cli/runtime: a dangling symlink in the SQLite database directory's path fails os dev and os serve late, with a plugin-start error that names neither the file nor the directory (the two bounded-walk copies accept any EEXIST)

Filing gate ①: a product defect at two public doors, measured. reach: on base b6805ac0f, by #23858's round-2 dev (report on #23858, out-of-scope finding 2; open question 1):

OS_HOME=SCRATCH/dl-home os dev, where data is a dangling symlink, exits 1 after 11.2 s with "Plugin com.objectstack.auth failed to start - rollback complete: The database refused to run this query for object sys_organization …";
OS_DATABASE_URL=file:SCRATCH/dl-db/link/ctl.db os serve, through a dangling symlink, exits 1 after 5.3 s with "Plugin package-service failed to start - rollback complete: The database refused to run a raw statement …".

Neither message names the database file, its directory or the symlink.

Filed by the domain:cli seat 2 (seat post #22648) · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT, by seat ruling 6227399342 on #23858 ⛔ Not a claim; the grade and lane are triage's.

Reader who acts: the domain:cli seat, for packages/cli/src/commands/dev.ts and packages/runtime/src/standalone-stack.ts.

Where (`origin/main`)

packages/cli/src/commands/dev.ts prepareDevDatabaseDirectory (about :117, its EEXIST arm about :142).
packages/runtime/src/standalone-stack.ts makeSqliteDatabaseDirectory (about :753, about :774).

Both are async copies of the bounded walk, and both accept ANY EEXIST on a created level. Each package's module-internal makeDirectorySync (packages/cli/src/utils/make-directory.ts, packages/runtime/src/make-directory.ts) accepts EEXIST only when a directory stands there. So the copies let a dangling symlink through to the driver, which then fails later and less clearly.

The dev's options (measured; the seat recommends A)

A. Fold both copies onto each package's makeDirectorySync.
- A patch changeset, Clause-②: no: every input whose answer changes already failed the boot.
- About −50 lines. The two existing pins stay unchanged, plus one dangling-symlink case each.
- The measured differences: the dangling-symlink classes go from late failure to an immediate named refusal (EEXIST at the link). The copies' async walk yielded 1 to 100 event-loop turns, where the fold yields 0, on a one-shot path with no consumer of that timing.
B. Keep the copies, and make their EEXIST accept a directory only.
C. Leave as is.

packages/drivers/driver-sql/src/sqlite-database-file.ts :74 has the same lenient EEXIST. Once the host is strict, no CLI door reaches it first; it is another lane's.

Done when

Both doors above refuse at once, naming the directory or the link.
The 5 other input classes the dev measured answer as before: creatable, existing, /proc ENOENT, ENOTDIR, and a file holding the directory's name.

Dedupe

MCP search_issues on this repository, closed included: dangling symlink database directory misleading error os dev data symlink plugin failed to start EEXIST bounded walk gave 0 hits.

Dedupe words: dangling symlink database directory misleading error; bounded walk EEXIST accepted non-directory; os dev data symlink plugin failed to start.

Generated by Claude Code

Triage: first grade, `priority:p3` · `domain:cli` · `area:devpath` · `bug` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T01:57Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Why p3: a dangling symlink in the database path is a rare input, and the boot already fails. Only the error's clarity and timing change.
Route: A, the filer seat's recommendation: fold both copies onto each package's makeDirectorySync. The driver-sql EEXIST stays the driver lane's, as the card says.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-17T22:49Z
Session: session_01QyoWKK9RwUNxBxmevy9Neb
Account: marchtian (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24090-db-dir-dangling-symlink
Worktree: objectstack-issue-24090
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main b9ac35cbf; line numbers move; stop on a breach and explain it in the report):

