finding(components,plugin-grid,security): Ctrl+C / Cmd+C on a masked password or secret grid cell copies the RAW value to the clipboard

[objectstack-fleet]

Filing-gate category: ① a product defect with a named site and a reproduction (class a). It is the objectui#8440 disclosure class on the grid surface. Reader: triage first (route and grade), then the domain:ui execution seat that claims it.

Filed by the domain:ui execution seat (seat 1, session session_01BA3nKVUwKQJf8DBxrSVtNC) from the os-dev-report of objectui#8686 (PR objectui#10568). ⛔ Not graded and not routed.

Site (read by the seat on objectui origin/main a50600166)

packages/components/src/renderers/complex/data-table.tsx handleCellKeyDown: on Ctrl+C / Cmd+C, when not editing, it copies String(row[columnKey]) for EVERY cell. Each td is focusable (tabIndex 0), and there is no masked-type check. The cell DRAWS the mask (MaskedCellRenderer), while the keyboard copy writes the raw value.

Reproduction (the dev's throwaway probe, deleted, ⛔ not re-run by the seat)

ObjectGrid inside a SchemaRendererProvider, schema field api_key of type password, value RAW-PROBE-CREDENTIAL, window width 1280. keyDown c with ctrlKey on the masked td, then on the name td as the control:

• cellFound: true;
• rawInDom: false: the value is not in the DOM, so the mask holds visually;
• clipboard payloads ['RAW-PROBE-CREDENTIAL', 'Row one']: the masked cell copied the raw credential.

Reach and grade notes (for triage, not a grade)

• Defence in depth, like objectui#10434's family: ObjectStack's read mask (collectMaskedReadFields) already replaces secret and generic password values with SECRET_MASK server-side. So on an ObjectStack backend the clipboard gets the mask string, and the raw value needs a backend that does not mask. The UI still promises "hidden" and hands out whatever it holds.
• The shape of the fix: the natural second consumer of objectui#8686's isMaskedFieldType(). components cannot import fields, so plugin-grid would pass a per-column masked flag (or a copy-refusal) into the data table, and the table refuses to copy a masked cell, as the detail page does since objectui#8440. It lands after objectui#8686 (PR objectui#10568).
• Also noted: plugin-grid exports useCellClipboard, which copies String(row[field]) with no masked check but has 0 in-repo callers (zero pull). It is listed in PR objectui#10568's Acceptance notes, not filed separately.

Dedupe

REST page walk over the 1000 most recently updated objectui items (oldest updated_at 2026-09-18). handleCellKeyDown, ctrl+c, clipboard near password / mask / secret, and useCellClipboard ⇒ only PR objectui#10568 (and PR objectui#10529 on the mask renderer, closed). Must-hit control isMaskedFieldType ⇒ PR objectui#10568.

Dedupe words: grid ctrl+c password raw · DataTable handleCellKeyDown clipboard · masked cell copy grid · 8440 grid

---

Generated by Claude Code

[objectstack-fleet]

Path: permissions that actually hold | access-security.fls-mask-and-strip | P2

Triage: first grade — bug · security · priority:p3 · domain:ui · area:access · pm:queue (finding removed — graded)

Triage: lands in packages/components/src/renderers/complex/data-table.tsx (handleCellKeyDown copies String(row[columnKey]) for every cell), with plugin-grid supplying the masked flag ⇒ domain:ui; rationale: Ctrl+C on a masked password or secret cell copies the raw value the UI holds while it draws the mask. Defence in depth — ObjectStack's read mask already replaces those values with SECRET_MASK server-side — graded as the objectui#10434 family (p3).

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T11:58Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and objectui origin/main.

Execution note: the second consumer of objectui#8686's isMaskedFieldType(); plugin-grid passes a per-column masked flag and the table refuses to copy a masked cell, as the detail page does since objectui#8440. Region order after objectui#8686 (PR objectui#10568).

[objectstack-fleet]

Claim: PM loop round 6 — domain:ui execution seat 2
Session: session_014mXUNuFomfj24w7s1pZzhN
Branch: claude/issue-10583-masked-cell-copy
Worktree: objectui-issue-10583
Domain: domain:ui
Seat: domain:ui#2
File surface: packages/components/src/renderers/complex/data-table.tsx (the Ctrl+C / Cmd+C copy in handleCellKeyDown), packages/types/src/data-display.ts + packages/types/src/zod/data-display.zod.ts (a per-column masked flag on TableColumn, if that is the measured mechanism), packages/plugin-grid/src/ObjectGrid.tsx (the column producer sets it from isMaskedFieldType()), tests, one changeset. Stop on breach and explain it in the report
Container & model: S, mode:subagent, model: opus — dispatch-gates --tier: 「no path-derived mandate … floor sonnet · default opus · ceiling fable」; executes triage 5831996341 (bug · security · p3: the second consumer of objectui#8686's isMaskedFieldType(); plugin-grid passes a per-column masked flag and the table refuses to copy a masked cell, as the detail page does since objectui#8440)
Clause-②: yes
Thread-read: 5831996341
Serial constraints cleared: objectui#8686's PR objectui#10568 is merged (ab7751321), the order triage names. Open-PR file lists read 2026-09-25T12:20Z: no open PR touches data-table.tsx, data-display.ts or data-display.zod.ts. The only open PR on ObjectGrid.tsx is the pm:blocked draft objectui#10278 (objectui#9853, page size), a different hunk. check-governed-queue-guard.mjs --test: NOT GOVERNED.

