From d520e353ab99529645b74f938baae543c8c7f196 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 24 Aug 2026 22:57:03 +0000 Subject: [PATCH] docs(tests): repair three stale claims that the input-radius detector cannot resolve a findUp walk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #10852 taught scripts/check-cross-package-test-inputs.mjs the findUp ANCHOR seeds: a walk keyed on the scanned package's own manifest name resolves to that package root, and one keyed on a WORKSPACE_ROOT_MARKERS file (pnpm-workspace.yaml) resolves to the repo root. Three test-file docblocks still told authors the opposite, and in two of them that sentence was the stated reason for a code decision. - serve-multi-node-cap-advisory.pin.test.ts: the unresolvable-spelling list now says BARE process.cwd() instead of "a findUp walk from process.cwd()". The other two examples are unchanged. - rate-limit-storage-isolation.test.ts: the "not a spelling it resolves" claim is restated in the past tense (true when this file was reseeded in #10161), and the "process.cwd() appears nowhere in that detector" clause — wrong when written — is replaced by what actually holds: the detector reads the anchor predicate as text and calls nothing. - managed-extension-fields.test.ts: the seed prohibition STAYS; only its reason is restated. What holds packages/**/*.object.ts is the heldBy witness, satisfied only while this file remains an escaping test; a findUp-anchored reseed keeps it escaping (measured), while an unresolvable seed drops it and reds the gate by name since #10566's unheld-glob limb — not the silent green the old sentence described. Each corrected sentence carries the measurement that makes it true, so the next reader can re-derive instead of trusting prose. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx --- .../serve-multi-node-cap-advisory.pin.test.ts | 19 ++++++- .../src/managed-extension-fields.test.ts | 57 ++++++++++++++----- .../src/rate-limit-storage-isolation.test.ts | 41 +++++++++---- 3 files changed, 91 insertions(+), 26 deletions(-) diff --git a/packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts b/packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts index b935e0bd9a..7f2883cb5e 100644 --- a/packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts +++ b/packages/cli/src/commands/serve-multi-node-cap-advisory.pin.test.ts @@ -86,14 +86,27 @@ const MASKED_SERVE_SOURCE = maskComments(SERVE_SOURCE); * one literal — but for that reason, not because the alternatives are invisible. * * The spellings that genuinely produce no flag are the ones the detector cannot - * resolve at all: a template-literal path, a `findUp` walk from `process.cwd()`, - * segments arriving out of a variable or an array. Reaching for one of those - * would leave this read **undeclared**: `@objectstack/cli` would then be absent + * resolve at all: a template-literal path, a BARE `process.cwd()` walk, segments + * arriving out of a variable or an array. Reaching for one of those would leave + * this read **undeclared**: `@objectstack/cli` would then be absent * from `turbo ls --affected` for a cluster-only change and its `test` cache * would not hash this file, so the pin below would sit green through exactly * the drift it exists to catch. The declaration it needs lives in that script's * `CROSS_PACKAGE_TEST_INPUTS` and in `turbo.json`'s `@objectstack/cli#test` * inputs; removing either turns this file's own gate red. + * + * ⚠️ BARE is load-bearing. This sentence used to name `a findUp walk from + * process.cwd()` without it, and that clause went stale under the file while the + * file stayed still. Since #10852 that detector resolves two ANCHOR predicates on + * such a walk: one keyed on the scanned package's own manifest `name`, which + * resolves to that package's root, and one keyed on a workspace-root marker file + * (`pnpm-workspace.yaml` today), which resolves to the repo root. Both are on the + * published `RECOGNISED_PATH_SPELLINGS` list printed in its failure text, and + * each is pinned by a `--self-test` case — so re-derive from those two sources + * rather than from this paragraph, which is prose and can rot again. What still + * resolves to nothing is the unadorned `process.cwd()` expression with no + * recognised predicate on it, and a `findUp` keyed on any other marker + * (`turbo.json`, `.git`); both are pinned unresolved by their own cases. */ const GATE_SOURCE = readFileSync( join(REPO_ROOT, 'packages/services/service-cluster/src/multi-node-gate.ts'), diff --git a/packages/plugins/plugin-auth/src/managed-extension-fields.test.ts b/packages/plugins/plugin-auth/src/managed-extension-fields.test.ts index 8560b2abe2..6c61a970ad 100644 --- a/packages/plugins/plugin-auth/src/managed-extension-fields.test.ts +++ b/packages/plugins/plugin-auth/src/managed-extension-fields.test.ts @@ -315,19 +315,50 @@ const COVERED_OBJECTS: readonly string[] = [ * This file's walk of `PACKAGES_DIR` below is what holds the * `packages/**\/*.object.ts` half of plugin-auth's declared radius and the * matching `turbo.json` inputs: it is the only escaping read in this package - * that reaches an object file anywhere in the tree. Deriving the root any - * other way — the `findUp` walk from `process.cwd()` that - * `member-role-canonical.test.ts` uses — makes this radius INVISIBLE to - * that gate, and note what that does NOT do any more: since #10161 gave - * plugin-auth a second visible escaping test - * (`rate-limit-storage-isolation.test.ts`, whose roster is the two consumer - * directories, not this glob), the package no longer goes stale-empty, so - * the gate stays GREEN and this glob is simply held by nothing. Measured on - * ceb33a9f12 by reseeding this file from `process.cwd()`: `--list-escapes` - * dropped this file and `--verify` still exited 0. Losing the seed would put - * this sweep back in #7802's blind spot with no gate reporting it: turbo - * would replay a cached green for a diff that changed another package's - * object file. + * that reaches an object file anywhere in the tree. + * + * ⛔ So this file keeps its `__dirname` seed. The reason that prohibition + * used to give has been RESTATED rather than repeated, because the gate moved + * under it twice and the sentence did not — re-derive