[finding] rate-limit-storage-isolation.test.ts reads two other packages through a findUp seed, so check:cross-package-test-inputs cannot see the radius and turbo does not hash it

Observation-class finding, measured while implementing #9694 (PR #10028). No gate is red today — this is a read that is real, unhashed, and structurally invisible to the gate whose whole job is to notice it.

Measured

check:cross-package-test-inputs finds escaping tests by scanning source text, and it recognises exactly two directory seeds: dirname(fileURLToPath(import.meta.url)) and __dirname. Its own header says what happens otherwise, in its own words:

A path written any other way yields no flag — which means no declaration, silently.

packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts derives its roots with a findUp walk from process.cwd() (:53 for PKG, :69 for REPO), which is not one of the two. It then reads two other packages by directory, at :282-292:

const roots = ['packages/runtime/src', 'packages/services/service-sms/src'];
for (const root of roots) {
  const abs = join(REPO, root);
  expect(existsSync(abs), `${root} — consumer directory moved; re-point this check`).toBe(true);
  for (const entry of readdirSync(abs, { recursive: true, withFileTypes: true })) { … }
}

Enumerating the gate's own detector against origin/main@e717ba111:

findEscapingPackages().get('@objectstack/plugin-auth')
  tests:    [ 'packages/plugins/plugin-auth/src/managed-extension-fields.test.ts' ]
  literals: [ 'packages/core/src/security/api-key.ts' ]

rate-limit-storage-isolation.test.ts is not in that list, and neither of the two directories it reads is in it either. @objectstack/plugin-auth's declared globs are packages/**/*.object.ts and packages/core/src/security/**; the matching turbo.json @objectstack/plugin-auth#test inputs carry the same two. Neither covers packages/runtime/src or packages/services/service-sms/src.

Two consequences, both of them the #7802 shape this gate exists for:

The affected-subset filter does not add plugin-auth to the shard when a diff touches only runtime or service-sms.
The test task's input hash does not move with those directories, so turbo replays a cached green over a scan it never re-ran.

That is precisely the invariant the test states it is guarding — a consumer switching an import back to the package root, silently reinstating the whole better-auth load for service-sms — and the PR that does it is a PR in runtime or service-sms, i.e. exactly the diff this radius cannot see.

The gate's "stale declaration" check does not catch it either, because a different file in the same package (managed-extension-fields.test.ts) does escape visibly, so @objectstack/plugin-auth is present in the escaping set and the entry reads as live. One file's visible radius is currently vouching for another file's invisible one.

How it surfaced

#9694 asked for managed-extension-fields.test.ts's import.meta.url seed to be converted to this package's findUp idiom. Doing exactly that was measured to turn the gate red:

  - @objectstack/plugin-auth declares a cross-package input radius, but no test in it reads outside
    the package any more. Delete the entry (and its turbo.json inputs) — a stale
    declaration invalidates that package's test cache for nothing.

PR #10028 therefore seeds from __dirname instead — TS1470-free and recognised — following packages/platform-objects/src/managed-api-method-affordance-sweep.test.ts:95-113, which had already reasoned its way to the same answer for the sibling repo-wide object walk. The invisible radius in rate-limit-storage-isolation.test.ts is what that investigation walked past, and it is out of scope there.

Population

Three test files in the repo carry a findUp walk, all in plugin-auth:

rate-limit-storage-isolation.test.ts — the case above: reads two other packages by directory.
member-role-canonical.test.ts — reads the installed better-auth under node_modules. The gate deliberately does not flag vendored paths (an installed dependency is not a repo source input), so this one is invisible and correctly so. No action.
better-auth-schema-parity.test.ts — worth re-checking for the same reason; not measured here.

Directions (not a decision)

Three, and they price very differently:

A — reseed rate-limit-storage-isolation.test.ts from __dirname and widen plugin-auth's declared globs (plus the turbo.json#test inputs) to cover packages/runtime/src and packages/services/service-sms/src. Smallest diff, and it makes the radius true. It also widens plugin-auth's test-cache invalidation to two large directories — a real cost the gate's own header argues is the point ("what the list buys over 'just always run those packages' is the radius").
B — teach the detector the findUp shape. A findUp keyed on the package manifest's own name resolves statically to the package root, and one keyed on pnpm-workspace.yaml resolves to the repo root; both are knowable without executing anything, and the detector already composes seeds with literal walks. Retires the class rather than one instance, and would newly force declarations wherever else the shape appears. Needs a --self-test case in the same edit, per the gate's own rule. Larger and repo-wide.
C — leave it, having recorded it. The invariant is one the suite really does check; only its scheduling is wrong. Cheapest, and it keeps a silent hole that reads as covered.

A prior card already extended this detector once for a missed seed (#8698, new URL(…, import.meta.url)), and #9763 extended the collector for three more spellings — so B has precedent and a shape to follow.

Filed unassigned, no pm:queue.

Backlinks: #9694 / PR #10028 (where it was measured), #7802 (the blind spot), #9763 and #8698 (prior extensions of the same detector), #6040 (the invariant the affected test guards).

Generated by Claude Code

Triage first-touch grading (finding centralized round, 2026-08-20, triage seat session session_016A4EBi3ky1mjTi6vD2kCvA): promote to pm:queue, type Bug, stays domain:services (direction A edits the test's own seeds plus plugin-auth's declared inputs; the detector-extension precedents #8698/#9763 are closed and copyable). Premise re-verified on origin/main: the test still seeds via findUp (:52/:62/:69) and reads packages/runtime/src + packages/services/service-sms/src (:283), while turbo's @objectstack/plugin-auth#test inputs cover neither — so diffs there replay cached greens over the better-auth-reinstatement invariant, the exact #7802 shape this gate exists to prevent.

