Repository navigation
Setup small fixes: impersonation landing, account email lifetime, sender name, agent sets in pickers #30212
Description
epic:#26676#1 · zhuangjianguo · session_cdb7a717def74e719988f089fbaa18ff
From a real-user walkthrough of Setup, filed on the maintainer's word: 「以上都同意，立卡」 (2026-11-05). Measured on main b7075d9908, with the console in dev mode, unless a line says otherwise. Test app scaffolded with create-objectstack@18.3.0.
Items
| # | Observed | Suggestion |
|---|---|---|
| 1 | Impersonating from a Setup page lands the administrator on 「你没有访问此应用的权限」, because the impersonated user has no Setup access. The banner and ending it work well | Go to the home page |
| 2 | Accounts created by bulk import receive a set-password link valid for 60 minutes, while invitations last days. A new employee who reads the mail later has to ask the administrator | Align with the invitation lifetime (the seat suggests 48 hours) |
| 3 | The mail sender name defaults to ObjectStack while the subject and body use the configured product name |
Follow the brand name until one is set |
| 4 | The permission set picker on a person offers MCP AI 助手 sets | Hide agent sets when assigning to a person |
Row 2 changes how long a credential-setting link lives, so the dev should confirm the lifetime with the security seat rather than assume it.
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p3 ·
domain:ui·pm:queue· 2026-11-05T03:02Z⛔ Not a claim.
Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUR8Nu4M7tbtgES7q2
Claim: PM loop round 3 · 2026-11-05T12:20Z
Session:
session_01L6bhgUR8Nu4M7tbtgES7q2Account:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch: the card thread's designated
claude/project-thread-*branch, named in a claim amendment once the thread reports itWorktree:
objectstack-issue-30212Domain:
domain:uiSeat:
domain:ui#6File surface: row 1 (impersonation landing:
ui/packages/app-shell/src/layout/ImpersonationBanner.tsx/ the start-impersonation path inui/packages/app-shell/src/**) and row 4 (hide agent permission sets from the person-assignment picker inui/packages/app-shell/src/views/metadata-admin/**), their tests, one root.changeset/file. ⛔ row 2 (credential link lifetime: server and security seat, per the card's own note) and ⛔ row 3 (mail sender name,packages/plugins/plugin-email): name both as the remainder. ⛔packages/**. If row 4 needs a server filter to know which sets are agent sets, stop and report (stop on breach; explain in the report)Container & model:
M,mode:thread,model: default(dispatch-gates --tier: no path-derived mandate; floor sonnet · default opus · ceiling fable),effort: highClause-②: no (a new language-pack key, if a row needs one, is declared by the dev in the PR body and the seat re-reads this line at ACCEPT)
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6648518863
Premise: holds as filed on
b7075d99; the dev reproduces rows 1 and 4 onorigin/mainfirstSerial constraints cleared: none in flight on
ImpersonationBanner.tsxor the assignment picker (open PRs read 2026-11-05T12:18Z). No maintainer ruling beyond 「以上都同意，立卡」.objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUR8Nu4M7tbtgES7q2
席位核对 · Amendment · 2026-11-05T12:23Z · claim 6657842228 branch named
Branch:
claude/project-thread-cro7hiThe card thread's harness-designated branch (a project-thread platform exception to the
claude/issue-<n>-<slug>convention); the dev thread is sessionsession_01L6bhgUiuTxKJNYhUNmgKS6. Everything else in claim 6657842228 stands.objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUR8Nu4M7tbtgES7q2
席位核对 · Amendment 2 · 2026-11-05T12:27Z · claim 6657842228 file surface for row 4 corrected
File surface: claim 6657842228's surface, with row 4 relocated: the person-assignment picker is the
permission-refwidget of thesys_user_permission_setgrant form,ui/packages/fields/src/widgets/RegistryRefField.tsx(PermissionRefField) and its tests, which excludes the spec constantMCP_AGENT_PERMISSION_SETS(@objectstack/spec/ai) by the samenonGrantableNamesmechanismposition-refalready uses for audience anchors; row 1 lands inui/packages/app-shell/src/layout/ImpersonationBanner.tsx. ⛔packages/**unchanged (stop on breach; explain in the report)Why: the dev thread (session
session_01L6bhgUiuTxKJNYhUNmgKS6) located the picker outsideviews/metadata-admin/**; the fix reads an existing spec export, so no server filter and nopackages/**edit. Everything else in claim 6657842228 stands.objectstack-fleet commentedon Nov 5, 2026
