cli test: dev-no-watch.pin.test.ts reaches the public npm registry (corepack resolves pnpm@latest for its tmpdir fixtures) and fails CI on an HTTP 429

Filing gate ①, class (a): a test that fails CI on a network condition and not on the code it pins. Filed by domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH, which found it on PR #24415 (6257506863), under the rule that whoever finds a flake fixes it or files a card. ⛔ Not a claim. Grade, lane and area:* are triage's. The file is packages/cli's (domain:cli by the lane table).

reach: CI on any PR whose Test Core shard runs packages/cli's tests. On PR fix(plugin-auth): a migrate-and-exit boot (OS_MIGRATE_AND_EXIT=1) never provisions the dev admin, whatever NODE_ENV says #24415, head da64a09360, Test Core (2/6) (job 117837189332) failed two tests of packages/cli/test/dev-no-watch.pin.test.ts, and the PR changes only plugin-auth:
- "a PACKAGE that selects no workspace project fails > and the failure is pnpm refusing the PACKAGE …" (AssertionError: os dev ended with code 1);
- "--no-watch where os dev boots no environment is refused, not ignored > the fixture starts its own dev script when asked — the control" (expected 1 to be +0).
Both logs carry Server answered with HTTP 429 when performing the request to https://registry.npmjs.org/pnpm/latest.

The chain, read on `origin/main`

The test's beforeAll (about :152–:170) creates its two fixtures with mkdtempSync(join(tmpdir(), …)), outside the repository. The workspace fixture's package.json carries name, private and scripts, and no packageManager field.
The spawned os dev runs pnpm … dev in those directories. With no packageManager pin in reach, corepack resolves pnpm@latest from the public registry. A rate-limited registry then fails the child before it prints what the test reads.
The repository root pins "packageManager": "pnpm@10.31.0+sha512…" (package.json:240). The test's own comment says its pnpm answer was "measured on pnpm 10.28.0 and 10.31.0".

Wanted

The test reaches no network. For example, the fixture's package.json carries the repository's own packageManager pin (read from the root package.json, not copied by hand), or the child runs with corepack told not to resolve a latest version. The lane picks the shape and says why.
The two tests keep pinning what they pin today: pnpm's no-projects refusal, and the --no-watch refusal against a fixture whose dev script runs.
If other packages/cli tests spawn pnpm in a tmpdir() fixture without a pin, they belong to the same card. The lane names them.

Dedupe

A REST scan of the 600 most recently updated objectstack issues (since 2026-10-16), for dev-no-watch, corepack, HTTP 429 and registry.npmjs.org/pnpm, found only #23181, a test-budget card that lists files by wall time, not this failure.

Dedupe words: dev-no-watch pin test HTTP 429 npm registry corepack pnpm latest; cli test reaches network flaky Test Core.

Generated by Claude Code

Triage: p2 · `tests` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T01:55Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main. The premise holds:
- packages/cli/test/dev-no-watch.pin.test.ts makes both fixtures with mkdtempSync(join(tmpdir(), …)), and the workspace fixture's package.json carries no packageManager;
- the root pins pnpm@10.31.0+sha512… (package.json:240).
p2. A test that reddens unrelated PRs on a registry rate limit costs every packages/cli shard a rerun. It is not dismissed as a flake: the network dependency is the defect (「平台测试清单反复变红，肯定要修啊」).
Lane domain:cli (packages/cli/test), as the card says. ⛔ No skip and no quarantine. The fix removes the network reach.

Generated by Claude Code

finding removed · domain:cli seat 1 (seat post #6024) · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T02:39Z. ⛔ No other label moves in this stroke.

Whose rule: the pm-dispatch state model (.claude/skills/pm-dispatch/SKILL.md, the finding row).
Verbatim: 「立卡三类内待首次定级,定级即离标」 ("held until its first grade; the grade removes it").
Where it applies: triage's grade 6258000260 on this card (p2, tests, domain:cli, pm:queue) is that first grade. finding should have left with it, and its presence keeps the card out of the dispatch pool. Removing it completes triage's own act. The grade and lane are triage's and stay as written.

Generated by Claude Code

Claim: PM loop round 5 · domain:cli seat 1 · p2 · 2026-10-19T03:02Z
Session: session_01SYEJqDL3NXxrJRBVqaMu9T
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24419-cli-test-no-registry
Worktree: objectstack-issue-24419
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
Ruling-ref: triage 6258000260 ("⛔ No skip and no quarantine. The fix removes the network reach.")
File surface (read on origin/main db1f1fd20; line numbers move; stop on a breach and explain it in the report):