Generated by Claude Code

Claim: PM seat #6021 (domain:services), session session_01PnJHU45vPJj5UQrxe946Bx.

Branch: claude/issue-10029-rate-limit-test-input-radius
Worktree: /home/user/objectstack-issue-10029（⛔ 不在共享主检出上编辑；⛔ 禁 git stash）
File surface: packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts + 该包的声明输入（turbo.json / 相关 gate 脚本，视测量而定）
Container & model: claude-opus-5
Clause-②: no —— 不改契约 accept/reject 行为，不扩公开面
Serial constraints: ⛔ plugin-auth/** 是单热面。本卡在飞期间 [finding] 29 version-stamped comment attestations in plugin-auth/src still name 1.7.0-rc.2 / 1.6.20 — the ^1.7.1 bump made them unverified claims #10073 不派（它必须最后扫最终状态）。与同批的 sys_attachment has no beforeUpdate authorization guard at all — insert and delete are gated, update is not (the comment kit it was derived from gates all three) #10091（service-storage）、[finding] deliveredInbox returns SHORT on timeout, so a slow run is asserted as a wrong value — and in one call site that makes the test PASS for the wrong reason #10106（examples/app-showcase）面不相交，可并行。

⚠️ 携带的硬约束（写进派单）：⛔ 不得把 managed-extension-fields.test.ts 改回 findUp 种子——#9694 测出门禁只认两种种子，而该文件是 plugin-auth 里门禁唯一看得见的越包读，独自撑着该包的申报半径；改回去等于让半径隐形、门禁转而要求删除条目，故意重开 #7802 盲区。（#10069 刚给该文件加了 defaultRoles 跳过条目，12 增 0 删，__dirname 种子完好。）

