Repository navigation
console: a member opening an app they may not access at its package-id URL gets "This app can't be opened" instead of the access-denied screen — the access probe asks the by-name route with the package id and reads its 404 as not found #12285
Description
Filing-gate category ① (product defect, named landing point) and ③ — the maintainer's order in the dispatching session, verbatim: 「测试遇到的问题，可以提交issue」.
QA-source: objectstack-ai/objectstack#23104 · platform-core.builtin-apps-nav-render · A2
Reader who acts: the objectui domain:ui execution seat (console app shell). Dedupe: semantic issue search on this repo, closed included, "console app access probe package id URL segment access denied screen unreachable shows app not found for member Setup" — 2 hits, neither this shape (objectui#4473, objectui#2794, both closed).
Verified twice: the runner reproduced it on two fresh browser contexts; the PM seat re-derived it independently from source at the pin (RUNNER rule 7, P0 item).
Environment
objectstack 36b2889c with the console built from objectui 1fb1ced36243 (the pin hop of objectstack-ai/objectstack#23104 / PR objectstack-ai/objectstack#23110), stock examples/app-showcase, --seed-admin, member persona phone.demo@example.com (positions org_member, everyone).
Reproduction
- Sign in through the console form as the member;
GET /api/v1/auth/get-sessionanswers 200 for that user. - Navigate to
/_console/apps/com.objectstack.setup— the package-id URL segment the admin's own Setup links use (ADR-0048 URL form). - Network:
GET /api/v1/meta/app200 (Setup absent from the member's list, correctly), thenGET /api/v1/meta/app/com.objectstack.setup→ 404RESOURCE_NOT_FOUND. - The page renders
[data-testid=app-not-found]: "This app can't be opened — The server did not return this app for your account".
Expected: [data-testid=app-access-denied] "You don't have access to this app" — the screen AppContent renders for a denied verdict (objectui#4252 / objectstack-ai/objectstack#8013).
Control: the same member, GET /api/v1/meta/app/setup (by NAME) → 403 PERMISSION_DENIED, "You do not have permission to open the 'setup' app." No Setup content leaks either way; this is the wrong verdict screen, not an access hole.
Mechanism (objectui 1fb1ced36243)
packages/app-shell/src/console/AppContent.tsx:const { appName } = useParams();— the URL segment, which may be a package id; the probe effect callsprobe.call(dataSource, appName)with it.packages/data-objectstack/src/index.tsprobeAppAccess(appName)→probeMetaItemAccess('app', appName)→ the by-name route, which keys on the app NAME. A package-id segment therefore answers 404, read asnot_found, so thedeniedbranch is unreachable from every package-id app URL.
Where the fix lands
Either the console resolves the segment to an app name before probing (the member's app list does not carry withheld apps, so it cannot do that from the list alone), or the backend's by-name app read also answers for the package id. Which side owns the mapping is the fixing seat's call; if it is the backend, this becomes a seam with objectstack-ai/objectstack.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 13, 2026
Triage: first grade,
bug·priority:p3·domain:ui·area:access, intopm:queue. The access probe asks by the app's routing key. A server half is a seam card only if no declared read existsTriage seat (seat post objectstack-ai/objectstack#6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-13T02:56Z. ⛔ Not a claim, ⛔ not a dispatch./apps/<packageId>). So the console's denied-or-missing verdict has to be answerable for that key. Asking the by-name route with a package id is the defect.?package=reading every/metadoor has (objectstack #22188) is the first candidate. If one does, the console probes a package-id segment through it, and the fix is objectui-only.pm:blockedon it.packages/app-shell/src/console/AppContent.tsxandpackages/data-objectstack(probeAppAccess) (domain:ui); rationale: probe by the key the URL carries.objectstack-fleet commentedon Oct 13, 2026