packages/cli/src/commands/dev.ts: prepareDevDatabaseDirectory (about :117, its EEXIST arm about :142).
packages/runtime/src/standalone-stack.ts: makeSqliteDatabaseDirectory (about :753, its EEXIST arm about :774).
Each package's makeDirectorySync (packages/cli/src/utils/make-directory.ts, packages/runtime/src/make-directory.ts), only as the fold target.
The two existing pins plus one dangling-symlink case each.
One .changeset/24090-*.md.
⛔ Hold-offs: packages/drivers/driver-sql/src/sqlite-database-file.ts (domain:engine; the card leaves its lenient EEXIST to that lane), every packages/spec path.
Container & model: M, mode:subagent, model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier --repo objectstack-ai/objectstack: "Model tier — no path-derived mandate")
Clause-②: no
Responsibility: the two async bounded-walk copies (packages/cli dev.ts, packages/runtime standalone-stack.ts) accept any EEXIST on a created level, so a dangling symlink reaches the SQLite driver and the boot fails late, naming neither file nor directory | none: each package's makeDirectorySync already accepts EEXIST only for a directory, but the copies do not use it | anyone whose database directory path holds a dangling symlink, at os dev and os serve; measured by cli/runtime: os start with an uncreatable OS_HOME hangs in Node's recursive mkdirSync (176,004 failing calls in 20 s) — the family-closing card for the remaining recursive-mkdir sites after #23696 and #23737 #23858's round-2 dev on b6805ac0f
Thread-read: 6228217116
Serial constraints cleared: the four files' latest changes on origin/main are PR fix(runtime): the SQLite file-path refusal names what the operator can change #24039 (605aa0172), PR fix(cli,runtime): refuse an uncreatable state, output or cache directory at once instead of looping in recursive mkdir #23979 (2e1562091) and earlier, all merged. No open PR touches them (open PRs' file lists read in this act). No pm:dispatched claim in any lane names them. This seat's in-flight runtime: the keys and actions domains answer 405 METHOD_NOT_ALLOWED with no Allow header (deps.error), where RFC 9110 requires one and the mcp, meta and ai domains send it #24023 (runtime/src/domains), cli: os migrate plan lists sys_packages under "declared by no object in this plan" right after os migrate apply created it — the unmanaged-table sweep's known set omits the one table migrate itself plans outside the object set #24059 (PR fix(cli): os migrate plan no longer lists sys_packages as unmanaged after os migrate apply created it #24226, cli/src/utils, migrate) and finding(mcp/oauth): an OAuth-token MCP agent acting for an ordinary user is denied every object operation — the D10 delegator is resolved with no active organization, so the user's organization-scoped grants do not count #24137 (runtime/src/security) are disjoint from them. Fold or serial with cli/serve: when the runtime state file cannot be written, os serve still prints "Press Ctrl+C to stop" and says nothing; a supervisor then gets ENOENT on runtime.<env>.<project>.json (writeRuntimeState's catch is silent) #24091 (serve.ts writeRuntimeState, the other finding of the same cli/runtime: os start with an uncreatable OS_HOME hangs in Node's recursive mkdirSync (176,004 failing calls in 20 s) — the family-closing card for the remaining recursive-mkdir sites after #23696 and #23737 #23858 report): serial, not folded. Gate ① fails: an EEXIST acceptance in a directory walk and a silent catch around a state-file write are different defect shapes in different files.
Scope: the maintainer, in this session's chat, verbatim: 「p3 任务也可以开始处理」.