from the three + * measurements below rather than trusting any prose version of them. Each was + * taken on b706af987 by reseeding this file and re-running the gate: + * + * · WHAT HOLDS THE GLOB is a declaration, not the roster. The walk below + * descends on a loop variable, so no `*.object.ts` path is ever NAMED; + * the holder is the `heldBy` witness in that gate's plugin-auth entry, + * which names this file and is satisfied only while this file is still + * one of the package's ESCAPING tests. `packages/core/src/security/**` + * rides on the same condition — its only holder is the api-key path + * quoted in this file's prose above, and a quoted path enters the roster + * only from a file that escapes. + * · A SEED THE DETECTOR CANNOT RESOLVE — a bare `process.cwd()`, or a + * `findUp` keyed on `turbo.json` — drops this file out of + * `--list-escapes`, and `--verify` then exits 1 naming both globs, the + * first annotated `witness no longer escaping`. That is the other half of + * this note that had rotted: it used to say the gate "stays GREEN and + * this glob is simply held by nothing", which was true before #10566 gave + * the gate its unheld-glob limb and is false now. The remaining route + * back into #7802's blind spot is one step further on — reading that red + * as the gate's disposition 3 and DELETING the glob, which its own + * failure text lists LAST for exactly this reason. + * · A `findUp` WALK NO LONGER ABLATES THIS. Reseeded through the + * workspace-root anchor (`pnpm-workspace.yaml`), this file stays in + * `--list-escapes` and `--verify` exits 0: the radius stays visible and + * named. So the clause this note used to carry — that deriving the root + * via the `findUp` walk `member-role-canonical.test.ts` uses makes the + * radius INVISIBLE — is false since #10852, which taught the detector + * two ANCHOR predicates (this package's own manifest `name`; a + * `WORKSPACE_ROOT_MARKERS` file). ⛔ Do not re-derive the seed choice + * from that clause: it now argues for nothing. + * + * What the prohibition rests on instead is the part that did not move. + * `import.meta` is a TS1470 here (above), and of what is left `__dirname` is + * the only spelling that both type-checks under this package's own config and + * resolves from the FILE alone — no `findUp` helper to carry, no repo context, + * no predicate the detector has to special-case. A reseed buys this file + * nothing and narrows its correctness to the two predicates that gate + * recognises today; the near miss is measured above, one marker filename + * apart. */ const HERE = __dirname; /** …/packages/plugins/plugin-auth/src → repo root */ diff --git a/packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts b/packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts index 58bc36285d..12bf8bfcdc 100644 --- a/packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts +++ b/packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts @@ -58,17 +58,38 @@ import { dirname, join, relative, resolve } from 'node:path'; * `__dirname` type-checks under the package's own config and is defined at * runtime by vitest's transform. * - `check:cross-package-test-inputs` detects an escaping read STATICALLY, by - * resolving the seed expression. A `findUp` walk from `process.cwd()` is not a - * spelling it resolves — `process.cwd()` appears nowhere in that detector — so - * the two cross-package directory reads at the bottom of this file yielded no - * flag and therefore no declaration, SILENTLY. Measured before this change: - * `--list-escapes` named only `managed-extension-fields.test.ts` for - * plugin-auth, and `@objectstack/plugin-auth#test`'s turbo input hash - * (`1bf3935543ab055b`) did not move when `packages/runtime/src` changed — so a - * runtime-only diff that reinstated the package-root import replayed a cached - * green over the very scan that catches it (#7802's shape, #10029). + * resolving the seed expression, and `__dirname` is one of the spellings it + * resolves. When this file was reseeded (#10161) a `findUp` walk of + * `process.cwd()` was not one, so the two cross-package directory reads at the + * bottom of this file yielded no flag and therefore no declaration, SILENTLY. + * Measured before that change: `--list-escapes` named only + * `managed-extension-fields.test.ts` for plugin-auth, and + * `@objectstack/plugin-auth#test`'s turbo input hash (`1bf3935543ab055b`) did + * not move when `packages/runtime/src` changed — so a runtime-only diff that + * reinstated the package-root import replayed a cached green over the very + * scan that catches it (#7802's shape, #10029). * - * Deriving the roots any other way puts this file back in that blind spot. + * ⚠️ Read that in the PAST tense — the sentence above used to be written in + * the present, with a second clause ("`process.cwd()` appears nowhere in that + * detector") that was already wrong when it was written. Since #10852 the + * detector DOES resolve a `findUp` walk, for two anchor predicates: one keyed + * on the scanned package's own manifest `name` (which resolves to that + * package's root) and one keyed on a `WORKSPACE_ROOT_MARKERS` file, + * `pnpm-workspace.yaml` today (which resolves to the repo root). It reads + * those predicates as TEXT and executes nothing, which is why the second + * clause never followed from the first: grep `process.cwd` in + * `scripts/check-cross-package-test-inputs.mjs` and every hit is a comment or + * a `--self-test` fixture — the detector names the call it recognises without + * ever making it. What still resolves to nothing is the unadorned + * `process.cwd()` expression, and a `findUp` keyed on any other marker + * (`turbo.json`, `.git`). + * + * So the constraint on the seed is not a spelling but a LIST: it must be one the + * gate publishes in `RECOGNISED_PATH_SPELLINGS` (printed in its failure text, + * each entry pinned by a `--self-test` case). `__dirname` is kept here because of + * the TS1470 above, not because the alternatives are invisible. Deriving the + * roots by a spelling that is NOT on that list puts this file back in the blind + * spot the measurement above describes. */ const HERE = __dirname; /** …/packages/plugins/plugin-auth/src → the package root, then the repo root. */