[objectstack-fleet]

Requested by Elon · project thread

domain:server#4 · os-elon-musk · session_016WV4cyQMWcGmm84uezumhc

Claim: 6677672237

Fixes #30797

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:三项复核跟进。① runtime 调度器那一侧的 /meta 读门,在拒绝无权打开的应用、仪表盘、列表视图时,也读部署自定义的 errors.permission_denied 文案(此前只有 REST 一侧读);② os package install 同时给了 --token 和邮箱密码时的拒绝句,写明 OS_RUNTIME_EMAIL/OS_RUNTIME_PASSWORD 也算 --email/--password;③ ui 三处注释和 README 里的旧拒绝句、旧 -r 参数改为现行写法。
• 为什么改:PR fix(cli,rest)!: os package install takes -u/--url and -t/--token; the /meta permission refusal is localized #30792 合约评审 6676098596 的 should-fix 三项。同一个用户走两个入口,看到的拒绝文案应一致;用户只在 shell 里 export 过邮箱变量时,看不出为什么带 --token 被拒。
• 风险与回滚:低。① 只多读一个可选服务,i18n 服务缺席、解析失败或 t 抛错都回落到内置句,仍是 403 不是 500;② 只改一句文案;③ 只改注释与 README,无 ui 行为变化。回滚即撤本 PR。
• 先看:packages/runtime/src/domains/meta.ts 的 metaItemReadGateSources 新增的 resolveMessageTranslator;packages/cli/src/commands/package/install.ts 的拒绝句。
• 两分钟验证:pnpm --filter @objectstack/runtime exec vitest run src/domains/meta-permission-refusal-override.test.ts(12 条全绿)。
• 需要你做的:无,席位落地。

What changes

1. @objectstack/runtime. metaItemReadGateSources (the HttpDispatcher side of the shared /meta read gate) now hands resolveMessageTranslator: the request's i18n service t, as RestServer.resolveMessageTranslator hands it. A deployment's errors.permission_denied override therefore reads the same on both doors for the app, dashboard and list-view refusals. An i18n service that cannot be resolved answers undefined; a t that throws is already caught by renderOperationMessage. Either way the caller gets the built-in catalog sentence and a 403.
2. @objectstack/cli. The os package install token-conflict refusal now reads: Pass either --token or --email/--password, not both (OS_RUNTIME_TOKEN counts as --token; OS_RUNTIME_EMAIL/OS_RUNTIME_PASSWORD count as --email/--password).
3. ui prose, comments and README only. MarketplacePackagePage.offlineLocalMenu-11627.test.tsx:84 doc comment -r → -u; ui/packages/data-objectstack/README.md:913 and the MetaItemAccess.message doc comment in src/index.ts quote the catalog's current English sentence. No ui behaviour change.

Changeset: patch for @objectstack/runtime, @objectstack/cli and @object-ui/data-objectstack (its README ships in files[]).

Tests

• New packages/runtime/src/domains/meta-permission-refusal-override.test.ts, through dispatch(), on all three refusals (app, dashboard, list view), caller locale zh-CN: the override is the message and t is asked errors.permission_denied in zh-CN; CONTROL with no i18n service gives the built-in zh-CN sentence; an unresolvable i18n service and a throwing t give the built-in sentence and the 403.
• packages/cli/test/package-install-url-token-flags.test.ts: a new case exports OS_RUNTIME_EMAIL/OS_RUNTIME_PASSWORD, passes only --token, and pins the full refusal sentence, exit 1 and no request sent.
• Red first: with both fixes reverted to origin/main (tests at HEAD), 3 of 12 runtime cases (the three override cases) and 1 of 9 CLI cases fail; with the fix, 12/12 and 9/9 pass.

Acceptance notes

• The ui test fixtures that still mock the old by-name sentence as a server answer (appAccessProbe.test.ts, metaItemAccessProbe-12112.test.ts, two studio-design draftUnreadable-29148 tests) are left alone: they are stand-in server answers, not prose, and the card scopes item 3 to the three residues it names.

Verification

All readings at head 6a24f4e1.

Package tests and typecheck

• pnpm --filter @objectstack/runtime typecheck and pnpm --filter @objectstack/cli typecheck: exit 0.
• pnpm --filter @objectstack/runtime exec vitest run: Test Files 551 passed (551), Tests 10124 passed, 19 skipped.
• pnpm --filter @objectstack/cli exec vitest run --project unit: 386/388 files on the first run; the 2 failures were published-subpath-console.pin.test.ts and published-subpath-hook-body.pin.test.ts refusing because packages/cli/dist was not built yet. After pnpm --filter @objectstack/cli build both pass (Tests 29 passed). Integration tier declared to CI (no spawn entry touched).
• ui: comments and README only, no ui test run locally; CI's ui lanes cover it.