Claim: PM loop round 1 (as triage
6137196505directs, in its order: the claimant first measures whether a declared server read already answers 403 or 404 for an app by package id, the?package=reading of the/metadoors (objectstack-ai/objectstack#22188) being the first candidate; if one does, the console probes a package-id segment through it, objectui-only; if none does, ⛔ no code, and this seat files the objectstack seam card and blocks this card on it)Session:
session_01RZYixBnXPWvcm2YenWo6eJAccount:
os-support-ai(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-12285-probe-by-package-idWorktree:
objectui-issue-12285Domain:
domain:uiSeat:
domain:ui#2File surface, on objectui
mainf0532d8:/metaapp reads, by name and with?package=, on objectstackmainand on the newest published@objectstack/*release, as source and, where the dev can boot it, as a live answer for a member on a withheld app.packages/app-shell/src/console/AppContent.tsx, the access-probe effect (const probed = appName;thenprobe.call(dataSource, probed), near:377–:378), andpackages/data-objectstack/src/index.ts,probeAppAccess(:6256) andprobeMetaItemAccess(:6283)..changeset/12285-probe-by-package-id.md(@object-ui/app-shell,@object-ui/data-objectstackif touched; ⛔ nevermajor).Container & model:
M,mode:subagent,model: default tier — dispatch-gates --tier --repo objectstack-ai/objectui: "no path-derived mandate"Clause-②: yes
Responsibility:
objectui's console app shell (@object-ui/app-shell AppContent's access probe, through @object-ui/data-objectstack probeAppAccess), which asks the by-name app route with a package-id URL segment and reads its 404 as not_found | the access-denied screen exists (objectui#4252), and the by-name route answers 403 for a name (the card's control); whether a package-id read answers is the measurement | every member opening a withheld app at its package-id URL, the ADR-0048 form the admin's own Setup links use (reproduced twice on the card)Thread-read: 6137196505
Serial constraints cleared: read at 2026-10-13T05:34Z on objectui
mainf0532d8:AppContent.tsxorpackages/data-objectstack/src/index.ts(4 open PRs read: objectui#12309 grid saves, two dependabotnextbumps, the release PR objectui#11600). Neither file has changed onmainsince 2026-10-12T05:00Z.AppContent.tsx(findFirstRoute) as not re-measured. Re-measured now: no open PR and no in-flight claim names it. This card's region is the access-probe effect, notfindFirstRoute.Clause-②: yescovers a probe input that may widenprobeAppAccesson the published adapter. If the measurement blocks the card, or the fix moves no published signature, the report narrows it tonoand says why.Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
os-dev-report
{ "issue": 12285, "status": "blocked", "branch": "claude/issue-12285-probe-by-package-id", "pr": null, "session": "session_01RZYixBnXPWvcm2YenWo6eJ (mode:subagent, the PM's own id; identity bit is the branch)", "premise_still_valid": true, "summary": "MEASURED, stop condition 2: no declared server read answers the app access verdict (403 PERMISSION_DENIED for exists-but-withheld, 404 for absent) keyed by PACKAGE ID, neither on objectstack main e540e7ffb nor on the newest published release 17.7.0. Per the dispatch no fix code was written and no PR opened; the branch holds only the empty probe push (head f0532d8 = objectui origin/main). Readings on main e540e7ffb: (1) By-name item read GET /api/v1/meta/app/NAME, RestServer (packages/rest/src/rest-server.ts, handler of the `${metaPath}/:type/:name` route, uncached arm `const envelope = await p.getMetaItem(itemRequest)` with `name: req.params.name`): addressed by the app's snake_case NAME. The spec declares exactly that (packages/spec/src/api/protocol.zod.ts GetMetaItemRequestSchema: name 'Item name (snake_case identifier)', packageId 'Optional package ID to filter items by'). `?package=` is read through `metaItemPackageBinding` (objectstack-ai/objectstack#22188 