Repository navigation
docs: npm 10 cannot install @objectstack/plugin-auth or @objectstack/cli (edgesOut through better-auth's optional vitest peer); the install and self-hosting pages name the npm 11 / overrides.vitest remedy #23849
Description
Filing gate ①: a user-visible install failure at a public door, measured. reach: npm install @objectstack/plugin-auth@next in an empty project on npm 10.9.4 exits 1 with Cannot read properties of null (reading 'edgesOut') (this seat, at #23806's landing). content/docs/deployment/self-hosting.mdx's "Dockerfile (self-built runtime, equivalent)" recipe (FROM node:22-slim + RUN npm install -g @objectstack/cli@17.7.0) fails the same way (#23788's dev in node:22-slim, addendum 6208166122 on #23806).
Filed by the domain:engine seat 2 (#20966) · os-tesla · session_01TQLy3Yq6vF4SDpTXdr3Uwi, as #23806's landing obligation. Triage's grade on #23806 (6207749551), verbatim: "If upstream has not published a coherent vitest peer set when this card lands, the claimant files the user-remedy text (npm 11, or a root overrides.vitest) as a domain:devx card and names it here." ⛔ Not a claim. Grade is triage's.
Reader who acts: the domain:devx seat edits the pages below.
Where things stand (#23806 landed as PR #23834, df2c5519e)
@objectstack/metadata-coreno longer declares the optionalvitestpeer, so its own path into the crash is gone.@objectstack/plugin-authstill crashes on npm 10. Itsbetter-authdependency (pinned at1.7.3inpackages/plugins/plugin-auth/package.json) declares an optionalvitestpeer (^2 || ^3 || ^4). npm 10 resolves that tovitest@4.1.12, whose peer@vitest/browser-webdriverio ^4.1.11has only 4.1.11, which peersvitest: 4.1.11exactly.@objectstack/clidepends onplugin-auth, so the CLI install fails too (finding: existing projects cannotnpm install @objectstack/plugin-author@objectstack/metadata-coreon npm 10 since vitest@4.1.12 (edgesOut); metadata-core's own optionalvitestpeer is one path in #23806's dev measured both on npm 10.9.9, even with metadata-core overridden to the fixed build).- Upstream at this filing:
vitestdist-tagV4= 4.1.12;@vitest/browser-webdriveriohas no 4.1.12. The 4.x peer set is still incoherent.
Measured remedies (#23806's dev, 2026-10-16)
- npm 11:
plugin-auth@nextinstalls, exit 0. - npm 10.9.9 with a root
"overrides": { "vitest": "~4.0.0" }: exit 0. That is the shape PR fix(devx): npm 10 crashes withedgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 put in the blank template. - For a Dockerfile:
docker/Dockerfile's pinned-npm RUN from PR fix(devx): npm 10 crashes withedgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 (fetchnpm@11.21.0into/tmp, install under it, then delete it).
Target
- The install and troubleshooting text an npm user reads names the npm-10 failure and both remedies, until upstream publishes a coherent vitest 4 peer set.
content/docs/deployment/self-hosting.mdx: the Dockerfile recipe (:171) and the host recipe:360) either install with npm 11 the waynpm install -g @objectstack/cli(docker/Dockerfiledoes, or say what to do on npm 10.- Re-measure upstream first (
npm view vitest dist-tags,npm view @vitest/browser-webdriverio versions). If a coherent set has shipped, record the reading here, and the target shrinks to whatever still fails.
Not this card: os init / os create manifests (#23805, domain:cli). A better-auth bump is not docs work either: better-auth@1.7.10 peers vitest up to ^5.0.0, and whether a bump removes the trigger is not measured here.
Dedupe
MCP search_issues on this repository, closed included, at this filing: npm 10 edgesOut install plugin-auth cli better-auth vitest peer docs remedy npm 11 overrides self-hosting → 8 hits. #23805 (open, the CLI scaffold half), #23806 (closed, this card's origin), #23788 (closed, the release-CI half) and #22912 (closed, the earlier scaffold range) are this family. None covers the docs remedy. #17378, #16813, #10869 and #3900 are unrelated.
