This repository was archived by the owner on Oct 26, 2026. It is now read-only.
Repository navigation
feat(core): the react-pages capability defaults off; a host turns it on - #13526
Merged
Merged
Conversation
Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X4d6XVfcfxL17bMpptytcc
Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X4d6XVfcfxL17bMpptytcc
Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X4d6XVfcfxL17bMpptytcc
github-actions
Bot
added
documentation
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
… probes eval
zod v4 calls `new Function('')` once, the first time an object schema is
built, to decide whether it may compile parsers. Under a content-security-policy
that refuses `eval` the probe is refused and reported on every load. An inline
classic script ahead of the module entry sets `jitless` on zod's global config;
a `z.config()` call in `main.tsx` runs too late, because the production bundle
evaluates the vendor chunks that build schemas before the entry's body.
Fixes #13511
Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X4d6XVfcfxL17bMpptytcc
Contributor
Author
|
e507155 adds objectui#13511 (zod
Generated by Claude Code |
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
os-zhuang
approved these changes
Oct 25, 2026
os-zhuang
marked this pull request as ready for review
October 25, 2026 14:30
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
This was referenced Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Tesla · project thread
What changes
The
react-pagescapability in@object-ui/core(it gateskind: 'react'pages, whose source runs in the application with no sandbox) now defaults to off. A host turns it on explicitly.packages/core/src/runtime/capabilities.ts: the default flips tofalse. The two page globals keep their meaning:__OBJECTUI_CAPABILITIES__turns a capability on,__OBJECTUI_CAPABILITIES_DISABLED__turns it off and wins over a stale enable list.ReactKindPage(packages/components/src/renderers/layout/react-page.tsx) already drew a named notice instead of a blank page while the capability is off. Its text now says the tier is off unless the deployment turns it on and names the switch,OS_PAGE_REACT_ENABLED=true(orenableCapability('react-pages')for a host that embeds the renderer). The title "React pages are disabled on this deployment" is unchanged.offeredPageSourceKinds) already offeredreactonly while the capability is on; only its comment changes.apps/console/src/sdui-workbench-preview.tsx(a dev preview harness) now sets the enable global itself, the way the server does, and?disable=1leaves it unset.content/docs/guide/react-pages.md: the security-gate section states the new default and how the server and an embedding host turn it on.Landing order
The ObjectStack server half is objectstack-ai/objectstack#25789: it reads
OS_PAGE_REACT_ENABLEDand writes the enable global when on and the disable global when off, so the Console follows the server whichever default its build carries. Land that first. After it, this PR changes nothing a server-hosted Console does; it changes the default for a host that embeds the renderer without saying either way, and for a Console served by an older server, where react pages stay off until the server is upgraded.This PR does not move
.objectstack-sha: nothing here reads an objectstack symbol the current pin lacks, and the pin move before the merge window is already in flight on its own card.Known side effect until a follow-up lands
With the tier off, the server's content-security-policy refuses
eval, and zod's one-timeevalprobe at Console boot is reported as one violation per load (nothing breaks). objectui#13511 sets zodjitlessin the Console boot and removes it.Tests
packages/components/src/__tests__/react-page-capability-gate.test.tsx: a real react page through the realtype: 'home'PageRenderer draws the notice namingOS_PAGE_REACT_ENABLED=trueby default and never runs its source; with the capability enabled the same source runs; disabled again, it is closed.packages/core/src/runtime/__tests__/capabilities.test.ts, rewritten to load a fresh module per case (the default is only observable before any override): default off; the enable global turns it on; the disable global wins over an enable list; host enable and disable; unknown capabilities off.react-page-adapter,react-page-content-identity,react-page-invalidation,react-page-scope,react-page-state(components),interfaceCreateandStudioDesignSurface.interfacesCreatePage-11823(app-shell),ListView.objectProviderBinding-7477(plugin-list),sdui-workbench-preview-listview-binding-8510(console). Measured: before the opt-in those nine files failed (27 tests) and nothing else failed, in a run of 695 files across core runtime, components, app-shell studio-design and previews, console, and the two plugin files.pnpm exec vitest run packages/core/src/runtime/ packages/components/src/__tests__/react-page …(the eleven files above plus the gate test) →Test Files 11 passed (11),Tests 73 passed (73).true, the default-off cases in the gate test and the capabilities test go red (2 failed, 6 passed); restored,git diff HEADis empty.turbo run type-check --filter=@object-ui/core --filter=@object-ui/components→ 10/10 tasks.turbo run type-check --filter=@object-ui/app-shell --filter=@object-ui/plugin-list --filter=@object-ui/console→ 38/38 tasks. Headf2792aa.eslint --no-inline-configon every changed.ts/.tsx→ 0 errors.check-changeset-presence,check-changeset-no-major,check:new-line-citations,check:control-bytes→ exit 0.check-governed-queue-guard --teston the file list → NOT GOVERNED.Changeset
.changeset/react-pages-default-off.md:minorfor@object-ui/core,@object-ui/components,@object-ui/app-shell,@object-ui/console(a published default changes;minorunder this repository's version policy), with the FROM → TO for an embedding host.Generated by Claude Code
🤖 Generated with Claude Code
https://claude.ai/code/session_01X4d6XVfcfxL17bMpptytcc