fix: pass full tar path to verify-packed-manifests

[hobostay]

Summary

• Fix verify-packed-manifests.mjs script that always fails because tar cannot find the packed tarball
• pnpm pack writes to packDir (temp directory) but tar was invoked with only the bare filename relative to the repo root

Details

Affected file: scripts/verify-packed-manifests.mjs (line 56)

The script packs packages into a temp directory (packDir), then tries to extract package.json from the tarball. But tar -xOf was given just the filename (e.g., hyperframes-core-0.1.0.tgz) with cwd: ROOT, so it looks for the file at the repo root instead of in packDir.

Test plan

• Run bun run verify:packed-manifests and verify it completes successfully

🤖 Generated with Claude Code

[jrusso1020]

Verified — pnpm pack --pack-destination packDir writes to the tempdir, but tar -xOf <filename> runs with cwd: ROOT, so the lookup misses unless a tarball with the same name happens to exist at repo root. Joining packDir onto the filename is the fix. The script is currently broken in CI's bun run verify:packed-manifests path; this should unblock it. LGTM.

[vanceingalls]

Additive review at e59094c9 — @jrusso1020 already verified and approved the fix shape. One small gap to surface.

Audited

• scripts/verify-packed-manifests.mjs:56 (the single-line fix)
• CI status

Strength

@jrusso1020 covered it — joining packDir onto the filename matches what pnpm pack --pack-destination packDir actually produces. ✓

Important — Format CI is failing

Format check is failed on e59094c9. The diff is a one-character path-join change in a .mjs script, so the format failure is almost certainly a pre-existing prettier disagreement on the file (or a missing trailing newline). Run bun run format locally on scripts/verify-packed-manifests.mjs and amend; should be a no-op edit beyond whitespace.

Per Rule 5, can't APPROVE while Format is red — but Format on its own isn't a substantive gate, so as soon as that's green this can land on James's approval.

Nit

• Worth a follow-up to assert this in a test — currently verify:packed-manifests is itself the only consumer, and a regression here would silently re-fail in CI without anyone noticing until they re-run the verifier. A 5-line vitest case (expect(execFileSync('tar', ['-xOf', ...])).not.toThrow()) would pin the contract.

Verdict

Verdict: COMMENT
Reasoning: Fix is correct (James verified end-to-end), but Format CI is still red and needs a prettier pass before merge. External-contributor PR — flagging for Vance's stamp once CI clears.

— Vai

[vanceingalls]

hobostay's verify-packed-manifests full tar path fix. @jrusso1020 already APPROVED on this SHA. Vance authorized the stamp.

Verdict: APPROVE
Reasoning: James verified, mechanical fix, no concerns.

— Vai