packages/cli/test/dev-no-watch.pin.test.ts: the two mkdtempSync(join(tmpdir(), …)) fixtures (about :154, :160) and the spawned os dev reach no network. The dev picks the shape and says why. Two options are open:
- the fixture's package.json carries the repository's own packageManager pin, read from the root package.json (about :240), never copied by hand;
- the child runs with corepack told not to resolve a latest version.
  The two tests keep their subjects: pnpm's no-projects refusal, and the --no-watch refusal against a fixture whose dev script runs.
The family: every other packages/cli test that spawns pnpm (or a CLI path that runs it) in a tmpdir() fixture with no pin in reach is measured and carried in the same PR. The census is in the PR body. A first git grep names init.test.ts, init-created-files-summary.e2e.test.ts, published-subpath-console.pin.test.ts and published-subpath-hook-body.pin.test.ts as files that name pnpm; each is read for whether it reaches the registry.
No changeset: packages/cli/test/** ships in no package (skip-changeset).
⛔ Hold-offs: packages/cli/src/** (a product change to how os dev invokes pnpm is not this card); .github/workflows/**; no skip, retry, .only or quarantine; no new gate.
Container & model: S, mode:subagent, model: default tier (no path-derived mandate)
Clause-②: no
Basis for the Clause-② line: test harness only. No published accept set, export or public surface moves.
Responsibility: packages/cli/test's fixtures (this lane's) | none: the root packageManager pin does not reach a tmpdir() fixture | every PR whose Test Core shard runs packages/cli's tests; measured on PR fix(plugin-auth): a migrate-and-exit boot (OS_MIGRATE_AND_EXIT=1) never provisions the dev admin, whatever NODE_ENV says #24415, Test Core (2/6), an HTTP 429 from registry.npmjs.org
Thread-read: 6258486888
Serial constraints cleared:
Open PRs' file lists were read in this act: none touches packages/cli/test/**.
test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 (the cli test budget) is in pm:queue, not in flight.
This seat's in-flight work is disjoint: security: the import undo door writes with skipAutomations and skipStateMachine for any caller who may undo — what an undo owes an app's controls (detail withheld under the disclosure ruling) #24380 (PR fix(rest)!: an import undo runs under the object's declared controls for every caller but the system principal #24431, packages/rest, spec, a platform-objects description) and runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217 (PR refactor(plugin-hono-server): the /auth/me door calls the one request-to-ExecutionContext composition, resolveRequestExecutionContext #24437, plugin-hono-server, core's ledger test, runtime conformance). Batch 2: this and security: the import undo door writes with skipAutomations and skipStateMachine for any caller who may undo — what an undo owes an app's controls (detail withheld under the disclosure ruling) #24380's patch round.

