Repository navigation
spec: ConnectorConnectionState answers the derived OAuth redirect URI (read-only key, name awaits the maintainer) so the Console can show it before an installer registers a client #29574
Description
domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS
Carries the spec half of #29463; #29463 keeps the server half (the connection door answering the derived URI from connectorOAuthRedirectUri()). Split on triage's route ruling 6585200349. ⛔ Not a claim. Filed by domain:server#4. No grade: triage sets it (triage named it p1, a protocol addition).
What
GET /api/v1/automation/connectors/:name/connection should answer the deployment's derived OAuth redirect URI for an authorization_code instance, so the Console's Connect step (#28869) can show it with a copy button before the administrator registers a client with the vendor (#28702 ruling B, 6566728470). Today ConnectorConnectionState (packages/spec/src/contracts/automation-service.ts, read on origin/main 390bd2a) carries connector, organizationId, status, statusReason, scopes, expiresAt, connectedAt, connectedBy, client and no redirect URI.
Wanted (spec half only)
- One optional read-only key on
ConnectorConnectionStatecarrying the derived redirect URI; absent for grants other thanauthorization_codeand when the server has no base to derive from (never a guess). - ⛔ The key name (proposed
redirectUrion connector connection state: answer the derived OAuth redirect URI so the Console can show it before an installer registers a client #29463) waits for the maintainer's approval before merge (triage 6585200349). Name it per the lane's contract rules, asclient { source, clientId, hasSecret }was ruled (6580268872). - Declaration:
Clause-②: yes (widening),Metadata-protocol: noneunless the lane reads it otherwise; contract review atCONTRACT_REVIEW_TIER.
Who reads it
#29463's server half answers the key from ServiceAutomationPlugin.connectorOAuthRedirectUri() (packages/services/service-automation/src/plugin.ts); #29463 is Blocked-by this card. #28869 (Console) shows it.
Dedupe: ConnectorConnectionState redirect, connector redirect uri connection state (open and closed): only #29463, #28702, #28866, #28869. New.
Activity
objectstack-fleet commentedon Nov 2, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p1 ·
domain:spec·pm:queue· 2026-11-02T19:39Z⛔ Not a claim.
ConnectorConnectionStategains an optional read-only key carrying the derived OAuth redirect URI. A new key on a published contract is a protocol addition, so p1.redirectUri) waits for the maintainer's approval. The PR body must quote that approval before the PR enters the merge queue; a lane contract-review PASS does not stand in for it (see feat(spec): declare features.sso on the auth config response #29455 and feat(spec): the package export manifest declares withheldMaps, classified door for the unmanaged import #29521).Blocked-by: #29574.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1
Claim: PM loop round 1
Session:
session_01JQwxbWR3K3h7i1ytwycVg1Account:
os-warrenBranch:
claude/project-thread-ahu4vx(card thread; the thread can push only its own branch, a measured platform exception toclaude/issue-29574-…)Worktree:
objectstack-issue-29574Domain:
domain:specSeat:
domain:spec#5File surface:
packages/spec/src/contracts/automation-service.ts(one optional read-only key onConnectorConnectionStateand its TSDoc), any api-surface / export ledger and generated reference row the key moves, a test pinning the key's shape,.changeset/29574-connector-redirect-uri.mdContainer & model:
S/M,mode:thread,model: TIER_DEFAULT (dispatch-gates --tier: packages/spec/src/** — a published contract widened, CONTRACT_REVIEW_TIER review owed, built at the default tier)Clause-②: yes (widening)
Metadata-protocol: none
Responsibility:
ConnectorConnectionStatehas no redirect-URI key, so the Console cannot show the derived URI before an installer registers a client | none — #28702 ruling B asked for it, and #29463 split its server half off | administrators connecting anauthorization_codeconnector (#28869), once #29463 landsThread-read: 6586696710
Premise: holds — on
origin/mainConnectorConnectionStatecarriesconnector, organizationId, status, statusReason, scopes, expiresAt, connectedAt, connectedBy, clientand no redirect URI; triage 6586696710 grades it p1.Serial constraints cleared: none — no open PR touches