Generated by Claude Code

os-dev-report
{
"issue": 24090,
"status": "done",
"branch": "claude/issue-24090-db-dir-dangling-symlink",
"pr": "#24233",
"session": "session_01QyoWKK9RwUNxBxmevy9Neb (subagent: the parent PM session's id)",
"premise_still_valid": true,
"summary": "Claim verified first: the newest Claim (6242575704) names branch claude/issue-24090-db-dir-dangling-symlink. Route A as ruled: prepareDevDatabaseDirectory (packages/cli/src/commands/dev.ts) and makeSqliteDatabaseDirectory (packages/runtime/src/standalone-stack.ts) now call their own package's makeDirectorySync inside their existing try, keep their error text, become synchronous (the dev caller at :624 and the two SQLite arms drop their await; the dev try/printError/remedy/exit 1 is unchanged), and the async walks are deleted (net -37 source lines, no export change). Hypotheses: H1 confirmed at b9ac35c (both copies accepted any EEXIST; both makeDirectorySync accept it only for a directory). H2 re-measured at b9ac35c: os dev with OS_HOME/data dangling exit 1 after 8.3 s 'Plugin com.objectstack.auth failed to start', os serve with a dangling file: directory exit 1 after 2.7 s 'Plugin package-service failed to start'; on 09c0232 both refuse before the boot (4.8 s / 2.4 s, the dev time is CLI start plus compile) with the wrapper's text naming file, directory and 'EEXIST: file already exists, mkdir' the link. H3 confirmed: no consumer of the yield (dev's one sequential caller; createStandaloneStack's three production callers each await it in sequence). H4 confirmed: neither door wraps or swallows the refusal (dev prints it plus its remedy line; serve prints the SqliteDatabaseDirectoryError). Measured extra: a dangling link mid-path was already an immediate named refusal (ENOENT at the level below the link) and now answers EEXIST at the link; the changeset says so. The five unchanged classes answer as before (pins green at base and head). driver-sql's lenient walk is untouched and noted in Acceptance notes (reach through a declared datasource NOT MEASURED: my one probe did not connect the datasource at all).",
"tests": "HEAD 09c0232, exit codes captured before any pipe, heavy runs under os-verify-lock (slot issue-24090-dev). (1) pnpm --filter @objectstack/cli run typecheck exit 0 (test layer 3 files / 28 errors, ledger unchanged); pnpm --filter @objectstack/runtime run typecheck exit 0 (27 files / 190 errors, unchanged). (2) pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 --project unit: exit 0, 310 files, 4602 tests. (3) pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 --project local (the runtime's whole pnpm test): exit 0, 409 files, 6282 passed, 19 skipped. (4) The two pins plus both walk suites: CLI 2 files 13 tests exit 0; runtime 2 files 14 tests exit 0. (5) Red at base: git restore --source=b9ac35cbf of dev.ts (blob de384bf3) and standalone-stack.ts (blob 6ddd65e0), tree only; runtime pin 1 failed / 5 passed ('expected a refusal, but createStandaloneStack returned'), dev pin 1 failed / 6 passed ("expected 'returned' to be 'rejected'"); restored with git checkout HEAD, blobs 17fc74e9 / 8b74041b == HEAD, git diff HEAD empty, status clean. (6) Ablation, fix committed first, scripts/ablation-replace.mjs wrap mode, once per package: in each make-directory.ts the anchor "if (errorCode(e) !== 'EEXIST' || !isDirectory(each)) throw e;" x1 to x0 and the lenient "if (errorCode(e) !== 'EEXIST') throw e;" x0 to x1 (runtime blob b6544e2a to 1c66dc92, CLI a4e52da6 to f1e8b164); each pin had exactly its dangling case red (runtime 1 failed / 5 passed, CLI 1 failed / 6 passed); restore proven: blob == HEAD, git diff HEAD empty, anchor back to x1. Resolution path: both pins import source (a tsx child of dev.ts; a relative import of standalone-stack.ts), so no dist is in the path and no rebuild was owed. (7) Doors on the built CLI (turbo run build --filter='@objectstack/cli...' exit 0 at base and at head), process groups killed at 90 s or on the banner: table in the PR body; CONTROLs reach the banner at 6.3 s (dev) and 3.0/3.1 s (serve) on both trees.",
"gates": "HEAD 09c0232. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 65 commands (7 paths vs merge base b9ac35c), run one by one with exits captured before any pipe: 62 exit 0; pnpm check:dual-build-cjs-loads and pnpm check:i18n-coverage first exit 3 (PREREQUISITE NOT MET: packages without dist) and after turbo run build --filter='!@objectstack/docs' under the lock (exit 0) both exit 0 (111 entries across 69 packages load; 'OK (14 config(s), 621 baselined untranslated string(s), none new)'); pnpm check:type-check-debt first exit 3 (its closure build queued behind my own CLI unit run and timed out) and re-run under the lock exit 0 ('none above its recorded number'). node scripts/pm/dispatch-gates.mjs --ran ran.list --repo objectstack-ai/objectstack exit 0: '65 derived famil(ies) accounted for — 65 run, 0 NOT-MEASURED'. pnpm exec eslint --no-inline-config --max-warnings=0 over the six changed .ts files exit 0. node scripts/check-nul-bytes.mjs exit 0; control-byte grep over the 7 files: no hit. Not run: check-platform-checklist (no exported symbol renamed or deleted). CI check-runs on 09c0232 at report time (37): 13 success (Auto Label, Check Documentation Links, Check PR Size, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, the four PR-claim checks, filter), 6 skipped (Build Docs, Console Pin Gate, the Dogfood Regression Gate matrix, Dogfood Verify CLI, Packed-tarball smoke (opt-in), Temporal Conformance), 18 in_progress (Build Core, Check Changeset, six Lint lanes, Test Core 1/6 to 6/6, the four Type Check lanes), 0 failure.",
"line_budget": "n/a — no skills/** path touched",
"mcp_calls": "0 — no MCP GitHub tool used",
"api_writes": "2 relay dispatches through scripts/pm/fleet-write as objectstack-fleet[bot]: (1) with-fleet.sh --via auto --actions, pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft #24233) + POST /repos//issues/24233/assignees (marchtian), read back: body 10890 bytes sent and stored identical, assignee marchtian, draft true, labels none; (2) post-stamped.mjs, POST /repos//issues/24090/comments (this report). Plus 2 git pushes of the branch (not REST). No label write, no card assignee write, no second claim, no PR body edit.",
"deviations": [
"File surface: both make-directory.ts files (the fold targets) carry comment-only edits: their doc blocks named the deleted async copies; no code line in either changed (the ablation's anchor counts and the passing walk suites stand on that).",
"The new pin cases are a second describe inside each of the two existing pin files rather than new files beside them; the existing cases and assertions are byte-identical. The dev cases share the file's one bounded tsx child (importing dev.ts costs about 7 s there).",
"Ablation ran once per package instead of once in total, plus a red-at-base run on both packages, because the card asks for a case red against today's code in each package. The copies no longer exist after the fold, so the lenient EEXIST was restored in each package's makeDirectorySync arm.",
"origin/main moved b9ac35c to 6e43b7b (4 commits; in these packages only migrate/schema-migrate/unmanaged-tables and runtime/src/domains, none of this PR's files; git merge-tree clean). Not merged before the PR; stated in the PR body.",
"Narrowed and declared: the CLI integration tier is CI's (no integration file or spawn entry touched); test:repo not run (no repo-project test touched).",
"Commits carry the model-free trailer pair from AGENTS.md, not the harness reminder's model-named Co-Authored-By.",
"One status reply to the coordinator's probe went out via SendMessage (not GitHub)."
],
"files_changed": [
".changeset/24090-db-dir-dangling-symlink.md",
"packages/cli/src/commands/dev-database-directory.test.ts",
"packages/cli/src/commands/dev.ts",
"packages/cli/src/utils/make-directory.ts",
"packages/runtime/src/make-directory.ts",
"packages/runtime/src/standalone-stack-uncreatable-db-directory.test.ts",
"packages/runtime/src/standalone-stack.ts"
],
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT → PR #24233 comment 6243629966 · domain:cli seat 2 · session session_01QyoWKK9RwUNxBxmevy9Neb · 2026-10-18T00:17Z · landing waits on every check of head 09c0232dc.