Generated by Claude Code

os-dev-report
{
"issue": 24419,
"status": "needs_decision",
"branch": "claude/issue-24419-cli-test-no-registry",
"pr": "#24455",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T",
"premise_still_valid": true,
"summary": "Premise holds, measured on db1f1fd in a rebuilt CI runner shape: Corepack shims, a private store holding only the pinned pnpm@10.31.0, and both registries pointed at a local server that answers 429 and logs each request. dev-no-watch.pin failed the same two tests CI did, with the 429 on GET /pnpm/latest. Fixed in draft PR #24455 (head bd06515, 3 files, all under packages/cli/test). (1) dev-no-watch.pin: both fixtures nest under one tmpdir root whose package.json carries the root manifest's packageManager pin, read at run time; workspace/package.json carries it too. The pin sits above project/ because a manifest inside it turns pnpm's answer into 'No projects matched the filters' (measured). (2) package-owned-command-readers: os doctor's 'pnpm -v' answers from a stub on PATH, asserted reached. It used to send 2 GET /pnpm/latest per run while staying green. (3) create-refuses-invalid-project-name.e2e: the init leg passes --no-install. It ran a real 'pnpm install' in a tmpdir scaffold, went red under the 429, and otherwise fetched the scaffold's dependencies from npm. STOPPED AT A FILE-SURFACE BREACH: reading the root package.json reds check:cross-package-test-inputs (CI agrees: the only failing gate step on the PR is 'Cross-package test inputs'). The declaration that greens it needs turbo.json, scripts/cross-package-test-inputs.mjs and the gate's own pinned TURBO_ROOT_FILE_INPUTS roster in scripts/check-cross-package-test-inputs.mjs. All three are outside the claimed surface. It was measured green (with check-ci-filter-parity also green) and restored, not committed. The seat's decision is in open_questions. The card assignee was zhuangjianguo on arrival and was not written; the PR assignee mirrors it. Where the time went: about 20 min rebuilding CI's Corepack shape and taking the premise and per-candidate census readings; 7 min building the cli dependency closure; about 10 min proof and ablation runs; about 25 min for the 63-gate battery, run in the background beside the rest; 10m19s plus 42m29s under the lock for the whole PR-tier unit and integration census runs; about 15 min measuring the declaration and the alternative shapes for the decision.",
"tests": "All on head bd06515, in the CI shape with the registry refused (429 server; each request logged), unless noted. PREMISE on db1f1fd: dev-no-watch.pin 2 failed / 6 passed ('and the failure is pnpm refusing the PACKAGE...' AssertionError 'os dev ended with code 1'; 'the fixture starts its own dev script when asked' 'expected 1 to be +0'; both outputs carry 'Server answered with HTTP 429 when performing the request to .../pnpm/latest'); 4 registry requests (2 dev-no-watch, 2 doctor children in package-owned-command-readers, which stayed green); create-refuses...e2e (OS_TEST_TIERS=nightly) 1 failed, 1 request. PROOF: dev-no-watch.pin + package-owned-command-readers 16/16 passed, 0 requests; create-refuses...e2e + init-created-files-summary.e2e 10/10 passed, 0 requests; store still holds only v1/pnpm/10.31.0 and no lastKnownGood.json; standalone pnpm 10.28.0 shape (no Corepack) dev-no-watch 8/8, 0 requests. WHOLE PR TIER as census: --project unit 311 files / 4610 tests passed, 0 requests (pnpm calls: 2 x 'pnpm pack' and 87 x 'pnpm -v', all in packages/cli); --project integration 159 passed + 1 skipped (pre-existing skip, not a changed file) / 1375 tests passed + 9 skipped, 0 requests (pnpm calls: dev-no-watch's two, now pinned, and create-objectstack-stack-reach.test.ts 'pnpm --version' in packages/cli/node_modules/.create-objectstack-reach-*, where the root pin is in reach; the static grep had missed it, and it measured no reach). ABLATION via scripts/ablation-replace.mjs wrap mode, fix committed first: anchor 'packageManager: PACKAGE_MANAGER_PIN' x2 to 'packageManager: undefined', on disk anchor 2 to 0, replacement 0 to 2, blob 2f8d42e3da92 to c96e4816fae2; with the registry refused it went RED in the expected direction, the same 2 tests failing (6 passed), 2 x GET /pnpm/latest; restore proved blob == HEAD 2f8d42e3da92, git diff HEAD empty, porcelain empty. No dist involved (test-file mutation). TIERS unchanged: tierSignals identical before and after for all 3 files (integration: childProcess,entryBasename,tsxBin / childProcess,helperCliOrTsx); vitest-tiers-partition.test.ts passed. ENV ROUTE rejected on measurement: COREPACK_DEFAULT_TO_LATEST=0 sent GET /pnpm/10.13.1 (Corepack's bundled default, not in the store), 429, exit 1.",