reading) and only NARROWS: it reaches `getItem(type, name, currentPackageId)` (packages/objectql/src/registry.ts, ADR-0048 3.3 prefer-local), which tries the bare key, then the `PKG:NAME` composite, then any key ending in `:NAME`. The name stays the key, so /meta/app/com.objectstack.setup?package=com.objectstack.setup asks for an app NAMED com.objectstack.setup and answers 404 exactly as the card's step 3 did; the runtime dispatcher's /meta item read (packages/runtime/src/domains/meta.ts) asks `protocol.getMetaItem` the same way. (2) List GET /api/v1/meta/app?package=ID: `?package=` scopes `getMetaItems`, then `createMetaListReadGate`'s app arm maps `filterAppForUser` over the items and drops nulls (packages/rest/src/meta-item-read-gate.ts, `.filter((it: any) => it != null);`). A member on a withheld app is answered 200 with that app left out, byte-identical to an unknown package id (200, empty): the collapse the card describes, so it does not answer the verdict. (3) List `?id=` (objectstack-ai/objectstack#7566) narrows by `a.name === appIdFilter` AFTER that gate: by name, and the same collapse. (4) GET /api/v1/packages/:id (packages/runtime/src/domains/packages.ts, `requireReadCapability`) refuses 403 'Reading packages requires the `studio.access` or `setup.access` capability.' BEFORE reading, so a member gets that 403 for every id, existing or not: a package-read capability answer, not an app verdict; probing it would show 'denied' for an unknown package id and break pin 2. (5) Census: the two route ledgers (packages/rest/src/rest-route-ledger.ts, packages/runtime/src/route-ledger.ts) list 165 routes; every item-addressed /meta GET keys on :name; the only package-keyed GETs are /packages/:id, /commits, /export (all behind the same gate). Readings on published 17.7.0 (npm 'latest' dist-tag of @objectstack/rest and @objectstack/client, published 2026-10-06; objectui's pnpm-lock.yaml resolves @objectstack/client, spec, core, formula, lint 17.7.0; read from `npm pack` tarballs): rest dist/index.js list `const packageId = req.query?.package || void 0;` and item read `const envelope = await p.getMetaItem(itemRequest);` by `name: req.params.name`; list gate `filterAppForUser(it, sysPerms, serviceGate, servabilityGate, docAudienceGate)).filter((it) => it != null)`; `a.name === appIdFilter`; metadata-protocol dist `this.engine.registry.getItem(request.type, request.name, request.packageId)`; runtime dist 'Reading packages requires the `studio.access` or `setup.access` capability.' 403. objectstack-ai/objectstack#22188 is NOT in 17.7.0 (`metaItemPackageBinding` 0 hits in rest@17.7.0 dist/index.js vs `createMetaListReadGate` 3 hits in the same file), which changes only how `?package=all` reads, not the name keying. H4 (segment kinds): the console CAN tell them apart without guessing, by spec grammar: an app name is SnakeCaseIdentifierSchema /^[a-z][a-z0-9_]*$/ (no dot, packages/spec/src/shared/identifiers.zod.ts; AppSchema name in packages/spec/src/ui/app.zod.ts) and a package id is MANIFEST_ID_PATTERN /^[a-z0-9][a-z0-9-]*(\\.[a-z0-9][a-z0-9-]*)+$/ (at least one dot, packages/spec/src/kernel/manifest.zod.ts): disjoint. It CANNOT map a withheld app's package id to its name: `matchAppBySegment` (packages/app-shell/src/utils/appRoute.ts) resolves `_packageId` then `name` over the member's list, and the withheld app's row is absent from that list. Premise still valid on objectui main f0532d8: AppContent's access-probe effect passes the raw URL segment (`const probed = appName;` then `probe.call(dataSource, probed)`), and `probeMetaItemAccess` asks `this.client.meta.getItem(type, name)`; Setup declares `requiredPermissions: ['setup.access']` (packages/platform-objects/src/apps/setup.app.ts on objectstack main), the withheld reason that by-name answers 403 for.", "tests": "No fix code, so no gate ran: objectui branch head f0532d8 (= BASE = origin/main), zero commits, zero files changed. Reads only: objectstack main e540e7ffb sources (rest-server.ts, meta-item-read-gate.ts, metadata-protocol protocol.ts, objectql registry.ts, runtime domains/meta.ts and domains/packages.ts, both route ledgers, spec protocol.zod.ts, app.zod.ts, manifest.zod.ts, identifiers.zod.ts, ADR-0048) and the published tarballs `npm pack @objectstack/rest@17.7.0`, `@objectstack/metadata-protocol@17.7.0`, `@objectstack/runtime@17.7.0`. Controls: `metaItemPackageBinding` 0 hits in rest@17.7.0 dist/index.js vs `createMetaListReadGate` 3 hits in that same file vs 16 hits in main's rest-server.ts; the route census read 165 routes with the known `GET /api/v1/meta/:type/:name` present. NOT MEASURED: live answer, reason: /home/user/objectstack has no node_modules and no dist (never installed or built in this container); a showcase boot with the member persona needs a full objectstack install plus a CLI-closure build in a separate worktree under the shared verify lock while two sibling devs run, for reads the source at both shas fixes structurally (the item read keys on :name, `?package=` only narrows, the list gate drops withheld apps). The card's own live readings on objectstack 36b2889c (by-name /meta/app/setup 403 PERMISSION_DENIED; /meta/app/com.objectstack.setup 404 RESOURCE_NOT_FOUND) agree with that source. Ablation: n/a (no code).", "mcp_calls": "0", "api_writes": "1 — POST /repos/objectstack-ai/objectui/issues/12285/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). The empty-branch `git push` is not a REST write. Reads: GET /repos/objectstack-ai/objectui/issues/12285 and .../issues/12285/comments?per_page=100 (2 comments, newest Claim 6139077736 names this branch), plus npm registry reads.", "open_questions": [ { "question": "While the seam card is open, should the console stop asserting not_found for a package-id-shaped segment (grammar-disjoint from app names), since the by-name 404 it reads is an answer about a NAME nobody asked for?", "options": [ "A — keep this card blocked and the console unchanged: a member on a withheld app's package-id URL keeps seeing app-not-found until the server answers by package id; pins 2 and 3 hold as they are.", "B — interim, objectui-only: a dotted segment the member's list does not carry is not probed by name and gets `unknown` (the screen that asserts nothing). No guess, no server change, no published signature moves; but it breaks pin 2 (an unknown package id would no longer show not-found) and is undone when the seam lands." ], "recommendation": "A, because triage's pins require not-found for an unknown package id and only a server read can tell withheld from absent there; B swaps one unmeasured screen for a vaguer one and spends a release on a stopgap." } ], "out_of_scope_findings": [ "SEAM CARD DRAFT, for the seat to file on objectstack-ai/objectstack (dev filed nothing). class: b · reach: public door + wrong answer: a member (showcase phone.demo@example.com, positions org_member + everyone) at /_console/apps/com.objectstack.setup is answered GET /api/v1/meta/app/com.objectstack.setup 404 RESOURCE_NOT_FOUND and the console renders app-not-found, while GET /api/v1/meta/app/setup answers 403 PERMISSION_DENIED (objectui#12285, reproduced on two fresh browser contexts) · Title: 'the app access verdict is answerable by package id, per ADR-0048 §3.1' · Contract quoted, ADR-0048 §3.1: 'The route/container coordinate for an installed package's UI is its **package id** (`manifest.id`, reverse-domain). With the current **one-app-per-package** invariant, the app *is* the package container' · Seam: spec:GetMetaItemRequestSchema.name and .packageId (name = the snake_case item name; packageId = 'Optional package ID to filter items by') → runtime:RestServer GET /meta/:type/:name (`getMetaItem` by `req.params.name`; `?package=` through `metaItemPackageBinding` only narrows the registry's prefer-local `getItem`) and the runtime dispatcher's /meta item read | renderer:objectui AppContent access-probe effect (`probeAppAccess` → `probeMetaItemAccess('app', segment)`) · Measured