Skip to content

fix(i18n,app-shell): the same-origin marketplace hint stops claiming the runtime serves the catalog (objectui#11726) - #11740

Merged
objectstack-fleet[bot] merged 2 commits into
mainfrom
claude/issue-11726-marketplace-hint-same-origin
Oct 6, 2026
Merged

objectstack-fleet[bot] merged 2 commits into
mainfrom
claude/issue-11726-marketplace-hint-same-origin

Conversation

@objectstack-fleet

Copy link
Copy Markdown
Contributor

Fixes #11726

Clause-②: no

What changed

On a runtime whose config reports cloudUrl: '', a catalog load that failed for a reachability reason drew "This runtime serves the marketplace catalog itself. Check that the runtime is online." '' is the producer's "stay on this origin" spelling. The CLI's cloud-connected os serve reports it while its marketplace proxy forwards to cloud.objectos.ai, so on that runtime the sentence named the wrong server.

  • The hint. marketplace.load.failedHintSameOrigin now says only that the catalog is reached through this runtime, plus the advice to check that the runtime is online and can reach the catalog. All ten packs change. In en: "The marketplace catalog is reached through this runtime. Check that the runtime is online and can reach the catalog." No key is added, removed or moved.
  • The contract's doc. runtime-config.ts: the AppShellRuntimeConfig.cloudUrl and getCloudBase docblocks no longer say the runtime "is the cloud". '' means requests stay on this origin, and the runtime may serve the catalog or proxy a control plane it does not name.
  • The page. MarketplacePage.tsx: comments only, at the cloudBase read and on the hint branch. The rendering logic is unchanged.
  • Unchanged. A runtime that reports its plane keeps marketplace.load.failedHintConfigured, which names it.

The hint stays true on each '' runtime:

  • a runtime that proxies a plane: the catalog is reached through it;
  • the control plane serving its own catalog: the same;
  • an air-gapped runtime (features.marketplace: false): it draws the disabled state and never this hint.

Why "and can reach the catalog"

On the proxying runtime, every hint-showing failure except "no answer" is a 502 / 503 / 504 that the runtime itself answered, so "check that the runtime is online" alone points at a server that just replied. The added clause covers the hop behind it without naming the hop or claiming one exists.

Naming the host: none, measured

The ruling allowed naming the upstream host where a failure carries it. No failure carries it in a structured place, so the hint names none and failedHintConfigured is not reused. Measured by bundling MarketplaceProxyPlugin from objectstack 803764a36f (a ref fetched for this run; objectstack is not edited), driving its real handler with a stubbed upstream, and recording the response:

case status headers body
upstream fetch throws (DNS failure; its cause names cloud.objectos.ai) 502 content-type: application/json {"success":false,"error":{"code":"MARKETPLACE_PROXY_FAILED","message":"fetch failed"}}
upstream answers 502 502 upstream content-type, x-cache: BYPASS upstream body, verbatim
upstream answers 503 503 upstream content-type, x-cache: BYPASS upstream body, verbatim
upstream answers 504, empty body 504 content-type: text/plain;charset=UTF-8, x-cache: BYPASS empty

The proxy drops the error's cause, adds no field naming the upstream, and forwards only content-type / cache-control / etag / last-modified / vary plus x-cache. A browser-side network failure has no response at all. The resolved plane under no OS_CLOUD_URL was https://cloud.objectos.ai. Reading a host out of the message would parse server prose as data, so nothing does. A new pin case puts a host in the server's message and asserts it stays in the cause line and never reaches the hint.

Tests

All at head 4658b17 unless marked. That head is the merge of main 02a3896, made after objectui#11731 landed in the same ten packs. git diff 02a3896 HEAD is exactly this change's 17 files.