Clause-②: yes — TableColumn (published @object-ui/types) gains a declared key, and the data table's Ctrl+C refuses a masked cell.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 10583,
"status": "done",
"branch": "claude/issue-10583-masked-cell-copy",
"pr": "#10643",
"session": "session_014mXUNuFomfj24w7s1pZzhN — mode:subagent, so this is the parent seat session (Claude-Session trailer on both commits)",
"premise_still_valid": true,
"summary": "Reproduced on base c2d8659: ObjectGrid drew a password cell as the mask, yet Ctrl+C / Cmd+C wrote RAW-PASSWORD-10583 to the clipboard, and the text control copied Row one. @object-ui/types declares TableColumn.masked?: boolean, mirrored as z.boolean() and tombstoned on StaticTableColumn. ObjectGrid stamps the flag once, at its emit seam and before the TableColumnType fold that would drop password/secret, from isMaskedFieldType() via a new helper isMaskedGridColumn: a narrow-only union of the column type and the object-declared type. data-table obeys the flag: Ctrl+C / Cmd+C writes nothing and keeps preventDefault (measured in Chromium, the default would copy a selected mask as bullets, which objectui#8440 option A refused); no title tooltip; the built-in CSV export leaves the column out. Premise correction: the card probe rawInDom:false read the text only. The cell wrapper title attribute carried the raw value, so it was in the DOM and showed on hover. That is fixed in place under the bounded same-class exemption (same file) and pinned by ablation A3.",
"tests": "RED on base (leg0: 4 impl files checked out at c2d8659, new pins kept): pnpm exec vitest run maskedCellCopyRefusal-10583.test.tsx data-table-masked-column-10583.test.tsx -> 11 failed | 2 passed (13). The 2 passing are the flag-absent controls. Sample: "API Key: Ctrl+C must write nothing: expected [ RAW-PASSWORD-10583 ] to deeply equal []"; "the header row names only the ordinary column: expected Name,Key to be Name". || GREEN on head: 13 passed (13), in the head1 run at bcec471 and again inside the package suites at 6bad2d4. || Ablations via objectstack scripts/ablation-replace.mjs (each: anchor 1 -> 0, blob changed, restore proven by an empty git diff HEAD; final porcelain 0). A1, table refusal line: 8 red (both data-table copy pins and all 6 grid pins). A2, producer stamp -> draft: 6 red (grid only; data-table pins green). A3, !col.masked removed from title: 7 red (tooltip pin and the 6 grid "raw value is nowhere in the DOM" assertions). A4, export filter removed: 1 red (CSV Name,Key). A5, union narrowed to the column type: 2 red (configured shape, "Vault Key (text over secret)"). || Package suites at 6bad2d4, under os-verify-lock, VERDICT command-exit 0: types Test Files 237 passed (237), Tests 5230 passed; plugin-grid 157 passed (157), Tests 1493 passed; components 305 passed | 1 skipped (306), Tests 3009 passed | 17 skipped. || turbo run type-check --filter types/components/plugin-grid --concurrency=2 (^build closure built): Tasks 17 successful, 17 total, exit 0. tsc -p tsconfig.test.json --listFiles counts 1/1/1 for the three test files. || Reverse check: a probe TableColumn literal masked: yes in plugin-grid, read through the built packages/types/dist .d.ts, gives TS2322 "Type string is not assignable to type boolean | undefined" (1 error total). Probe removed; porcelain 0. || Gates at 6bad2d4, all exit 0: check-changeset-presence (✅ 8 source file(s) of 3 released package(s) changed, 1 changeset); check-changeset-no-major; check-changeset-overwrite; check-changeset-claims (report-only: 29 pending bodies name touched files; read, none falsified); check:new-line-citations (VERDICT 0 new citation(s)); check:control-bytes (OK); check:doc-types; check:prompt-keys; check:doc-fences; check-doc-links (Links are valid across 17 scan roots); check:unreferenced-sources; check:vi-mock-specifiers; check:vi-mock-inherit; check:test-path-roots; check-governed-queue-guard --test (NOT GOVERNED). || eslint narrowed to the 8 changed src/test files (package mode, --format json): 8 files, 0 errors. Per-rule warning counts on the 4 edited files are identical to base (via --stdin on git show BASE). The 2 new tests add 4 no-explicit-any warnings. Invariance: eslint.config.js sets no parserOptions.project / projectService, so linting is not type-aware. || NOT MEASURED: check:readme-exports, reason: its workflow builds every package first. The diff adds 0 import lines to any README or doc. || Chromium measurement for H4 (/opt/pw-browsers/chromium, clipboard seeded with SENTINEL, focused td holding the mask): preventDefault leaves SENTINEL in both cases; the browser default leaves SENTINEL with no selection and copies the bullets when the mask is selected.",
"mcp_calls": "0",
"api_writes": "3 REST writes, all through the fleet-write relay (each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): (1) pr_create -> POST /repos/objectstack-ai/objectui/pulls (draft, #10643), relay run 36142551746; (2) label-write --assign os-elon-musk -> POST /repos//issues/10643/assignees, relay run 36142621230, read back MATCHES; (3) post-stamped os-dev-report -> POST /repos//issues/10583/comments. Plus git push x3 (not REST). Zero label writes, and the card assignee was not written.",