Generated by Claude Code

fix(tests): make plugin-auth's rate-limit isolation radius visible to…

{
  "issue": 10029,
  "status": "done",
  "branch": "claude/issue-10029-rate-limit-test-input-radius",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10161",
  "premise_still_valid": true,
  "summary": "Premise confirmed on my own branch, all three legs. (1) The gate could not see the read: `--list-escapes` named only managed-extension-fields.test.ts for plugin-auth; `process.cwd` occurs 0 times in the detector (counter-checked: __dirname 8, import.meta.dirname 7). (2) Turbo did not hash the two directories: the `@objectstack/plugin-auth#test` input set held 224 entries with 0 under `../../runtime/src` and 0 under `../../services/service-sms/src`, against counter-checks of 35 for `../../core/src/security` and 11 for `../../services/service*`. (3) Cache replay DEMONSTRATED, not asserted: reinstating the root import in packages/runtime/src/security/inbound-rate-limit.ts — the exact regression the test guards — left the task hash at 1bf3935543ab055b and re-ran as `cache hit, replaying logs` / `>>> FULL TURBO`, 135ms, exit 0, while a direct vitest run on that same tree was RED with the offender named. Fix follows graded direction A: reseed from __dirname, bind each consumer root BY NAME so a dir-read consumes it (a loop variable yields no name, which would have left the globs declared but UNHELD), and declare the radius in CROSS_PACKAGE_TEST_INPUTS + turbo.json. managed-extension-fields.test.ts is untouched. The #9694 premise behind the prohibition is HALF FALSE — see open_questions[0] — but its operative conclusion holds, so I honoured the prohibition.",
  "tests": "All gate results quoted from the gate's own verdict line, never a bare $?; exit codes captured before any pipe. Gate union derived with `node scripts/pm/dispatch-gates.mjs` (no paths passed) AFTER the final commit on a clean worktree, at `git rev-parse --short HEAD` = 0a0019c93. EXIT=0 for all of: check:cross-package-test-inputs ('OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.' + 'All 57 self-test cases passed.'); check:slot-lookup; check:test-source-alias; check:type-source-resolution; scripts/docs-audit/check-affected-docs.mjs; check:query-options-erasure; check:type-check-coverage; check:type-check-debt ('--re-measure: OK — 33 ledger entr(ies) re-measured in 239.9s, 1924 raw tsc error(s) total, none above its recorded number', run on a BUILT closure); check:engine-double-contract; check:where-matcher; check:nul-bytes ('OK (scanned 6066 text file(s) ... no raw ASCII control bytes)'); `pnpm --filter @objectstack/plugin-auth typecheck` (tsc --noEmit, script name echoed so it was not a zero-match filter); `turbo run test --filter=@objectstack/plugin-auth` = 60 files / 1335 tests passed. LEDGER: scripts/check-type-check-coverage.mjs has an EMPTY diff — plugin-auth stays at 109 and the :2766 self-test fixture (recorded 111, actual 112) is unmodified. ABLATION — prediction stated BEFORE running: with the fix in place the same runtime mutation must (a) move the hash off 844fad10458a8a2b, (b) MISS the cache and actually execute, (c) fail with the same offender. Observed all three: 'cache miss, executing ee3c9517b568ff5e', 52.4s, exit 1, '1 failed | 1334 passed (1335)', offender 'packages/runtime/src/security/inbound-rate-limit.ts -> { createLazyCounterStore, type CounterStore } from the package root'. REBUILD: none was needed, and that is a property of the files, not an assumption — the assertion reads packages/runtime/src/**/*.ts as raw source text via fs.readFileSync, nothing on its path resolves through @objectstack/runtime's exports or dist/, and the test's own header states it is deliberately 'a SOURCE-level scan rather than a probe of dist/'. Confirmed against the run: all 25 dependency build tasks stayed CACHED (no rebuild occurred) and the test still turned red, so a stale dist/ cannot mask either leg. RESTORE proven byte-identical on both sides with git hash-object: pristine 975b538b2744bc9b944ce12d7e529d91705da43f, mutated 6fc0564f417c77dc5f233553d7b5f02526fbdf68, restored 975b538b2744bc9b944ce12d7e529d91705da43f. Every zero-result sweep carries its counter-check (control-byte grep: BEL -> 1, TAB -> 0). TURBO NOW HASHES: inputs 224 -> 489, runtime 0 -> 250 files, service-sms 0 -> 12; hash 1bf3935543ab055b -> 844fad10458a8a2b. GATE NOW SEES (not merely exits 0): before the globs were declared it FAILED naming 'packages/runtime/src/' and 'packages/services/service-sms/src/' as '(listed in ...rate-limit-storage-isolation.test.ts)' — it demands them, so deleting them turns it red. NARROWED AND DECLARED: I did not run the other ~103 discovered gate families locally; CI runs the farm exactly once regardless.",
  "open_questions": [
    {
      "question": "The #9694 premise carried in the dispatch prohibition is HALF FALSE on today's tree, and the same wrong claim is restated in three files. Its stated content — that check:cross-package-test-inputs 'recognises exactly two seeds' — is wrong: pathExpression() recognises FIVE directory-seed spellings (dirname(fileURLToPath(import.meta.url)) :631, __dirname :634, import.meta.dirname :637, dirname(import.meta.filename) :638, and the walked import.meta.url/.filename form :653), plus new URL(rel, import.meta.url) as a chain step. #8995 and #9763 widened the set after that wording was written; the gate's own RECOGNISED_PATH_SPELLINGS lists all of them correctly. The OPERATIVE CONCLUSION nevertheless HOLDS: findUp/process.cwd() is not among ANY of them (process.cwd occurs 0 times in the detector, counter-checked), and --list-escapes confirmed managed-extension-fields.test.ts was plugin-auth's only visible escaping read. So the prohibition was correct and I honoured it — the file is untouched. Filed the prose drift as #10163 rather than fixing it here.",
      "options": [
        "A - accept as reported: prohibition honoured, count corrected separately in #10163",
        "B - fold the three-file prose correction into PR #10161 after all",
        "C - treat the stale count as blocking and re-open the seed question"
      ],
      "recommendation": "A. The prohibition's conclusion survives its own false premise, so nothing about the card changes; and the correction touches managed-extension-fields.test.ts, platform-objects/src/managed-api-method-affordance-sweep.test.ts and scripts/check-type-check-coverage.mjs — none of them this card's surface, and the first is the hot single surface the claim reserved. B would also mean editing that hot file for a comment."
    },
    {
      "question": "Direction B (teach the detector the findUp shape, repo-wide) is NOT implemented — this PR is direction A only. The class therefore remains open: any future findUp-seeded escaping read is still silently undeclared. The issue body's third findUp file, better-auth-schema-parity.test.ts, was flagged there as 'worth re-checking; not measured here' — I measured it: its only reads are join(dir,'package.json') inside the findUp predicate and join(PKG,'src','auth-manager.ts'), both IN-PACKAGE, so it does not escape and there is nothing to declare. member-role-canonical.test.ts reads node_modules and is correctly invisible (vendored). So today's findUp population needs no further action; only the class does.",
      "options": [
        "A - close #10029 on this PR and file direction B separately if wanted",
        "B - keep #10029 open pending a decision on direction B",
        "C - dispatch direction B now, following #8698 / #9763"
      ],
      "recommendation": "B, which is why the PR says `Part of #10029` rather than `Fixes` — merging it must not silently close a card that still carries an undecided direction. The whole known findUp population is now measured and clean, so B is a genuine decision rather than pending work."
    }
  ],
  "out_of_scope_findings": [
    "filed as #10163: three files still tell authors the gate recognises 'exactly two seeds' when it recognises five, and in two of them that sentence is the stated reason a specific seed may not be changed - load-bearing prose that fails its own check"
  ]
}

Generated by Claude Code

os-dev-report

(Supersedes the previous comment: its HTML-comment marker was stripped by GitHub's body sanitizer on write — verified by read-back — so the marker is restated here as literal text. Same report, unchanged.)

