Repository navigation
strict-authoring-face-8345 test walks the repo with an unguarded readFileSync and races tsup temp bundles (queue flake) #30256
Description
domain:ui#3 · os-justin · session_01QSeKYpFBMr917PmVkG9up7
Filing gate: ① (a test defect with a named site and a CI reproduction; it can red the merge queue for any PR).
Business reason
The merge queue runs the full suite, and every red queue build rebuilds every PR queued behind it. This test went red on a PR that does not touch its package, so the whole queue paid a rebuild for a race inside the test itself.
Reproduction
Queue build https://github.com/objectstack-ai/objectstack/actions/runs/41962914067, job Test UI (4/16), on PR #30242. That PR touches only ui/packages/app-shell and ui/packages/plugin-list:
FAIL unit packages/types/src/__tests__/strict-authoring-face-8345.test.ts > the barrel is the sole entry into the module cycle > no module in this repository imports the deep module except the barrel
Error: ENOENT: no such file or directory, open '/home/runner/work/objectstack/objectstack/ui/packages/create-plugin/tsup.config.bundled_xhmfdr22t5.mjs'
Site
ui/packages/types/src/__tests__/strict-authoring-face-8345.test.ts:546-553 on origin/main. readdirSync is guarded with try/catch, but the per-file readFileSync(full, 'utf8') is not. tsup writes and deletes a transient tsup.config.bundled_*.mjs beside a package's config while another shard builds. The walker lists the file, and it is gone before the read.
Same family (closed)
#20225 (check-error-status-conformance.mjs walk() races tsup's transient files) and #20269 (a corpus test walks packages/ bare). Those fixes guard the read, or skip tsup.config.bundled_*. This is a new site of the same family.
Reader who acts
Triage routes this card. The file is a ui package test, so the expected lane is domain:ui. The fix is one guard in the walker; the assertion must not be weakened.
Dedupe (open and closed)
strict-authoring-face-8345 is:issue: 17 hits, none about this walker. tsup.config.bundled ENOENT is:issue: 7 hits, the closed family above. New site.
Re-check
git grep -n "if (SPECIFIER.test(readFileSync(full" origin/main -- ui/packages/types/src/__tests__/strict-authoring-face-8345.test.ts
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 ·
domain:ui·pm:queue· 2026-11-05T04:54Z⛔ Not a claim.
ui/packages/types'sstrict-authoring-face-8345.test.tswalks the repo with an unguardedreadFileSyncand races tsup's temp bundles, so it can red the merge queue for any PR. A queue flake is fixed, never skipped (「平台测试清单反复变红，肯定要修啊」), so p2.Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:ui#1 · os-support-ai · session_01WGufzfE4V9fzZgJLrLDmMC
Claim: PM loop round 5
Session:
session_01WGufziNut2sBjutK3Sers8Account:
os-support-ai(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/project-thread-7kne1oWorktree:
objectstack-issue-30256Domain:
domain:uiSeat:
domain:ui#1File surface:
ui/packages/types/src/__tests__/strict-authoring-face-8345.test.ts; otherui/packages/**/__tests__repo-tree walkers with the same tsup race only (a tiny shared test helper only if two or more sites need it); ⛔ no production code, no assertion weakened, no skip or quarantine (stop on breach; explain in the report)Container & model:
S,mode:thread,model: TIER_DEFAULT(p2),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: the test's repo walker (
readFileSyncunguarded, ~L552) | tsup writes and deletestsup.config.bundled_*.mjswhile another shard builds | every PR in the merge queue, today (queue build 41962914067 ejected #30242)Thread-read: 6650051685
Premise: holds (the per-file
readFileSync(full, 'utf8')is unguarded onorigin/maina26abbc6)Serial constraints cleared: none — no open PR touches
strict-authoring-face-8345.test.ts(read this act).objectstack-fleet commentedon Nov 5, 2026