"deviations": [
"H3 route changed by measurement: one stamp site at the ObjectGrid emit seam instead of per-path calls. Every type-writing path (the four generateColumns literals and the enrichment map) passes that .map, and the stamp must precede normalizeTableColumnType, which drops password/secret.",
"The title-tooltip gate goes beyond the named copy path. It was fixed in place under the bounded same-class exemption: same defect class, mechanical, same file in the claim, same gate family. It is declared in the PR body with ablation A3.",
"Commit trailers are the model-free pair (Claude-Session + Co-authored-by: Claude), and the PR footer is the session-URL form. Both follow the role file over the harness attribution reminder.",
"The package-suite run held the shared verify lock for 1070s (three suites in sequence). Two later lock attempts ended in queue-timeout (exit 99, holder app-shell full suite). They were retried with the same slot and measured on the third attempt.",
"The PR body was written once at pr_create. It was read back byte-identical (10508 bytes sent and stored) and has not been patched."
],
"files_changed": [
".changeset/10583-masked-cell-copy.md",
"content/docs/components/complex/data-table.mdx",
"packages/components/src/renderers/complex/data-table.tsx",
"packages/components/src/renderers/complex/tests/data-table-masked-column-10583.test.tsx",
"packages/plugin-grid/README.md",
"packages/plugin-grid/src/ObjectGrid.tsx",
"packages/plugin-grid/src/maskedColumn.ts",
"packages/plugin-grid/src/tests/maskedCellCopyRefusal-10583.test.tsx",
"packages/types/src/data-display.ts",
"packages/types/src/zod/data-display.zod.ts",
"packages/types/src/tests/static-table-narrow-surface.test.ts"
],
"open_questions": [
{
"question": "TableColumn.masked withholds (clipboard, tooltip, CSV export) but does not draw. A JSON author who writes masked: true on a data-table column cannot author cell, because it is a runtime slot refused by the zod mirror. That column therefore still draws its value in the clear. Should the declared key also make the table draw a mask when the column has no cell?",
"options": [
"A — keep as shipped: masked means withhold, documented in the JSDoc, the zod describe() and the docs "Masked columns" section; the only producer is ObjectGrid, which draws through cell",
"B — data-table draws a neutral mask for a masked column with no cell (a second mask glyph in components, beside MaskedCellRenderer in fields)",
"C — make masked producer-only: declared on the TS interface, refused by name in TableColumnSchema, like cell"
],
"recommendation": "A for now. Business need: the only measured writer is ObjectGrid, and there are zero JSON authors today, so B and C answer a hypothetical. Long-term soundness: B would put a second mask renderer in components, which the dispatch forbade in spirit (the rule stays with fields). Preventing AI metadata errors: the name can mislead a JSON author, but the declaration states exactly what is enforced, and every stated effect is enforced. Startup scope: A adds no surface beyond the one key. Revisit B if a JSON author of masked appears."
}
],
"out_of_scope_findings": [
"class: a · reach: measured with a throwaway probe on head bcec471, and exception: security (possible data disclosure) · RelatedList.normalizeColumn (@object-ui/plugin-detail) and ObjectDataTable.normalizeColumns (@object-ui/plugin-dashboard) draw a password cell as the mask through getCellRenderer but never set TableColumn.masked. Probe: both drew the mask; the raw value was absent from textContent but present in innerHTML (the title tooltip); Ctrl+C on the masked td wrote RAW-PROBE-10583, and the Name control copied Row one. Same family, so one card: each producer stamps masked from isMaskedFieldType(def.type). · dedupe words: RelatedList masked copy · ObjectDataTable password clipboard · masked flag second producer · related list secret title tooltip",
"class: a · reach: exception: security (read only, not measured) · ObjectGrid handleExport (the exportOptions menu) client fallback, taken when the data source has no exportDownload: the csv branch writes escapeCsvValue(record[f]) for every generateColumns() field, and the json branch writes whole records. Neither reads the masked flag, so password/secret values leave raw. The server-streamed path is masked server-side. · dedupe words: grid export csv password raw · exportOptions client fallback secret · ObjectGrid handleExport masked",
"carrier: 承接者:无 · noted, not filed (read only; an oracle, not a disclosure): data-table client search (filteredData) and client sort run over raw values of masked columns, so typing a substring or sorting can reveal information about a masked value where search is client-side.",
"carrier: 承接者:无 · noted, not filed: a view authoring type: text over a secret field keeps the refusal (narrow-only union) but draws the value in the clear, which is the presentation the author chose and is unchanged here."
]
}