gap, alike on main e540e7ffb and published 17.7.0: no declared read answers 403-or-404 for an app keyed by package id. The item read keys on the name; the list GET /meta/app?package=ID and `?id=` answer 200 with a withheld app left out, byte-identical to an unknown package id; GET /packages/:id refuses 403 before reading to every caller without studio.access/setup.access, every id alike. The two keys' grammars are disjoint (SnakeCaseIdentifierSchema has no dot, MANIFEST_ID_PATTERN needs one), so a package-id-keyed answer is unambiguous. Which accept set answers it (a package-id arm on the app item read, or a separately declared verdict read) is the spec lane's call, per triage 6137196505 ('No alias acceptance is added to the by-name route here'). Consumer once it lands: objectui AppContent's probe; objectui#12285 goes pm:blocked on it · dedupe words: app access verdict package id; by-name app read package id 403; ADR-0048 3.1 routing key access probe; withheld app package-id URL PERMISSION_DENIED; meta app package-scoped item read" ], "gates": [], "gates_note": "None owed: the dispatch's gate list applies only if a fix lands, and none did. Pinned head: f0532d8 (git rev-parse --short HEAD on the branch before the clean worktree removal).", "line_budget": "n/a — no skills/** (no diff at all)", "files_changed": [], "deviations": [ "pnpm install in the worktree skipped: os-dev rule 1 orders it before the first edit, and no edit was made (read-only measurement). The worktree was removed clean afterwards (`git worktree remove`, exit 0, no --force, no node_modules ever created); the remote branch stays at f0532d8 for a Resume-from.", "The dispatch asked for file:line citations; objectui AGENTS.md #11 bans every line address in a card or PR body (a card has no same file), and this report is posted on the objectui card. So citations are path + symbol + quoted string at a named sha; each quoted string greps to its line at that sha. Conflict named here rather than silently resolved.", "Clause-②: the claim declared `yes`; no PR was opened and no published signature moved, so it narrows to `no` (nothing to copy into a PR body).", "Live answer NOT MEASURED (reason in `tests`)." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
State:
pm:dispatched→pm:blockedon objectstack-ai/objectstack#23183 ·domain:uiseat 2 ·session_01RZYixBnXPWvcm2YenWo6eJ· 2026-10-13T05:56ZThe measurement triage
6137196505ordered first is done, and it lands on step 2. Inputs: claim6139077736and the dev report6139227357(status: blocked,pr: null, no commit).origin/maine540e7f(the dev's report, not this comment, carries the full evidence):rest-server.tsbuilds the request withname: req.params.name, and the spec declaresnameas "Item name (snake_case identifier)".?package=only narrows..filter((it: any) => it != null)inmeta-item-read-gate.ts), so a member gets 200 without it, the same answer as for an unknown id.GET /packages/:idrefuses every caller withoutstudio.access/setup.accessbefore reading.unknownscreen for dotted segments): answered A. Triage's direction already decides it: "⛔ The console does not guess", and pin 2 needs not-found for an unknown package id, which only a server read can tell apart from withheld. No decision card is opened.nofor this round: no PR was opened, and no published signature moved.Release:
session_01RZYixBnXPWvcm2YenWo6eJ(accountos-support-ai) releases claim6139077736.pm:blockednow. When Seam: the app access verdict is answerable by package id, per ADR-0048 §3.1 — no declared /meta read answers 403 or 404 for an app keyed by its package id, so the console cannot tell a withheld app from a missing one at /apps/PACKAGE_ID objectstack#23183 closes, the card returns topm:queuefor a fresh claim, which re-measures the read on the version the console runs against.claude/issue-12285-probe-by-package-idholds no commit of its own (it points atmainf0532d8).Blocked-by: objectstack-ai/objectstack#23183
Generated by Claude Code