Derived gates (dispatch-gates --commands, reconciled with --ran)

• dispatch-gates --ran: 68 derived, 67 run, 1 NOT-MEASURED, 0 UNRUN; every run family exit 0.
• check:plugin-teardown-shape --self-test first exited 3 on a shallow clone (its positive control commit was absent); after fetching that commit it exits 0.
• check:i18n, check:i18n-coverage, check:i18n-walk-parity first exited 3 (CLI not built); after building their prerequisite closure all exit 0.
• NOT MEASURED: check:dual-build-cjs-loads, reason: prerequisite not met, it reads every package's dist/ and ten packages outside this diff's closure are unbuilt locally. CI runs it.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cyQMWcGmm84uezumhc

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/runtime, touching 3 documentable anchor(s).

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/connectors.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/automation/jobs.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/data-modeling/external-datasources.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/data-modeling/seed-data.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/app-dependencies.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/cli.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/cloud-connection.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/install-modes.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/marketplace-handbook.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/deployment/publish-and-preview.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/protocol/kernel/index.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/protocol/kernel/lifecycle.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/protocol/kernel/metadata-service.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/protocol/kernel/plugin-spec.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/releases/v17/17-6.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/releases/v17/17-7.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/releases/v18/18-1.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))
• content/docs/releases/v18/18-3.mdx (via os package install (command, read off packages/cli/src/commands/package/install.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 63 of 222 client-bound route-ledger rows — the other 159 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 159: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 51 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b6182249c3278a60d07727b59afc291054521b4b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 042ad813b81789b52e8f8aa2899d46a7daaa9f93 — the merge of head 6a24f4e1fe390a95596f82b574d8bfdd77c7a406 into base b6182249c3278a60d07727b59afc291054521b4b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 042ad813b81789b52e8f8aa2899d46a7daaa9f93 && git checkout 042ad813b81789b52e8f8aa2899d46a7daaa9f93
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b6182249c3278a60d07727b59afc291054521b4b 6a24f4e1fe390a95596f82b574d8bfdd77c7a406 && git checkout -B drift-repro b6182249c3278a60d07727b59afc291054521b4b && git merge --no-ff 6a24f4e1fe390a95596f82b574d8bfdd77c7a406

node scripts/docs-audit/affected-docs.mjs --json b6182249c3278a60d07727b59afc291054521b4b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b6182249c3278a60d07727b59afc291054521b4b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

维护者速读

1. 改了什么：服务端 /meta 读取的权限拒绝，在 HttpDispatcher 这条入口上也会使用部署覆盖的 errors.permission_denied 文案，和 RestServer 一致。os package install 的 --token 冲突提示现在会说明 OS_RUNTIME_EMAIL/OS_RUNTIME_PASSWORD 也算作 --email/--password。另外修正了 ui 包 README 和注释里过时的拒绝句子。
2. 为什么改：PR fix(cli,rest)!: os package install takes -u/--url and -t/--token; the /meta permission refusal is localized #30792 合同复核（6676098596）的三条 should-fix，立为卡 follow-ups from #30126 rows 12-13 (PR #30792): runtime meta door override lookup, install token-conflict wording, ui prose residues #30797。
3. 风险：低。拒绝仍是 403；没有 i18n 服务或服务出错时回退到内置句子，绝不变成 500。ui 只改文档和注释，没有行为变化。
4. 先看：packages/runtime/src/domains/meta.ts 的 metaItemReadGateSources。
5. 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run src/domains/meta-permission-refusal-override.test.ts。
6. 需要你做的：无。不属 Tier H，166 行 ≤ 3000，不是破坏性改动，由席位入队落地。

席位意见：ACCEPT（#30797）。

席位核对

Head-sha: 6a24f4e1fe390a95596f82b574d8bfdd77c7a406 · read 2026-11-06T06:36Z

Item	Reading
Shape	Draft → main, Fixes #30797, title fix(runtime,cli):. 8 files, +160/−6. Branch claude/project-thread-9z4vjw (claim 6677672237).
Seat diff read	metaItemReadGateSources hands resolveMessageTranslator. It resolves i18n through deps.resolveService, answers undefined when that throws or when there is no t, and binds t to its service. A throwing t is caught by renderOperationMessage. The install refusal sentence names both env families. The ui edits are one test doc comment, one README line and one JSDoc block; no code moved.
Evidence	os-dev-report 6678428223. Red leg with the fixes reverted: runtime pin 3 failed, cli pin 1 failed. Green: 12/12 and 9/9. runtime full suite 10124 passed; cli unit passes after build; typechecks exit 0. dispatch-gates --ran 67/68 run, all exit 0. Not measured: check:dual-build-cjs-loads, an unrelated dist prerequisite.
Gates (check-runs on this head)	8 skipped, 55 success, 0 failed. mergeable_state clean.
Accepted deviations	'@object-ui/data-objectstack': patch for the shipped README and JSDoc.
Out of scope	ui test fixtures still mock the old by-name refusal sentence as stand-in server answers (appAccessProbe.test.ts, metaItemAccessProbe-12112.test.ts, two draftUnreadable-29148 tests). Noted, not filed: fixtures only, no served text.
Semver	@objectstack/runtime, @objectstack/cli, @object-ui/data-objectstack: patch. Clause-②: no, Metadata-protocol: none. No contract review owed.
Landing	Not governed (check-governed-merges --pr 30839: NOT governed), 166 lines ≤ 3000, not BREAKING. The seat lands it: pr_ready + automerge_enable on this head.