cli: os plugin publish decodes the compiled manifest twice and finds its raw entry by a filename two packages spell separately #27914
Description
domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL
Filing gate: ① a should-fix from the contract review of PR #27910 (#27810), record 6514352615, outside that card's dispatched file surface. Filed by domain:server seat 4. ⛔ Not a claim. No grade: triage sets the lane and grade.
What the review found (read from code, not measured)
After PR #27910, packages/cli/src/commands/plugin/publish.ts validates the archive's compiled manifest through readCompiledPluginManifest (packages/runtime/src/compiled-plugin-manifest.ts), then builds the verbatim plugin_manifest payload from a second JSON.parse over archiveFiles.find(f => f.path === MANIFEST_FILENAME)!.data. The verbatim upload is right (the parsed ManifestSchema value stamps defaultDatasource and scope, which would change every publish's payload and stop matching the signed bytes). The weak part is the second lookup: its non-null assertion holds only while the CLI's MANIFEST_FILENAME and the runtime's COMPILED_PLUGIN_MANIFEST_FILE spell the same string.
Wanted (route is triage's)
readCompiledPluginManifest hands back the raw document (or entry) it already decoded beside the parsed manifest, so the publish door decodes once and asserts nothing.
Dedupe
Read the open titles for plugin publish, compiled manifest, readCompiledPluginManifest: only #27810. New.
Activity
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: p3 ·
domain:server·area:devpath· 2026-10-30T03:59Z⛔ Not a claim.
readCompiledPluginManifesthands back the raw document it decoded, so publish decodes once and asserts nothing. Under 「低优先级的先不考虑」 it is p3, and it rides the next server PR inplugin/publish.tsorcompiled-plugin-manifest.ts.pm:queue.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 2 · 2026-10-30T10:28Z
Session:
session_016WV4cxECYe6ksiqRSsT4Rm(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-8qhl4f(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27914Domain:
domain:serverSeat:
domain:server#3File surface:
packages/runtime/src/compiled-plugin-manifest.ts(readCompiledPluginManifestreturns the raw entry/document beside the parsed manifest),packages/cli/src/commands/plugin/publish.ts(decode once, no non-null lookup), tests beside them,.changeset/*.Container & model:
S,mode:thread,model: opus (TIER_DEFAULT),effort: mediumClause-②: yes (widening: the
okarm of@objectstack/runtime's root-exportedCompiledPluginManifestReadgainsdocument; amended 11:50Z from the PR's diff, so aTIER_DEFAULTcontract-review record by the lane seat is owed before the queue)Metadata-protocol: none
Responsibility: the plugin-publish manifest read in
cliandruntime.Thread-read: 6514620984
Premise: holds (read from code by the #27910 contract review 6514352615)
Serial constraints cleared: no open PR touches this surface at claim time (checked against the open PR list).
Dispatch-note: p3. Dispatched on the maintainer's 2026-10-30 10:19Z message in the project ("明明有这么多任务啊", pointing at the open
pm:queue+domain:serverlist), which the seat reads as releasing the 「低优先级的先不考虑」 hold for this queue.objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4cxECYe6ksiqRSsT4Rm
os-dev report for #27914 (PR #28075)
{ "card": 27914, "pr": 28075, "branch": "claude/project-thread-8qhl4f", "head": "263039c193a9c9986fe2913e5f589af7ddecbba1", "session": "session_016WV4cxECYe6ksiqRSsT4Rm", "status": "pr_open", "files": [ "packages/runtime/src/compiled-plugin-manifest.ts", "packages/runtime/src/compiled-plugin-manifest.test.ts", "packages/cli/src/commands/plugin/publish.ts", "packages/cli/test/plugin-publish.test.ts", "packages/cli/test/plugin-publish-manifest-entry.test.ts", ".changeset/27914-publish-decodes-manifest-once.md" ], "pins": { "control_byte_order": "green on main and on head", "filename_drift": "red on main (TypeError at the second lookup), green on head; reached by mocking the CLI constant, no product change", "runtime_document": "red on main, green on head" }, "gates": { "derived": 61, "run_exit0": 60, "not_measured": [ "pnpm check:dual-build-cjs-loads (exit 3)" ], "unrun": 0, "lint": 0, "cli_suite": "535 files passed, 1 skipped" }, "declarations": { "clause2": "yes (widening: CompiledPluginManifestRead ok arm gains document)", "metadata_protocol": "none", "changeset": "patch on @objectstack/runtime and @objectstack/cli" }, "skills_docs": "none (grep over skills/, content/docs/, docs/: 0 hits)", "out_of_scope": [ "the integrity preflight exempt list in publish.ts is still spelled with the CLI MANIFEST_FILENAME; same two-spelling dependency, not changed here" ], "deviations": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
ACCEPT → PR #28075 comment 6522194220 · 2026-10-30T12:01Z · contract review PASS 6521886792 · ready + auto-merge armed through the relay. Filename-constant follow-up: #28080.