domain:ui#6 · os-sales · session_01L6bhgUiuTxKJNYhUNmgKS6
os-dev-report
{ "issue": 30212, "status": "done", "branch": "claude/project-thread-cro7hi", "pr": "https://github.com/objectstack-ai/objectstack/pull/30482", "session": "session_01L6bhgUiuTxKJNYhUNmgKS6", "premise_still_valid": true, "summary": "Rows 1 and 4 shipped (ui/** only), Refs not Fixes. Row 1: ImpersonationBanner navigates to / (host navigate) when an ordinary held session becomes impersonated; RootLandingRedirect then resolves the impersonated user's landing. Boot-impersonated and stop do not move the page. Row 4: permission-ref (RegistryRefField nonGrantableNames) leaves the spec's MCP_AGENT_PERMISSION_SETS out of its options, stored agent set still shown; picker lives in ui/packages/fields (claim amended). Both rows reproduced live on main first. Remainder: row 2 (bulk-import set-password link lifetime 60 min; server lane, security seat to confirm the lifetime) and row 3 (mail sender name default ObjectStack, packages/plugins/plugin-email; server lane) are not shipped and stay on the card.", "tests": "Head 8b921e1c. pnpm --dir ui exec vitest run (ImpersonationBanner, RemediationOverlay.impersonation-13208, RegistryRefField.audienceAnchors-12200, RegistryRefField.registryName-7611, RegistryRefCell.readFace): 5 files, 49 tests passed. Positive control: source files restored to base c5800818 (markers counted 0), tests kept: 3 failed / 21 passed (the 3 new behaviour pins); restored with git checkout HEAD, git diff HEAD empty. No dist-resolved ablation needed (vitest aliases @object-ui/* to src). turbo run type-check --filter=@object-ui/fields --filter=@object-ui/app-shell: 69/69 successful. eslint --no-inline-config on the 4 files: 0 errors.", "gates": "dispatch-gates --commands: 35 derived, all run, each exit 0 captured before pipes (vitest run scripts/ SIGKILLed once by the container memory limit, re-run alone under the lock: exit 0, 170 files / 4985 tests). --ran: 35/35, 0 NOT-MEASURED, 0 UNRUN. ui: check:new-line-citations exit 0 (0 new), check:test-path-roots exit 0. check:spec-symbols NOT MEASURED: exit 1 on 22 stale-ALLOW entries in packages the diff does not touch, cause in this container not established; diff declares no new type. check:eager-closure NOT MEASURED (needs full console build). CI check-runs: in_progress at report time.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "5 — issue_read x2 (get, get_comments) on #30212; read-only", "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, run 42032277908); this os-dev-report comment (post-stamped). git push of the branch and of the never-merged evidence branch claude/project-thread-cro7hi-evidence are not REST writes.", "open_questions": [], "security_findings": "withheld", "out_of_scope_findings": [ "carrier: #30212 · rows 2 and 3 remain (server lane): row 2 credential link lifetime needs the security seat; row 3 packages/plugins/plugin-email sender name · noted, not filed" ] }14 remaining items
objectstack-fleet commentedon Nov 6, 2026
domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4
Row 2 routed to the maintainer · 2026-11-06T00:49Z
Rows 1, 3 and 4 have landed (PR #30548 and earlier). Only row 2 is left, and it is a ruling, not a build. Seat 5 asked security#1 on this card at 2026-11-05T16:39Z, and no answer is posted here. So
domain:server#4puts row 2 to the maintainer, offering three of the options above:D (a new spec key) and C (a global raise) are not offered. A security#1 comment here before the ruling is still read. State:
pm:queue→needs-user-decision. This seat records the ruling and dispatches from it.objectstack-fleet commentedon Nov 6, 2026
coordinator#1 · hotlong · session_6eb9ec2e0e3f410b91239dab7a337b9e
Ruling: #30212 row 2 · letter E · maintainer 「按推荐裁」 (2026-11-06, in the coordinator session) · 2026-11-06T01:36Z
What binds (
domain:server#4's option E, comment above):Rows 1, 3 and 4 have landed. With row 2 ruled,
needs-user-decision→pm:queue.🤖 Generated with Claude Code
objectstack-fleet commentedon Nov 6, 2026
domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4
Claim: PM loop round 1 (row 2, ruling E) · 2026-11-06T01:54Z
Session:
session_016WV4czvZykUqhYxYXSSDt4Account:
os-elon-musk(the seat's linked user asGET /useranswers it; the card's assignee)Branch: the card thread's designated
claude/project-thread-*branch, named in a claim amendment once the thread reports itWorktree:
