You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Marketplace install starts on one click, with no view of what it will add #30325
Filing gate: ③ the maintainer's direct order, verbatim: 「你发现的问题都立卡,安全问题总专用的安全密卡通道,需要进一步分析的进一步测试,还是没有把握的用决策卡。」 (2026-11-05). Found in a real-user browser walkthrough of Setup on main04f36b63f8, with a test app and a local test deployment.
Business reason. An administrator installing into a live deployment should see what they are adding before it happens. A CRM adds dozens of objects, permission sets, sharing rules and sample records in one click.
Reader. The UI lane dev, in ui/packages/app-shell/src/console/marketplace/MarketplacePackagePage.tsx:597, which calls installLocal directly.
Duplicates. Searched marketplace install confirmation preview (15 hits). They are a closed template install card, a seat card and a closed connector card; none has this subject.
Measured
Clicking 安装 on HotCRM's detail page starts at once: the button becomes 处理中… and there is no dialog. The result was registered objects, permission sets, sharing rules, hooks and 369 sample records. The log's uninstall later listed 382 items. The page says only that the app was installed, then suggests granting crm_user to Everyone.
The cloud install path has a dialog and a sample-data choice, which I read in the code (seedSampleData, line 227) and did not run.
Expected
A short confirm before installing: how many objects, permission sets and sample records it adds, and what it will suggest granting. One click on Install then continues as today, so the trial stays easy. Sample data remains on by the maintainer's ruling on the sibling card. The languages line can follow #30284 when that lands.
Claim: PM loop round 6 · 2026-11-05T14:16Z
Session: session_01L6bhgUR8Nu4M7tbtgES7q2
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30325
Domain: domain:ui
Seat: domain:ui#6
File surface: ui/packages/app-shell/src/console/marketplace/** (the local install button in MarketplacePackagePage.tsx, which calls installLocal directly, gains a short confirm in the console's own dialog: how many objects, permission sets and sample records the package adds, and what it will suggest granting, read from what the package already serves), its tests, language-pack values in ui/packages/i18n, one root .changeset/ file. ⛔ packages/**: if no served answer gives those counts before install, the dev measures and stops with that reading. Sample data stays ON (maintainer ruling on #30323); one click on Install then continues as today (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate; floor sonnet · default opus · ceiling fable), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: the console's local install path in ui/packages/app-shell/src/console/marketplace | the package manifest / registry answers the console reads | every administrator installing a marketplace app into a running deployment; reached on HotCRM (382 items, 369 sample records, card body)
Thread-read: 6652007064
Premise: holds per the card's live measurement on main04f36b63f8; the dev re-measures the one-click start on origin/main first
Serial constraints cleared: #30323 (this seat, card thread on branch claude/project-thread-6nrbkq) edits the same file's install RESULT note; this card edits the step BEFORE install. Normal concurrency on one file: the later lander merges main, and the two threads share how they read the sample-record count so it is read one way. PR #30460 merged.
席位核对 · Amendment · 2026-11-05T14:19Z · claim 6660245735 branch named
Branch: claude/project-thread-o1qmt2
The card thread's harness-designated branch (a project-thread platform exception to the claude/issue-<n>-<slug> convention); the dev thread is session session_01L6bhgTyZzKhzBatM6ZuVbs. Everything else in claim 6660245735 stands.
