{"record":{"id":"c25285d6f7cbb939","repo":"stablyai/orca","slug":"verify-skills-cli-runtime-import-specifier","errorCode":null,"errorMessage":"[verify-skills-cli-runtime] import \"${specifier}\" from ${artifactPath(outDir, importer)} resolved outside ${artifactRoot}: ${resolved}","messagePattern":"\\[verify-skills-cli-runtime\\] import \"(.+?)\" from (.+?) resolved outside (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-skills-cli-runtime.cjs","lineNumber":99,"sourceCode":"function resolveRuntimeImport(outDir, artifactRoot, importer, specifier) {\n  if (BUILTINS.has(specifier) || isBuiltin(specifier)) {\n    return null\n  }\n  let resolved\n  try {\n    resolved = createRequire(importer).resolve(specifier)\n  } catch (error) {\n    if (isOptionalPackageImport(artifactRoot, importer, specifier)) {\n      return null\n    }\n    const detail = error instanceof Error ? error.message : String(error)\n    throw new Error(\n      `[verify-skills-cli-runtime] missing runtime import \"${specifier}\" from ` +\n        `${artifactPath(outDir, importer)}: ${detail}`\n    )\n  }\n  if (isOutsideRoot(artifactRoot, resolved)) {\n    throw new Error(\n      `[verify-skills-cli-runtime] import \"${specifier}\" from ` +\n        `${artifactPath(outDir, importer)} resolved outside ${artifactRoot}: ${resolved}`\n    )\n  }\n  return resolved\n}\n\nfunction collectRuntimeClosure(outDir, artifactRoot = dirname(outDir)) {\n  outDir = realpathSync(outDir)\n  artifactRoot = realpathSync(artifactRoot)\n  if (isOutsideRoot(artifactRoot, outDir)) {\n    throw new Error(`[verify-skills-cli-runtime] ${outDir} is outside ${artifactRoot}`)\n  }\n  const entry = resolve(outDir, 'cli', 'index.js')\n  if (!existsSync(entry)) {\n    throw new Error(`[verify-skills-cli-runtime] missing entry ${entry}`)\n  }\n  const pending = [entry]","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-skills-cli-runtime.cjs#L81-L117","documentation":"resolveRuntimeImport() resolves a specifier successfully but isOutsideRoot(artifactRoot, resolved) returns true — the resolved file lives outside the artifact root. The verifier requires every runtime import to be self-contained within the artifact, so an escape (e.g. resolving into node_modules at the repo root, or the system) is a defect.","triggerScenarios":"A dependency was marked external and resolves to the repo's top-level node_modules instead of being bundled; a relative import climbs above the artifact root with ../; the artifact root passed to collectRuntimeClosure is wrong (too narrow).","commonSituations":"Bundler externals list too aggressive; symlinks that realpath above the artifact root; artifactRoot path computation off-by-one (dirname vs the actual publish dir); dep hoisting in a monorepo putting the file outside the package.","solutions":["Inspect the resolved path in the message — if it's in a node_modules outside the artifact, the dep must be bundled rather than left external.","Remove the offending package from the bundler's externals, or vendor it under the artifact root.","Confirm artifactRoot passed to collectRuntimeClosure is the directory that will actually ship.","If realpath symlinking causes a false escape, ensure the artifact is built and resolved without crossing the boundary."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before running the closure walk, confirm artifactRoot is correct and contains outDir:\nimport { realpathSync } from 'node:fs'\nfunction assertContained(child, root) {\n  const c = realpathSync(child), r = realpathSync(root)\n  if (c !== r && !c.startsWith(r + path.sep)) {\n    throw new Error(`${child} resolves outside artifact root ${root}`)\n  }\n}\nassertContained(outDir, artifactRoot)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid bundler externals for runtime deps; bundle them into the artifact root.","Pin artifactRoot to the directory that will ship, not a parent.","Beware realpath on symlinked dist dirs that escape the package."],"tags":["bundler","dependency","path-escape","skills-cli","build-artifact"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}