From d606375366c370e9cf3eb2994c6ea866eb33f694 Mon Sep 17 00:00:00 2001
From: montjeffrey <montjeffrey@gmail.com>
Date: Thu, 8 Oct 2026 15:47:10 +0000
Subject: [PATCH] test(carriers): flag absolute and package imports a carrier
 cannot ship

---
 .../scripts/validate-carrier-closure.test.js  | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/tests/scripts/validate-carrier-closure.test.js b/tests/scripts/validate-carrier-closure.test.js
index 61dfd07f4..df3747a00 100644
--- a/tests/scripts/validate-carrier-closure.test.js
+++ b/tests/scripts/validate-carrier-closure.test.js
@@ -56,11 +56,29 @@ test('a dynamic require warns without failing', () => withFixture(root => {
   assert.equal(result.status, 'success');
   assert.deepEqual(result.failures, []);
   assert.ok(result.warnings.length > 0);
-  assert.ok(result.warnings.every(warning => warning.expression === 'process.env.ECC_PLUGIN_PATH'));
+  assert.ok(result.warnings.every(warning => warning.kind === 'dynamic' && warning.expression === 'process.env.ECC_PLUGIN_PATH'));
   assert.ok(result.warnings.every(warning => warning.file.endsWith('skills/ecc-guide/scripts/tool.js')));
   assert.equal(result.dynamicCount, result.warnings.length);
 }));
 
+test('an absolute require leaves the carrier tree and fails', () => withFixture(root => {
+  plantSkillScript(root, "'use strict';\n\nrequire('/opt/shared/helper');\n");
+  const result = validator().validate(root);
+  assert.equal(result.status, 'failure');
+  assert.ok(specifiersOf(result.failures).includes('/opt/shared/helper'));
+  assert.ok(result.failures.every(failure => failure.reason === 'outside-carrier-tree'));
+}));
+
+test('a package import warns because carriers ship no node_modules; builtins do not', () => withFixture(root => {
+  plantSkillScript(root, "'use strict';\n\nconst yaml = require('js-yaml');\nconst { x } = require('@scope/pkg/deep');\n"
+    + "const fs = require('node:fs');\nconst path = require('path');\nmodule.exports = { yaml, x, fs, path };\n");
+  const result = validator().validate(root);
+  assert.equal(result.status, 'success');
+  const packages = result.warnings.filter(warning => warning.kind === 'package').map(warning => warning.package);
+  assert.deepEqual([...new Set(packages)].sort(), ['@scope/pkg', 'js-yaml']);
+  assert.equal(result.packageCount, packages.length);
+}));
+
 test('a require shape quoted inside a string literal is not a dependency', () => withFixture(root => {
   plantSkillScript(root, "'use strict';\n\nconst snippet = \"require('../../../../../etc/passwd')\";\n\nmodule.exports = { snippet };\n");
   const result = validator().validate(root);