Repository navigation
@objectstack/hono runs its tests against @objectstack/plugin-hono-server's dist — the missing vitest alias was hidden by the unbounded import regex until #12555 #12767
Description
Filed unassigned by the #12555 dev, as the one repo-wide finding that card's detector fix unmasked. Not fixed there: the remediation makes a suite execute another package's source and so needs its own verification, which is a different surface from a gate-script PR.
What was hidden
packages/adapters/hono/src/index.ts imports at module scope:
export type EnvironmentDriverRegistry = any;
import {
createOriginMatcher,
hasWildcardPattern,
DEFAULT_CORS_ALLOW_HEADERS,
DEFAULT_CORS_EXPOSE_HEADERS,
} from '@objectstack/plugin-hono-server';check-test-source-alias.mjs never saw that import. Its IMPORT_PATTERNS clause capture was an unbounded [\s\S]*?, so the match started at the preceding export, ran through the ; and swallowed the whole import statement — leaving a clause that BEGINS with type, which isTypeOnlyClause then discarded as erased-at-compile-time. A real runtime import was filtered out as type-only.
Reproduced against the pre-#12555 regex:
CURRENT runtime imports kept: [] discarded as TYPE-ONLY: ["@objectstack/plugin-hono-server"]
FIXED runtime imports kept: ["@objectstack/plugin-hono-server"]
Independent corroboration on main, from an artifact nobody edited for this: check-type-source-resolution.mjs has carried @objectstack/plugin-hono-server in ITS entry for this package all along, because extractTypeImports reads only the specifier captures and never applies the type-only filter. The two gates disagreed about the same package for exactly this reason.
Current state after #12555
The detector is corrected and the ledger re-measured, so KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/hono'] now records the truth:
'@objectstack/hono': ['@objectstack/plugin-hono-server', '@objectstack/types'],That is a LEDGER CORRECTION, not a remediation. The hazard the ledger exists to track is still live for this pair: @objectstack/hono's unit verdicts are a function of build state for @objectstack/plugin-hono-server, so a stale or behind dist/ runs those tests green against old behaviour.
The remediation the gate prescribes
packages/adapters/hono/vitest.config.ts today aliases only @objectstack/runtime, in the OBJECT form. The gate asks for an anchored array-form entry, and verified the target file exists in the checkout:
alias: [
{ find: /^@objectstack\/plugin-hono-server$/, replacement: path.resolve(__dirname, '../../plugins/plugin-hono-server/src/index.ts') },
]Note this converts the existing @objectstack/runtime object entry to array form as well, and it points that suite at plugin-hono-server's SOURCE — so it needs the package's tests actually run, not just the gate re-run. That is the whole reason this is a separate card.
⛔ Do not resolve this by widening KNOWN_UNALIASED_TEST_IMPORTS: that registry is shrink-only and the entry above is already the corrected measurement.
Blast radius is exactly this one pair — --list before and after the detector fix differ in one line repo-wide (303 -> 304 package-dependency pairs, 61 of 72 packages unchanged).
Found while implementing #12555 (branch claude/issue-12555-import-regex-statement-bound).
Activity
huangyiirene commentedon Aug 27, 2026
Triage: lands in⚠️ Note the routing is not devx even though the finding was produced by a gate and is about a gate ledger: the anchoring rule follows the file the remediation edits, and that is an adapter package's test config, not
packages/adapters/hono/vitest.config.ts⇒domain:cli— the lane table carriespackages/adapters/*andplugin-hono-serverby name.scripts/. The gate half stays with #12555 in devx.Type Task: a missing test alias violates no declaration and widens nothing. Real cost, though, and it is worth naming plainly —
@objectstack/hono's unit verdicts are currently a function of build state for another package, so a stale or behinddist/runs those tests green against old behaviour. A green that depends on what was last built is the same false-clearance family as the other cards this seat graded today.State
pm:blocked, notpm:queue, and the card's own framing is what forces it. Its stated "current state after #12555" — the ledger recording['@objectstack/plugin-hono-server', '@objectstack/types']— is true on #12555's branch, not onmain. And #12555 is itselfpm:blockedas of this round (it moved frompm:dispatchedtopm:blockedat 17:23Z, after this card was filed at 17:18Z). Two consequences:mainyet, so the remediation has nothing to shrink and cannot be verified by the gate — onmainthe detector is still the unbounded regex that filtered this import out as type-only in the first place.KNOWN_UNALIASED_TEST_IMPORTStouches the same gate file check-test-source-alias loses a bare side-effectimport 'x';whenever any laterimport … from …follows it, so the clocked-window rule reports a file that already applied the fix it prescribes #12555 is changing.Blocked-by: #12555
[Decision],needs-user-decision, devx) asks whether the pair unmasked by the fixed detector counts as a re-measurement or a widening, givenKNOWN_UNALIASED_TEST_IMPORTSis shrink-only while its two self-descriptions point opposite ways. ⇒ That ruling decides whether this card's entry is legitimately in the ledger to begin with. ⛔ Do not dispatch this card's remediation while #12770 is open and could reclassify the entry underneath it. On unlock, re-check #12770's state as well as #12555's — this seat is deliberately naming only oneBlocked-by:(the file collision, which is unambiguous) rather than two, but the decision is the substantive gate.Fences carried forward, both from the card and endorsed:
KNOWN_UNALIASED_TEST_IMPORTSto resolve this. It is shrink-only, and the entry is already the corrected measurement — widening it would launder the hazard the ledger exists to track.plugin-hono-server's SOURCE, converting the existing@objectstack/runtimeobject entry to array form as a side effect. ⇒ The package's tests must actually be run, not just the gate re-run. That is the entire reason this is a separate card from check-test-source-alias loses a bare side-effectimport 'x';whenever any laterimport … from …follows it, so the clocked-window rule reports a file that already applied the fix it prescribes #12555, and a dispatch that only re-runs the gate has not verified the change.⭐ Worth preserving from the filing: the independent corroboration was found in an artifact nobody edited for this —
check-type-source-resolution.mjshas carried@objectstack/plugin-hono-serverin its entry for this package all along, becauseextractTypeImportsreads only the specifier captures and never applies the type-only filter. Two gates disagreeing about the same package, with the disagreement explained by the defect, is much stronger evidence than either gate alone. Blast radius is bounded and measured: one line repo-wide, 303 → 304 pairs, 61 of 72 packages unchanged.Generated by Claude Code