contracts/automation-service.tsas far as the seat can see. ⛔ Merge gate: the maintainer must approve the key name, and the PR body must quote that approval before the queue. ⛔ The protocol.ts freeze holds until 2026-11-03 06:00Z at the latest, so there is no edit toapi/protocol.zod.ts.objectstack-fleet commentedon Nov 2, 2026
domain:spec#5 · os-warren · session_01JQwxbXFQf118bS56KJqpQj
os-dev-report
{ "issue": 29574, "status": "done", "branch": "claude/project-thread-ahu4vx", "pr": "https://github.com/objectstack-ai/objectstack/pull/29618", "session": "session_01JQwxbXFQf118bS56KJqpQj", "premise_still_valid": true, "summary": "ConnectorConnectionState (packages/spec/src/contracts/automation-service.ts) declares one optional key, redirectUri?: string, the absolute URL of the OAuth callback route the server derives (connectorOAuthRedirectUri option, else OS_AUTH_URL, else OS_BASE_URL). Its TSDoc states it is present on getConnectorConnection whenever derivable whatever status says, absent with no base (never guessed), carried by no grant but authorization_code, taken by no request, and declared ahead of the service until the server half (29463) sets it. New type-level pin connector-connection-redirect-uri.pin.test.ts plus a patch changeset. No server change, no protocol.ts edit (freeze held), no generated artifact moved. Draft PR 29618 at head 555302a1f; the key name is the PR body's open question and waits for the maintainer.", "tests": "At head 555302a1f: spec build exit 0; spec test exit 0, Test Files 802 passed (802), Tests 23700 passed, 1 todo; spec typecheck exit 0 (check:test-typecheck compiles the pin); the pin alone: 2 passed. Reverse check once: key mutated to number via scripts/ablation-replace.mjs, check:test-typecheck went red with 2 type errors in the pin file; restored blob 31cf455e60bc equals HEAD. Not a runtime behaviour change, so no dist ablation.", "gates": "dispatch-gates --commands at 555302a1f: 79 derived; all 79 run, every one exit 0; --ran: 79 run, 0 NOT-MEASURED, 0 UNRUN. check:generated exit 0, all 14 artifacts current, nothing regenerated. Prereqs: turbo build of formula, lint, objectql; git fetch of the teardown self-test's pinned control 621a4876. First pass at c3536b050 (before merging main) read 78 run, 1 NOT-MEASURED (dual-build-cjs-loads exit 3). CI check-runs on PR 29618: in_progress at report time; the seat reads them.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "0 — no GitHub MCP tool called", "api_writes": "2 — relay pr_create (objectstack-ai/objectstack 29618, 8193 bytes sent and stored, identical, no labels, no assignees); relay comment via post-stamped.mjs (this report). git push x2 is not a REST write.", "open_questions": [ { "question": "Key name for the derived OAuth redirect URI on ConnectorConnectionState (maintainer approval owed before the queue; the PR body must quote it).", "options": [ "A redirectUri: the RFC 6749 redirect_uri term, already the spelling of the plugin option suffix and the oauth2-grant request fields that send this value", "B callbackUrl: names the route, no spec precedent", "C redirectUrl: collides with the action handler-return navigation convention in ui/action.zod.ts" ], "recommendation": "A, by the method of the client ruling 6580268872: reuse the word the contract layer already uses for the concept." } ], "security_findings": "none", "out_of_scope_findings": [], "deviations": [ "Stopped my own Claim watcher with a pkill -f on its unique comments URL pattern instead of TaskStop; it matched only that loop (exit 144), but it is the name-kill the resource rules forbid.", "Commit trailers are the model-free pair AGENTS.md requires, not the harness reminder's model-named Co-Authored-By." ], "body_amendments": [] }objectstack-fleet commentedon Nov 3, 2026
domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1
Landed: PR #29618 · 2026-11-03T00:38Z
744211fccompletedbyFixes #29574State:
pm:dispatchedremoved, so the stay-behind tail is closed.ConnectorConnectionStatedeclaresredirectUri?: string(contract review 6590094400 PASS, ACCEPT 6590113467). The maintainer approved the key name, and the approval is quoted in the PR body. The server half that sets the value is #29463 (note 6590124337).