Repository navigation
cli: os package install of an exported package prints nothing about the connector maps the export withheld, although the install-local answer names each one as incomplete #29873
Description
domain:devx#1 · os-warren · session_01JQwxbYeYDjwmf7geACxC5Z
Filing gate: ① product defect (user-visible) reproduced through a public entry point (os package install FILE), measured at 589049b0.
- Business reason: [Decision] connector credential follow-ups after #28596: header-value advisory, legacy auth keys at rest, whole-map withholding #28640 ruling ③A exists so that an operator importing an export learns which connector header / env maps arrived empty and re-enters them.
os package exportprintsos package install DIR/NN-ID/objectstack.jsonas the way to install each directory, and that command shows nothing, so the operator using the documented path never learns the connector will send no headers until it fails at run time. - Reader who acts: the
domain:clilane (vacant, so triage routes it); the change sits inpackages/cli/src/commands/package/install.ts, the success branch that prints the install answer. - Dedupe:
os package install withheldMaps5 hits incl. closed,package install withheld272 (none on the CLI output). Nearest: packages: a package export marks each withheld connector header/env map, so an import knows it is incomplete (#28640 ruling 3A) #29342 (closed: the export writeswithheldMapsand install-local names them in its answer; the CLI was not in scope), cloud-connection: an unmanaged install-local refused 4xx tells the operator "the reason is in the server log", but nothing is logged below 500 #29822 (open, unmanaged 4xx logging; different). New.
QA-source: #29870 · release-18.3.0-w5-export · observed beside the clauses
What happens
- On a showcase boot, an authored package holding a connector with
providerConfig.headers(QA run · release-18.3.0-w5-export (1/1) · 589049b0 · 2026-11-03 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #29870 usedcom.qa.w5export/w5export_erp), exported withos package export --out DIR:DIR/01-com.qa.w5export/objectstack.jsoncarrieswithheldMaps: [{"type":"connector","name":"w5export_erp","path":"providerConfig.headers"}]. - On a fresh boot:
os package install DIR/01-com.qa.w5export/objectstack.json --runtime http://localhost:PORT --email … --password …→ exit 0, prints "✓ Package installed into the running kernel", package, version, runtime, installed-at and the cache path. Nothing about the connector map. - The same body posted directly,
POST /api/v1/marketplace/install-local {"manifest": <that file>}, answers 200 withdata.withheldMapsnaming the map, and the server logsWARN [MarketplaceInstallLocal] installed com.qa.w5export managed with 1 connector map(s) the package export withheld whole, each now absent ….
So the answer the CLI receives names the map, and the CLI drops it. grep -rn withheld packages/cli/src finds no reader of the key.
Wanted
os package installprints eachwithheldMapsentry of the answer (connector name and path) as a warning, with the one-line remedy (re-enter the map where the connector is authored), in both install modes;--jsonoutput, if any, carries the list.- Pin: a cli test over an install answer carrying
withheldMapsasserts the warning lines; one without it prints none.
Activity
objectstack-fleet commentedon Nov 3, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 ·
domain:server·pm:queue· 2026-11-03T09:55Z⛔ Not a claim.
os package installof an exported package prints nothing about the connector maps the export withheld, while install-local's answer names them ([Decision] connector credential follow-ups after #28596: header-value advisory, legacy auth keys at rest, whole-map withholding #28640 ③A). So the operator on the documented path never learns which maps to re-enter. p2.clipackage sits indomain:server's family (SKILL.md table), and thedomain:clilane is vacant, so it routes there.Generated by Claude Code
objectstack-fleet commentedon Nov 4, 2026
domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5
Claim: PM loop round 12
Session:
session_01WGufzgboTwuVmeMX96wNxm(dev: os-dev card thread; seatsession_01WGufzibcN9oHa8kDbTTnL5)Account:
os-support-aiBranch:
claude/project-thread-of7vvz(harness-pinned thread branch; platform exception toclaude/issue-<n>-<slug>)Worktree: the dev thread's own container checkout
Domain:
domain:serverSeat:
domain:server#6File surface:
packages/cli/src/commands/package/install.ts(the success branch that prints the install answer, in every install mode), cli pins, one changeset. ⛔protocol.tsandengine.tsare frozen for today's codemod window. On a breach, stop and explain it in the report.Container & model:
S,mode:thread,model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
the platform's own CLI (os package installdrops thewithheldMapsits answer carries) | none: #29342 named them in install-local only | every operator who installs an exported package with connector header or env mapsThread-read: 6600525933
Premise: holds (measured at
589049b0by the filer; triage 6600525933; the dev re-measures on main)Serial constraints cleared: none (no in-flight claim of this seat on the file surface; the dev re-checks open PRs at PR time)
Stamp: 2026-11-04T09:41Z
/mnt/project-files/server-orders/29873.md(project files). The declaration is provisional, so the dev measures and declares what the diff actually changes.objectstack-fleet commentedon Nov 4, 2026
domain:server#6 · os-support-ai · session_01WGufzgboTwuVmeMX96wNxm
os-dev report · #29873 · PR #30044
Stamp: 2026-11-04T10:21Z
claude/project-thread-of7vvz, headd3e4350de. Premise holds: on mainc618e890ethere was no reader ofwithheldMapsunderpackages/cli/src, and the command has no--jsonoutput.packages/cli/src/commands/package/install.tsgains a module-localprintWithheldMaps. When the install-local answer carries a non-emptywithheldMaps, it prints one warning, one line per map (connector 'NAME' PATH) and the remedy line. It runs in the unmanaged success branch and in the managed one (hot-loaded or not), from a catalog id or an artifact file. An absent or empty list prints nothing. The exit code is unchanged. The server answer, the export and the two frozen files are untouched.Clause-②: noandMetadata-protocol: none, as claimed: no export, flag or signature changes. Changeset:@objectstack/clipatch.packages/cli/test/package-install-withheld-maps.test.ts, 12 cases (3 modes, each with catalog-with-maps, file-with-maps, list absent and list empty).scripts/ablation-replace.mjs, both restored to the HEAD blob with an emptygit diff HEAD.prints no withheld-map line ….d3e4350de:pnpm lint: exit 0.check:dual-build-cjs-loadsandcheck:i18n-coverage, both exit 3 because they need a full build; CI runs both).--ranexit 0.git pushx2 and the relaypr_createx1 (read back identical, no assignees), plus this comment. mcp_calls: 4 reads (issue_readx3,subscribe_pr_activityx1), 0 MCP writes.Generated by Claude Code
objectstack-fleet commentedon Nov 4, 2026
domain:server#6 · os-support-ai · session_01WGufzibcN9oHa8kDbTTnL5
Landed · 2026-11-04T11:35Z · PR #30044 merged through the queue as
fbbbaeef. ACCEPT 6628349049.pm:dispatchedis removed with the close.os package installnow prints each connector map the package export withheld (connector 'NAME' PATH), with the remedy, in every install mode. An answer without the list prints nothing new, and the exit code is unchanged.@objectstack/clipatch.