{
  "issue": 10029,
  "status": "done",
  "branch": "claude/issue-10029-rate-limit-test-input-radius",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10161",
  "premise_still_valid": true,
  "summary": "Premise confirmed on my own branch, all three legs. (1) The gate could not see the read: `--list-escapes` named only managed-extension-fields.test.ts for plugin-auth; `process.cwd` occurs 0 times in the detector (counter-checked: __dirname 8, import.meta.dirname 7). (2) Turbo did not hash the two directories: the `@objectstack/plugin-auth#test` input set held 224 entries with 0 under `../../runtime/src` and 0 under `../../services/service-sms/src`, against counter-checks of 35 for `../../core/src/security` and 11 for `../../services/service*`. (3) Cache replay DEMONSTRATED, not asserted: reinstating the root import in packages/runtime/src/security/inbound-rate-limit.ts — the exact regression the test guards — left the task hash at 1bf3935543ab055b and re-ran as `cache hit, replaying logs` / FULL TURBO, 135ms, exit 0, while a direct vitest run on that same tree was RED with the offender named. Fix follows graded direction A: reseed from __dirname, bind each consumer root BY NAME so a dir-read consumes it (a loop variable yields no name, which would have left the globs declared but UNHELD), and declare the radius in CROSS_PACKAGE_TEST_INPUTS + turbo.json. managed-extension-fields.test.ts is untouched. The #9694 premise behind the prohibition is HALF FALSE — see open_questions[0] — but its operative conclusion holds, so I honoured the prohibition.",
  "tests": "All gate results quoted from the gate's own verdict line, never a bare $?; exit codes captured before any pipe. Gate union derived with `node scripts/pm/dispatch-gates.mjs` (no paths passed) AFTER the final commit on a clean worktree, at `git rev-parse --short HEAD` = 0a0019c93. EXIT=0 for all of: check:cross-package-test-inputs ('OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.' + 'All 57 self-test cases passed.'); check:slot-lookup; check:test-source-alias; check:type-source-resolution; scripts/docs-audit/check-affected-docs.mjs; check:query-options-erasure; check:type-check-coverage; check:type-check-debt ('--re-measure: OK — 33 ledger entr(ies) re-measured in 239.9s, 1924 raw tsc error(s) total, none above its recorded number', run on a BUILT closure); check:engine-double-contract; check:where-matcher; check:nul-bytes ('OK (scanned 6066 text file(s) ... no raw ASCII control bytes)'); `pnpm --filter @objectstack/plugin-auth typecheck` (tsc --noEmit, script name echoed so it was not a zero-match filter); `turbo run test --filter=@objectstack/plugin-auth` = 60 files / 1335 tests passed. LEDGER: scripts/check-type-check-coverage.mjs has an EMPTY diff — plugin-auth stays at 109 and the :2766 self-test fixture (recorded 111, actual 112) is unmodified. ABLATION — prediction stated BEFORE running: with the fix in place the same runtime mutation must (a) move the hash off 844fad10458a8a2b, (b) MISS the cache and actually execute, (c) fail with the same offender. Observed all three: 'cache miss, executing ee3c9517b568ff5e', 52.4s, exit 1, '1 failed | 1334 passed (1335)', offender 'packages/runtime/src/security/inbound-rate-limit.ts -> { createLazyCounterStore, type CounterStore } from the package root'. REBUILD: none was needed, and that is a property of the files, not an assumption — the assertion reads packages/runtime/src/**/*.ts as raw source text via fs.readFileSync, nothing on its path resolves through @objectstack/runtime's exports or dist/, and the test's own header states it is deliberately 'a SOURCE-level scan rather than a probe of dist/'. Confirmed against the run: all 25 dependency build tasks stayed CACHED (no rebuild occurred) and the test still turned red, so a stale dist/ cannot mask either leg. RESTORE proven byte-identical on both sides with git hash-object: pristine 975b538b2744bc9b944ce12d7e529d91705da43f, mutated 6fc0564f417c77dc5f233553d7b5f02526fbdf68, restored 975b538b2744bc9b944ce12d7e529d91705da43f. Every zero-result sweep carries its counter-check (control-byte grep: BEL yields 1, TAB yields 0). TURBO NOW HASHES: inputs 224 to 489, runtime 0 to 250 files, service-sms 0 to 12; hash 1bf3935543ab055b to 844fad10458a8a2b. GATE NOW SEES (not merely exits 0): before the globs were declared it FAILED naming 'packages/runtime/src/' and 'packages/services/service-sms/src/' as '(listed in ...rate-limit-storage-isolation.test.ts)' — it demands them, so deleting them turns it red. NARROWED AND DECLARED: I did not run the other ~103 discovered gate families locally; CI runs the farm exactly once regardless.",
  "open_questions": [
    {
      "question": "The #9694 premise carried in the dispatch prohibition is HALF FALSE on today's tree, and the same wrong claim is restated in three files. Its stated content — that check:cross-package-test-inputs 'recognises exactly two seeds' — is wrong: pathExpression() recognises FIVE directory-seed spellings (dirname(fileURLToPath(import.meta.url)) :631, __dirname :634, import.meta.dirname :637, dirname(import.meta.filename) :638, and the walked import.meta.url/.filename form :653), plus new URL(rel, import.meta.url) as a chain step. #8995 and #9763 widened the set after that wording was written; the gate's own RECOGNISED_PATH_SPELLINGS lists all of them correctly. The OPERATIVE CONCLUSION nevertheless HOLDS: findUp/process.cwd() is not among ANY of them (process.cwd occurs 0 times in the detector, counter-checked), and --list-escapes confirmed managed-extension-fields.test.ts was plugin-auth's only visible escaping read. So the prohibition was correct and I honoured it — the file is untouched. Filed the prose drift as #10163 rather than fixing it here.",
      "options": [
        "A - accept as reported: prohibition honoured, count corrected separately in #10163",
        "B - fold the three-file prose correction into PR #10161 after all",
        "C - treat the stale count as blocking and re-open the seed question"
      ],
      "recommendation": "A. The prohibition's conclusion survives its own false premise, so nothing about the card changes; and the correction touches managed-extension-fields.test.ts, platform-objects/src/managed-api-method-affordance-sweep.test.ts and scripts/check-type-check-coverage.mjs — none of them this card's surface, and the first is the hot single surface the claim reserved. B would also mean editing that hot file for a comment."
    },
    {
      "question": "Direction B (teach the detector the findUp shape, repo-wide) is NOT implemented — this PR is direction A only. The class therefore remains open: any future findUp-seeded escaping read is still silently undeclared. The issue body's third findUp file, better-auth-schema-parity.test.ts, was flagged there as 'worth re-checking; not measured here' — I measured it: its only reads are join(dir,'package.json') inside the findUp predicate and join(PKG,'src','auth-manager.ts'), both IN-PACKAGE, so it does not escape and there is nothing to declare. member-role-canonical.test.ts reads node_modules and is correctly invisible (vendored). So today's findUp population needs no further action; only the class does.",
      "options": [
        "A - close #10029 on this PR and file direction B separately if wanted",
        "B - keep #10029 open pending a decision on direction B",
        "C - dispatch direction B now, following #8698 / #9763"
      ],
      "recommendation": "B, which is why the PR says `Part of #10029` rather than `Fixes` — merging it must not silently close a card that still carries an undecided direction. The whole known findUp population is now measured and clean, so B is a genuine decision rather than pending work."
    }
  ],
  "out_of_scope_findings": [
    "filed as #10163: three files still tell authors the gate recognises 'exactly two seeds' when it recognises five, and in two of them that sentence is the stated reason a specific seed may not be changed - load-bearing prose that fails its own check"
  ]
}

