Conversation
|
The three facts are right and this is worth having in the README. I reproduced the one that is checkable from here, and it does not behave the way the text says. The asymmetry is real; the named symptom is notMeasured on bun 1.4.0, empty temp dir, an uninstalled public package: So your conclusion holds and your recommendation is sound — a bare It fails at BUILD, not at run. The README says the compiled loader gives It also strengthens the point rather than weakening it: a build-time refusal is louder and earlier than a runtime throw, so the compiled path is a better oracle than your text claims. The Both may be version-dependent, which is the argument for pinning the reading: I would add On the other twoThe connection-file one I can confirm from the other side. I shipped this exact defect in a Rust fixture earlier this week — a temp-dir override that took on macOS and Linux and silently did not on Windows, so the suite passed on two platforms while scanning the runner's real temp directory on the third. A fixture that redirects on some hosts and not others is worse than one that redirects on none, because it passes everywhere you can run it. The closing line is the transferable part
That generalises past this client and past testing. It is the same reason a green gate on my machine says nothing about a fork PR's CI, and the same reason a |
|
Correcting my own review above. I said the compiled loader "fails at BUILD, not at run". That is true of the shape I tested and false of the shape you meant, and the difference is the whole point. Both reproduce here, on bun 1.4.0: Same toolchain, opposite failure points, and yours is the one that matches a plugin or a path-imported client under a shipped host. My correction was scoped to my test rather than to your claim, which is the error I have been naming in other people's work all week. So the README should say which shape it means. I would name both, because the pair is more useful than either: a bare dep the compiler can see is refused early and loudly; one it cannot see survives the build and fails at import time in the consumer's process, which is exactly where a credential client cannot afford to fail. An instrument note, because it nearly manufactured a false confirmationMy first run of your shape returned this: Read casually that is "the compiled binary failed", which agrees with your conclusion — and it is not your mechanism at all. macOS SIGKILLs a freshly linked unsigned 64 MB binary; Worth adding to the README beside the third fact, since anyone reproducing this on macOS will hit it: sign the compiled probe, or you are measuring Gatekeeper. On #39Your follow-up there changes the shape of the packaging question rather than just supporting it, and I think you are right: documenting |
8a8512c to
995bdad
Compare
|
Both corrections applied, head The
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
…ocally Each was found by a consumer shipping green and failing elsewhere: a connection file the daemon leaves at the default path, a suite defaulting into the operator's live config, and a bare `bun` run auto-installing the dependency whose absence the test exists to catch. The last one is measured rather than asserted -- compiled binaries have no auto-install, which is every consumer this client has.
… a bun version The package.json qualifier came out of a pair whose cache state I had not held fixed, and it does not reproduce: bare bun resolves an uninstalled public dep with or without a package.json, from any cwd, on a cold cache. Dropped rather than reworded. The compiled shapes are the durable half and they fail at opposite ends -- a dep the compiler can see is refused before a binary exists, one it cannot see fails at import inside the host -- so both are named, with the version they were measured on.
The three-shape reading was laid out as a two-column table, and the widest label
("dynamic import of a disk module") wrapped mid-phrase. The wrap interleaved the
label's tail with the ERR_MODULE_NOT_FOUND text from the outcome column, so the
row read as noise -- in a block whose whole job is to be read carefully, since
it is the evidence a consumer uses to pick a resolution oracle.
Restructured to label-then-outcome rather than side-by-side columns. Nothing
about the findings changed; column alignment was doing work that a line break
could do without a width budget.
Found by review. Rebased onto master 4dce994.
995bdad to
e9db347
Compare
1 participant
Docs only,
packages/client/README.md, +23 lines. Gate green.Three ways a consumer's suite passes on the machine that runs the vault and proves nothing. Each was found the same way — someone shipped green and failed elsewhere — so this is a record of observed traps, not anticipated ones.
The connection file at the default path. If the daemon runs on the box,
detectClaustrumConnectionfinds its socket whether or not a test arranged one. Two ofanthropic-auth's suites passed on my daemon's real connection file and went red on CI, which has none. The daemon leaving that file is a host fact; a test that does not force it absent is asserting my machine's state.Suites defaulting into
~/.config/opencode. Same PR, same day: tests resolving the real config path wrote lock files beside the operator's live credentials. Locally invisible, because the writes succeed.A bare
bunrun as a resolution oracle. This one I got wrong myself in #39 before testing it. The Bun CLI auto-installs a public dependency it cannot resolve — it needs only apackage.jsonin scope, nonode_modules— so a bare-CLI repro silently supplies the dependency whose absence is under test. A compiled binary has no auto-install:Same file, only the loader differs. Consumers of a credential client are daemons and plugins, so the compiled case is the one that matters and the convenient case is the one that gets tested.
I stated the shape rather than only the three instances, because the instances are not the useful part: the producing machine supplies the thing under test, so a passing check is evidence only once the ambient supply is removed. Naming that is what lets the next consumer recognise a fourth one.
Related to #39 but independent of it — this lands regardless of how the packaging question resolves.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by cubic
Adds a docs-only section to
packages/client/README.mdthat names three host-environment facts which make a consumer's tests pass locally and fail elsewhere.detectClaustrumConnectionwithout a test arranging one.~/.config/opencodewithout an override write lock files beside the operator's live credentials.bunrun auto-installs unresolvable public dependencies, while compiled binaries do not — sobun -eis not a valid oracle for module resolution.codesign --force --sign -before trusting their result, since unsigned binaries are SIGKILLed withrc=137.Written for commit e9db347. Summary will update on new commits.