[objectstack-fleet]

Requested by Tesla · project thread

Fixes #28260

Refs #27238

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:新增一个测试,钉住 Setup → Integrations 分组里五个入口的顺序(Webhooks/Datasources → Connect an Agent → Connector Credentials → Cloud Connection),顺序从各插件真实的 priority 读出;另在真实运行的服务上走通了「安装应用 → 缺凭据 → 跳过 → 去凭据页填写 → 连接器无需重启即就绪」的全过程,记录贴在卡上。
• 为什么改:feat(console): Setup → Integrations → Connector Credentials, and a credential step after a marketplace install #28200 的契约复审留了两条应修项:S1 要求在真实环境证明凭据闭环,S2 要求防止以后有人改一个数字就悄悄打乱管理员看到的菜单顺序。
• 风险与回滚:只加一个测试文件,不动任何产品代码,不发布任何包;回滚即删除该文件。
• 先看:packages/cli/test/setup-integrations-order.pin.test.ts(顺序断言与优先级读取两段)。
• 两分钟验证:pnpm --filter @objectstack/cli exec vitest run --project unit test/setup-integrations-order.pin.test.ts,预期 1 passed;把 Connect an Agent 与 Connector Credentials 的 priority 对调后重建,同一命令变红。
• 需要你做的:无,席位落地。

What changes

One new test file, packages/cli/test/setup-integrations-order.pin.test.ts (S2 of the contract review on #28200). It composes the real Setup app shell and the five packages that contribute into group_integrations, folds them through the real SchemaRegistry, and asserts:

• the merged order, tier by tier: nav_webhooks / nav_http_deliveries / nav_datasources (one priority, compared as a set because the fold's stable sort leaves that tie to registration order), then nav_connect_agent, then nav_connector_credentials, then nav_cloud_connection;
• the priorities behind that order, read from the contributions themselves (no priority literal appears in the test): each tier shares one priority and every tier sorts strictly before the next, with the failure message naming the package that declares each side;
• that nothing else contributes into the group, so a new entry is a deliberate edit of this pin.

@objectstack/plugin-webhooks and @objectstack/service-datasource register their contribution from init(), so they are booted on a context serving only the manifest service, the same way packages/cli/scripts/check-app-nav-i18n.mjs boots them. The file uses SchemaRegistry directly (no new ObjectQL(), so it classifies into the unit tier.

S1 (the live round trip) changes no file. Its record is posted on #28260.

Tests

• pnpm --filter @objectstack/cli exec vitest run --project unit test/setup-integrations-order.pin.test.ts test/connect-agent-both-halves-wire.pin.test.ts test/vitest-tiers-partition.test.ts at 98931dde: 3 files, 25 tests passed.
• Ablation (one-time, not kept): swapped the two priorities in source (connector-credentials-ui.ts 120 to 110, connect-ui.ts 110 to 120) with scripts/ablation-replace.mjs, rebuilt both packages, ablation-dist-preflight.mjs saw both markers in dist/, and the pin went red on the tier assertion (expected Set{ 'nav_connector_credentials' } to deeply equal Set{ 'nav_connect_agent' }). Restore proven (blob equals HEAD, git diff HEAD empty), both packages rebuilt, --absent preflight clean, pin green again.
• pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 at 98931dde: 358 files, 5136 tests passed. The integration tier is declared to CI (the diff touches no integration-tier file or spawn entry).
• pnpm --filter @objectstack/cli typecheck (tsc plus check:test-typecheck): exit 0.

Acceptance notes

• S1 ran on a probe package, not on HotCRM. HotCRM declares no connector at all: git grep -il credentialRef origin/main over objectstack-ai/hotcrm at a598256 returns nothing, and its own content/docs/guides/integrations.mdx says "src/ carries no connector metadata of any kind". The Slack connector the decision card [Decision] Where a customer administrator supplies a declarative connector credential: a platform credentials page over an encrypted object, an app-shipped settings manifest, env-only as today, or the OAuth connection record #27230 cites is a roadmap line in that page, so installing HotCRM would list no reference. The probe package (com.example.slackprobe) declares one rest connector whose bearer token is credentialRef: SLACK_BOT_TOKEN.
• The marketplace catalog was a local stand-in. This container's proxy refuses cloud.objectos.ai and marketplace.objectos.ai (CONNECT 403), so the dev stack read its catalog through OS_MARKETPLACE_PUBLIC_BASE_URL pointed at a local server serving the snapshot shape (packages.json, packages/ID.json, packages/ID/versions/latest/manifest.json). Everything after that (the Console package page, POST /api/v1/marketplace/install-local, the credential step, the Setup page, the credential door, the automation service) is the real stack.
• The live Setup sidebar served the Integrations group in exactly the order this pin holds: Webhooks, HTTP Deliveries, Datasources, Connect an Agent, Connector Credentials, Cloud Connection.
• Observation, not filed: the Connector Credentials page's "Last changed" column shows the raw user id (… by aPIvyNcbsR4QACN8KHZlCylmhRIImV7v) rather than a name. carrier: none.