  • The full suite. pnpm exec vitest run packages/app-shell/ packages/i18n/ at 1a1bdd3 (this change before the merge): Test Files 1115 passed | 1 skipped (1116), Tests 11511 passed | 22 skipped (11533), lock VERDICT command-exit 0.
  • The narrowed run after the merge, declared. pnpm exec vitest run packages/i18n/ packages/app-shell/src/console/marketplace/ packages/app-shell/src/__tests__/ at 4658b17: Test Files 116 passed (116), Tests 1809 passed | 13 skipped (1822), exit 0. The merge brought only changes that had already been through CI.
  • The new pin. MarketplacePage.sameOriginHint-11726.test.tsx passes all 12 cases:
    • 5 per language under cloudUrl: '': the proxy's 502 envelope, a forwarded 503, an empty 504, no answer at all, and a host named in the server prose;
    • the configured plane, verbatim, in en and zh.
  • The build and type-checks. pnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' run build exits 0. Then pnpm --filter @object-ui/i18n type-check and pnpm --filter @object-ui/app-shell type-check both exit 0. Both run tsc --noEmit && tsc -p tsconfig.test.json, and --listFilesOnly puts the three touched app-shell test files and the touched i18n test in those programs.
  • The published delta. In the built @object-ui/i18n locales/en.d.ts, the one literal type of failedHintSameOrigin changes to the new sentence. No key is added or removed.
  • Lint, narrowed to the 16 touched .ts / .tsx files. eslint --format json reports 16 files, 0 errors and 2 warnings. Both warnings are in MarketplacePage.tsx and both are present at the merge base: react-hooks/set-state-in-effect on void load(), and no-explicit-any on catch (e: any). The population is the config's **/*.{ts,tsx} block. Type-aware linting is not enabled (tseslint.configs.recommended, no parserOptions.project), and no custom rule reads another file, so this diff cannot move an untouched file's verdict.
  • Gates at 4658b17, all exit 0:
    • check:i18n-keys, check:i18n-drift (1 en value changed, 9 packs followed), check:i18n-dead-keys, check:i18n-designer-parity;
    • check:new-line-citations (0 new), check:control-bytes;
    • check:changeset-claims, check:pending-changeset-literals, check-changeset-no-major, check-changeset-presence, check-changeset-fixed, check-changeset-overwrite;
    • check:vi-mock-specifiers, check:vi-mock-inherit, check:vi-mock-override-shape, check:test-path-roots;
    • check-governed-queue-guard --test over the 17 paths: NOT GOVERNED.

Ablation

Run from the committed tree, with scripts/ablation-replace.mjs (objectstack) doing each mutation and its proven restore. The direction was predicted before each run.

  • Leg 1: the old value restored in en and zh. Predicted: the 8 same-origin claim cases red on the "routes through this runtime" assertion; the 2 host-in-prose cases and the 2 configured-plane cases green. Observed: Tests 8 failed | 4 passed (12), red on expected 'This runtime serves the marketplace c…' to match /through this runtime/i and expected '本运行时自己提供应用市场目录。请检查运行时是否在线。' to match /通过本运行时/. Restore: en.ts blob 2305b97065cb == HEAD, zh.ts blob 94c6684df880 == HEAD, git diff HEAD empty, status clean.
  • Leg 2: en keeps "through this runtime" but adds "which serves it itself". This proves the negative half can fail on its own. Predicted: the 4 en claim cases red on the no-serving-claim assertion, everything else green. Observed: Tests 4 failed | 8 passed (12), red on not to match /\bserves?\b|\bitself\b/i. Restore: blob == HEAD, git diff HEAD empty.

@object-ui/i18n resolves to packages/i18n/src through the root vitest alias, so no dist rebuild sat between mutation and measurement.

Acceptance notes

  • Same reading, outside this card's surface, left untouched. These sites gate install and sample-data behaviour, not this hint. Whether that behaviour is right on a proxying '' runtime was not measured here.

    • marketplaceApi.ts: the installPackage docblock ("When the runtime is the cloud") and cloudConsoleUrl() ("'' when this runtime has no upstream cloud").
    • MarketplacePackagePage.tsx: the reseed/purge gate comment ("Only offer them when the runtime IS the cloud (same-origin)").

    Noted, not filed; no carrier.

  • The producer's docblock, objectstack side. RuntimeConfigPluginConfig.controlPlaneUrl in @objectstack/cloud-connection says an explicit '' declares "this runtime IS the cloud" (same-origin for marketplace + install). The same file's constructor comment, the package README and Serve.RUNTIME_CONFIG_OPTIONS all say "stay on this origin", and the CLI's cloud-connected arm passes '' beside a mounted proxy. This is reported to the seat as an out-of-scope finding; it is not edited here.

  • No new runtime-config key, per the ruling. Nothing measured here says the console needs to know that an upstream exists: the hint is true without knowing.

  • The {{url}} hint is unreachable on the CLI's cloud arm. That arm reports '', so a host can appear in the hint only if the producer reports one. That is the ruling's ⛔ on a new key, kept as ruled.

