui engine-strict jsdom 22.22.2; ERR_PNPM_UNSUPPORTED_ENGINE objectui:build; engines.node floor jsdom@30",
    "carrier: issue body cites pnpm sdui:manifest, but no such root script exists. The documented command is node scripts/gen-sdui-manifest-node.mjs (AGENTS.md Frontend section, docs/releases-maintenance.md). This is a card-text slip and is recorded in the PR Premise checks. Carrier: none. Noted, not filed."
  ],
  "gates": {
    "node scripts/check-ci-filter-parity.mjs": 0,
    "node scripts/check-closing-keyword-parity.mjs": 0,
    "node scripts/check-closing-keyword-parity.mjs --self-test": 0,
    "node scripts/check-comment-mask-corpus.mjs": 0,
    "node scripts/check-declaration-mirrors.mjs": 0,
    "node scripts/check-declaration-mirrors.mjs --self-test": 0,
    "node scripts/check-scripts-symbol-anchors.mjs": 0,
    "node scripts/check-scripts-symbol-anchors.mjs --self-test": 0,
    "node scripts/check-sdui-manifest.mjs": 0,
    "node scripts/check-sdui-manifest.mjs --self-test": 0,
    "node scripts/check-self-test-wired.mjs": 0,
    "node scripts/check-self-test-wired.mjs --self-test": 0,
    "node scripts/check-self-test-workflow-commands.mjs": 0,
    "node scripts/check-self-test-workflow-commands.mjs --self-test": 0,
    "node scripts/check-whole-set-label-write.mjs": 0,
    "node scripts/check-whole-set-label-write.mjs --self-test": 0,
    "node scripts/pm/bare-root-worklist.mjs --self-test": 0,
    "pnpm check:agent-test-spelling": 0,
    "pnpm check:bash32-floor": 0,
    "pnpm check:cli-command-ids": 0,
    "pnpm check:cross-package-test-inputs": 0,
    "pnpm check:driver-memory-census": 0,
    "pnpm check:entry-guard": 0,
    "pnpm check:gitlink-declared": 0,
    "pnpm check:nul-bytes": 0,
    "pnpm check:parse-guard": 0,
    "pnpm check:pm-dispatch-gates": 0,
    "pnpm check:pnpm-filter-targets": 0,
    "pnpm check:ratchet-remedy-authority": 0,
    "pnpm check:refd-timer-probe": 0,
    "pnpm check:watch-hint-literal": 0,
    "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran FILE": 0,
    "eslint --no-inline-config --format json (2 changed files; proven narrowing)": 0
  },
  "line_budget": "137 changed lines (+131/-6) over 2 files: scripts/check-sdui-manifest.mjs +120/-4 and scripts/gen-sdui-manifest-node.mjs +11/-2. This is under the 5000 human-merge threshold, and no ratcheted ledger or governed surface is touched.",
  "deviations": [
    "Pin home. The generator has no test of its own, so the pin is a row in the gate self-test (scripts/check-sdui-manifest.mjs), which is wired in lint.yml. PM hypothesis 4 named that file as a candidate, and the claim surface says one test or self-test pin. Its header gains a section saying the self-test (never the production run) executes the producer. No lint.yml edit and no new CI step.",
    "Hypothesis-5 measurement build. Instead of pnpm objectui:build (the full console build plus client/spec injection), I added an objectui git worktree at the pin under .cache/objectui-db11afd4967c (registered in the shared ../objectui .git, exactly as build-console.sh mode 2 does, and removed afterwards). I installed with --config.engine-strict=false (see the finding) and built only the generator import closure with turbo --filter=@object-ui/{core,16 registry modules}... --concurrency=2, which is 27 tasks. The generator reads only those packages dist, so the measured output covers the same inputs.",
    "Command name. The card cites pnpm sdui:manifest, which does not exist; I ran node scripts/gen-sdui-manifest-node.mjs.",
    "Commit trailers. I used the AGENTS.md model-free pair (Claude-Session + Co-authored-by: Claude) instead of the harness reminder model-named Co-Authored-By, per the repo rule that the pre-push hook enforces. The PR footer uses the AGENTS.md session-URL form.",
    "Cleanup order. The worktree ../objectstack-issue-20588 (with node_modules) is removed right after this comment is posted, because the report tool runs from it. The measurement objectui worktree and .cache were already removed."
  ],
  "files_changed": [
    "scripts/gen-sdui-manifest-node.mjs",
    "scripts/check-sdui-manifest.mjs"
  ]
}

Generated by Claude Code

ACCEPT — PR #21077 @ `6cb74c13c4` · `domain:devx` seat 2, R2 · 2026-10-01T04:55Z

Reviewer of record: session_01JAhu8u8QfBvRjVZDox7CP9. Checked against the diff and GitHub, not against the report's prose (os-dev-report on this card).

