Repository navigation
console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238
Description
Filing gate ③ (maintainer ruling). Ruled on #27230, letter A, comment 6468327468, 2026-10-28; the maintainer's words in the session thread, verbatim: 「同意」. This is the Console half; the server half (object, resolver chain, REST surface, install-local answer) is #27237 (the sibling card filed in the same batch).
Filed by session_01J8VVAjRKqdoEYQ4hXxtBuf. ⛔ Not a claim. Lane suggestion: domain:ui (ui/packages/app-shell, the Setup Integrations group and the marketplace install dialog). Triage sets labels and priority. Blocked-by: #27237 (the server card's REST surface).
Business reason. The customer's administrator who installs an app holds the vendor key and has no server access on a hosted environment. Today there is no place in the Console to supply the credential a connector declares, so the app's integration stays dark. This card is that place: one page listing every declared credential with its status, and a prompt at install time.
Who acts. The domain:ui seat, against the sibling's routes. Readers: administrators; the docs page for Setup.
Dedupe: as #27230 (two searches, 2026-10-28, nothing open).
Governing text
- [Decision] Where a customer administrator supplies a declarative connector credential: a platform credentials page over an encrypted object, an app-shipped settings manifest, env-only as today, or the OAuth connection record #27230 ruling comment 6468327468: "Setup → Integrations gains a 'Connector credentials' page listing every ref the installed apps declare with its connector and status" and "install-local prompts for the missing refs of the package being installed and lets the administrator skip".
- cloud ADR-0009 as restated in
packages/cloud-connection/src/marketplace-ui.ts: a capability's nav entry lives and dies with the capability — the page is contributed by the automation service's UI bundle (theMARKETPLACE_*_UI_BUNDLEshape), not hard-coded in the shell. - ADR-0007 render rules: secret inputs are masked; write of an empty value means "don't change".
- platform-core.marketplace-console-honesty (checklist): nav entries render the configuration conclusion, never a red "failed to load".
Protocol statement. Metadata-protocol: none. Skills-docs: follow-up owed — an administrator page under content/docs (Setup → Integrations → Connector credentials: what the list shows, env-sourced rows, rejected status, skipping at install).
Premises (each with a re-check)
- Setup's Integrations group exists and takes plugin-contributed entries. Re-check:
git grep -n "group_integrations\|Integrations" origin/main -- packages/platform-objects/src/apps/setup-nav.contributions.ts. - The marketplace install dialog is
MarketplacePackagePage's install dialog (ui/packages/app-shell/src/console/marketplace/). Re-check:git grep -n "install" origin/main -- ui/packages/app-shell/src/console/marketplace/MarketplacePackagePage.tsx. - The sibling's routes exist on the runtime the Console talks to (blocked until then).
Work
- Connector credentials page under Setup → Integrations, contributed by the automation service's UI bundle: one row per declared ref — ref, connector, package, status (
set/missing/rejectedwith the upstream message /envread-only), last changed by/at; a masked input to set or replace (empty = unchanged), a clear action with confirm. Never displays a value. - Install dialog: after the package's manifest is resolved and before install, a "Credentials" step listing the refs the package declares that are missing, each with a masked input and a "skip for now" affordance; skipped refs are shown on the result screen with a link to the page.
- Honesty states: when the runtime has no credential routes (older runtime, or walled posture refusing), the page renders the configuration conclusion, not an error.
- Docs: the administrator page named in
Skills-docs:.
Acceptance
- Install HotCRM on a fresh environment through the Console with no env vars: the dialog shows the Slack ref as missing; fill it; the connector is ready on the next reconcile without restart; the page shows
set, by whom, when. - Skip at install; the page shows
missing; set it later; same result. - A wrong key: page shows
rejectedwith the upstream message; correcting it clears the state. - With the ref in env: the row reads
env, input disabled. - No value ever rendered, in the DOM or in network responses.
Out of scope
- OAuth "Connect" flows: connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702's Console follow-up.
- App-shipped settings pages (option B): its own card later.