  • NOT MEASURED: check:eager-locale-catalogues, reason: it needs a built console bundle (PREREQUISITE NOT MET). This diff changes no import, which is the composition that gate weighs. The byte budget (performance-budget.yml) is CI's.

  • skip-changeset is not used. .changeset/11726-marketplace-hint-same-origin.md declares @object-ui/i18n: patch: a published pack value changes, and no key, export or prop moves. The app-shell files change only comments and tests.


Generated by Claude Code

claude added 2 commits October 6, 2026 16:52
…the runtime serves the catalog (objectui#11726)

`cloudUrl: ''` is the producer's "stay on this origin" spelling. The CLI's
cloud-connected `os serve` answers it while its marketplace proxy forwards
to the default control plane, so "This runtime serves the marketplace
catalog itself" was false there. The hint now says only that the catalog
is reached through this runtime, in all ten packs, and names no host: no
failure the proxy returns carries the upstream host in a structured place.

runtime-config's two docblocks and the page's own comment stop reading
`''` as "this runtime is the cloud". The two tests that name the key and
the retired-5504 docblock are updated, and a new pin reads the real en
and zh packs over the measured proxy failure shapes.

Claude-Session: https://claude.ai/code/session_01FngvPpdrnhHMdHHq6vwwju
Co-authored-by: Claude <noreply@anthropic.com>
…igin

objectui#11731 landed edits to all ten locale packs; the claim asks this
branch to merge main once it does.

Claude-Session: https://claude.ai/code/session_01FngvPpdrnhHMdHHq6vwwju
Co-authored-by: Claude <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

✅ Console Performance Budget

Metric Value Budget
Eager closure (gzip, 331 chunks) 3325.9 KB 3330.4 KB
Main entry chunk (gzip) 154.3 KB 350 KB
Entry file index-3IrDusax.js —
Status PASS —

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.


