From 91845ce7c4c47b5811d2ef76f5d4e117f501e9ff Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 9 Oct 2026 10:47:13 +0000 Subject: [PATCH 1/2] docs(agents): an authored `events` bag is refused by `objectui validate` and named by `objectui check` (objectui#5250) AGENTS.md section 5 #4 and skills/objectui/rules/protocol.md said an `events` bag that arrives as data is "kept, judged by nothing and run by nothing". Once PR objectui#11069 (objectui#5250 slice A) lands, `objectui validate` and `objectui check` judge a document through the strict authoring face, which refuses `events` as an undeclared key. The two sentences now say that; the tolerant face still keeps the bag, and nothing runs it. Must merge together with or after PR objectui#11069, never before. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude --- AGENTS.md | 2 +- skills/objectui/rules/protocol.md | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 02bb43170f..14f09edb14 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -98,7 +98,7 @@ interface BaseSchema { ```json { "type": "action:button", "properties": { "label": "Open details", "actionType": "url", "target": "/users/ada" } } ``` - ⛔ Never author an `events` bag: `BaseSchema` declares no `events` member and no renderer reads `schema.events` — a typed literal refuses it (#0.1), but the tolerant zod face is `.passthrough()`, so one that arrives as data is kept, judged by nothing and run by nothing. `ButtonSchema.onClick` is a runtime slot for a host-supplied function and is refused by name for the same reason. + ⛔ Never author an `events` bag: `BaseSchema` declares no `events` member and no renderer reads `schema.events` — a typed literal refuses it (#0.1), and one that arrives as data is refused by name as an undeclared key by `objectui validate` and named the same way by `objectui check`, which both judge through the strict authoring face (objectui#5250). The tolerant zod face is `.passthrough()`: it still keeps the bag, and nothing runs it. `ButtonSchema.onClick` is a runtime slot for a host-supplied function and is refused by name for the same reason. - **#5 — Layout as components.** Treat `Grid`/`Stack`/`Container` as first-class. Layout schemas declare responsive columns on the node as `columns` — a number, or a breakpoint object (`columns: { xs: 1, md: 2, lg: 4 }`); never `cols`, which nothing reads (objectui#4001). - **#6 — Type safety over magic.** No `any` — use strict generics. Map `"type": "button"` → React component via a central `ComponentRegistry`. **No `eval()` / runtime dynamic imports** to load components (security). - **#7 — No-Touch zones (Shadcn purity).** `packages/components/src/ui/**/*.tsx` are upstream 3rd-party files overwritten by sync scripts — **never edit their logic/styles**. To change `Button`/`Dialog` behavior: create/edit a wrapper in `packages/components/src/custom/`, import the primitive from `@/ui/...`, and wrap it. diff --git a/skills/objectui/rules/protocol.md b/skills/objectui/rules/protocol.md index ff716489de..d314286a83 100644 --- a/skills/objectui/rules/protocol.md +++ b/skills/objectui/rules/protocol.md @@ -277,9 +277,11 @@ component refuses a node-level `actionType` / `target` as mis-layered **❌ DO NOT** use function references or inline callbacks in JSON schemas, and **❌ DO NOT** author an `events` bag. `BaseSchema` declares no `events` member and no -renderer reads `schema.events`: a typed literal refuses it (objectui#8347), and the -tolerant zod face is `.passthrough()`, so one that arrives as data is kept, judged -by nothing and run by nothing (objectui#6497). `ButtonSchema.onClick` is a +renderer reads `schema.events`: a typed literal refuses it (objectui#8347), and one +that arrives as data is refused by name as an undeclared key by `objectui validate` +and named the same way by `objectui check`, which both judge through the strict +authoring face (objectui#5250). The tolerant zod face is `.passthrough()`: it still +keeps the bag, and nothing runs it (objectui#6497). `ButtonSchema.onClick` is a runtime slot for a host-supplied function and is refused by name for the same reason. ## Rule: Action Params Use Field Types (Shared Widget Renderer) From d4737568df145ce74ec8d547c86adaf68b0858ab Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 9 Oct 2026 11:02:00 +0000 Subject: [PATCH 2/2] docs(skills): `objectui check` also exits non-zero on a refused expression (objectui#5250) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit skills/objectui/guides/project-setup.md said `objectui check` exits non-zero on unreadable JSON only. Since objectui#4795 a `${…}` refused on a text key its node never evaluates fails the run too. One sentence in the CLI table. Claude-Session: https://claude.ai/code/session_01MgfduSkFrfM3eorB3UGfAU Co-authored-by: Claude --- skills/objectui/guides/project-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/objectui/guides/project-setup.md b/skills/objectui/guides/project-setup.md index 26dc670ddf..a41a59bf35 100644 --- a/skills/objectui/guides/project-setup.md +++ b/skills/objectui/guides/project-setup.md @@ -166,7 +166,7 @@ overriding the token values: [`rules/styling.md`](../rules/styling.md). | `objectui build` | Production build (Vite) | | `objectui start` | Serve a previously-built production bundle | | `objectui validate` | Validate a schema file (CI-friendly, exits non-zero on failure) | -| `objectui check` | Sweep the project's JSON files — not a validation verdict: a file whose root carries a structural key (`children`, `className`, `body`, …) is recognised by that key and never parsed against the schema; only a file with none of those keys is parsed, and it is listed as an advisory when its root `type` names a registered component but the document fails; exits non-zero on unreadable JSON only. Use `objectui validate` for the verdict | +| `objectui check` | Sweep the project's JSON files — not a validation verdict: a file whose root carries a structural key (`children`, `className`, `body`, …) is recognised by that key and never parsed against the schema; only a file with none of those keys is parsed, and it is listed as an advisory when its root `type` names a registered component but the document fails; exits non-zero on unreadable JSON and on a `${…}` refused on a text key its node never evaluates (objectui#4795). Use `objectui validate` for the verdict | | `objectui generate` | Code/schema generation (`object`, `page`, `plugin`) | | `objectui doctor` | Diagnostics (Node version, deps, etc.) | | `objectui analyze` | Bundle-size report over the built `dist/` output |