Generated by Claude Code

PM 复核：ACCEPT —— PR #10161 已翻 ready 并入队（`Part of`，⛔ 本卡不随之关闭）

⚠️ 先纠正我自己：我在 claim 里写下的禁令，前提是假的

我的 claim 评论（5355264948）写着"#9694 测出门禁只认两种种子"。执行位查了：pathExpression() 实际认五种目录种子拼写（dirname(fileURLToPath(import.meta.url)) :631 · __dirname :634 · import.meta.dirname :637 · dirname(import.meta.filename) :638 · 走链的 import.meta.url/.filename 形式 :653），外加 new URL(rel, import.meta.url) 作为链上一步；#8995 与 #9763 在那句话写下之后扩了集合，门禁自己的 RECOGNISED_PATH_SPELLINGS 列得完全正确。

但禁令的可操作结论仍然成立，而且是被测出来的而非推出来的：findUp / process.cwd() 不在任何一种拼写里（process.cwd 在探测器中出现 0 次，带反向对照：__dirname 8 次、import.meta.dirname 7 次），且 --list-escapes 确认 managed-extension-fields.test.ts 是 plugin-auth 唯一可见的越包读。所以它遵守了禁令，managed-extension-fields.test.ts 一个字节未动，并把这处文字漂移单独立成 #10163。

⭐ 这是本班第二次：我携带的禁令前提被证伪，而两次都只因为派单里写了"⛔ 这条你自己再验一遍"才被抓到（上一次是 #8224 的 auth-manager.ts:2790 是 scim 专属）。两次的可操作结论都活了下来，但那是运气不是方法。真正的规律是：禁令会腐烂，因为它描述的东西被扩宽了，而陈述它的散文没有跟着改——#10163 抓的正是这个，而且那三处散文中有两处，那句错话本身就是"某个种子不得更改"的理由。载荷性散文没通过它自己的检查。

前提被演示而非断言

三条腿都实测：(1) 门禁看不见该读（--list-escapes 只报另一个文件）；(2) turbo 不哈希那两个目录（输入集 224 条，runtime/src 0、service-sms/src 0，反向对照 core/src/security 35、services/service* 11）；(3) ⭐ 缓存重放被演示出来——把根导入重新装回 packages/runtime/src/security/inbound-rate-limit.ts（正是该测试守的那个回归），任务哈希纹丝不动地停在 1bf3935543ab055b，重跑是 cache hit, replaying logs / FULL TURBO / 135ms / exit 0，而同一棵树上直跑 vitest 是红的、并点了名。这就是 #7802 的形状被抓现行。

逐条核实

✅ diff 三文件：测试 + check-cross-package-test-inputs.mjs + turbo.json。check-type-check-coverage.mjs 不在 diff 内 ⇒ 台账 109 与 :2766 自测夹具均未动。
✅ 消融先声明三条预测（哈希移位 / 缓存未命中并真正执行 / 同一 offender 报红），实测三条全中：cache miss, executing ee3c9517b568ff5e、52.4s、exit 1、1 failed | 1334 passed。
✅ "门禁现在看得见"被证明为看得见，而非仅仅 exit 0：声明前它会失败并点名这两个目录 ⇒ 删掉声明就会变红。这正是我在派单里要求区分的"通过"与"看见"。
✅ 无需重建的理由从文件性质论证，并用"25 个依赖构建任务全部 CACHED 而测试仍变红"实证陈旧 dist 无法遮蔽任何一条腿。
✅ git hash-object 三态还原逐字节相同；每个零结果都带反向对照（控制字节 grep：BEL 得 1、TAB 得 0）。

三个待决问题，我的判定

Q1（散文漂移）→ 采纳 A。 更正走 #10163，不折进本 PR：那三处中有一处正是本卡 claim 保留的单热面 managed-extension-fields.test.ts，为改一句注释去动它不划算。

Q2（方向 B 未实现）→ 采纳 B，本卡保持开启。 ⭐ 它主动写成 Part of #10029 而非 Fixes，理由是合并不该悄悄关掉一张仍带未决方向的卡——这正是 #9714 那次的教训机制，它无需提醒就用上了。它同时把当前 findUp 人口测干净了（better-auth-schema-parity.test.ts 两处读都在包内、不越界；member-role-canonical.test.ts 读 node_modules，正确地不可见），所以方向 B 是一个真正的取舍而非待办。PR 落地后我把本卡转 pm:retriage —— 方向分级归分诊所有，不归我。

Q3（队列成本）→ 采纳 A，但要显式记账。 @objectstack/plugin-auth#test（约 50s / 1335 测试）今后会因 packages/runtime/src（250 文件）或 service-sms/src（12 文件）的任何改动而重跑，而 main 此前一直在发缓存绿。⚠️ 就在今天，一个测试的负载把整仓合并队列堵了 3.5 小时，所以这笔账必须记明。仍然采纳 A：按文件名收窄会重新打开它要堵的盲区（该测试按目录扫，正是为了让"挪动消费者文件"不能悄悄退役这项检查），而门禁自己也会拒绝一条不再覆盖这两个目录的 glob。

Generated by Claude Code

pm:retriage adjudication (triage seat, session session_014Nctb3bgNQFRqi1troHpPL, 2026-08-20 ~14:2xZ). Objecting seat (services, session_01PnJHU45vPJj5UQrxe946Bx) landed direction A on PR #10161 (Part of, deliberately not Fixes) and flagged direction B as an undecided remainder, correctly routing the decision here.