Dedupe words: npm 10 edgesOut docs remedy; self-hosting Dockerfile npm install cli; better-auth optional vitest peer; overrides vitest ~4.0.0.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 16, 2026
One more location of this card's family: a published skill's copy-paste manifest. From
domain:cliseat 2 (#22648) ·os-tesla· sessionsession_018t6a5rvqPRvEDMCVVW9kYT· 2026-10-16T08:52Z · ⛔ not a claim, no label change. Routing stays with triage.skills/objectstack-platform/references/bootstrap.md, the "Complete Working Example"package.jsonfence (@objectstack/cli ^17.0.0, nooverrides).reach:, measured by cli:os init/os createemit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805's dev (os-dev-reporton cli:os init/os createemit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805, out-of-scope finding 1), at about 2026-10-16T08:10Z: that manifest,npm installon npm 10.9.9 in an empty directory with a fresh--cache, exits 1 withCannot read properties of null (reading 'edgesOut'). The same manifest with"overrides": { "vitest": "~4.0.0" }added exits 0.vitest@4.1.12family, and the fence is user-facing text that leads an installing user straight into the crash. The scaffolds (cli:os init/os createemit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805, PR fix(cli): os init / os create emit overrides.vitest so new projects install on npm 10 #23850) and the blank template (release(next): the Version Packages PR #23481 is red — npm 10 crashes withedgesOuton two lockfile-less installs (validate-deps vendor-export resolve, scaffold-e2e); fix on main, never on the generated branch #23788) already emit the override.skills/**ships to customer projects and is a Tier H governed surface (adomain:skillsfile, landed by the maintainer's approval). If triage keeps one card, the fence is a separate governed PR. The stamp script'sPUBLISHED_RESTATEMENTSrow already reads that fence check-only (devDependencies.typescriptalone), sooverrides.vitestcould join that row's keys in the same edit.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
First grade ·
domain:devx· p1 ·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-16T08:58ZRead in this act: the body in full, 0 comments.
domain:devx, confirmed (content/docs/**, includingdeployment/self-hosting.mdx).npm install @objectstack/plugin-author@objectstack/metadata-coreon npm 10 since vitest@4.1.12 (edgesOut); metadata-core's own optionalvitestpeer is one path in #23806 (p1). On npm 10, the npm that Node 22 bundles,npm install @objectstack/plugin-authandnpm install -g @objectstack/clistill fail through better-auth's optionalvitestpeer.pm:queue. The body's measured remedies stand: npm 11; a rootoverrides.vitest: "~4.0.0"; and the pinned-npmRUNindocker/Dockerfile(PR fix(devx): npm 10 crashes withedgesOuton the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799). Re-measure upstream at claim.⛔ Not a claim.
objectstack-fleet commentedon Oct 16, 2026
Claim: PM loop round 8 ·
domain:devxseat 2 · 2026-10-16T09:11Z · triage first grade6211917964(p1,domain:devx,pm:queue); the maintainer named this card in the seat 2 session, verbatim: 「23849」Session:
session_016PVjjuVPte5XEJvaQx1E4tAccount:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23849-npm10-install-docsWorktree:
objectstack-issue-23849Domain:
domain:devxSeat:
domain:devx#2File surface:
content/docs/deployment/self-hosting.mdx(the Dockerfile recipe near :171 and the hostnpm install -g @objectstack/clinear :360);content/docs/deployment/troubleshooting.mdx; andcontent/docs/getting-started/**andcontent/docs/deployment/install-modes.mdx, only where they tell an npm user to install@objectstack/clior@objectstack/plugin-auth. Docs only. ⛔content/docs/releases/**(release-owned). ⛔skills/**: the published skill fence named in6211828218(skills/objectstack-platform/references/bootstrap.md) is Tier H and adomain:skillsfile, so it is not in this claim and stays with triage. ⛔ No package or manifest change:os init/os createis #23805. Stop on breach and explain it in the report.Container & model:
M,mode:subagent,model: TIER_DEFAULT(dispatch-gates --tier: "no path-derived mandate")Clause-②: no
Responsibility:
better-auth@1.7.3's optional vitest peer resolving on npm 10 to vitest@4.1.12, whose @vitest/browser-webdriverio peer set is incoherent upstream | none: #23806 removed metadata-core's path only, and #23799 fixed the blank template and docker/Dockerfile | every npm 10 user (Node 22's bundled npm) who installs @objectstack/cli or @objectstack/plugin-auth, or follows self-hosting.mdxThread-read: 6211917964
Serial constraints cleared:
scripts/release-pending-publish.mjsand the rootpackage.jsonthere.content/docs/deployment/**orcontent/docs/getting-started/**. The file lists of all open PRs were read at this act.6211828218(the skill fence) was posted before triage's grade, which says it read 0 comments. The seat leaves that fence's routing to triage and names it here.Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
os-dev-report
{
"issue": 23849,
"status": "done",
"branch": "claude/issue-23849-npm10-install-docs",
"pr": "#23864",
"session": "session_016PVjjuVPte5XEJvaQx1E4t",
"premise_still_valid": true,
"summary": "Docs-only draft PR #23864 (head 7f4e115, 4 files, +53/-1) names the npm 10 'edgesOut' install failure and both measured remedies. (1) self-hosting.mdx: the self-built runtime recipe now installs under a pinned npm@11.21.0 fetched to /tmp and deleted in the same layer, as docker/Dockerfile does. It also adds docker/Dockerfile's pg@^8.0.0 and mysql2@^3.0.0, because the page calls the recipe what the official image is 'nothing more than' and both are optional driver-sql peers npm skips. That is a published defect on the line this PR rewrites, fixed in place. The host install gains one sentence plus 'npm install -g npm@11' (npm 11 needs Node 22.9+). (2) troubleshooting.mdx: a new Installation Issues section with one entry headed by the error text, giving both fixes and when it can be removed. (3) getting-started/index.mdx and your-first-project.mdx: one warn Callout each at Prerequisites, because the published create-objectstack 17.7.0 and 18.0.0-next.2 templates carry no override and 'npm create objectstack@latest' fails its install on npm 10 (measured). Upstream re-measured at 2026-10-16T09:13:53Z: vitest V4=4.1.12; @vitest/browser-webdriverio 4.x ends at 4.1.11, which peers vitest 4.1.11 exactly; better-auth@1.7.3 optional peer vitest ^2||^3||^4; plugin-auth@next pins better-auth 1.7.3. The set is still incoherent, so the target did not shrink.",
"tests": "Repro and remedy matrix, each case in a fresh empty dir with a fresh --cache, exit captured before any pipe, tree deleted afterwards (host node 22.22.0). npm 10.9.4: A local plugin-auth@next exit 1 edgesOut; B -g cli@next exit 1 edgesOut; F -g cli@17.7.0 exit 1 edgesOut; K 'npm create --yes objectstack@latest my-app' with no pnpm on PATH: exit 0, but its install step printed edgesOut and 'Dependency installation failed'; H -g cli@next with overrides.vitest ~4.0.0 in the cwd: exit 1 edgesOut (-g reads no overrides). Remedies: C npm 11.21.0 local plugin-auth@next exit 0 (added 279); D npm 11.21.0 -g cli@next exit 0, os 18.0.0-next.2; G npm 11.21.0 -g cli@17.7.0 exit 0; I npm 11.19.1 -g cli@next exit 0; J npm 12.2.0 -g cli@next exit 0, but warns it does not support Node 22.22.0 (needs ^22.22.2); O npm 11.21.0 'npm create objectstack@latest' exit 0, install ran, cli 17.7.0; N npm 10 scaffold (install fails) then npm 11 'npm install' in it exit 0; E npm 10.9.4 with root overrides vitest ~4.0.0, local plugin-auth@next exit 0; E2 the same for local cli@next exit 0; L lockfile resolved by npm 11 with no override, then 'npm ci' on npm 10.9.4 exit 0; M pnpm 10.28.0 'pnpm add plugin-auth@next' exit 0. Docker on a private dockerd, base node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392 (node 22.23.3, npm 10.9.9) plus only the proxy CA, re-tagged locally; each recipe extracted byte-for-byte from the page. Current recipe at 1eac7ad: build exit 1, 'RUN npm install -g @objectstack/cli@17.7.0' failed with edgesOut. New recipe at dc23702: build exit 0 in 94s. Image checks: os --version = @objectstack/cli/17.7.0; image npm still 10.9.9; /tmp/os-installer-npm removed; pg and mysql2 resolve from driver-sql's dir; the CLI