[verify-skills-cli-runtime] missing runtime import "${specif

Error message

[verify-skills-cli-runtime] missing runtime import "${specifier}" from ${artifactPath(outDir, importer)}: ${detail}

What it means

resolveRuntimeImport() uses Node's createRequire(importer).resolve(specifier) to resolve a runtime import inside the skills CLI build artifact. It throws when resolution fails for a non-builtin, non-optional specifier — meaning the built CLI references a dependency that isn't bundled and isn't resolvable from the artifact's location.

Source

Thrown at config/scripts/verify-skills-cli-runtime.cjs:93

    }
    directory = dirname(directory)
  }
  return false
}

function resolveRuntimeImport(outDir, artifactRoot, importer, specifier) {
  if (BUILTINS.has(specifier) || isBuiltin(specifier)) {
    return null
  }
  let resolved
  try {
    resolved = createRequire(importer).resolve(specifier)
  } catch (error) {
    if (isOptionalPackageImport(artifactRoot, importer, specifier)) {
      return null
    }
    const detail = error instanceof Error ? error.message : String(error)
    throw new Error(
      `[verify-skills-cli-runtime] missing runtime import "${specifier}" from ` +
        `${artifactPath(outDir, importer)}: ${detail}`
    )
  }
  if (isOutsideRoot(artifactRoot, resolved)) {
    throw new Error(
      `[verify-skills-cli-runtime] import "${specifier}" from ` +
        `${artifactPath(outDir, importer)} resolved outside ${artifactRoot}: ${resolved}`
    )
  }
  return resolved
}

function collectRuntimeClosure(outDir, artifactRoot = dirname(outDir)) {
  outDir = realpathSync(outDir)
  artifactRoot = realpathSync(artifactRoot)
  if (isOutsideRoot(artifactRoot, outDir)) {
    throw new Error(`[verify-skills-cli-runtime] ${outDir} is outside ${artifactRoot}`)

View on GitHub (pinned to 1136503c6a)

Solutions

Read the error's specifier and importer path, then confirm that dependency is declared in package.json and bundled.
If the import is genuinely optional at runtime, register it in isOptionalPackageImport's allowlist (the function the verifier already consults).
Rebuild the CLI artifact and re-run the verifier.
If the dep is required, add it to the bundler's externals-or-include set so it ships inside the artifact.

Defensive patterns

Strategy: validation

Validate before calling

// Before invoking the verifier, statically confirm every non-builtin import in the
// entry file is either bundled into the artifact or registered as optional:
import { readFileSync } from 'node:fs'
function listImports(file) {
  const src = readFileSync(file, 'utf8')
  const re = /(?:require\(|import\s[^'";]*from\s*)['"]([^'"]+)['"]/g
  return [...src.matchAll(re)].map((m) => m[1]).filter((s) => !s.startsWith('.') && !s.startsWith('node:'))
}

Prevention

Keep the bundler's externals and package.json dependencies in sync: any external must be a real dependency or registered optional.
Add new runtime deps to the bundler include set in the same commit that adds the import.
Run the runtime verifier in PR CI so a missing import fails the build, not a downstream release.

When it happens

Trigger: The CLI source imports a package that wasn't added to the bundle (missing dependency in the build config); a dynamic require() to a specifier that only resolves from source, not from the published artifact; an optional dependency not declared in the optional-import allowlist; a typo'd specifier.

Common situations: Bundler misconfiguration excluding a needed dep; new dependency added to source but not to package.json dependencies; production prune removing a dep that the runtime requires; platform-conditional import that the verifier doesn't recognize as optional.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/a50c1593312d37b1. Report an issue: GitHub.