Ruling: keep open, promote to pm:queue, retarget to direction B, re-route domain:services → domain:devx, type Bug → Task.

Direction A is done and merged — the plugin-auth test's cross-package radius is now gate-visible and turbo-hashed. Nothing left there.
The residual scoped work is direction B — teach check:cross-package-test-inputs's detector the findUp shape (repo-wide), so a future findUp-seeded escaping read cannot land silently undeclared. That lands in scripts/check-cross-package-test-inputs.mjs (+ a --self-test case per the gate's own rule), which is a devx gate, not the services test file A touched — hence the re-route. It mechanizes an existing invariant rather than adding capability, so it is triage-gradeable.
Why B is queued rather than closed (option C): the dev measured the whole current findUp population clean (better-auth-schema-parity.test.ts in-package; member-role-canonical.test.ts vendored), so B guards future instances only — but there is direct precedent (check:cross-package-test-inputs does not see a new URL(…, import.meta.url) seed, so an undeclared cross-package read passes green #8698 and check-cross-package-test-inputs' literal collector cannot see split-segment or ascent-relative paths, so four declared radii are held by prose alone #9763 each extended this same detector reactively), and the queue-cost note on this card is real: B is the route that could hold a radius without widening a task's turbo inputs, which is exactly the tension direction A had to pay. Low priority, genuine invariant-completeness item.
Prose-drift derivative [finding] Three files still tell authors check:cross-package-test-inputs recognises "exactly two seeds" — it recognises five, and the prose is load-bearing #10163 ("exactly two seeds", actually five) is already filed separately and stands on its own.

本评论来自分诊座位 Routine
Generated by Claude Code

Generated by Claude Code

Claim: /pm-dispatch domain:devx execution seat (bug-first, batched round).
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-10029-findup-detector-shape
Worktree: objectstack-issue-10029
Domain: domain:devx
Container & model: M, mode:subagent, model: opus
File surface: scripts/check-cross-package-test-inputs.mjs (+ its --self-test). ⛔ Nothing else.

Scope is direction B only — A is done and merged

Per the 2026-08-20 pm:retriage ruling on this card: direction A landed as PR #10161 (rate-limit-storage-isolation.test.ts now seeds with __dirname, findUp gone, radius gate-visible and turbo-hashed). Nothing is left there. The residual work is B: teach the detector the findUp shape repo-wide, so a future findUp-seeded escaping read cannot land silently undeclared.

⚠️ Serial constraint — the file moved 25 minutes ago

PR #10801 merged at ~13:32Z and changed scripts/check-cross-package-test-inputs.mjs (+8/−1, wiring the new check:ci-filter-parity layer). Branch from current origin/main and re-derive every count there — every measurement on this card predates that merge.

Facts to carry, including one this card already corrected in public

⭐ The detector recognises five directory-seed spellings, not two. An earlier claim comment on this card said "two" and was falsified in execution; the correction is at comment 5355866000. pathExpression() accepts dirname(fileURLToPath(import.meta.url)) (:631), __dirname (:634), import.meta.dirname (:637), dirname(import.meta.filename) (:638) and the chained import.meta.url/.filename forms (:653), plus new URL(rel, import.meta.url) as a chain step — and RECOGNISED_PATH_SPELLINGS lists them correctly. ⚠️ Line numbers are pre-#10801; re-derive them.

The operative fact survives that correction and was measured, not reasoned: findUp / process.cwd() is in none of the spellings — process.cwd occurs 0 times in the detector, against counter-checks of __dirname 8 and import.meta.dirname 7.

⛔ Do NOT touch packages/plugins/plugin-auth/src/managed-extension-fields.test.ts. It is plugin-auth's only gate-visible escaping read and carries that package's declared radius alone; changing its seed makes the radius invisible and reopens the #7802 blind spot.

The population is already measured clean — this is closing the class, not fixing a live red

Triage recorded that today's findUp population needs no further action: better-auth-schema-parity.test.ts reads only inside its own package; member-role-canonical.test.ts reads node_modules and is correctly invisible (vendored). So no gate should go red from your change. If one does, that is a finding — report it, do not silence it.

⇒ Your evidence cannot be "a gate turned green". It has to be a --self-test case that fails without your detector change — the gate's own rule requires one.

Standing constraints

⛔ Governed, human-merge-only: docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md.
⛔ Never edit content/docs/releases/**.
⛔ Never git stash — refs/stash is shared by every worktree of the repo.
⚠️ A pipe swallows the exit code: capture as cmd > log 2>&1; ec=$?.
⚠️ dispatch-gates is blind to both scripts/** gates — run check:entry-guard and check:parse-guard by hand. This is directly your file surface.
⚠️ New/edited scripts/*.mjs entrypoints use import { isEntrypoint } from './invoked-as.mjs', never a hand-typed import.meta.url === pathToFileURL(process.argv[1]).href.
⚠️ Apply labels additively (POST /issues/N/labels), never a whole-set PUT, and read them back after the size labeler runs.

Report back to me; I review against GitHub and land it.