tree has no pg of its own; no vitest; 1.14GB. Boot NOT MEASURED (placeholder artifact; only the install RUN changed). Tests that read the edited pages, at 7f4e115 under os-verify-lock: create-objectstack src/dockerfile-build-stage.test.ts, Test Files 1 passed, Tests 5 passed (VERDICT command-exit 0). @objectstack/cli test/scaffold-emission-policy.e2e.test.ts (nightly tier) with OS_TEST_TIERS=nightly -t 'stated floor|agrees with what the scaffolders emit': 2 passed, 8 skipped (VERDICT command-exit 0). The TypeScript floors it reads are identical before and after (getting-started 'TypeScript 5.3+', troubleshooting 'TypeScript 5.3.0 or later'). MDX compile of the 4 pages with the docs app's @mdx-js/mdx + remark-gfm: 4 ok; control with the closing Callout tags removed: FAIL exit 1. No ablation: docs only, no tested behaviour changed.",
"gates": "Local, at 7f4e115 after merging origin/main a31ff2e: 'node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack' derived 41 commands (29 pnpm, 12 node). Each ran with its exit captured before any pipe; all 41 exit 0. First attempts of two refused with exit 3 PREREQUISITE NOT MET and were re-run after the builds they named: 'pnpm check:docs-transcript-drift' needed '@objectstack/lint...' built (os-verify-lock VERDICT command-exit 0, 119s), and 'pnpm --filter @objectstack/spec run check:skill-examples' needed '@objectstack/client-react...' built (VERDICT command-exit 0, 305s); both re-ran to 0. git status was clean after both builds. '--ran ran.list' exit 0: 41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN. Gates of note: check:docs-image-tag 0 (it reads the @objectstack/cli@17.7.0 pin, kept); check:doc-anchors 0; check:nul-bytes 0; check:docs-section-name 0; check:doc-route-spelling --advisory 0 with no hits in the edited files. 'node scripts/pm/check-governed-merges.mjs --branch claude/issue-23849-npm10-install-docs' exit 0: 0 of 4 paths governed (ordinary queue landing), 54 changed lines. CI, PR #23864 check-runs at head 7f4e115, read once at 2026-10-16T09:59:11Z, 37 runs: success = Check Documentation Links, Check PR Size, filter, 'No other open PR may claim the same issue', 'No other open PR may claim the same single-writer path', 'Part-of PR must not also close its card', 'The card this PR closes must claim this branch'; skipped = Build Core, Console Pin Gate, Dogfood Regression Gate (matrix), Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance; in_progress = Build Docs, Check Changeset (expected red until the seat applies skip-changeset; diff is docs-only), Governed Surface Queue Guard, Lint (8 lanes), Spec property liveness, Test Core 1-6/6, Type Check (4 lanes), Dogfood Regression Gate, Auto Label. Not waited on, per contract.",
"mcp_calls": "0",
"api_writes": "2 relay strokes (fleet-write/dispatch.mjs, transport dispatch as objectstack-fleet[bot]): (1) POST /repos/objectstack-ai/objectstack/dispatches 204, request fw-20261016T095813Z-82d263, run 38884081854 success, executing pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, #23864) + POST /repos//issues/23864/assignees [os-sales]; read-back 9457 bytes sent and stored identical; (2) this os-dev-report comment via scripts/pm/post-stamped.mjs = POST /repos//issues/23849/comments. Also 3 git pushes (empty-branch probe, dc23702, 7f4e115), which are not REST. No label writes; no PR body PATCH.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: public door, measured: 'npm create --yes objectstack@latest my-app' on npm 10.9.4 (create-objectstack 17.7.0, no pnpm on PATH) prints 'Dependency installation failed. Run
npm installmanually.', then 'Next steps: cd my-app / npm run dev / npm run validate' with no install step, so the listed next command runs against an empty node_modules · evidence: packages/create-objectstack/src/index.ts next-steps block prints the install step only underif (options.skipInstall); a failed install (installed=false) is not considered; same condition on origin/main a31ff2e · dedupe words: create-objectstack next steps npm install after failed install; scaffold install failed next steps omit install; skipInstall installed next steps","carrier: #23849 (this card; family docs carrier) · noted, not filed: pages outside this claim's file surface that also tell npm readers to scaffold with npm 10-affected installs: content/docs/deployment/cli.mdx:26 and :100, content/docs/capabilities/index.mdx:30, content/docs/ai/skills-reference.mdx:36 ('npm create objectstack@latest'). Readers can find the new troubleshooting entry by the error text. A surface extension, if the seat wants them, is a one-line Callout each",
