Context
After the flake-elimination work (#161 lbug WAL retry, #162 hermetic npm prefix, plus the smoke now printing the analyze tail on failure), the macOS Verify-Global-Install matrix is mostly green. Two legs remain red — both for runner-environment reasons, not OpenCodeHub code defects. They fail on main itself and the workflow is not a required check ("opt in after the first green run"), so they block nothing today. Filing so the path to opting macOS into required-checks is tracked.
Leg 1 — macos-x64-node22-nvm: onnxruntime native binding missing (darwin-x64)
The analyze smoke exits 1. With the new smoke diagnostics, the captured tail shows:
codehub: Cannot find module '../bin/napi-v6/darwin/x64/onnxruntime_binding.node'
Require stack:
- .../node_modules/@opencodehub/embedder/node_modules/onnxruntime-node/dist/binding.js
onnxruntime-node's prebuilt .node for darwin-x64 isn't present in the global install tree. analyze touches the embedder path by default, so the missing binding throws. Surfaced now because #162's hermetic prefix lets the install proceed far enough to reach the embedder.
Likely fix directions: ensure onnxruntime-node is in allowBuilds so its install script fetches the platform binding under the isolated prefix; OR confirm its darwin-x64 prebuild ships in the packed tree; OR make the embedder load lazy/optional so analyze doesn't hard-require it when embeddings aren't requested. (arm64 has the binding; only x64 is affected.)
Leg 2 — macos-arm64-node22-volta: Volta overrides npm_config_prefix
#162 isolates the install into a per-run mktemp -d prefix via npm_config_prefix. This fixed gate 2 on nvm (node-pty fetch gone). But Volta shims npm and forces its own managed global dir, ignoring npm_config_prefix — so on the Volta leg the install still hits Volta's cross-run-cached prefix, re-running the stale node-pty prebuild-install GHCR fetch (gate 2) and a slow reconcile (gate 4, ~75-95s).
There's also a gate-5 edge case introduced by the isolated-prefix path on Volta: npm root -g returns <prefix>/lib/node_modules before npm creates lib/, so gate 5 reports "could not resolve npm global prefix."
Likely fix directions: for the Volta leg, pin/clean a per-run Volta global dir (or volta install into a temp VOLTA_HOME); OR mkdir -p "$prefix/lib/node_modules" before install so gate 5 resolves; OR exclude Volta from the matrix until its prefix model is reconciled (it's the least-used manager).
Evidence
- No OpenCodeHub package depends on node-pty: 0 in
pnpm-lock.yaml, graphty/node-pty absent from every packed tarball (ingestion ships vendored graphty-leiden.js). The node-pty fetch is purely cached runner state.
- Same-run contrast:
macos-arm64-node22-nvm passes gate 2; volta fails it — confirms environment, not dep graph.
Done when
All 9 Verify-Global-Install cells are green on main, after which the workflow can be added to branch-protection required checks.
Context
After the flake-elimination work (#161 lbug WAL retry, #162 hermetic npm prefix, plus the smoke now printing the analyze tail on failure), the macOS Verify-Global-Install matrix is mostly green. Two legs remain red — both for runner-environment reasons, not OpenCodeHub code defects. They fail on
mainitself and the workflow is not a required check ("opt in after the first green run"), so they block nothing today. Filing so the path to opting macOS into required-checks is tracked.Leg 1 —
macos-x64-node22-nvm: onnxruntime native binding missing (darwin-x64)The
analyzesmoke exits 1. With the new smoke diagnostics, the captured tail shows:onnxruntime-node's prebuilt.nodefor darwin-x64 isn't present in the global install tree.analyzetouches the embedder path by default, so the missing binding throws. Surfaced now because #162's hermetic prefix lets the install proceed far enough to reach the embedder.Likely fix directions: ensure
onnxruntime-nodeis inallowBuildsso its install script fetches the platform binding under the isolated prefix; OR confirm its darwin-x64 prebuild ships in the packed tree; OR make the embedder load lazy/optional soanalyzedoesn't hard-require it when embeddings aren't requested. (arm64 has the binding; only x64 is affected.)Leg 2 —
macos-arm64-node22-volta: Volta overridesnpm_config_prefix#162 isolates the install into a per-run
mktemp -dprefix vianpm_config_prefix. This fixed gate 2 on nvm (node-pty fetch gone). But Volta shimsnpmand forces its own managed global dir, ignoringnpm_config_prefix— so on the Volta leg the install still hits Volta's cross-run-cached prefix, re-running the stale node-ptyprebuild-installGHCR fetch (gate 2) and a slow reconcile (gate 4, ~75-95s).There's also a gate-5 edge case introduced by the isolated-prefix path on Volta:
npm root -greturns<prefix>/lib/node_modulesbefore npm createslib/, so gate 5 reports "could not resolve npm global prefix."Likely fix directions: for the Volta leg, pin/clean a per-run Volta global dir (or
volta installinto a tempVOLTA_HOME); ORmkdir -p "$prefix/lib/node_modules"before install so gate 5 resolves; OR exclude Volta from the matrix until its prefix model is reconciled (it's the least-used manager).Evidence
pnpm-lock.yaml, graphty/node-pty absent from every packed tarball (ingestion ships vendoredgraphty-leiden.js). The node-pty fetch is purely cached runner state.macos-arm64-node22-nvmpasses gate 2;voltafails it — confirms environment, not dep graph.Done when
All 9 Verify-Global-Install cells are green on
main, after which the workflow can be added to branch-protection required checks.