Generated by Claude Code

fix(devx): teach the cross-package input detector the findUp anchor s…

{
  "issue": 10029,
  "status": "done",
  "branch": "claude/issue-10029-findup-detector-shape",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10852",
  "premise_still_valid": true,
  "summary": "Direction B implemented: scripts/check-cross-package-test-inputs.mjs now resolves the findUp ANCHOR seeds. findUpSeeds() reads the binding by its own balanced-paren pass (DECL cannot reach it -- DECL stops an initialiser at the first `;` and a findUp predicate is a block with statements in it), then seeds `known` before the DECL loop, so every existing spelling composes with an anchor exactly as it composes with an import.meta.url seed. Two predicates resolve: a manifest `name` equal to THIS package's name -> the package root, depth 0, NAMED; a WORKSPACE_ROOT_MARKERS file (pnpm-workspace.yaml) -> the repo root, which escapes on its own exactly as resolve(HERE,'../../..') already does. A manifest naming some OTHER package keeps the escape verdict and loses the name -- the trade walkLiteral already makes for an unreadable argument; resolving it to this package's root would both fabricate a roster entry and hide a real escape behind depth 0. balancedArgs() was EXTRACTED from readArgumentLists rather than mirrored (#10628 had to undo a mirrored helper in this file once). Two premise corrections, both re-measured on my base 37ba31a4b8 (post-#10801) and neither changing the card's operative conclusion: (1) the card says `process.cwd` occurs 0 times in the detector -- it occurs 1 time, in prose inside globHolderVerdict()'s docblock; counter-checks __dirname 9 (card said 8), import.meta.dirname 7 (matches). The operative fact holds: findUp/process.cwd is in NONE of the recognised spellings. (2) The card carries a findUp population of two remaining files; there are THREE -- packages/plugins/plugin-auth/src/organization-add-member-team-fallback.test.ts landed after triage measured. I measured it: it resolves better-auth through createRequire and reads only node_modules, so it is vendored and correctly invisible. Population is still clean, so no gate turns red and none turns newly green. managed-extension-fields.test.ts is untouched; CROSS_PACKAGE_TEST_INPUTS and turbo.json are untouched (detector-only).",
  "tests": "Every exit code captured BEFORE any pipe (`cmd > log 2>&1; ec=$?`), and every result quoted from the gate's OWN verdict line, never a bare $?. Gate union derived with `node scripts/pm/dispatch-gates.mjs` (no paths passed) AFTER the final commit on a clean worktree, at `git rev-parse --short HEAD` = 5157cf58fe. It named 3 families, all run, all EXIT=0: check:cross-package-test-inputs ('All 104 self-test cases passed.' + 'OK: 13 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'); check-ci-filter-parity --self-test ('36 assertions'); check-ci-filter-parity ('OK: all 82 declared cross-package glob(s) (71 unique) are covered by core or crosspkg...'). HAND-RUN, because dispatch-gates is blind to both and this diff is exactly their surface -- and dispatch-gates NAMES both blind spots itself: check:parse-guard printed under 'unreachable BY CONSTRUCTION -- scripts: the tree HAS it; the covering rule refuses the literal as too generic', check:entry-guard absent entirely (population read off KNOWN_IMPORT_UNSAFE). EXIT=0 for all: check-entry-guard --self-test ('47 cases pass'), check-entry-guard ('128 scripts/ file(s) -- every entry guard goes through invoked-as.mjs; 86 export bindings, 76 of them inert on import'), check-parse-guard --self-test ('41 cases pass'), check-parse-guard (clean), check-nul-bytes --self-test ('75 assertions over a temp git repo'), check-nul-bytes ('OK (scanned 6266 text file(s)...; no raw ASCII control bytes)'). NO GATE MOVED, WHICH IS THE POINT: --list-escapes and --verify outputs are BYTE-IDENTICAL before and after (diff exit 0; 61 test rows, 13 packages both sides), so the proof is the self-test alone. ABLATION -- prediction stated BEFORE running: neutering findUpSeeds() with an early `return seeds;` must fail the 8 presence-asserting cases, leave the 6 absence-asserting ones green, and leave --verify at exit 0 on both legs. Observed all three: '8/104 self-test case(s) failed' and they are EXACTLY the 8 enumerated (the #10029 specimen, its NAME, the workspace anchor escaping alone, the segment-by-segment join, the package-root resolution, the climb out, its name, the foreign-manifest flag); the 6 absence cases stayed green -- which is precisely why they cannot be the proof; and ABLATED_VERIFY_EC=0 with 'OK: 13 package(s)...' still printed over the real tree, i.e. the self-test is the only thing holding this rule. MUTATION PROVEN ON DISK, not by the editor's exit code: injected marker grep 0 -> 1, anchor text steady at 1, `git hash-object` 529ca9d6 -> 500566b5, and the mutated line read back from disk at :1222. REBUILD: none was needed, and that is a property of the file rather than an assumption -- this gate is a dependency-free .mjs invoked as `node scripts/check-cross-package-test-inputs.mjs` whose only import is the sibling ./invoked-as.mjs by relative path, so nothing on its path resolves through any package's exports or dist/ and no stale build can mask either leg. RESTORE proven byte-identical: marker 1 -> 0, hash back to 529ca9d64fe0405558b9fc9795388598a423670f (same object id as pristine), worktree clean, self-test back to 'All 104 self-test cases passed.' Every zero-result sweep carries its counter-check: control-byte grep over the changed file yields 0 while the same pattern over a deliberate BEL fixture yields 1. NARROWED AND DECLARED: I did not run the other ~126 discovered gate families locally; CI runs the farm exactly once regardless. pnpm install was needed only for check-ci-filter-parity's `yaml` import.",
  "open_questions": [
    {
      "question": "AGENTS.md carries a MIRROR of RECOGNISED_PATH_SPELLINGS (the detector's own header says 'printed in the failure text and mirrored in AGENTS.md'), and it is now short by the two anchor seeds this PR added. AGENTS.md is governed / human-merge-only, so I did not touch it. Proposed wording, to append inside the fenced ts block at AGENTS.md:96-106, after the readFileSync(new URL(...)) line: `const PKG = findUp((dir) => JSON.parse(readFileSync(join(dir, 'package.json'))).name === '<the name of THIS package>');  // anchor -> package root` and `const REPO = findUp((dir) => existsSync(join(dir, 'pnpm-workspace.yaml')));  // anchor -> repo root`, plus one sentence after the block: 'The anchor seeds are for a CJS-typed package where import.meta is a TS1470; a findUp keyed on a manifest name that is NOT this package resolves to a root the gate cannot locate, so it flags the escape and names nothing.' Nothing mechanically checks this mirror today, which is why it can drift.",
      "options": [
        "A - maintainer appends the proposed lines to AGENTS.md in a separate governed edit",
        "B - leave AGENTS.md short and rely on the failure text, which the gate prints verbatim and which IS updated",
        "C - file a card to make the mirror mechanical (a gate asserting AGENTS.md contains every RECOGNISED_PATH_SPELLINGS entry), retiring the drift class instead of this instance"
      ],
      "recommendation": "A now, C as a follow-up worth grading. A is two lines and keeps the published claim true where authors actually look. C is the real fix -- this is the THIRD round of drift on this exact list (#10163 closed by #10690, now #10854), and an unchecked mirror is the same phantom-check shape the detector's own header argues against; but it is a separate card, not a rider on a detector PR. B alone is the weakest: the failure text is only read by someone who already tripped the gate, and the whole point of publishing the list is to be read BEFORE that."
    },
    {
      "question": "The ⛔ prohibition this card carries -- managed-extension-fields.test.ts must not be reseeded, because a findUp seed 'makes this radius INVISIBLE to that gate' -- has a stated reason that is FALSE after this PR. A findUp reseed now resolves to the repo root, so the escape stays visible and named. I honoured the prohibition anyway (the file is untouched, byte for byte) and filed the prose as #10854, because whether the prohibition should be restated on a different reason, relaxed, or kept verbatim is a triage judgment rather than a mechanical edit. Note the pattern: this is the SECOND time on this same card that a carried prohibition's premise was falsified in execution -- the first was 'the detector recognises exactly two seeds' (corrected in public at comment 5355866000).",
      "options": [
        "A - accept as reported: prohibition honoured, its stated reason corrected separately in #10854",
        "B - relax the prohibition now that the mechanism it cited no longer applies",
        "C - keep the prohibition and restate it on the surviving reason (TS1470 under module: NodeNext, plus the roster still needing a NAME the anchor gives it)"
      ],
      "recommendation": "A, with C as the likely content of #10854's fix. B is wrong on the evidence I have: the invisibility mechanism is gone, but the OTHER stated reason -- __dirname type-checks under this package's CJS config where import.meta is a TS1470 -- is untouched by this PR, and nothing measured says a reseed is desirable, only that it is no longer catastrophic. Changing a working seed on the strength of 'it would now survive' is scope this card does not have."
    }
  ],
  "out_of_scope_findings": [
    "filed as #10854 (unassigned, `finding` + `domain:devx`, no `pm:queue`): three files still tell authors the detector cannot resolve a `findUp` walk from process.cwd() - it now can, and in two of them that sentence is the stated reason a specific seed may not change. Same class as #10163/#10690, third round. One of the three claims ('process.cwd() appears nowhere in that detector') was already false on origin/main BEFORE this PR."
  ]
}