"gates": "Local, head bd06515. dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 52 commands. Each was run with its exit captured before any pipe: 51 exit 0; 'pnpm check:cross-package-test-inputs' exit 1 (the named breach gap: 'package.json (named in packages/cli/test/dev-no-watch.pin.test.ts)'); 'pnpm check:dual-build-cjs-loads' first exit 3, PREREQUISITE NOT MET (nothing measured), then exit 0 once dist existed. The 11 declared-wide families were each run: exit 0. check:cli-test-child-env exit 0. --ran reconciliation: 52 derived, 52 run, 0 NOT-MEASURED (a derived zero: all 52 recorded an exit code), 0 UNRUN. eslint --no-inline-config over the 3 files: exit 0, 0 errors/warnings, none ignored. pnpm --filter @objectstack/cli typecheck: exit 0; tsc -p tsconfig.test.json --listFiles lists all 3 files, and its 28 errors are exactly the ledgered test-typecheck debt. CI on the PR head at report time: 27 success, 10 skipped; failure: 'Lint · CI, release & engine gates' (sole failing step 'Cross-package test inputs') and the aggregate 'Lint & Repo Gates'; Test Core (1/6)-(4/6) in_progress. CI is not re-run locally. check-platform-checklist not owed: no export was renamed or deleted.",
"mcp_calls": "0",
"api_writes": "3 relay requests through fleet-write: pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft), POST /issues/24455/assignees [zhuangjianguo], POST /issues/24455/labels [skip-changeset]; plus this comment, POST /issues/24419/comments. Relay read-back: body 11852 bytes sent and stored, identical; assignee zhuangjianguo. The relay row did not name the label, so the label was confirmed by a separate REST read of PR 24455: labels ['skip-changeset'], draft true. git push x2 (the empty branch, then bd06515); git push is not a REST write.",
"open_questions": [
{
"question": "dev-no-watch.pin's fixtures read the pin from the root package.json, as the card and the claim ask. check:cross-package-test-inputs then demands a declaration in three files outside the claimed surface (turbo.json, scripts/cross-package-test-inputs.mjs, and the pinned TURBO_ROOT_FILE_INPUTS roster in scripts/check-cross-package-test-inputs.mjs). Approve that declaration, or move to the in-surface shape? The dispatch carried no decision-framework axes, so the options give measured costs only and no self-made axes.",
"options": [
"A. Approve the declaration: turbo.json @objectstack/cli#test inputs += '$TURBO_ROOT$/package.json'; cross-package-test-inputs.mjs cli globs += 'package.json'; TURBO_ROOT_FILE_INPUTS += 'package.json'. Measured: gate exit 0, check-ci-filter-parity exit 0 (ci.yml's core filter already lists package.json, so no workflow edit), then restored. Cost: the root package.json becomes a cli#test input, so every PR that edits it adds cli's PR-tier suite to Test Core and moves cli#test's cache key. Today a root-package.json-only edit affects 0 packages (control: a packages/types edit affects 69). 42 of the last 300 origin/main commits (since 2026-10-16) touched the root package.json and no packages/examples/apps path. Work: one commit, about 6 lines.",
"B. Stay in the surface: pin the fixtures to the version that 'pnpm --version' answers with cwd = packages/cli (the root pin through Corepack's walk), with no file read. Measured network-free: pnpm@10.31.0 without hash resolves from the store, 0 requests. Cost: the pin stays an undeclared input, so a pin-only bump does not re-run this file. That is the same blind spot the suite's 87 in-process 'pnpm -v' calls and 2 'pnpm pack' calls already have. It also drops the integrity hash, adds one spawn, and is not literally 'read from the root package.json'. Work: one commit in dev-no-watch only, and the gate goes green.",
"C. Use npm_execpath to run the suite's own pnpm (prior art in published-subpath pins). Rejected on measurement: npm_execpath is unset under 'pnpm exec vitest' (os-dev's single-file recipe) and set only under 'pnpm run', so the fix silently lapses under exec.",
"D. COREPACK_DEFAULT_TO_LATEST=0 (the card's env route). Rejected on measurement: GET /pnpm/10.13.1, 429, exit 1. The network is still reached."
],
"recommendation": "A, because the pin is this file's real input: the sentence it pins is pnpm's own wording ('measured on pnpm 10.28.0 and 10.31.0'), so a pin bump is exactly the change that should re-run it, and the declaration is what makes it do so. Choose B if the seat judges cli's PR-tier suite on root-package.json PRs too costly. Either way the follow-up is one small commit on PR #24455; the PR body (written once) records the gap and the measured three-file patch."
}
],
"out_of_scope_findings": [
"class: a · reach: public door 'os doctor', measured: in a tmpdir with no packageManager under Corepack, with the registry answering 429, doctor prints '✗ pnpm Not found' and '→ Install pnpm: npm install -g pnpm@10.28.1' and exits 1, with Corepack's stack trace on stderr above the report. pnpm IS installed; the Corepack fetch failed. Seat: packages/cli/src/commands/doctor.ts, the pnpm probe's catch, which maps every 'pnpm -v' failure to 'Not found' (held off for this card: packages/cli/src/**) · evidence: probe run on head bd06515, tsx bin/run-dev.js doctor · dedupe words: os doctor pnpm Not found corepack registry offline misleading install hint"
]
}

