[AhmedElBanna80]

Closes #2583

Root cause

zone-signer-glue.test.ts generated the zone glue into an OS temp dir (outside the repo) and only symlinked packages/grpc/node_modules into it. The generated glue imports @getknext/grpc/runtime, which that node_modules does not contain (workspace packages are not linked there), and nothing up the tree from /tmp can resolve it. The test leaned on mock.module alone to rescue the unresolvable specifier, whose behaviour depends on whether packages/grpc/dist exists (see Round 2).

Fix

The scratch dir now gets a real node_modules: per-entry symlinks to the package's own dependencies plus a small @getknext/grpc stub whose ./runtime export re-exports the source runtime. The specifier now resolves for real everywhere (verified it passes with the mock.module line removed), and the scratch dir stays in the existing emptyDir registry drained by removeScratchDirs() in afterAll.

Proof

• Test green with TMPDIR outside the repo.
• GITHUB_REF_NAME=main PROVER_LANE_REF=integration/v2 (GITHUB_BASE_REF unset), prover with private outside-repo TMPDIR: {"declared":18,"run":18}, exit 0.

Other tests with the same tmp-outside-repo pattern (not changed here)

gateway-transport.test.ts and use-cache-two-user.test.ts also create dirs under tmpdir() and import generated code; both pass in the lane today, but they rely on their own wiring rather than this one.

No user-visible surface changed. Test-only change; no supply-chain path touched.

Round 2 (corrected root cause)

The cause is NOT the platform: it is whether packages/grpc/dist exists. mock.module('@getknext/grpc/runtime') resolves through the package exports map (./runtime -> ./dist/runtime.js). With no dist, Bun keys the mock under the bare name and the import from /tmp hits it; with dist present, the mock is keyed to the dist path and the bare import misses it. In the lane an earlier prover leg (deploy-function-bin-e2e) builds dist, so the result depended on test order.

• linkWorkspaceRuntime moved to the shared helpers.ts; used by zone-signer-glue.test.ts and by glue-action-refresh.test.ts (same latent defect).
• New guard glue-runtime-link-guard.test.ts: scans specs; one that mocks the runtime and uses a scratch dir without the link fails. Mutation-proved (link removed from glue-action-refresh -> guard exit 1; restored -> exit 0).
• Results under lane env, TMPDIR outside the repo, by exit code, both with packages/grpc/dist built and with it absent: the 3 specs 24 pass/0 fail (exit 0); mutation-prove-2510-zone-token.mjs 18/18 (exit 0); mutation-prove-2050-zone-glue.mjs 33/33 (exit 0, core built as in the lane).

🤖 Generated with Claude Code

https://claude.ai/code/session_0198oVxWkEEDJJnVhES6ULnx

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
knext-docs	Ready	Preview	Oct 22, 2026 3:48pm UTC