objectstack-issue-30212Domain:
domain:serverSeat:
domain:server#4File surface: the
auth.account_invitationmail's last line inpackages/plugins/plugin-email/src/templates/auth-templates.ts, in all four locales (en, zh-CN, ja-JP, es-ES), HTML and text bodies; their tests;content/docs/**only for a sentence this PR makes false; one root.changeset/file. ⛔ the token lifetime (resetPasswordTokenExpiresIn),packages/spec/**,ui/**,packages/plugins/plugin-auth/**(stop on breach; explain in the report)Container & model:
S,mode:thread,model: default(dispatch-gates --tier: no path-derived mandate),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6674421054
Premise: ruling E (6674421054). The link keeps its 60-minute lifetime. The import mail's last line, which today reads
If the link has expired, contact {{inviter.name}}.(measured onmainby seat 5, 6663589807), is rewritten in all four locales: it points first at getting a new link through the sign-in page's forgot-password flow, which already works for an imported account (ResetPasswordPage.tsx), and then at the administrator. Rows 1, 3 and 4 have landed.Serial constraints cleared: no open PR touches
packages/plugins/plugin-email/src/templates/auth-templates.ts(the dev re-reads at branch start)objectstack-fleet commentedon Nov 6, 2026
domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4
Claim amendment · claim 6674750170 · 2026-11-06T02:05Z
Branch:
claude/project-thread-t0w5reDev session:
session_016WV4cyRC88C4E1MFT2bqMu(the card thread this seat opened; worktreeobjectstack-issue-30212)Everything else in claim 6674750170 stands.
objectstack-fleet commentedon Nov 6, 2026
domain:server#4 · os-elon-musk · session_016WV4cyRC88C4E1MFT2bqMu
os-dev-report
{ "issue": 30212, "status": "done", "branch": "claude/project-thread-t0w5re", "pr": "https://github.com/objectstack-ai/objectstack/pull/30779", "session": "session_016WV4cyRC88C4E1MFT2bqMu", "premise_still_valid": true, "summary": "Row 2 shipped under ruling E, Fixes. The auth.account_invitation mail (sent only by the identity import: auth-manager-auth-instance.ts ~L513, invitation branch; org invitations use auth.invitation, untouched) ends, in en-US/zh-CN/ja-JP/es-ES HTML and text bodies, by pointing an expired link at the sign-in page's forgot-password entry, named as the console labels it (auth.login.forgotPasswordText), with the account's own address (user.email, already declared), and only then at the administrator. Self-serve path measured by reading: expired link -> ResetPasswordPage.tsx with no token -> 'invalid or has expired' + 'Request a new link' -> /forgot-password; the import mints through requestPasswordReset, the same flow. Link lifetime, plugin-auth, spec, ui untouched.", "tests": "Head bc6db17e. New describe in auth-account-invitation-template.test.ts: red on origin/main b3098661 (4 failed / 28 passed), green on head. builtin-auth-render-identity.test.ts: 8 account_invitation body digests re-pinned from the registry render, subjects and other rows unchanged. pnpm --filter @objectstack/plugin-email test + typecheck under the lock: VERDICT command-exit 0, 48 files / 809 tests, check:test-typecheck OK. eslint --no-inline-config on the 3 changed source files: 0 errors. No ablation beyond the red-on-main run (template text only).", "gates": "dispatch-gates --commands at bc6db17e: 58 derived, each exit captured to a file before any pipe; --ran: 57 run exit 0, 1 NOT MEASURED (pnpm check:dual-build-cjs-loads exit 3, PREREQUISITE NOT MET, needs every package built; left to CI). check-commit-card-trailers --range origin/main..HEAD OK. CI check-runs: pending at report time.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "0", "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, run 42150866141, read-back identical 5341 bytes, no assignees); this os-dev-report comment (post-stamped). git push of the branch is not a REST write.", "open_questions": [], "security_findings": "withheld", "out_of_scope_findings": [] }Report taken 2026-11-06T02:32Z.
objectstack-fleet commentedon Nov 6, 2026
domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4
Landing record · 2026-11-06T03:36Z · PR #30779 merged through the queue as
ea757ff4f(ACCEPT 6675654975 on headbc6db17e). Row 2 ruling E (6674421054) has landed: the import mail's last line points first at getting a new link, and the 60-minute lifetime is unchanged. Rows 1, 3 and 4 had already landed. Card closed completed byFixes;pm:dispatchedremoved in this stroke.