REWORK (patch round 1) → PR #24455 comment 6260033601 · domain:cli seat 1 · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T05:00Z. The open question is answered B: the fixture pin is derived from pnpm --version in packages/cli, so no root-manifest read and no new turbo input. Filed from the review: #24464 (os doctor reports a failing pnpm -v as "Not found").

Generated by Claude Code

os-dev-report
{
"issue": 24419,
"patch_round": 1,
"status": "done",
"branch": "claude/issue-24419-cli-test-no-registry",
"pr": "#24455",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T",
"premise_still_valid": true,
"summary": "Patch round 1 implements the seat's option B on head 8994da1, one commit on bd06515 that touches only packages/cli/test/dev-no-watch.pin.test.ts. derivePackageManagerPin() runs 'pnpm --version' with cwd = packages/cli (the root pin, reached through Corepack's walk) and env: childEnv(). It refuses loudly on a non-version answer and returns pnpm@VERSION. Both fixture manifests carry it, keeping the measured nesting: the pin sits in the fixture root above project/, and in workspace/package.json. No root file is read, and no turbo input is declared. The file's comment says why the pin is derived and not read, and names the blind spot: a pin-only bump does not re-run this file, the same as the suite's other 'pnpm -v' and 'pnpm pack' callers. check:cross-package-test-inputs exits 0. turbo.json, scripts/cross-package-test-inputs.mjs and scripts/check-cross-package-test-inputs.mjs are untouched (git diff db1f1fd HEAD is empty for all three). CI on 8994da1 is fully green, all five required contexts included. The PR body was not patched; body_edits holds 12 exact old/new pairs against the live body (11852 bytes, byte-identical to the body sent at creation). Each old string occurs exactly once, and they apply in any order. The other two file fixes and the census are unchanged, as accepted. The os doctor finding is #24464 and is not in this PR. Where the time went this round: about 5 min recreating the worktree (the closure build replayed fully from the turbo cache in 1s); about 4 min for proof, ablation and the standalone shape; about 20 min for the 63-gate battery, the origin/main derivation comparison, typecheck and eslint; about 10 min building and verifying the body edits.",
"tests": "All on head 8994da1, in the rebuilt CI Corepack shape: a store holding only pnpm@10.31.0, with COREPACK_NPM_REGISTRY and npm_config_registry pointed at a local server that answers 429 and logs each request. PROOF: dev-no-watch.pin + package-owned-command-readers 16/16 passed, 0 registry requests. pnpm calls: 'pnpm --version' in packages/cli (the derivation), then '--filter false --fail-if-no-match dev' in /tmp/os-dev-no-watch-*/project and 'dev' in .../workspace, both resolved from the store. The store still holds only v1/pnpm/10.31.0 and no lastKnownGood.json. STANDALONE pnpm 10.28.0 shape (no Corepack), with both registries refused: dev-no-watch.pin 8/8, 0 requests. ABLATION via scripts/ablation-replace.mjs wrap mode, with the fix committed first: anchor 'packageManager: packageManagerPin' x2 replaced by 'packageManager: undefined'. On disk: anchor 2 to 0, replacement 0 to 2, blob 0881d577b041 to 1df76c152cb3. With the registry refused it went RED in the expected direction: the same 2 tests failed ('and the failure is pnpm refusing the PACKAGE...' and 'the fixture starts its own dev script when asked — the control'), 6 passed, and 2 x GET /pnpm/latest were logged. Restore: blob after restore 0881d577b041 == HEAD, git diff HEAD empty, porcelain empty. TIERS: tierSignals is identical on db1f1fd, bd06515 and 8994da1 for all 3 files, and vitest-tiers-partition.test.ts passed 22/22. Unchanged files were not re-run this round: create-refuses...e2e and init-created-files-summary.e2e (10/10, 0 requests on bd06515), and the whole-PR-tier census on bd06515 (unit 311 files / 4610 tests and integration 159 + 1 skipped / 1375 tests, both with 0 requests).",
"gates": "Local, head 8994da1. dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 52 commands. Each was run with its exit code captured before any pipe, and all 52 exit 0, including check:cross-package-test-inputs ('OK: 31 package(s) read outside themselves, all declared'). check:dual-build-cjs-loads first answered exit 3, PREREQUISITE NOT MET: the fresh worktree had no dist for packages outside cli's closure. That run measured nothing. A later battery gate, check:type-check-debt, built them, and the re-run exited 0 (111 entry points across 69 packages). The derivation flagged the tree as behind origin/main, with two gate files changed there. The same derivation on a detached tree at origin/main 725a5b1 with this diff applied gave an identical 52-command list (since removed). The 11 declared-wide families: all exit 0. check:cli-test-child-env: exit 0 (155 spawner sources, all 190 spawn calls declare env). --ran reconciliation: 52 derived, 52 run, 0 NOT-MEASURED (a derived zero: every entry records an exit code), 0 UNRUN. eslint --no-inline-config over the 3 changed files: exit 0, 0 errors, 0 warnings, none ignored. pnpm --filter @objectstack/cli typecheck: exit 0. tsc -p tsconfig.test.json --listFiles lists all 3 files, and its 28 errors are exactly the ledgered debt, 0 of them in these files. CI read on bd06515 before pushing: all 6 Test Core shards, Build Core, TypeScript Type Check and Governed Surface Queue Guard success; the only red was the Lint lane's 'Cross-package test inputs' step. CI on 8994da1: 33 success, 7 skipped, 0 failures; Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core and Governed Surface Queue Guard all success.",
"mcp_calls": "0",
"api_writes": "1 this round: this os-dev-report comment, sent through the fleet-write relay as POST /repos//issues/24419/comments. Plus git push x1 (bd06515 to 8994da1), which is not a REST write. The PR body was not written.",
"body_edits": [
{
"old_str": "Measured after pnpm turbo run build --filter=@objectstack/cli: the identifiers this PR adds (PACKAGE_MANAGER_PIN, STUB_PNPM_VERSION, writeStubPnpm, stubBinDir, fixtureRoot) occur in 0 of those files.",
