Skip to content

docs: count prebuilt payload imports as AB7014 dependency evidence #574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ScriptedAlchemy merged 1 commit into from
Sep 5, 2026
Merged

docs: count prebuilt payload imports as AB7014 dependency evidence #574

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions website/docs/en/guide/distribution/validation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,8 +198,9 @@ entry is therefore only for what the packed files demonstrably need from outside
— a package a packed module still imports because the author kept it external through the
[`tools` hatch](../../reference/configuration.mdx#tools) (possible in the package build's `dist`
output, which `AB6005` does not walk; a host-pack module with that import fails the build), one a
consumer-side install script runs, one whose `bin` a packed file executes, or one a packed
declaration file references — and `AB7014` reports a declared dependency with none of that
prebuilt payload module imports (prebuilt files are opaque to `AB6005` but are scanned for
`AB7014`), one a consumer-side install script runs, one whose `bin` a packed file executes, or one
Comment on lines +201 to +202

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Qualify AB7014's prebuilt scan by extension

When a prebuilt hook or MCP entry is an extensionless Node module, this statement is incorrect: prebuilt entries have no extension restriction and AB6005 skips every prebuilt path, but importedPackageNames scans only packed .js, .mjs, .cjs, and declaration files. A dependency used solely by such a module therefore still triggers AB7014. Qualify this claim to the supported JavaScript extensions, as the following paragraph does, or expand the scanner; the mirrored Chinese sentence needs the same correction.

AGENTS.md reference: AGENTS.md:L108-L111

Useful? React with 👍 / 👎.

@ScriptedAlchemy ScriptedAlchemy Sep 5, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed — importedPackageNames only scans packed .js/.mjs/.cjs (and declaration) files (javaScriptSuffix), so an extensionless prebuilt module is no evidence. Qualified in en and zh in #577.

a packed declaration file references — and `AB7014` reports a declared dependency with none of that
evidence, while `AB7015` reports one a consumer's npm cannot install.

| Code | Meaning |
Expand Down
3 changes: 2 additions & 1 deletion website/docs/zh/guide/distribution/validation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,8 @@ CLI、MCP 入口、钩子包装层以及包构建的 JavaScript bundle——都
从产物之外加载的只有内建模块。因此，`dependencies` 条目只留给打包后的文件有据可证地需要从已编译 bundle 之外
获取的内容——打包后的模块因作者通过 [`tools` 逃生舱](../../reference/configuration.mdx#tools)将其保持外部化
而仍然导入的包（这在包构建的 `dist` 输出中是可能的，因为 `AB6005` 不会遍历它；带有这种导入的宿主包模块则会
让构建失败），消费者侧安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包——
让构建失败），预构建 payload 模块导入的包（预构建文件对 `AB6005` 不透明，但会被 `AB7014` 扫描），消费者侧
安装脚本运行的包，打包后的文件执行其 `bin` 的包，或打包后的声明文件引用的包——
`AB7014` 会报告不具备上述任何一种证据的已声明依赖，而 `AB7015` 会报告消费者的 npm 无法安装的依赖。

| 代码 | 含义 |
Expand Down
Loading