Related
#27230 (ruling) · #27237 · #26702 · #27223 · ADR-0007.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 28, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Triage:
domain:ui, p2,area:automation·pm:blockedon #27237 · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-28T13:14Z⛔ Not a claim.
sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 (domain:server, p1, dispatched).sys_connector_credential) is on connectors:sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237, which is p1 under 「协议新增定 p1」. This card adds UI only.sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237: the page needs that card's REST routes.packages/cloud-connection). It never shows a stored value, and writing an empty value leaves the credential unchanged (ADR-0007). It stays in objectstack: the ADR is cited for shape, and no cloud-repository change is asked for.priority:p2,domain:ui,area:automation,pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
Part of #27293 (E2 credential hand-off) · 2026-10-28T15:01Z
Epic link on the maintainer's ruling 「是否建议立专题卡统一处理。」→「同意」 (2026-10-28,
session_01J8VVAjRKqdoEYQ4hXxtBuf). Role in the chain: the Console half — credentials page and install dialog step; Blocked-by #27237 stands. Lane claims and dispatch proceed as triage set them; the epic PM seat (epic:#27293) tracks this card and reserves only what it drives in order. ⛔ Not a claim.Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
Reserved for the epic subtree · 2026-10-28T15:12Z —
pm:epicadded;pm:blockedon #27237 unchanged.The maintainer in
session_017xRBcVBKAFk1ntXSjvPt7U, 2026-10-28, verbatim: 「有很多子卡，这是没有挂到子任务，你应该处理。」 This card is attached under #27293 and now carriespm:epic: other seats' candidate reads skip it; the epic PM claims it with the full claim protocol when it dispatches. ⛔ Not a claim, ⛔ not a dispatch.objectstack-fleet commentedon Oct 28, 2026
Cloud ask (objectstack-ai/cloud#3352) (2026-10-28T15:41Z)
On a hosted environment, the Console installs a package through
/cloud-connection/install. That call reaches the cloud control plane'sPOST /cloud/environments/:id/install-package, not install-local (MarketplacePage.tsx:462-474,MarketplacePackagePage.tsx:94-105). So a prompt fed by install-local's answer (#27237 item 5) never appears on hosted environments, and the triage note "no cloud change required" does not hold for them.Ask: could the install dialog's credential step read the environment's credential-refs route (the #27237 contract) after any install completes, whether hosted or local, instead of reading it off the install answer? Then both paths get the prompt with no cloud change. If that does not fit this card, please say so here, and cloud#3352 will make the control plane's install answer carry the refs in #27237's shape.
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 能用的表单 | none | P②
Triage: unblocked · p2 ·
domain:ui·pm:queue· 2026-10-30T12:28Z⛔ Not a claim.
sys_connector_credential+ open-tier resolver chain (env → credential object → vault), reconcile on credential change, install-local prompt for missingcredentialRefs (ruling A on #27230) #27237 (the server half:sys_connector_credential, the resolver chain and the REST surface) is closed, so the block is stale.pm:epicreservation is released too: its epic PM ([Epic] Marketplace and connector auto-shelf — E1 platform prerequisites (openapi/mcp hardening, outbound OAuth, request signing), E2 administrator credential hand-off, E3 author recipes and handbook, E4 the first shelf of official connector apps #27293) has had no own output on it since 2026-10-28 15:16Z, more than a day, under seat-lifecycle.pm:queuefor thedomain:uilane. The hosted-environment install path stays objectstack-ai/cloud#3352's, not this card's.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:ui#1 · os-tesla · session_01L9qibzC6RxMfB59EsgAoNN
Claim: PM loop round 2 · 2026-10-30T14:55Z
Session:
session_01L9qibzC6RxMfB59EsgAoNN(seat; implementation by card thread sessionsession_01L9qibvG8uA9GWnnZkscgFF,mode:thread)Account:
os-tesla(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/project-thread-5nh6oc(the card thread's designated push branch, the recorded platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-27238Domain:
domain:uiSeat:
domain:ui#1File surface:
ui/packages/app-shell/src/**(a new Setup → Integrations page and the marketplace install dialog step), i18n keys in the ten packs, the automation service's UI bundle declaration inpackages/services/service-automation(contribution only; cross-lane, the dev checks open claims and PRs there first),packages/cli/scripts/check-app-nav-i18n.mjsif the bundle census needs a row, acontent/docsadministrator page, tests, root changeset (stop on breach; explain in the report)Container & model:
L,mode:thread,model: default(dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6522868103
Premise: holds (the server half #27237 is closed; credential object, resolver and door present on
origin/main10fc9bf1; thepm:epicreservation was released by triage 6522868103)Serial constraints cleared: no live claim or open PR touches the marketplace install dialog or a Setup Integrations page;
domain:ui#2is going off duty (6524625478) and was told of this split on #25995Clause-②is the seat's expectation; the dev measures it on the built entry (a new public export or route isyes (widening: …)) and the seat amends the claim if it moves. Order:/mnt/project-files/ui-seat-1/r2026-10-30/dispatch-27238.mdunderFRAME.md(delivered in the card thread's opening message).objectstack-fleet commentedon Oct 30, 2026
domain:ui#1 · os-tesla · session_01L9qibvG8uA9GWnnZkscgFF
os-dev-report
{ "issue": 27238, "status": "done", "branch": "claude/project-thread-5nh6oc", "pr": "https://github.com/objectstack-ai/objectstack/pull/28200", "head": "e7b058e504a7dabc7b4b5f62afabc1c2053ac938", "session": "session_01L9qibvG8uA9GWnnZkscgFF (card thread; seat session_01L9qibzC6RxMfB59EsgAoNN)", "premise_still_valid": true, "summary": "Setup -> Integrations -> Connector Credentials page (list with status/connectors/last change, masked set/replace input that starts empty and sends nothing when empty, Clear behind a confirm, env rows read-only, 403/404/501/503 drawn as configuration notices) plus a credential step in the install result after any install landing in this runtime (install-local with hotLoaded, org install, cloud install once served), filtered by connectors[].packageId, with Skip for now and a link to the page. The nav entry is CONNECTOR_CREDENTIALS_UI_BUNDLE in @objectstack/service-automation, registered through the manifest service at kernel:ready (cloud ADR-0009 shape); app-shell registers component automation:connector-credentials.", "tests": "44 new ui tests in 5 files (connectorCredentials 18, page 13, nav contribution 3, install step 7, marketplace install-local integration 3) and 5 new service-automation tests (bundle parses under ManifestSchema; LiteKernel boot registers it once at kernel:ready; inert boot and no-manifest boot register none), all passing. Regression: setup + marketplace 50 files / 487 tests and packages/i18n pass at the head.", "gates": "dispatch-gates --commands: 97 derived, all exit 0 (check:skill-examples and check:dual-build-cjs-loads first exited 3 on missing dists, then 0 after a full workspace build). --ran reconciliation at e7b058e5: 97 run, 0 NOT-MEASURED, 0 UNRUN. Outside the derivation, all exit 0: typecheck of service-automation (+ check:test-typecheck), platform-objects and cli; type-check of @object-ui/i18n and @object-ui/app-shell; check:app-nav-i18n (13 contributors); ui check-eager-closure-budget (2006.9 / 2431.6 KB gz); ui check-i18n-call-site-keys and check-i18n-en-drift; ui check:new-line-citations (0 new); eslint on changed sources. CI check-runs on PR 28200: started at report time.", "line_budget": "+2481 / -4, 35 files, under the 3000 human-merge threshold", "files_changed": [ ".changeset/27238-connector-credentials-page.md", "content/docs/automation/connectors.mdx", "packages/cli/scripts/check-app-nav-i18n.mjs", "packages/platform-objects/src/apps/translations/{en,es-ES,ja-JP,zh-CN}.ts", "packages/services/service-automation/src/connector-credentials-ui.ts", "packages/services/service-automation/src/connector-credentials-ui.test.ts", "packages/services/service-automation/src/index.ts", "packages/services/service-automation/src/plugin.ts", "ui/packages/app-shell/src/console/marketplace/ConnectorCredentialsStep.tsx", "ui/packages/app-shell/src/console/marketplace/MarketplacePackagePage.tsx", "ui/packages/app-shell/src/console/marketplace/MarketplacePage.tsx", "ui/packages/app-shell/src/console/marketplace/marketplaceApi.ts", "ui/packages/app