"new_str": "Measured on head 8994da181, after pnpm turbo run build --filter='@objectstack/cli...': the identifiers this PR adds (derivePackageManagerPin, packageManagerPin, PACKAGE_ROOT, STUB_PNPM_VERSION, writeStubPnpm, stubBinDir, fixtureRoot) occur in 0 of those files."
},
{
"old_str": "## Status: one named gap, waiting on a seat decision\n\ncheck:cross-package-test-inputs (in Lint & Repo Gates) is RED on this head, on purpose, and it stays red until the seat decides. The fix the card and the claim ask for reads the repository's packageManager pin from the ROOT package.json. That read leaves packages/cli, so the gate requires it to be declared. The declaration touches three files outside the claim's file surface, so the work stopped there. Measured on this head and then restored (blob equal to HEAD, git diff HEAD empty for all three), these three edits turn the gate green, and check-ci-filter-parity stays green:\n\n- turbo.json: \"$TURBO_ROOT$/package.json\" in the @objectstack/cli#test inputs;\n- scripts/cross-package-test-inputs.mjs: 'package.json' in the @objectstack/cli globs;\n- scripts/check-cross-package-test-inputs.mjs: 'package.json' in TURBO_ROOT_FILE_INPUTS. That roster is pinned so that a second repo-root file input fails the gate rather than arriving unnoticed. Adding one is a reviewer-visible change to the gate's own data.\n\nWhat the declaration costs: the root package.json becomes an input of @objectstack/cli#test. Any PR that edits it therefore adds cli's PR-tier suite to Test Core. Measured: a root-package.json-only edit gives turbo ls --affected 0 packages today (the control, a packages/types/package.json edit, gives 69 including cli). On origin/main, 42 of the last 300 commits (since 2026-10-16) touched the root package.json and no packages/, examples/ or apps/ path. ci.yml's core filter already lists package.json, so no workflow edit is needed.\n\nThe options, with what each was measured to do, are in the report on #24419. The in-surface alternative is to pin the fixtures to the version the package root's pnpm resolves to, asked at run time, with no file read. It is also network-free (measured: 0 requests). It keeps the pin an undeclared input, the same blind spot this suite's other pnpm calls already have.\n\n",
"new_str": "## The pin's shape: derived from pnpm (option B, the seat's decision)\n\nThe first head (bd0651500) read the packageManager pin from the root package.json. That read leaves packages/cli, so check:cross-package-test-inputs went red, and declaring it needed three files outside the claim's file surface. The work stopped there, and the seat chose option B (PR thread, patch round 1).\n\nThe pin is now derived. dev-no-watch.pin.test.ts runs pnpm --version with cwd = packages/cli and writes pnpm@VERSION into the fixtures. That answer is the root pin, reached through Corepack's own walk. No root file is read and no new turbo input is declared. check:cross-package-test-inputs exits 0 on 8994da181, and turbo.json, scripts/cross-package-test-inputs.mjs and scripts/check-cross-package-test-inputs.mjs are untouched (git diff db1f1fd20 HEAD is empty for all three).\n\nWhy B:\n- The card's acceptance is that the test reaches no network. B meets it, and the pin is derived rather than copied by hand.\n- A would have made the root package.json an input of @objectstack/cli#test. Every PR that edits it would then add cli's PR-tier suite to Test Core. Measured: a root-package.json-only edit gives turbo ls --affected 0 packages today (the control, a packages/types/package.json edit, gives 69 including cli). On origin/main, 42 of the last 300 commits (since 2026-10-16) touched the root package.json and no packages/, examples/ or apps/ path.\n\nWhat B leaves, stated in the file's own comment: the pin is an undeclared input, so a pin-only bump does not re-run this file. This suite's other pnpm -v and pnpm pack callers have the same blind spot, so B adds no new class of it. The fixture spec carries no integrity hash, and the derivation costs one extra spawn.\n\nOption A's patch was measured and not taken. On bd0651500, three edits turned the gate green with check-ci-filter-parity also green, and were then restored (blob equal to HEAD, git diff HEAD empty for all three):\n- turbo.json: \"$TURBO_ROOT$/package.json\" in the @objectstack/cli#test inputs;\n- scripts/cross-package-test-inputs.mjs: 'package.json' in the cli globs;\n- scripts/check-cross-package-test-inputs.mjs: 'package.json' in the pinned TURBO_ROOT_FILE_INPUTS roster.\n\n"
},
{
"old_str": "The fixtures carry the repository's own pin, read from the root package.json at run time (never copied by hand). The pin is the one version CI's Corepack store already holds, so it resolves with no network call.",
"new_str": "The fixtures carry the repository's own pin as pnpm@VERSION, where VERSION is what pnpm --version answers in packages/cli (see the section above). Nothing is copied by hand. It is the one version CI's Corepack store already holds, so it resolves with no network call."
},
{
"old_str": "| 2 × GET /pnpm/latest, 2 tests red | fixed: pin from the root manifest |",
"new_str": "| 2 × GET /pnpm/latest, 2 tests red | fixed: pin derived from pnpm --version in packages/cli |"
},
{
"old_str": "| yes | 87 calls, 0 requests | no reach |\n",
"new_str": "| yes | 87 calls, 0 requests | no reach |\n| test/create-objectstack-stack-reach.test.ts (found by the whole-tier run below; the grep missed it) | pnpm --version | packages/cli/node_modules/.create-objectstack-reach-* | yes | 0 requests (measured at bd0651500) | no reach |\n"
},
{
"old_str": "- --project integration (160 files): still running when this body was written, and NOT MEASURED here. Its reading (pass/fail, registry requests, pnpm calls) is in the os-dev-report comment on #24419. The two integration files this PR changes were measured separately (see Proof).",