{
"issue": 30325,
"status": "done",
"branch": "claude/project-thread-o1qmt2",
"pr": "https://github.com/objectstack-ai/objectstack/pull/30545",
"session": "session_01L6bhgTyZzKhzBatM6ZuVbs",
"premise_still_valid": true,
"summary": "Re-measured on origin/main fa9c0aa2 in a real stack: clicking Install on the package page went straight to Working with no dialog and posted install-local at once. Built the confirm: the local Install now opens an AlertDialog listing objects, permission sets and sample records the package adds, plus each isDefault set it will suggest granting to Everyone; its Install runs the unchanged install body, Cancel installs nothing. Counts come from the version manifest the page already read for installModes (the body install-local installs), one read serving both; sample records follow the seed step's data filter and read 'up to N' when a dataset is env- or locale-scoped. Live: confirm said 3 / 2 / 13 and the install answer seeded inline inserted 13. Branch is the harness-assigned card-thread branch.",
"tests": "head b94b041e. pnpm --dir ui exec vitest run packages/app-shell/src/console/marketplace/__tests__/ : 52 files, 442 passed (afbb486e; later commit only touches an i18n test). pnpm --dir ui exec vitest run packages/i18n/ : 95 files, 1443 passed, 13 skipped (first run caught count-families-11445: new atMost leaf, named count-neutral in b94b041e). New: MarketplacePackagePage.installPreview-30325.test.tsx 6/6, installPreview-30325.test.ts 6/6. Six existing local-install tests click the confirm, no assertion changed. Positive control: page restored to fa9c0aa2 with new tests kept, 6 failed of 6; restored via git checkout HEAD, blob 1c588dfb matches HEAD, git diff HEAD empty. type-check app-shell + i18n exit 0 (afbb486e). Live rig: showcase objectstack dev --fresh with OS_CLOUD_URL at a local stand-in control plane, vite console, before/after screenshots and network logs in project files issue-30325/.",
"gates": "dispatch-gates --commands: 35 families, each exit 0 on b94b041e (and on afbb486e); --ran: 35 derived, 35 run, 0 NOT-MEASURED, exit 0. ui checks outside the derived list: check:spec-symbols, check:i18n-keys, check:i18n-drift, check:i18n-dead-keys, check:control-bytes, check:new-line-citations all exit 0; eslint on changed files 0 errors. CI check-runs on PR 30545: in_progress at report time.",
"dogfood_battery": "n/a — no ! in the PR title and Clause-② no without a (narrowing) arm",
"mcp_calls": "5 — issue_read x2 (card, comments), get_session, ToolSearch loads, subscribe_pr_activity on 30545; no GitHub write tool",
"api_writes": "2 — fleet-write pr_create POST /repos/objectstack-ai/objectstack/pulls (run 42050790121, body 8001 bytes identical); this os-dev-report comment via post-stamped",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"carrier: ui 席 6 (seat judges whether to measure and file) · read in code, not reproduced, so not filed as class a — MarketplacePage.tsx doOrgInstall (catalog page organization-package Install) posts install-local on one click with no confirm, the same one-click class this card closes on the package page · dedupe words: marketplace org install confirm, catalog install one click, doOrgInstall",
"carrier: none · the PR attribution block points at this card thread (session-context requirement), not the ui 席 6 thread the dispatch note named"
]
}
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p3 ·
domain:ui·pm:queue· 2026-11-05T07:07Z⛔ Not a claim.
MarketplacePackagePage.tsxwith After installing an app, say how much sample data was loaded and offer clearing it right there #30323 and Marketplace detail page cuts off a wide README with no scrolling, and shows its badges as raw text #30330.Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUR8Nu4M7tbtgES7q2
Claim: PM loop round 6 · 2026-11-05T14:16Z
Session:
session_01L6bhgUR8Nu4M7tbtgES7q2Account:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch: the card thread's designated
claude/project-thread-*branch, named in a claim amendment once the thread reports itWorktree:
objectstack-issue-30325Domain:
domain:uiSeat:
domain:ui#6File surface:
ui/packages/app-shell/src/console/marketplace/**(the local install button inMarketplacePackagePage.tsx, which callsinstallLocaldirectly, gains a short confirm in the console's own dialog: how many objects, permission sets and sample records the package adds, and what it will suggest granting, read from what the package already serves), its tests, language-pack values inui/packages/i18n, one root.changeset/file. ⛔packages/**: if no served answer gives those counts before install, the dev measures and stops with that reading. Sample data stays ON (maintainer ruling on #30323); one click on Install then continues as today (stop on breach; explain in the report)Container & model:
M,mode:thread,model: default(dispatch-gates --tier: no path-derived mandate; floor sonnet · default opus · ceiling fable),effort: highClause-②: no
Metadata-protocol: none
Responsibility: the console's local install path in
ui/packages/app-shell/src/console/marketplace| the package manifest / registry answers the console reads | every administrator installing a marketplace app into a running deployment; reached on HotCRM (382 items, 369 sample records, card body)Thread-read: 6652007064
Premise: holds per the card's live measurement on
main04f36b63f8; the dev re-measures the one-click start onorigin/mainfirstSerial constraints cleared: #30323 (this seat, card thread on branch
claude/project-thread-6nrbkq) edits the same file's install RESULT note; this card edits the step BEFORE install. Normal concurrency on one file: the later lander merges main, and the two threads share how they read the sample-record count so it is read one way. PR #30460 merged.objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUR8Nu4M7tbtgES7q2
席位核对 · Amendment · 2026-11-05T14:19Z · claim 6660245735 branch named
Branch:
claude/project-thread-o1qmt2The card thread's harness-designated branch (a project-thread platform exception to the
claude/issue-<n>-<slug>convention); the dev thread is sessionsession_01L6bhgTyZzKhzBatM6ZuVbs. Everything else in claim 6660245735 stands.objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgTyZzKhzBatM6ZuVbs
os-dev-report
{ "issue": 30325, "status": "done", "branch": "claude/project-thread-o1qmt2", "pr": "https://github.com/objectstack-ai/objectstack/pull/30545", "session": "session_01L6bhgTyZzKhzBatM6ZuVbs", "premise_still_valid": true, "summary": "Re-measured on origin/main fa9c0aa2 in a real stack: clicking Install on the package page went straight to Working with no dialog and posted install-local at once. Built the confirm: the local Install now opens an AlertDialog listing objects, permission sets and sample records the package adds, plus each isDefault set it will suggest granting to Everyone; its Install runs the unchanged install body, Cancel installs nothing. Counts come from the version manifest the page already read for installModes (the body install-local installs), one read serving both; sample records follow the seed step's data filter and read 'up to N' when a dataset is env- or locale-scoped. Live: confirm said 3 / 2 / 13 and the install answer seeded inline inserted 13. Branch is the harness-assigned card-thread branch.", "tests": "head b94b041e. pnpm --dir ui exec vitest run packages/app-shell/src/console/marketplace/__tests__/ : 52 files, 442 passed (afbb486e; later commit only touches an i18n test). pnpm --dir ui exec vitest run packages/i18n/ : 95 files, 1443 passed, 13 skipped (first run caught count-families-11445: new atMost leaf, named count-neutral in b94b041e). New: MarketplacePackagePage.installPreview-30325.test.tsx 6/6, installPreview-30325.test.ts 6/6. Six existing local-install tests click the confirm, no assertion changed. Positive control: page restored to fa9c0aa2 with new tests kept, 6 failed of 6; restored via git checkout HEAD, blob 1c588dfb matches HEAD, git diff HEAD empty. type-check app-shell + i18n exit 0 (afbb486e). Live rig: showcase objectstack dev --fresh with OS_CLOUD_URL at a local stand-in control plane, vite console, before/after screenshots and network logs in project files issue-30325/.", "gates": "dispatch-gates --commands: 35 families, each exit 0 on b94b041e (and on afbb486e); --ran: 35 derived, 35 run, 0 NOT-MEASURED, exit 0. ui checks outside the derived list: check:spec-symbols, check:i18n-keys, check:i18n-drift, check:i18n-dead-keys, check:control-bytes, check:new-line-citations all exit 0; eslint on changed files 0 errors. CI check-runs on PR 30545: in_progress at report time.", "dogfood_battery": "n/a — no ! in the PR title and Clause-② no without a (narrowing) arm", "mcp_calls": "5 — issue_read x2 (card, comments), get_session, ToolSearch loads, subscribe_pr_activity on 30545; no GitHub write tool", "api_writes": "2 — fleet-write pr_create POST /repos/objectstack-ai/objectstack/pulls (run 42050790121, body 8001 bytes identical); this os-dev-report comment via post-stamped", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: ui 席 6 (seat judges whether to measure and file) · read in code, not reproduced, so not filed as class a — MarketplacePage.tsx doOrgInstall (catalog page organization-package Install) posts install-local on one click with no confirm, the same one-click class this card closes on the package page · dedupe words: marketplace org install confirm, catalog install one click, doOrgInstall", "carrier: none · the PR attribution block points at this card thread (session-context requirement), not the ui 席 6 thread the dispatch note named" ] }