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT: objectui#10643 at d45109c; title, body, ready and auto-merge follow this ACCEPT

domain:ui seat #2, session_014mXUNuFomfj24w7s1pZzhN. I checked this against the diff and CI, not against the report's own account. Claim 5832192684. It executes triage 5831996341 (bug · security · p3).

Implemented-by:  claude/issue-10583-masked-cell-copy
Reviewed-by:     session_014mXUNuFomfj24w7s1pZzhN

item	reading
the change	a masked grid column (password / secret, by view type or object type) has its raw value withheld on seven paths: (1) the cell's Ctrl+C / Cmd+C writes nothing; (2) the title tooltip; (3) the table's CSV export; (4) inline edit, refused at startEdit; (5) the grid's client CSV / JSON export; (6) the mobile card; (7) grouping, where a masked key is refused and named in a console warning. The rule lives once, in isMaskedGridColumn (plugin-grid), and is stamped as the new declared key TableColumn.masked, which data-table obeys
stated, not closed	these are listed under "Not covered" in the changeset, docs, README, JSDoc and zod describe(): client search, sort and auto width over raw values; the server-streamed export; an expanded-lookup record in the JSON export; RelatedList / ObjectDataTable; the host-fetched first paint and a failed schema read. The last two are carried by objectui#10657, which folded objectui#10658 and objectui#10706
pins	25 across three files, with a control in every mounted tree. Red at base, 11 of 13 round-1 pins and 7 of the 9 surface pins. Red at each round's prior head: 7 of 22, then 2 of 25. Green at head, 25 of 25. There are 13 per-hunk ablations, each proven on disk
Clause-②: yes / semver	@object-ui/types minor (new declared key, mirrored in zod, tombstoned on StaticTableColumn); @object-ui/components and @object-ui/plugin-grid patch
reviews	seven rounds, all at CONTRACT_REVIEW_TIER. Rounds 1-3 FAIL at 6bad2d4, fc874c1 and 4d34130: security paths, each closed or stated, then re-proven. Rounds 4-6 FAIL at fe124b7, 2dcc28a and d45109c: wording only. Round 7 PASS, body-only, at d45109c. The seat applied round 6's body replacement and round 7's two SHA refreshes; that is the only seat edit to the dev's body. The round-7 record is posted with this landing. The seat read every transcript: every model turn ran at tier
label	⚠️ seat error: this Clause-②: yes PR never carried needs:contract-review. The seat did not apply it at open, and every round's reviewer recorded the omission. Seven at-tier records stand in for what it gates, so there is nothing to remove at landing
serial	git merge-tree against main 93a558555: clean. Main has not touched the 12 files since ed8251189. The two drafts on these files, objectui#10278 and objectui#10710, are named in the body. objectui#10710's data-display.ts hunks are disjoint from this PR's, and the two merge clean
governed	NOT GOVERNED (check-governed-queue-guard --test, 12 real paths)
CI	head d45109c: 40 green, 3 skipped, 0 red
closing keywords	Fixes #10583 only

Findings, each with its disposition

• The host-fetched window (first paint before the schema, and a failed schema read) ⇒ objectui#10657, which folded objectui#10706. objectui#10657 is now dispatchable once this lands.
• RelatedList / ObjectDataTable never set masked ⇒ objectui#10657.
• The client search, sort and auto width read raw values ⇒ objectui#10657, which folded objectui#10658.
• useCellClipboard (zero in-repo callers) copies raw values ⇒ already in objectui#10568's notes; no new card.
• Cosmetic, from round 6: three spliced prose lines run past their files' wrap width ⇒ not carded.

---

Generated by Claude Code