"new_str": "- --project integration: 160 files, 159 passed + 1 skipped (a pre-existing skip in a file this PR does not touch), 1375 tests passed + 9 skipped, 0 registry requests. pnpm was called by dev-no-watch's two spawns (pinned) and by create-objectstack-stack-reach.test.ts's pnpm --version in packages/cli/node_modules/…, where the root pin is in reach. That file is the table's last row.\n\nPatch round 1 (8994da181) changes only dev-no-watch.pin.test.ts. That file was re-proved on the new head (see Proof); the whole-tier readings above were taken on bd0651500."
},
{
"old_str": "## Proof: the converted tests with the registry refused (head bd0651500)\n\n- dev-no-watch.pin + package-owned-command-readers: 16/16 passed, 0 registry requests. The pnpm calls in /tmp/os-dev-no-watch-*/project and …/workspace resolved to 10.31.0 from the store.\n- create-refuses-invalid-project-name.e2e + init-created-files-summary.e2e (OS_TEST_TIERS=nightly): 10/10 passed, 0 registry requests.\n- The Corepack store still holds exactly v1/pnpm/10.31.0, with no lastKnownGood.json.\n- Also green in this container's default shape (a standalone pnpm 10.28.0, not Corepack), with both registries refused: dev-no-watch.pin 8/8, 0 requests.\n\n",
"new_str": "## Proof: the converted tests with the registry refused\n\n- Head 8994da181: dev-no-watch.pin + package-owned-command-readers 16/16 passed, 0 registry requests. The derivation's pnpm --version ran in packages/cli. The pnpm calls in /tmp/os-dev-no-watch-*/project and …/workspace resolved to 10.31.0 from the store.\n- Head bd0651500, files unchanged since: create-refuses-invalid-project-name.e2e + init-created-files-summary.e2e (OS_TEST_TIERS=nightly) 10/10 passed, 0 registry requests.\n- The Corepack store still holds exactly v1/pnpm/10.31.0, with no lastKnownGood.json.\n- Also green in this container's default shape (a standalone pnpm 10.28.0, not Corepack), with both registries refused, on 8994da181: dev-no-watch.pin 8/8, 0 requests.\n\n"
},
{
"old_str": "## Ablation (scripts/ablation-replace.mjs, wrap mode, fix committed first)\n\n- Anchor packageManager: PACKAGE_MANAGER_PIN (2 hits, --expect 2), replaced with packageManager: undefined. On disk: anchor 2 → 0, replacement 0 → 2, blob 2f8d42e3da92 → c96e4816fae2.\n- With the registry refused, it went RED, the expected direction. These are the same two tests the premise run failed: "and the failure is pnpm refusing the PACKAGE…" and "the fixture starts its own dev script when asked — the control". 6 passed, and there were 2 × GET /pnpm/latest.\n- Restore: blob after restore 2f8d42e3da92 equals HEAD, git diff HEAD empty, git status --porcelain empty.\n\n",
"new_str": "## Ablation (scripts/ablation-replace.mjs, wrap mode, fix committed first, head 8994da181)\n\n- Anchor packageManager: packageManagerPin (2 hits, --expect 2), replaced with packageManager: undefined. On disk: anchor 2 → 0, replacement 0 → 2, blob 0881d577b041 → 1df76c152cb3.\n- With the registry refused, it went RED, the expected direction. The same two tests failed as in the premise run: "and the failure is pnpm refusing the PACKAGE…" and "the fixture starts its own dev script when asked — the control". 6 passed, and there were 2 × GET /pnpm/latest.\n- Restore: blob after restore 0881d577b041 equals HEAD, git diff HEAD empty, git status --porcelain empty.\n- The same ablation on bd0651500's read-the-manifest shape gave the same red: 2 failed, 2 requests, restore proven.\n\n"
},
{
"old_str": "before (db1f1fd20) and after (bd0651500).",
"new_str": "before (db1f1fd20), on bd0651500 and on 8994da181."
},
{
"old_str": "test/vitest-tiers-partition.test.ts passed.",
"new_str": "test/vitest-tiers-partition.test.ts passed (22/22 on 8994da181)."
},
{
"old_str": "## Gates (local, head bd0651500)\n\n- node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 52 derived commands, each run with its exit code captured before any pipe.\n - 51 exited 0.\n - pnpm check:cross-package-test-inputs exited 1. This is the named gap above: package.json (named in packages/cli/test/dev-no-watch.pin.test.ts).\n - pnpm check:dual-build-cjs-loads first answered 3, PREREQUISITE NOT MET (no dist/ yet). That run measured nothing. Once dist/ existed, it was re-run and exited 0.\n- The 11 declared-wide families were each run and exited 0. pnpm check:cli-test-child-env exited 0.\n- --ran reconciliation: 52 derived, 52 run, 0 NOT-MEASURED (a derived zero: all 52 recorded an exit code), 0 UNRUN.\n- eslint --no-inline-config over the 3 changed files: exit 0, 0 errors, 0 warnings, none ignored.\n- pnpm --filter @objectstack/cli typecheck: exit 0. tsc -p tsconfig.test.json --listFiles lists all 3 changed files. Its 28 errors are exactly the ledgered test-typecheck-debt.json set, none in these files.\n\n",
"new_str": "## Gates (local, head 8994da181)\n\n- node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 52 derived commands, each run with its exit code captured before any pipe. All 52 exited 0, pnpm check:cross-package-test-inputs included.\n - pnpm check:dual-build-cjs-loads first answered 3, PREREQUISITE NOT MET: the fresh worktree had no dist/ for packages outside cli's closure, so that run measured nothing. A later gate in the battery (check:type-check-debt) built them, and the re-run exited 0.\n - The head is behind origin/main, and the derivation flagged two gate files changed there. The same derivation on a tree at origin/main 725a5b131, with this diff applied, gives the identical 52 commands.\n- The 11 declared-wide families were each run and exited 0. pnpm check:cli-test-child-env exited 0.\n- --ran reconciliation: 52 derived, 52 run, 0 NOT-MEASURED (a derived zero: all 52 recorded an exit code), 0 UNRUN.\n- eslint --no-inline-config over the 3 changed files: exit 0, 0 errors, 0 warnings, none ignored.\n- pnpm --filter @objectstack/cli typecheck: exit 0. tsc -p tsconfig.test.json --listFiles lists all 3 changed files. Its 28 errors are exactly the ledgered test-typecheck-debt.json set, none in these files.\n- CI on 8994da181, read before this reply: 33 success, 7 skipped, 0 failures. All five required contexts are green (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard).\n\n"
},
{
"old_str": "It is reported to the seat as a finding, not fixed here (packages/cli/src/** is held off).",
"new_str": "Filed as #24464, not fixed here (packages/cli/src/** is held off)."
}
],
"open_questions": [],
"out_of_scope_findings": []
}