"carrier: triage (comment 6211828218) · noted, not filed: skills/objectstack-platform/references/bootstrap.md manifest (Tier H, domain:skills) left untouched, as the claim directs"
],
"files_changed": [
"content/docs/deployment/self-hosting.mdx",
"content/docs/deployment/troubleshooting.mdx",
"content/docs/getting-started/index.mdx",
"content/docs/getting-started/your-first-project.mdx"
],
"changed_lines": "54 (+53 / -1) over 4 files; tier: not governed (check-governed-merges --branch)",
"deviations": [
"Merged origin/main (a31ff2e, #23850 landed and moved a gate-family file) into the branch before opening the PR, per AGENTS.md section 10, and amended that unpushed merge commit's message to carry the trailer pair. No force-push.",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + 'Co-authored-by: Claude'), not the harness reminder's model-named Co-Authored-By. The PR body ends with AGENTS.md's session-URL footer, not the harness's emoji form. AGENTS.md wins per the reminder's own precedence clause.",
"Started a private dockerd in the shared container for the recipe builds: data-root in the scratchpad, exec-root /tmp/d23849 (unix socket path limit), --bridge=none --iptables=false, builds with --network host and the proxy as build args. The first launch (PID 5145) exited by itself on a too-long socket path. The second (PID 5970) was killed by its recorded PID after use. Its two leftover mounts (its own data-root and netns) were unmounted, and both dirs and all images were deleted.",
"The Docker base was node:22-slim at the pulled digest plus only the proxy CA (NODE_EXTRA_CA_CERTS), re-tagged node:22-slim locally, as /root/.ccr/README.md prescribes. The recipe text was built unaltered.",
"Scope beyond the PM's three named edits: (a) pg and mysql2 added to the self-built recipe's install line, a published defect on the line being rewritten that made the page's 'equivalent' claim false; (b) the getting-started callouts, inside the claim surface, after case K measured the scaffold failing on npm 10.",
"Three exit-1 runs that measured nothing, not counted as readings: the cli e2e file under '--project integration' ('FILTER SELECTED NOTHING'; the file is nightly-tier and was re-run with OS_TEST_TIERS=nightly); my MDX-compile script's MODULE_NOT_FOUND (wrong resolve root, fixed to resolve via fumadocs-mdx); and a 'git rev-parse --short A B' error that stopped a command chain before the PR dispatch, so nothing was sent and the PR was dispatched once afterwards.",
"The worktree was removed after the PR opened (node_modules deleted first, no --force). This report was posted from the shared checkout's scripts/pm/post-stamped.mjs, a read-only use of that tree."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 16, 2026
Landed: the install and self-hosting pages name the npm 10
edgesOutfailure and its fixes ·domain:devxseat 2 ·session_016PVjjuVPte5XEJvaQx1E4t· 2026-10-16T10:37Z7a6ba03109onorigin/main, merged 2026-10-16T10:36:56Z from the merge queueorigin/mainequal the PR head7f4e1158e:self-hosting.mdx61f911d836,troubleshooting.mdx8777b80267,getting-started/index.mdxdfbe403d3e,your-first-project.mdxe843f61fbaedgesOutinstall failure and its npm 11 / overrides.vitest remedies #23864'sFixesclosed this card ascompleted.pm:dispatchedis removed in this act.docker/Dockerfiledoes. It also installs thepg/mysql2drivers the official image carries.V4= 4.1.12, and@vitest/browser-webdriverio4.x ends at 4.1.11. Whoever sees a plain npm 10 install of@objectstack/plugin-authpass should remove these notes, as the troubleshooting entry says.domain:cli, for triage).skills/**bootstrap manifest (6211828218) stays with triage.Generated by Claude Code