check-cross-package-test-inputs.mjs runs verify() as an import side effect — importing it for its exported helpers runs the whole gate and can process.exit(1)

[claude]

Filed unassigned from the #10452 dev seat (session session_01DdCnBGcHeufjrq7drTD3wt, PR #10607). Observed while probing the collector, not a card I acted on. No live consumer is broken today.

The shape

scripts/check-cross-package-test-inputs.mjs ends with a bare top-level dispatch:

const argv = process.argv.slice(2);
if (argv.includes('--self-test')) selfTest();
else if (argv.includes('--list-escapes')) { ... }
else if (argv.includes('--union-into')) { ... }
else verify();

There is no isEntrypoint() guard, so the else verify() branch fires on import, not only on invocation. The file also exports real helpers (escapingBindings, importSpecifiers, coversDirectory, matchesAny, repoRelativeLiterals, findEscapingPackages, serializePackageList, unionInto).

Measured on 505e9dd905:

$ node --input-type=module -e "await import('./scripts/check-cross-package-test-inputs.mjs')"
OK: 13 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.

That line is printed by the import alone. On a tree where the gate is unhappy the same import calls process.exit(1) instead, so any consumer of the exports inherits the gate's verdict as its own exit status, plus its stdout.

Why it is a finding rather than a bug report

Nothing imports the module today — the nine files that mention it, mention it in prose. So there is no present breakage, and this is about the absence of a guard rather than a live defect.

Two things make it worth recording anyway:

• The repo has the idiom and uses it widely. scripts/invoked-as.mjs exports isEntrypoint, and 35 scripts under scripts/ already call it. This file is one of the ones that does not.
• The cost may already have been paid once. scripts/check-examples-live-imports.mjs:315 documents that its globToRegExp is "Mirrored from globToRegExp in check-cross-package-test-inputs.mjs rather than" imported. A hand-mirrored copy of a helper is exactly the sort of duplication an unguarded entry point encourages, and duplicated glob semantics between two gates that must agree is its own hazard.

Not claimed

• I have not checked whether the mirroring in check-examples-live-imports.mjs was actually motivated by this; the comment gives a reason that is truncated in my quote above and should be read in full before that link is asserted.
• I have not swept the other scripts/** gates for the same missing guard. If several are unguarded the shape of the fix changes.

Likely fix

Wrap the dispatch in the existing predicate, matching the 35 files that already do:

if (isEntrypoint(import.meta.url)) { /* existing dispatch */ }

The self-test would want a case pinning that importing the module produces no output and no exit, or the guard can be removed again as quietly as it was never added.

---

Generated by Claude Code

[claude]

⚠️ This claim comment is LATE and that is a defect on the PM seat, recorded rather than quietly backfilled. The assignee and pm:dispatched were set at dispatch time, but CLAUDE.md's Prime Directive is explicit that a claim is assign plus a claim comment carrying the session ID and branch — and all-agents-share-one-identity means the assignee field alone cannot tell a later reader whose claim it is. Caught by the dev seat working #10595, which read the comments as instructed, found none, and said so instead of assuming. No competing claim existed on any of these, so no work was duplicated; the exposure was real regardless.

Claim: /pm-dispatch domain:devx execution seat (bug-first round).
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-10610-cross-package-entry-guard
Worktree: objectstack-issue-10610
Domain: domain:devx
File surface: scripts/check-cross-package-test-inputs.mjs (entry guard) + possibly scripts/check-examples-live-imports.mjs (the mirrored globToRegExp)

⛔ Governed surface out of scope for the diff (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/**) and the #9465 epic fence (.changeset/ tooling, cut-rc.yml, release.yml, root package.json).
⭐ Changeset: AGENTS.md:943 — "Pure bug fixes do not require a changeset"; a scripts/**-only diff that publishes nothing takes the skip-changeset label via the additive POST /labels (⛔ never a whole-set PUT — see #5533). Precedent: PR #10502.

---

Generated by Claude Code

[claude]