Verification

Derived gates: 48 derived, 48 run, all exit 0 (reconciled at 98931dd)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran …: "48 derived famil(ies) accounted for — 48 run, 0 NOT-MEASURED". check-plugin-teardown-shape.mjs --self-test first answered exit 3 (its fixture commit absent from the shallow clone); after git fetch origin 621a487607881c66b2899b7e3477115229a156b4 --depth=1 it passed (48 cases). node scripts/check-sdui-manifest.mjs: exit 0. The record is 28260-gates-ran-98931dde.list in the seat's out folder.

S1 live round trip (summary; the full record is on #28260)

pnpm dev -- --fresh -p 38517 (showcase), no connector env var set (SLACK_BOT_TOKEN unset), catalog stand-in on 38518. Install from the Console package page: POST /api/v1/marketplace/install-local {"packageId":"slack_probe"} answered 200 with credentialRefs: [{ref: SLACK_BOT_TOKEN, status: missing}]; the step listed SLACK_BOT_TOKEN · slack_probe_api; Skip showed "Skipped for now" with a link to /_console/apps/com.objectstack.setup/component/automation/connector-credentials; on that page PUT …/credential-refs/SLACK_BOT_TOKEN answered status: set, source: object with the connector state: ready; GET /api/v1/automation/connectors lists slack_probe_api ready with action request. Server pid 15400 before and after. The value appeared in no response body, no DOM text, no input after save, no reloaded page and no server log line.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json efdddc90603d4855ca41168e9e507e87edf4316f → packageMentionDocs.

[objectstack-fleet]

domain:ui#1 · os-tesla · session_01L9qibzC6RxMfB59EsgAoNN

席位核对

ACCEPT · seat domain:ui#1 · head 98931dde · 2026-10-31T05:48Z

席位意见：连接器凭证的完整流程已在真实开发栈上实测通过。安装后凭证步骤列出缺失的凭证，跳过后会给出凭证页的链接。在凭证页填好后，连接器不用重启就变为就绪，页面任何地方都不会显示凭证值。另外加了一个测试，钉住 Setup → Integrations 分组的顺序，以后有人悄悄调换顺序就会报红。

1. Shape: Fixes #28260, Refs #27238, draft, base main, 1 file (packages/cli/test/setup-integrations-order.pin.test.ts, +181/−0), skip-changeset. Test-only, so no contract review is owed. Clause-②: no, Metadata-protocol: none.
2. Seat read: the pin reads each contribution's own priority from the five real contributors, including the two that register from init(), and compares the ids inside a shared-priority tier as a set. It copies no priority literal. The swap ablation (Connector Credentials 120 ↔ Connect an Agent 110) went red and was restored.
3. S1 record: comment 6539579665, GREEN. Two departures were accepted by the seat. HotCRM main declares no connector, so the probe used a one-connector package naming SLACK_BOT_TOKEN. The container's proxy refuses the marketplace hosts, so the catalog came from a local snapshot server behind OS_MARKETPLACE_PUBLIC_BASE_URL. Everything from the Console on was the real stack, and the server pid was unchanged across the save. No defect against console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238 was found. HotCRM's missing Slack connector is a roadmap row, so it is noted only and no card is filed.
4. Gates / check-runs: on 98931dde: 35 success, 18 skipped (ui lanes filtered out), 0 failure. mergeable_state clean.
5. Landing: check-governed-merges --pr 28336 reports NOT governed, 181 changed lines ≤ 3000. The seat readies the PR and arms auto-merge, on the maintainer's 「按 pm-dispatch 审过的pr你可以自主落地」 (seat thread, 2026-10-30T14:19Z).