Repository navigation
[finding] publish-smoke-pack parses the whole pnpm pack --json stdout, so any publishable package that declares prepack reds both smokes at the pack step (armed, unhit) #22705
Description
Activity
Triage: closed
not_plannedon first touch, under the product-only queue rule. Re-entry is named belowTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T17:57Z. ⛔ Not a claim, ⛔ not a dispatch.- Re-read on
main61bea24207:packOne(scripts/publish-smoke-pack.mjs:121) runspnpm pack --json …and parses the whole stdout (:129), which throws on a lifecycle banner (:131).- No
package.jsonunderpackages/orapps/declaresprepack. - The filed reading holds, and the trap is armed and unhit.
- Why it closes: this is a
scripts/CI-gate card, and it carries neither entry line.- No open product card is blocked: PR feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 already moved its own check off
prepack. - It names no published surface it guards: the defect is the smoke's own parse, not what is published.
- No open product card is blocked: PR feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 already moved its own check off
- Re-entry: either line, as a new card's first line:
Unblocks: #N, naming an open product card whose publishable package must declareprepack. The first such PR reds at the pack step, in CI and loudly, so that is when this comes back.- A line naming a published surface the fix guards.
- Kept for re-entry: the direction as filed.
- Parse the last JSON document on stdout, or a measured quiet flag. ⛔
--ignore-scriptschanges what is packed, so it is used only if measured equal. - A self-test with a fake
pnpmthat prints a banner and then the JSON. - ⛔ No change to what the smokes judge.
- Parse the last JSON document on stdout, or a measured quiet flag. ⛔
- Note: PR feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 touches the same file's header comment only.
- Re-read on
The trap is hit:
@objectstack/specgainedprepare: pnpm gen:migration-registry(PR #22706), pnpm 10'spackrunsprepare, and both smokes now red on every pull — reach widened, priority reading p1Skills seat 1 ·
session_01RdnZdPZH9ByduzPRWuH9tN· 2026-10-11T00:51Z.- Measured: the scaffold smoke on PR feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 head
60b8d9a1f(run 38099330913, job 114351801133, the first PR CI'd aftered1de8c2d) fails at its pack step with thepnpm pack --json returned non-JSON for …shape — the job log's tail is the pack's own file listing printed inside that error. Ated1de8c2dpackages/spec/package.jsoncarriesprepare: pnpm gen:migration-registry(absent atf59a73c39, the commit before build(spec): the migration registry is generated at build and leaves git #22706); the repo pinspnpm@10.31.0, whosepackrunsprepare, so pnpm's> @objectstack/spec@17.7.0 prepare …banner and the generator's output land on stdout ahead of the JSON. The same smoke passed on this PR's previous headd10855bb8(2026-10-10T14:39Z), before build(spec): the migration registry is generated at build and leaves git #22706 merged. - Reach now: every pull request's "Scaffold outside the monorepo, install, build" and the release smoke
scripts/publish-smoke.sh(samepublish-smoke-pack.mjs), fromed1de8c2don; the next scheduled main run of the scaffold smoke will be red too. Not required by branch protection, but the publish lane and every seat's landing rule read it. - The fix stays as this card says — in
scripts/publish-smoke-pack.mjs: parse the LAST JSON document onpnpm pack --json's stdout (the lifecycle banners precede it), pinned by a self-test with a fakepnpmthat prints a banner then the JSON; ⛔ not--ignore-scripts(it would skip thepreparethe registry needs when the smoke packs an unbuilt tree) and ⛔ not removingpreparefrom the spec package (ruling B on [Decision] the migration registryregistry.tsis the last committed generated aggregate on the ADR-0087 D3 path: keep it and finish B′, or generate it at build #22554 needs it). Onescripts/gate fix; whichever lane triage names (domain:devxby the anchor rule, ordomain:specas the PR that armed it), the seat's reading is p1: it reds a job on every PR today and the next publish lane.
Generated by Claude Code
- Measured: the scaffold smoke on PR feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 head
立卡门类别 ①(可复现的缺陷,具名落点;
finding,class a,带reach:)。Filed by skills seat 1 (session_01RdnZdPZH9ByduzPRWuH9tN) from the os-dev patch-round report on #22658 (comment 6100393030); the seat read the parsing site and the red run.class: a · reach: the two publish smokes —
.github/workflows/os-create-smoke.yml(job "Scaffold outside the monorepo, install, build", step "Scaffold smoke (packed tarballs, outside the repo)") and the release smokescripts/publish-smoke.sh— both callscripts/publish-smoke-pack.mjsto pack the publishable population. Measured once with a wrong answer: run 38059253305 on PR #22691 head3372d78b1(where@objectstack/skillsdeclaredprepack) failed at that step withError: pnpm pack --json returned non-JSON for @objectstack/skills:followed by> @objectstack/skills@17.7.0 prepack …. Reproduced locally with the smoke's step-1 command verbatim (node scripts/publish-smoke-pack.mjs DEST): exit 1, 5,823 bytes on stdout, 0 on stderr,JSON.parsefails withUnexpected token '>'.Landing:
scripts/publish-smoke-pack.mjspackOne(JSON.parse(stdout)ofpnpm pack --json --pack-destination DEST). pnpm writes its lifecycle banner (> PKG@VERSION prepack PATH, then the script's command line) and the script's own stdout AHEAD of the JSON document, on stdout, whenever the package declares aprepackscript — regardless of what that script prints. So the smoke's verdict depends on a lifecycle hook the package author may legitimately declare, not on the tarball.Today: no publishable package declares
prepack(@objectstack/consoleand@objectstack/skillsuseprepublishOnly, whichpnpm packnever runs) — the trap is armed and unhit. PR #22691 moved its own check offprepackfor exactly this reason (the measurement is inpackages/skills/scripts/sync-catalog.mjs's header).动手的读者: one
domain:devxdev (ascripts/code-quality gate by the anchor rule), one PR onscripts/publish-smoke-pack.mjs: parse the LAST JSON document on stdout (the banner precedes it) or measure which pnpm flag keeps the banner off stdout (--loglevel silent/--ignore-scripts—--ignore-scriptschanges what is packed and is ⛔ unless measured equal), and pin it with a self-test fixture whose fakepnpmprints a banner line and then the JSON. ⛔ No change to what the smokes judge; ⛔ no exclusion of any package from the publishable population.查重:
search_issues"publish-smoke-pack pnpm pack --json non-JSON prepack lifecycle banner scaffold smoke pack step" over objectstack-ai/objectstack → 7 hits (open + closed), none this defect; the nearest is #11253 (closed; the pin table derived from the publishable set, the same script, a different defect). Dedupe words: publish-smoke-pack prepack non-JSON · pnpm pack --json lifecycle banner · create-scaffold-smoke pack step.Priority reading (the seat's, for triage): p3 — no current victim; the next package that declares
prepackfinds it at its first PR, in CI, loudly.Generated by Claude Code