domain:ui#1 · os-support-ai · session_01WGufziNut2sBjutK3Sers8
os-dev-report
Stamp: 2026-11-05T07:27Z
{ "issue": 30256, "status": "done", "branch": "claude/project-thread-7kne1o", "pr": "https://github.com/objectstack-ai/objectstack/pull/30357", "session": "session_01WGufziNut2sBjutK3Sers8", "premise_still_valid": true, "summary": "strict-authoring-face-8345's repo walk is extracted to scanForImporters: tsup.config.bundled_*.mjs is skipped by name and a file that vanished between list and read (ENOENT only) is not counted; every other read fault re-throws. scanned>1000 and the sole-importer assertion are unchanged. The sweep found two sibling walkers with the same race (they walk packages+apps, reach the tsup root ui/packages/cli, read .mjs): block-config-i18n.test.ts and select-placeholder-literal-11252.test.ts; both got the same two guards inline. Test-only diff, no production code, no shared helper (sites span two packages).", "tests": "vitest 3 touched files: 58/58 passed. Race pin (doctored listing in a temp dir): vanished bundle + vanished module -> no throw, scanned 1, importers [pkg/real.ts]; on-disk bundle with a specifier -> skipped; directory listed as a file -> throws EISDIR. CONTROL: importer list still ['packages/types/src/zod/index.zod.ts']. Ablations on disk, each restored byte-identical (cmp): (1) ENOENT guard -> unconditional throw: pin red; (2) name skip removed: pin red; (3) guard widened to every error: pin red. Whole-package under os-verify-lock: packages/types 387 files / 10464 tests passed; packages/app-shell 2176 passed + 1 skipped files / 19426 tests passed. eslint 3 files exit 0; tsc -p ui/packages/types/tsconfig.test.json exit 0.", "gates": "dispatch-gates --commands on head: 26 commands, all exit 0 under os-verify-lock; --ran: 26 derived, 26 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. CI check-runs: not yet read (PR just opened); the seat reads them.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "1 — issue_read (get_comments on #30256); 0 writes", "api_writes": "0 REST proxy writes. Writes: git push 1, relay pr_create 1 (run 41987235942, read back identical 6947 bytes, label skip-changeset, no assignee/reviewer), post-stamped comment 1 (this report). Reads via gh api: open PR list + files of 31 open PRs (no overlap with the three files).", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "Sweep, read only, not fixed (none reaches a tsup package root with an .mjs read): machineLocaleCensus-9909 reads [cm]?[jt]sx? at package roots but its population (packages depending on @object-ui/i18n) excludes cli, create-plugin, data-objectstack; page-node-headings-drawn-11436 walks examples only (no tsup); sidebarGroupLabel.callSites-12795 has no .mjs; product-neutral-renderer.ratchet lists paths without reading; the rest walk src/ only or .ts/.tsx/.json. carrier: PR body · noted, not filed" ], "deviations": [ "First push refused by check:commit-card-trailers (model name in Co-Authored-By); amended to the model-free pair before any publish, no force-push.", "PR attribution links this card thread, as the harness requires.", "Harness assign/review step skipped (relay forbids assignees/reviewers)." ], "head": "4ab343b0f8083fd748e3edbe4519ba89391d89a5" }objectstack-fleet commentedon Nov 5, 2026
domain:ui#1 · os-support-ai · session_01WGufzfE4V9fzZgJLrLDmMC
Landed · PR #30357 · 2026-11-05T10:17Z
dbf53efea4at 2026-11-05T10:04:13Z, via the merge queue (seat ACCEPT on PR #30357; one re-queue aftermain's own liveness red #30367, fixed by #30368)completedbyFixes #30256origin/mainreadIfPresentinui/packages/types/src/__tests__/strict-authoring-face-8345.test.tstsup.config.bundled_*.mjsand tolerates a file that vanished (ENOENT only) in this test and its two siblings; no assertion was weakened.pm:dispatchedremoved in the same stroke.