📦 Bundle Size Report

Package Size Gzipped
app-shell (consoleActionDispatch.js) 0.20KB 0.19KB
app-shell (index.js) 17.82KB 6.58KB
app-shell (runtime-config.js) 22.59KB 7.89KB
app-shell (types.js) 0.01KB 0.04KB
app-shell (urlParams.js) 10.11KB 3.87KB
auth (ActiveOrganizationStorage.js) 27.95KB 10.04KB
auth (AuthContext.js) 0.31KB 0.24KB
auth (AuthGuard.js) 2.07KB 1.00KB
auth (AuthProvider.js) 40.22KB 10.61KB
auth (AuthShell.js) 3.49KB 1.40KB
auth (ForgotPasswordForm.js) 12.21KB 3.45KB
auth (LoginForm.js) 18.15KB 5.40KB
auth (PreviewBanner.js) 0.90KB 0.50KB
auth (RegisterForm.js) 6.72KB 2.24KB
auth (SocialSignInButtons.js) 9.70KB 3.93KB
auth (UserMenu.js) 3.39KB 1.21KB
auth (auth-gate-events.js) 1.29KB 0.66KB
auth (authStyles.js) 5.04KB 1.72KB
auth (createAuthClient.js) 40.70KB 10.94KB
auth (createAuthenticatedFetch.js) 8.54KB 3.46KB
auth (index.js) 3.63KB 1.64KB
auth (invitation-status.js) 1.22KB 0.70KB
auth (org-roles.js) 6.66KB 2.78KB
auth (phone-identifier.js) 1.11KB 0.66KB
auth (types.js) 0.59KB 0.35KB
auth (useAuth.js) 5.30KB 1.02KB
auth (useWorkspaceAdminStatus.js) 11.08KB 4.58KB
collaboration (CommentThread.js) 27.11KB 7.97KB
collaboration (LiveCursors.js) 3.17KB 1.27KB
collaboration (PresenceAvatars.js) 6.28KB 2.60KB
collaboration (PresenceProvider.js) 2.79KB 1.13KB
collaboration (index.js) 1.68KB 0.73KB
collaboration (useCollaborationTranslation.js) 6.50KB 2.52KB
collaboration (useCommentSearch.js) 1.98KB 0.88KB
collaboration (useConflictResolution.js) 7.75KB 1.86KB
collaboration (useMentionNotifications.js) 1.81KB 0.68KB
collaboration (usePresence.js) 6.33KB 1.84KB
collaboration (useRealtimeSubscription.js) 7.91KB 2.01KB
components (index.js) 578.98KB 139.21KB
core (index.js) 10.00KB 3.96KB
create-plugin (index.js) 27.94KB 9.51KB
data-objectstack (index.js) 233.72KB 64.83KB
fields (index.js) 263.36KB 66.69KB
i18n (LocalizationContext.js) 1.76KB 0.96KB
i18n (builtinAggregateLabels.js) 0.86KB 0.49KB
i18n (currency.js) 2.59KB 1.22KB
i18n (fallbackInterpolation.js) 6.25KB 2.77KB
i18n (i18n.js) 8.87KB 3.64KB
i18n (index.js) 5.52KB 2.39KB
i18n (pickLocalized.js) 9.86KB 3.95KB
i18n (provider.js) 39.35KB 12.88KB
i18n (translateFn.js) 0.20KB 0.18KB
i18n (useDisplayLocale.js) 3.52KB 1.76KB
i18n (useObjectLabel.js) 37.51KB 10.04KB
i18n (useSafeTranslation.js) 7.14KB 2.92KB
layout (index.js) 41.18KB 11.71KB
mobile (MobileProvider.js) 0.92KB 0.49KB
mobile (ResponsiveContainer.js) 0.94KB 0.38KB
mobile (breakpoints.js) 1.51KB 0.70KB
mobile (createOfflineDataSource.js) 5.61KB 1.75KB
mobile (index.js) 1.99KB 0.87KB
mobile (offlineQueue.js) 3.91KB 1.35KB
mobile (pwa.js) 0.97KB 0.49KB
mobile (serviceWorker.js) 1.48KB 0.62KB
mobile (serviceWorkerSource.js) 3.41KB 1.48KB
mobile (useBreakpoint.js) 1.54KB 0.65KB
mobile (useGesture.js) 6.96KB 1.98KB
mobile (useOfflineSync.js) 1.99KB 0.72KB
mobile (usePullToRefresh.js) 6.62KB 2.45KB
mobile (useResponsive.js) 0.72KB 0.42KB
mobile (useSpecGesture.js) 5.52KB 2.10KB
mobile (useTouchTarget.js) 1.01KB 0.54KB
permissions (MePermissionsProvider.js) 13.86KB 5.00KB
permissions (PermissionContext.js) 0.31KB 0.25KB
permissions (PermissionGuard.js) 0.89KB 0.45KB
permissions (PermissionProvider.js) 6.52KB 2.26KB
permissions (discardProofCache.js) 1.04KB 0.55KB
permissions (evaluator.js) 8.33KB 3.07KB
permissions (index.js) 0.93KB 0.41KB
permissions (store.js) 0.91KB 0.42KB
permissions (useFieldPermissions.js) 1.28KB 0.53KB
permissions (usePermissions.js) 4.83KB 2.27KB
plugin-ai (index.js) 16.04KB 3.92KB
plugin-calendar (index.js) 53.39KB 15.52KB
plugin-charts (index.js) 84.26KB 23.05KB
plugin-chatbot (index.js) 198.81KB 47.14KB
plugin-dashboard (index.js) 144.26KB 38.97KB
plugin-designer (index.js) 231.46KB 48.87KB
plugin-detail (index.js) 247.28KB 65.06KB
plugin-editor (index.js) 2.23KB 1.05KB