Generated by Claude Code

Landed: PR #24233 → `d702b1812` (#24090, `Fixes #24090`) · `domain:cli` seat 2 · `marchtian` · session `session_01QyoWKK9RwUNxBxmevy9Neb` · 2026-10-18T01:00Z

Reading	Result
PR #24233 object	`merged: true`, merge commit `d702b1812`, merged 2026-10-18T01:00Z through the merge queue (enqueued 2026-10-18T00:39Z)
`origin/main`	`d702b1812` is an ancestor of `origin/main`, with a single parent (squash). The 7 files and +140 / −76 match what was reviewed at `09c0232dc`
queue branch	no `gh-readonly-queue/main/pr-24233` head remains

Review chain: claim 6242575704 → report 6243612919 → ACCEPT 6243629966 on PR fix(cli,runtime): a dangling symlink as the SQLite database's directory is refused at once by os dev and os serve, naming the file and the directory #24233 → pointer 6243633371. No cross-lane declaration was owed: every file is in domain:cli.
What landed: os dev's prepareDevDatabaseDirectory and the standalone stack's makeSqliteDatabaseDirectory call their own package's makeDirectorySync, so a dangling symlink as the SQLite database's directory is refused at once with EEXIST, naming the file and the directory, instead of failing late in a plugin start. Their private async walks are deleted, and no published signature moves.
State change: the card was closed completed by Fixes. pm:dispatched is stripped in this act; the other labels stay.
Left in its lane, not filed: driver-sql's lenient EEXIST walk (noted in the PR's Acceptance notes; its reach through a declared datasource is NOT MEASURED).

Generated by Claude Code

Navigation Menu

Repository navigation

cli/runtime: a dangling symlink in the SQLite database directory's path fails os dev and os serve late, with a plugin-start error that names neither the file nor the directory (the two bounded-walk copies accept any EEXIST) #24090

Where (`origin/main`)

The dev's options (measured; the seat recommends A)

Done when

Dedupe

Triage: first grade, `priority:p3` · `domain:cli` · `area:devpath` · `bug` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T01:57Z

Landed: PR #24233 → `d702b1812` (#24090, `Fixes #24090`) · `domain:cli` seat 2 · `marchtian` · session `session_01QyoWKK9RwUNxBxmevy9Neb` · 2026-10-18T01:00Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli/runtime: a dangling symlink in the SQLite database directory's path fails os dev and os serve late, with a plugin-start error that names neither the file nor the directory (the two bounded-walk copies accept any EEXIST) #24090

Description

Where (origin/main)

The dev's options (measured; the seat recommends A)

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 17, 2026

Triage: first grade, priority:p3 · domain:cli · area:devpath · bug · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-17T01:57Z

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Landed: PR #24233 → d702b1812 (#24090, Fixes #24090) · domain:cli seat 2 · marchtian · session session_01QyoWKK9RwUNxBxmevy9Neb · 2026-10-18T01:00Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Where (`origin/main`)

Triage: first grade, `priority:p3` · `domain:cli` · `area:devpath` · `bug` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T01:57Z

Landed: PR #24233 → `d702b1812` (#24090, `Fixes #24090`) · `domain:cli` seat 2 · `marchtian` · session `session_01QyoWKK9RwUNxBxmevy9Neb` · 2026-10-18T01:00Z