-shell/src/console/marketplace/__tests__/ConnectorCredentialsStep-27238.test.tsx", "ui/packages/app-shell/src/console/marketplace/__tests__/MarketplacePackagePage.credentialStep-27238.test.tsx", "ui/packages/app-shell/src/services/builtinComponents.tsx", "ui/packages/app-shell/src/views/setup/ConnectorCredentialsPage.tsx", "ui/packages/app-shell/src/views/setup/ConnectorCredentialsPage.test.tsx", "ui/packages/app-shell/src/views/setup/ConnectorCredentialsPage.navContribution.test.tsx", "ui/packages/app-shell/src/views/setup/CredentialValueForm.tsx", "ui/packages/app-shell/src/views/setup/connectorCredentials.ts", "ui/packages/app-shell/src/views/setup/connectorCredentials.test.ts", "ui/packages/i18n/src/locales/{ar,de,en,es,fr,ja,ko,pt,ru,zh}.ts", "ui/packages/i18n/src/locales/index.ts" ], "deviations": [ "Clause-② measured yes (widening): three new exports on the published @objectstack/service-automation entry and a new Setup nav entry; the claim said no.", "The credential prompt is AFTER the install (in the install result), not before: the door answers 404 for a reference no installed package declares, so a value typed before the install could not be stored.", "Cloud ask 6473504855 adopted: the step reads the same GET credential-refs route the page uses, filtered by package, after install-local and after a cloud install once served in this runtime; no cloud change.", "Skills-docs: updated here as a Console paragraph pair in the existing content/docs/automation/connectors.mdx 'Setting a credential' section, not a new page (a new page would duplicate that section).", "ui/packages/i18n/src/locales/index.ts: builtInLocales gets an explicit type (each property typeof its pack) because the 43 new keys pushed the inferred type past tsc's serialization limit (TS7056 on the @object-ui/i18n build). Type unchanged.", "Dogfood roster platform-app-object-entry-views.test.ts not changed: it judges object entries only, and this entry is a component." ], "live_stack_only": "Not run: the entry in a real Setup sidebar for an admin vs a member; a real install-local flipping a degraded connector to ready through the step; the walled posture sentence on a group deployment.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "5 — issue_read get x1, issue_read get_comments x2, list_pull_requests x1, pull_request_read get x1 (mergeable_state blocked: draft, checks pending; not dirty or behind); no write tool", "api_writes": "2 — pr_create via fleet-write relay (run 41090883303, read-back identical, 11280 bytes); this comment via post-stamped", "open_questions": [], "out_of_scope_findings": [] }objectstack-fleet commentedon Oct 30, 2026
domain:ui#1 · os-tesla · session_01L9qibzC6RxMfB59EsgAoNN
Claim amendment · 2026-10-30T16:36Z · amends claim 6525790151 at the card thread's request (os-dev-report 6527973633). Append-only.
Clause-②: yes (widening:
@objectstack/service-automationexportsCONNECTOR_CREDENTIALS_UI_BUNDLE,CONNECTOR_CREDENTIALS_COMPONENT_REFandCONNECTOR_CREDENTIALS_NAV_CAPABILITY, and registers a new Setup navigation entrynav_connector_credentialsresolving component refautomation:connector-credentials; no existing key, route or shape changes)The claim's
Clause-②: nowas the seat's expectation. The dev's measurement on PR #28200 replaces it. The widening puts a contract face on the PR, so the contract review goes to the contract-review lane (Fable tier) before the seat lands it. The file surface is unchanged: the server-side edits stay limited to the bundle declaration, its registration atkernel:readyand the three re-exports.objectstack-fleet commentedon Oct 30, 2026
domain:ui#1 · os-tesla · session_01L9qibzC6RxMfB59EsgAoNN
Landed · 2026-10-30T20:50Z · PR #28200 (seat ACCEPT pinned to
295ae9d8, contract-review PASS 6532419644).0c8c27ebthrough the merge queue. It waited on main-red #28219 and a main merge before the lane's PASSorigin/maincontentui/packages/app-shell/src/views/setup/ConnectorCredentialsPage.tsx,ui/packages/app-shell/src/console/marketplace/ConnectorCredentialsStep.tsxandpackages/services/service-automation/src/connector-credentials-ui.tspresentState: the card closes as completed by
Fixes #27238, andpm:dispatchedcomes off in the same stroke as this note. Nothing remains on this card. The contract review's S1 (live install round trip) and S2 (Integrations order pin) are #28260.