ACCEPT → PR #24455 comment 6260393740 (patch round 1, head 8994da181). It is ready with auto-merge on and lands through the queue; the card closes on the merge. Filed from the review: #24464.

Generated by Claude Code

Landed: PR #24455 → `83e31cd40` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T05:54Z

Reading	Result
PR #24455 object	`merged: true`, merge commit `83e31cd40`, merged 2026-10-19T05:53Z through the merge queue (enqueued 2026-10-19T05:32Z)
`origin/main`	`83e31cd40` is an ancestor of `origin/main`, with a single parent (squash). The 3 files and +137 / −11 match what was reviewed at `8994da181`
queue branch	no `gh-readonly-queue/main/pr-24455` head remains

Review chain: claim 6258726768 → report 6259990435 (needs_decision: the root-manifest read needed a turbo input outside the claim) → REWORK 6260033601, answered B, pointer 6260039425 → report 6260358776 → the seat's 12 body edits → ACCEPT 6260393740 → pointer 6260411563.
What landed:
- dev-no-watch.pin's fixtures carry the pnpm pin derived from pnpm --version in packages/cli, so Corepack never resolves pnpm@latest.
- package-owned-command-readers answers pnpm -v from a stub on PATH.
- create-refuses-invalid-project-name.e2e initialises with --no-install.
- With the registry refused in CI's Corepack shape, the whole PR tier made 0 registry requests.
Filed from this card: os doctor: a pnpm -v that fails for any reason (Corepack unable to fetch its pinned or latest pnpm) is reported "✗ pnpm Not found" with "Install pnpm: npm install -g pnpm@10.28.1", though pnpm is installed #24464 (os doctor reports a failing pnpm -v as "Not found").
State: the card closed completed on the merge. pm:dispatched is removed in the stroke after this comment.

Generated by Claude Code

Navigation Menu

Repository navigation

cli test: dev-no-watch.pin.test.ts reaches the public npm registry (corepack resolves pnpm@latest for its tmpdir fixtures) and fails CI on an HTTP 429 #24419

The chain, read on `origin/main`

Wanted

Dedupe

Triage: p2 · `tests` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T01:55Z

Landed: PR #24455 → `83e31cd40` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T05:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli test: dev-no-watch.pin.test.ts reaches the public npm registry (corepack resolves pnpm@latest for its tmpdir fixtures) and fails CI on an HTTP 429 #24419

Description

The chain, read on origin/main

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

Triage: p2 · tests · domain:cli · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-19T01:55Z

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Landed: PR #24455 → 83e31cd40 · domain:cli seat 1 · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T05:54Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The chain, read on `origin/main`

Triage: p2 · `tests` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T01:55Z

Landed: PR #24455 → `83e31cd40` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T05:54Z