{"record":{"id":"6414405b16596ca2","repo":"affaan-m/ECC","slug":"typescript-compiler-not-found-install-root-dev-de","errorCode":null,"errorMessage":"TypeScript compiler not found. Install root dev dependencies before publishing so .opencode/dist can be built.","messagePattern":"TypeScript compiler not found\\. Install root dev dependencies before publishing so \\.opencode/dist can be built\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/build-opencode.js","lineNumber":18,"sourceCode":"#!/usr/bin/env node\n\nconst fs = require(\"node:fs\")\nconst path = require(\"node:path\")\nconst { execFileSync } = require(\"node:child_process\")\n\nconst rootDir = path.resolve(__dirname, \"..\")\nconst opencodeDir = path.join(rootDir, \".opencode\")\nconst distDir = path.join(opencodeDir, \"dist\")\n\nfs.rmSync(distDir, { recursive: true, force: true })\n\nlet tscEntrypoint\n\ntry {\n  tscEntrypoint = require.resolve(\"typescript/bin/tsc\", { paths: [rootDir] })\n} catch {\n  throw new Error(\n    \"TypeScript compiler not found. Install root dev dependencies before publishing so .opencode/dist can be built.\"\n  )\n}\n\nexecFileSync(process.execPath, [tscEntrypoint, \"-p\", path.join(opencodeDir, \"tsconfig.json\")], {\n  cwd: rootDir,\n  stdio: \"inherit\",\n})\n","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/build-opencode.js#L1-L27","documentation":"_validate_file_path() blocks any resolved path that falls under OS system directories (/etc, /usr, /bin, /sbin, /proc, /sys, /var/log, /var/run, /var/lib, /var/spool, plus macOS /private/etc, /private/var/log, /private/var/run, /private/var/db). This is a system-safety / path-traversal guard that fires even when the path is valid and exists, because writing instinct storage into system dirs could corrupt the OS or exfiltrate data. The check runs after .resolve() so symlinks are followed.","triggerScenarios":"Passing '/etc/myconfig'; a symlink inside the project that resolves to /usr/local/...; an expanduser('~') that on a misconfigured system lands under a blocked prefix; a user-supplied path containing '../etc'.","commonSituations":"A project contains a symlink pointing into a system directory; a path was constructed from untrusted input without sanitization; the home directory was misconfigured to resolve under /var.","solutions":["Point the path at a project-local or user-data directory (e.g. under the project root or ~/.local/share).","Remove or avoid symlinks inside the working tree that resolve into /etc, /usr, /var, etc.","If you genuinely need a system path, copy the relevant file into a non-system location first and validate that."],"exampleFix":"# before\n_validate_file_path('/etc/myapp/instinct.md')  # blocked\n\n# after\n_validate_file_path(project_root / 'instincts' / 'myapp.md')","handlingStrategy":"validation","validationCode":"# Pre-check against the same blocked prefixes before calling.\nimport os\nBLOCKED = ('/etc', '/usr', '/bin', '/sbin', '/proc', '/sys',\n           '/var/log', '/var/run', '/var/lib', '/var/spool',\n           '/private/etc', '/private/var/log', '/private/var/run', '/private/var/db')\nresolved = str(os.path.realpath(path))\nfor prefix in BLOCKED:\n    if resolved == prefix or resolved.startswith(prefix + '/'):\n        raise SystemExit(f'refusing to use system path {resolved}')","typeGuard":"import os\n\ndef is_safe_user_path(p) -> bool:\n    resolved = str(os.path.realpath(p))\n    blocked = ('/etc', '/usr', '/bin', '/sbin', '/proc', '/sys',\n               '/var/log', '/var/run', '/var/lib', '/var/spool')\n    return not any(resolved == b or resolved.startswith(b + '/') for b in blocked)","tryCatchPattern":"try:\n    _validate_file_path(user_path)\nexcept ValueError as e:\n    if 'system directory' in str(e):\n        log.error('rejected system path: %s', user_path)\n    raise","preventionTips":["Keep instinct storage under the project root or a designated user-data directory.","Avoid symlinks inside the working tree that point into system directories.","Sanitize all user-supplied paths at the trust boundary, not deep in the call stack."],"tags":["security","filesystem","path-traversal","validation","system"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}