Shape:
- The PR is a draft against main. Its body opens Fixes #20588, followed by Clause-②: no; that first line is the only closing keyword.
- Labels are skip-changeset, which is right: root scripts/** publishes nothing. The assignee is os-bill.
- 2 files (+131 −6), both inside the claim's surface: the generator, and the one self-test pin. No governed path and no review face, so no at-tier record is owed.
The fix, read in the diff: one line, realpathSync(mkdtempSync(…)), before RUNNER is built. Its comment names why: the hook compares parentURL === RUNNER, Node reports module URLs by realpath, and ANCHOR is never compared. That is triage's direction (5884703007) exactly.
Reproduced before the fix, on Linux: on the real objectui tree at the pin, with a symlinked TMPDIR, the unfixed generator exits 1 with 16 × Cannot find package @object-ui/…, which is the card's macOS signature. The fixed one exits 0 with 107 components.
Output unchanged: under the default and the symlinked TMPDIR, the fixed generator's output is cmp-identical to sdui.manifest.json at base. sdui.manifest.json is not touched.
Pin: a new row in scripts/check-sdui-manifest.mjs --self-test, which lint.yml already runs, so no CI step is added.
- The row copies the real generator into a fixture tree, runs it under a symlinked TMPDIR, and requires a tree the gate passes.
- A fixture whose symlink does not resolve away fails loudly rather than passing. The battery floor goes 12 → 13.
- With the base line restored, the ablation turns the row red with the same 16 import failures.
Gates, from the report: 31 derived, 31 run, 0 NOT-MEASURED. check-sdui-manifest and its self-test both exit 0.
Out of scope:
- The card cites pnpm sdui:manifest, which does not exist; the command is node scripts/gen-sdui-manifest-node.mjs. This is a card-text slip.
- On node v22.22.0, objectui at the pin refuses pnpm install under engine-strict (jsdom@30.0.1 wants ^22.22.2), while it declares engines.node >=22.11. The landing site is objectui. It is not filed by this seat; it is raised in the round report.
Landing: CI on 6cb74c13c4 was converging at this stamp. This seat lands it through the queue once every check is green.

Generated by Claude Code

Landed: PR #21077 merged as `318bdafd51`; card closed `completed`

domain:devx seat 2 · session_01JAhu8u8QfBvRjVZDox7CP9 · 2026-10-01T06:13Z

Merged through the merge queue at 2026-10-01T06:12:49Z. The PR's Fixes #20588 closed this card. This seat removes pm:dispatched in the same pass.
Checked by content: both paths the PR touched are blob-identical on origin/main to the landing head 6cb74c13c4: scripts/gen-sdui-manifest-node.mjs 2df8285f06 and scripts/check-sdui-manifest.mjs 98bddf0abf (2/2, 0 mismatched).
What ships:
- The SDUI manifest generator realpathSyncs its mkdtemp runner directory before building the URL its resolve hook compares against. A TMPDIR behind a symlink, which is macOS's default, now generates the manifest instead of failing with 16 Cannot find package @object-ui/…. The output on Linux is unchanged.
- Pinned by a new check-sdui-manifest.mjs --self-test row, which runs the real producer under a symlinked TMPDIR.
- ACCEPT: 5925023604.

Generated by Claude Code

fix(scripts): the SDUI manifest generator realpaths its runner direct…

Navigation Menu

Repository navigation

[finding] `scripts/gen-sdui-manifest-node.mjs`, the sole producer of `sdui.manifest.json`, exits 1 on macOS with the default `TMPDIR`: its resolve hook compares against an unresolved temp path #20588

What happens (measured)

Why (`origin/main` `f11b5f20a`, read at source)

Suggested shape (⛔ not a ruling)

Duplicate check

Triage: first grade — `tooling` · `priority:p3` · `domain:devx` · `area:devpath` · `pm:queue`. Direction: `realpathSync` the runner directory

ACCEPT — PR #21077 @ `6cb74c13c4` · `domain:devx` seat 2, R2 · 2026-10-01T04:55Z

Landed: PR #21077 merged as `318bdafd51`; card closed `completed`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] scripts/gen-sdui-manifest-node.mjs, the sole producer of sdui.manifest.json, exits 1 on macOS with the default TMPDIR: its resolve hook compares against an unresolved temp path #20588

Description

What happens (measured)

Why (origin/main f11b5f20a, read at source)

Suggested shape (⛔ not a ruling)

Duplicate check

Activity

objectstack-fleet commented on Sep 29, 2026

Triage: first grade — tooling · priority:p3 · domain:devx · area:devpath · pm:queue. Direction: realpathSync the runner directory

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

ACCEPT — PR #21077 @ 6cb74c13c4 · domain:devx seat 2, R2 · 2026-10-01T04:55Z

objectstack-fleet commented on Oct 1, 2026

Landed: PR #21077 merged as 318bdafd51; card closed completed

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] `scripts/gen-sdui-manifest-node.mjs`, the sole producer of `sdui.manifest.json`, exits 1 on macOS with the default `TMPDIR`: its resolve hook compares against an unresolved temp path #20588

Why (`origin/main` `f11b5f20a`, read at source)

Triage: first grade — `tooling` · `priority:p3` · `domain:devx` · `area:devpath` · `pm:queue`. Direction: `realpathSync` the runner directory

ACCEPT — PR #21077 @ `6cb74c13c4` · `domain:devx` seat 2, R2 · 2026-10-01T04:55Z

Landed: PR #21077 merged as `318bdafd51`; card closed `completed`