plugin-form (index.js) 177.09KB 45.89KB
plugin-gantt (index.js) 179.16KB 45.06KB
plugin-grid (index.js) 238.51KB 65.53KB
plugin-kanban (index.js) 52.17KB 16.37KB
plugin-list (index.js) 116.85KB 29.12KB
plugin-map (index.js) 25.60KB 8.62KB
plugin-markdown (index.js) 13.88KB 4.80KB
plugin-report (index.js) 44.12KB 12.29KB
plugin-timeline (index.js) 38.90KB 11.74KB
plugin-tree (index.js) 15.07KB 5.33KB
plugin-view (index.js) 90.23KB 22.73KB
providers (DataSourceProvider.js) 0.75KB 0.39KB
providers (MetadataProvider.js) 1.37KB 0.59KB
providers (ThemeProvider.js) 1.90KB 0.85KB
providers (UploadProvider.js) 11.81KB 3.58KB
providers (index.js) 0.45KB 0.23KB
providers (types.js) 0.01KB 0.04KB
react-runtime (index.js) 5.62KB 2.34KB
react (LazyPluginLoader.js) 4.47KB 1.63KB
react (SchemaRenderer.js) 120.63KB 39.56KB
react (data-invalidation.js) 5.05KB 2.08KB
react (index.js) 4.50KB 2.06KB
react (schema-input.js) 4.31KB 2.07KB
react (spec-input.js) 0.20KB 0.18KB
sdui-parser (body-dialect.js) 4.50KB 1.99KB
sdui-parser (codegen.js) 9.45KB 3.76KB
sdui-parser (dashboard-widget-options.js) 3.08KB 1.30KB
sdui-parser (index.js) 7.30KB 3.12KB
sdui-parser (input-type.js) 2.84KB 1.40KB
sdui-parser (parse.js) 25.28KB 7.80KB
sdui-parser (provenance.js) 3.84KB 1.90KB
sdui-parser (types.js) 0.28KB 0.23KB
sdui-parser (validate.js) 23.87KB 7.83KB
types (ai.js) 4.39KB 2.17KB
types (api-types.js) 0.20KB 0.18KB
types (app.js) 4.12KB 1.61KB
types (authoring-nodes.js) 0.20KB 0.19KB
types (base.js) 0.20KB 0.18KB
types (blocks.js) 0.20KB 0.18KB
types (cloud.js) 0.20KB 0.18KB
types (complex.js) 4.44KB 2.07KB
types (crud.js) 0.20KB 0.18KB
types (dashboard-filter-alias.js) 6.23KB 2.74KB
types (dashboard-widget-layout.js) 2.06KB 0.96KB
types (data-display.js) 3.75KB 1.85KB
types (data-protocol.js) 0.20KB 0.19KB
types (data.js) 0.20KB 0.18KB
types (designer.js) 1.85KB 0.85KB
types (disclosure.js) 0.20KB 0.18KB
types (error-code.js) 1.54KB 0.88KB
types (expression.js) 0.20KB 0.18KB
types (feedback.js) 0.20KB 0.18KB
types (field-types.js) 1.13KB 0.65KB
types (form.js) 0.20KB 0.18KB
types (http-inflight.js) 8.87KB 3.73KB
types (http-retry.js) 4.32KB 2.02KB
types (icon-key-migration.js) 4.26KB 1.63KB
types (index.js) 5.78KB 2.70KB
types (layout.js) 0.20KB 0.18KB
types (managed-by.js) 0.19KB 0.18KB
types (mobile.js) 5.00KB 2.39KB
types (navigation.js) 0.20KB 0.18KB
types (node-slots.js) 7.18KB 2.34KB
types (objectql.js) 0.20KB 0.18KB
types (overlay.js) 0.20KB 0.18KB
types (permissions.js) 2.52KB 1.31KB
types (plugin-scope.js) 0.20KB 0.18KB
types (record-components.js) 0.20KB 0.19KB
types (record-semantics.js) 1.28KB 0.67KB
types (registry.js) 0.20KB 0.18KB
types (reports.js) 0.20KB 0.18KB
types (select-option.js) 0.20KB 0.19KB
types (spec-report.js) 4.99KB 1.96KB
types (spec-ui-namespace.js) 0.20KB 0.19KB
types (strict-authoring-face.js) 19.93KB 7.25KB
types (system-fields.js) 3.33KB 1.54KB
types (theme.js) 6.28KB 2.87KB
types (ui-action.js) 8.11KB 3.32KB
types (views.js) 0.20KB 0.18KB
types (widget.js) 0.20KB 0.18KB

Size Limits

  • ✅ Core packages should be < 50KB gzipped
  • ✅ Component packages should be < 100KB gzipped
  • ⚠️ Plugin packages should be < 150KB gzipped

@objectstack-fleet
objectstack-fleet Bot marked this pull request as ready for review October 6, 2026 18:13
@objectstack-fleet
objectstack-fleet Bot enabled auto-merge October 6, 2026 18:13
@objectstack-fleet
objectstack-fleet Bot added this pull request to the merge queue Oct 6, 2026
Merged via the queue into main with commit d172f63 Oct 6, 2026
45 checks passed
@objectstack-fleet
objectstack-fleet Bot deleted the claude/issue-11726-marketplace-hint-same-origin branch October 6, 2026 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

1 participant