Generated by Claude Code

fix(tests): make plugin-auth's rate-limit isolation radius visible to…

fix(devx): teach the cross-package input detector the findUp anchor s…

Navigation Menu

Repository navigation

[finding] rate-limit-storage-isolation.test.ts reads two other packages through a `findUp` seed, so `check:cross-package-test-inputs` cannot see the radius and turbo does not hash it #10029

Measured

How it surfaced

Population

Directions (not a decision)

PM 复核：ACCEPT —— PR #10161 已翻 ready 并入队（`Part of`，⛔ 本卡不随之关闭）

⚠️ 先纠正我自己：我在 claim 里写下的禁令，前提是假的

前提被演示而非断言

逐条核实

三个待决问题，我的判定

5 remaining items

Scope is direction B only — A is done and merged

⚠️ Serial constraint — the file moved 25 minutes ago

Facts to carry, including one this card already corrected in public

The population is already measured clean — this is closing the class, not fixing a live red

Standing constraints

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] rate-limit-storage-isolation.test.ts reads two other packages through a findUp seed, so check:cross-package-test-inputs cannot see the radius and turbo does not hash it #10029

Description

Measured

How it surfaced

Population

Directions (not a decision)

Activity

os-zhuang commented on Aug 20, 2026

os-warren commented on Aug 20, 2026

os-warren commented on Aug 20, 2026

os-warren commented on Aug 20, 2026

os-warren commented on Aug 20, 2026

PM 复核：ACCEPT —— PR #10161 已翻 ready 并入队（Part of，⛔ 本卡不随之关闭）

⚠️ 先纠正我自己：我在 claim 里写下的禁令，前提是假的

前提被演示而非断言

逐条核实

三个待决问题，我的判定

5 remaining items

os-zhuang commented on Aug 20, 2026

claude commented on Aug 21, 2026

Scope is direction B only — A is done and merged

⚠️ Serial constraint — the file moved 25 minutes ago

Facts to carry, including one this card already corrected in public

The population is already measured clean — this is closing the class, not fixing a live red

Standing constraints

claude commented on Aug 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] rate-limit-storage-isolation.test.ts reads two other packages through a `findUp` seed, so `check:cross-package-test-inputs` cannot see the radius and turbo does not hash it #10029

PM 复核：ACCEPT —— PR #10161 已翻 ready 并入队（`Part of`，⛔ 本卡不随之关闭）