Found while fixing the same defect in the other scaffolder (#10323). Filing rather than fixing: packages/cli/src/commands/init.ts is outside that card's surface, and PR #10522 is currently modifying that exact file.
The shape
packages/cli/src/commands/init.ts builds a createdFiles array as it writes, then prints it:
// Summaryconsole.log(chalk.bold(' Created files:'));for(constfofcreatedFiles){console.log(chalk.green(` + ${f}`));}console.log('');// Install dependenciesif(flags.install){…execSync(`${chosenPm} install`,{stdio: 'inherit',cwd: targetDir});The list is printed before the install, so by construction it cannot name pnpm-lock.yaml, node_modules/, or anything else the package manager writes. Same root cause as #10323 in create-objectstack: the summary is assembled by the phase that writes the template, while later phases belong to other processes.
How it differs from #10323 — smaller, and worth confirming rather than assuming
The gap here is narrower, and the difference is the reason this is its own card rather than a copy of the fix:
So the severity is plainly lower. What has not been done is the measurement — #10323's own brief required scaffolding with the real CLI and diffing printed-vs-disk, and the number that came out (18,033 unreachable paths) was not guessable from reading the emitter. Whoever takes this should run objectstack init for real and diff, rather than porting the other fix on the strength of the shared shape.
Suggested landing
packages/create-objectstack/src/created-summary.ts (added in the #10323 PR) is a reusable implementation of the property "every path the run writes is reachable from what it prints" — it walks the finished directory, collapses large trees to one line with entry count and size, and exports unreachablePaths() as the assertion. If this card is taken up, moving that module somewhere both scaffolders can import is probably better than a second copy; that is a judgement for whoever picks it up, not a decision made here.
⚠️Serial note: PR #10522 is modifying packages/cli/src/commands/init.ts. Check whether it has landed before starting.
Found while fixing the same defect in the other scaffolder (#10323). Filing rather than fixing:
packages/cli/src/commands/init.tsis outside that card's surface, and PR #10522 is currently modifying that exact file.The shape
packages/cli/src/commands/init.tsbuilds acreatedFilesarray as it writes, then prints it:The list is printed before the install, so by construction it cannot name
pnpm-lock.yaml,node_modules/, or anything else the package manager writes. Same root cause as #10323 increate-objectstack: the summary is assembled by the phase that writes the template, while later phases belong to other processes.How it differs from #10323 — smaller, and worth confirming rather than assuming
The gap here is narrower, and the difference is the reason this is its own card rather than a copy of the fix:
initdoes not install skills (grep -n skills packages/cli/src/commands/init.tsreturns nothing), so the ~1.9 MB of unnamed agent instructions that made [finding] The scaffolder's "Created files" list names 12 files and omits AGENTS.md, both ~968 KB skill trees and the lockfiles — then tells you to review the skills it did not name #10323 a security-flavoured finding is absent here. No "review the skills" advice is printed either, so the pairing that made [finding] The scaffolder's "Created files" list names 12 files and omits AGENTS.md, both ~968 KB skill trees and the lockfiles — then tells you to review the skills it did not name #10323 the wrong failure direction does not apply.So the severity is plainly lower. What has not been done is the measurement — #10323's own brief required scaffolding with the real CLI and diffing printed-vs-disk, and the number that came out (18,033 unreachable paths) was not guessable from reading the emitter. Whoever takes this should run
objectstack initfor real and diff, rather than porting the other fix on the strength of the shared shape.Suggested landing
packages/create-objectstack/src/created-summary.ts(added in the #10323 PR) is a reusable implementation of the property "every path the run writes is reachable from what it prints" — it walks the finished directory, collapses large trees to one line with entry count and size, and exportsunreachablePaths()as the assertion. If this card is taken up, moving that module somewhere both scaffolders can import is probably better than a second copy; that is a judgement for whoever picks it up, not a decision made here.packages/cli/src/commands/init.ts. Check whether it has landed before starting.