{"record":{"id":"caca839ee8413fbf","repo":"stablyai/orca","slug":"verify-skills-cli-runtime-outdir-is-outside","errorCode":null,"errorMessage":"[verify-skills-cli-runtime] ${outDir} is outside ${artifactRoot}","messagePattern":"\\[verify-skills-cli-runtime\\] (.+?) is outside (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-skills-cli-runtime.cjs","lineNumber":111,"sourceCode":"    throw new Error(\n      `[verify-skills-cli-runtime] missing runtime import \"${specifier}\" from ` +\n        `${artifactPath(outDir, importer)}: ${detail}`\n    )\n  }\n  if (isOutsideRoot(artifactRoot, resolved)) {\n    throw new Error(\n      `[verify-skills-cli-runtime] import \"${specifier}\" from ` +\n        `${artifactPath(outDir, importer)} resolved outside ${artifactRoot}: ${resolved}`\n    )\n  }\n  return resolved\n}\n\nfunction collectRuntimeClosure(outDir, artifactRoot = dirname(outDir)) {\n  outDir = realpathSync(outDir)\n  artifactRoot = realpathSync(artifactRoot)\n  if (isOutsideRoot(artifactRoot, outDir)) {\n    throw new Error(`[verify-skills-cli-runtime] ${outDir} is outside ${artifactRoot}`)\n  }\n  const entry = resolve(outDir, 'cli', 'index.js')\n  if (!existsSync(entry)) {\n    throw new Error(`[verify-skills-cli-runtime] missing entry ${entry}`)\n  }\n  const pending = [entry]\n  const visited = new Set()\n\n  while (pending.length > 0) {\n    const file = pending.pop()\n    if (!file || visited.has(file)) {\n      continue\n    }\n    visited.add(file)\n    const source = readFileSync(file, 'utf8')\n    for (const specifier of runtimeImportSpecifiers(source, file)) {\n      const resolved = resolveRuntimeImport(outDir, artifactRoot, file, specifier)\n      if (resolved && !isOutsideRoot(artifactRoot, resolved) && /\\.(?:c|m)?js$/.test(resolved)) {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-skills-cli-runtime.cjs#L93-L129","documentation":"collectRuntimeClosure() realpaths both outDir and artifactRoot, then checks isOutsideRoot(artifactRoot, outDir). It throws when the build output directory itself is not contained within the artifact root — i.e. the verifier was pointed at an outDir that lives outside the package it's supposed to validate.","triggerScenarios":"Calling collectRuntimeClosure with an outDir that is a sibling of or above artifactRoot; defaulting artifactRoot to dirname(outDir) when outDir is already at the root; realpath resolving a symlinked outDir to a location outside the artifact root.","commonSituations":"Misconfigured build output path; symlinked dist directory pointing outside the package; CI step that copies build output to an unexpected location before verification; caller passing absolute paths computed against the wrong base.","solutions":["Confirm outDir is physically inside artifactRoot (print both realpaths).","Pass an explicit artifactRoot that contains outDir instead of relying on the dirname default.","Remove symlinks in the outDir path that escape the artifact root, or rebuild into a contained directory.","Adjust the build config so dist emits inside the package boundary."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pass an explicit artifactRoot and assert containment before calling collectRuntimeClosure:\nconst outDir = path.resolve(projectRoot, 'dist/skills')\nconst artifactRoot = path.resolve(projectRoot, 'dist')\nif (!outDir.startsWith(artifactRoot + path.sep)) {\n  throw new Error(`outDir ${outDir} must be inside artifactRoot ${artifactRoot}`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Don't rely on the dirname default for artifactRoot; pass it explicitly.","Keep the build output physically inside the package boundary.","Resolve symlinks before the containment check."],"tags":["bundler","path-escape","skills-cli","build-artifact","configuration"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}