ObjectChart's option-color / dimension-label probe reads the global fetch, bypassing the host's apiFetch channel #4114

Found while stopping the plugin-charts network escapes in #4106 (PR pending). Filing rather than fixing: #4106 is a test-hygiene card and its discipline is explicit that product code stays untouched unless a bug is found, in which case it gets reported with its own premise verification.

The defect

ObjectChart's category option-color effect makes two metadata reads off the global fetch:

• packages/plugin-charts/src/ObjectChart.tsx:344 — GET /api/v1/meta/dataset/{dataset}
• packages/plugin-charts/src/ObjectChart.tsx:352 — GET /api/v1/meta/object/{objectName}

Both are bare await fetch(...) calls. Neither consults SchemaRendererContext.apiFetch, which is this repo's channel for host-authenticated API reads.

Why that is a bug, not a style choice

The convention is established and documented elsewhere in the same codebase:

• packages/plugin-detail/src/useRecordEditable.ts:32 states it outright — the read must go through "apiFetch, the same channel provider: 'api' view sources use), not the bare" global — and line 74 implements const doFetch = apiFetch ?? fetch;.
• packages/plugin-gantt/src/ObjectGantt.tsx:461-468 does the same for its data source.
• packages/react/src/hooks/useViewData.ts:100-107 likewise.
• packages/app-shell/src/console/ConsoleShell.tsx:245 is the host that supplies it: SchemaRendererProvider dataSource={adapter} apiFetch={apiProviderFetch}.

ObjectChart already reads the context — const context = useContext(SchemaRendererContext); at line 253 — so the injection point is in scope. The effect just does not use it.

Consequence in a hosted console: these two reads skip whatever apiProviderFetch supplies (auth headers, base URL / proxy target, draft-preview query params). The effect is best-effort and swallows every failure, so the visible symptom is not an error — it is semantic option colors and dataset dimension labels silently never applying, with the chart quietly falling back to the positional theme palette and raw stored values.

Premise verification

Not inferred from reading. Instrumenting fetch under the test suites showed these two call sites emitting live requests to the default origin, and packages/plugin-charts/src/ObjectChart.elementDataSource.test.tsx is a demonstration case: it mounts a real SchemaRendererProvider, and the probe still leaves the process instead of being routed by the host. The host being present changes nothing, because the component never asks the context.

Note the sibling implementation in plugin-dashboard (DatasetWidget) resolves the same /api/v1/meta/object/... document for the same purpose, so whichever way this is resolved should probably cover both.

Suggested direction (not a ruling)

Mirror useRecordEditable: const doFetch = context?.apiFetch ?? fetch; — preserving the documented standalone-embed fallback to the global fetch while letting a host intercept. That is a product contract change though, so it wants a maintainer call rather than a silent edit inside a hygiene PR.

Filed unassigned for triage.

Generated by Claude Code