{
 "issue": 10610,
 "status": "done",
 "branch": "claude/issue-10610-cross-package-entry-guard",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10628",
 "premise_still_valid": true,
 "summary": "Wrapped check-cross-package-test-inputs.mjs's top-level dispatch in isEntrypoint(import.meta.url), the form the other 41 guarded scripts use. Then collected the value: check-examples-live-imports.mjs's hand-mirrored globToRegExp named this exact load-time gate as its reason for copying, so with the reason gone the copy is gone too and the helper is imported. Added two self-test cases (79 to 81) that spawn a real child to pin the guard, per the issue's own suggestion. Three claims in the brief turned out false and are corrected below; the issue's own premise held.",
 "tests": "Union re-run against final HEAD=8600651003 after the last commit. Gate set derived by `node scripts/pm/dispatch-gates.mjs` with no path list (it took the changeset from the merge base itself) — it matched exactly 3 families, all green, each quoted from the gate's own verdict line: `pnpm check:cross-package-test-inputs` -> 'All 81 self-test cases passed.' + 'OK: 13 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'; `pnpm check:examples-live-imports` -> 'All 31 self-test cases passed.' + 'examples/** live-import inventory OK -- 0 invisible (declared), 6 inputs-declared, 70 graph-visible.'; `node scripts/check-cross-package-test-inputs.mjs` (ci.yml) -> the same OK line. Also `pnpm check:entry-guard` -> '✓ check:entry-guard: 123 scripts/ file(s) — every entry guard goes through invoked-as.mjs.' and its self-test '26 cases pass'; `pnpm check:nul-bytes` -> 'OK (scanned 6211 text file(s)...)'; `eslint --no-inline-config` on both changed files exit 0, no findings, routed through scripts/pm/os-verify-lock.sh ('VERDICT command-exit 0 · held the lock 1s · waited 3s'). REPRODUCTION: before, `node --input-type=module -e \"await import('./scripts/check-cross-package-test-inputs.mjs')\"` printed the OK line at exit 0; after, 0 bytes of output at exit 0 with all exports intact. REJECT SIDE, asserted positively on an unhappy tree (one declared glob deleted from turbo.json, mutation confirmed on disk by anchor count 1->0, restored and re-confirmed 0->1): pre-guard IMPORT exited 1, printed the whole FAIL block, and the importer's trailing 'ALIVE' never printed — it was killed mid-flight by process.exit(1); post-guard IMPORT exited 0, silent, 'ALIVE' printed; post-guard INVOCATION still exited 1 with 'FAIL: cross-package test inputs are not declared consistently.' All three CLI paths (--self-test, --list-escapes, bare) still fire. MIRROR EQUIVALENCE, measured before converting: the two globToRegExp bodies differ by exactly one comment line, and a differential run over 89 globs (every turbo.json inputs glob plus synthetic cases exercising every encoder branch) x 5,321 real repo paths = 473,569 pairs found 0 compiled-RegExp-source differences and 0 verdict mismatches — no drift. check:examples-live-imports output is byte-identical to a genuine pristine origin/main baseline on both verify and --self-test (diffed; my first baseline attempt was bogus — I ran the modified file twice — and was redone against a real origin/main copy). ABLATIONS, each mutation confirmed on disk by anchor count, never by an editor's exit code: (1) guard -> `if (true)`: guard-line count 1->0, ablation-marker 0->1; import side effect returned (OK line printed) and self-test exited 1 with 'FAIL importing this module prints NOTHING'. Only ONE of my two new cases reddened — the second ('does not exit the importer') stays green on a HAPPY tree because the unguarded dispatch succeeds without exiting; it only bites on an unhappy tree, so it is a weaker pin than the first and I am not claiming otherwise. (2) imported globToRegExp made to let `*` span segments: real call site 1->0, ABLATION marker 0->1; `check:examples-live-imports --self-test` exited 1 with 'FAIL * does not span segments' — the consumer's self-test genuinely pins the imported helper. (3) import statement deleted: exited 1 with a loud ReferenceError, not a silent green. Every restore leg re-confirmed by anchor count and re-run green.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #10631: 39 more scripts/ modules export bindings with no entry guard — the same class, now fixed one file at a time twice (#9757 for dispatch-gates.mjs, this card for check-cross-package-test-inputs.mjs), and check:entry-guard accepts 'no guard at all' as an explicit self-test assertion. Includes three candidate shapes for closing the class in the gate rather than filing a 40th ticket."
 ],
 "corrections_to_the_brief": [
 "FALSE — 'the count of guarded scripts goes up' is not something check:entry-guard can show. It is a NEGATIVE gate: it rejects wrong spellings and prints the number of files SCANNED (123, unchanged by this diff). It never counts guarded scripts, and it accepts a file with no guard at all by design. Recognition of the new guard was asserted directly instead: scanFile() returns 0 findings for the edited file, and the file contains the gate's exported CANONICAL string.",
 "STALE — the guarded-script count is 41, not 35 (42 after this PR). Re-derived on today's tree using the gate's own codeOnly() masking so a prose mention of the idiom is not miscounted; a naive grep gives 43 because my new comment mentions the idiom in two files.",
 "PARTLY WRONG — the issue's export list is inaccurate in both directions. `serializePackageList` and `unionInto` are NOT exported (they are module-internal), while `globToRegExp`, `RECOGNISED_PATH_SPELLINGS` and `RECOGNISED_IMPORT_SPELLINGS` are exported and were not listed. This matters: globToRegExp being exported is what makes the mirror conversion possible at all.",
 "CONFIRMED, not false — the mirror comment's stated reason IS the import side effect, verbatim: 'because that module runs its gate at load time -- importing it would execute a second gate as a side effect of classifying'. So the guard removes the reason and the conversion was the right call.",
 "PROCESS — the brief said the issue was 'claimed for you by the PM seat', but issue #10610 has ZERO comments, so no claim comment exists. The assignee is os-zhuang. I proceeded because the dispatch named my branch and session explicitly, but per CLAUDE.md a claim is assign PLUS a claim comment, and the comment half is missing.",
 "TOOLCHAIN — `pnpm install --workspace-concurrency=2` fails on pnpm 10.31.0 with \"Unknown option: 'workspace-concurrency'\". That flag applies to `pnpm run`, not `pnpm install`. Environment/usage error, not a gate verdict; re-run without it installed in 6.3s."
 ],
 "scope_declaration": "scripts/check-examples-live-imports.mjs was edited under the bounded in-place clause and is named in the PR body with its evidence: same defect class as the card (a hand-mirrored helper whose stated cause is this card's missing guard), mechanical, correct form pinned by the existing comment and by a 473,569-pair equivalence measurement, and inside the same gate family — no new verification surface. It is NOT guarded itself; that is left to #10631 with the other 38.",
 "changeset": "none — scripts/**-only, publishes nothing (AGENTS.md:943, pure bug fixes do not require one). `skip-changeset` applied via additive POST /labels, never a whole-set PUT; read back after the bots settled and the size bot's `size/m` survived alongside it: ['size/m', 'skip-changeset']."
}

---

Generated by Claude Code