quickstart.mdx sample `os start` output does not match what CLI 17.0.0 prints, and the plugin count is wrong

[os-zhuang]

Restart-when: npm view @objectstack/cli dist-tags reports a latest newer than 17.0.0 (the release carrying objectstack-ai/objectstack#9736)

(PM state, repo:objectos seat 2026-08-19: items 1, 3 and 4 below and half of item 2 landed via PR #140 (ce018b6). The residue is Path B's banner, unmeasurable until a fixed CLI publishes — hence the executable restart criterion above. Reasoning and the hold justification are in the ACCEPT comment; objectos#141 tracks this alongside the two other publish-time triggers on this page. Body otherwise unchanged from the filer, and its line numbers are pre-#140.)

Found while working #88 (the probe-URL row in the same page). Different defect class from #88, so filed rather than folded in.

Measured, not inferred

I installed @objectstack/cli@17.0.0 — the exact package quickstart.mdx tells a reader to install — and booted it with os start --port 3877 --home ... on a clean home. The real readiness banner:

 ✓ Server is ready

 ➜ API: http://localhost:3877/
 ➜ Console: http://localhost:3877/_console/
 ➜ MCP: http://localhost:3877/api/v1/mcp
 connect an AI client (Claude Code, Cursor, …) · skill: http://localhost:3877/api/v1/mcp/skill

 Config: objectstack.config.ts
 Mode: production
 Driver: SqlDriver(better-sqlite3) → .../home/data/objectstack.db
 Tenancy: single
 Plugins: 30 loaded

What the page says instead

1. quickstart.mdx:39-49 — the Path A sample block prints Console: twice (once with an extra space after the colon), prints an Account: line the real CLI does not print, and has no MCP: line. It also says Plugins: 23 loaded; the measured count on an empty kernel is 30.
2. quickstart.mdx:137-145 — the Path B (pnpm dev) sample block carries the same duplicated Console: pair.
3. quickstart.mdx:57-62 — the "What's running" table lists http://localhost:3000/_console/ on two separate rows, with different descriptions ("The admin UI — and the app marketplace" / "Users, roles, audit log, settings").
4. quickstart.mdx:214-216 — the out-of-the-box plugin list says "these 23 plugins" and names Console UI twice inside the blockquote.

The duplicated pairs in 1-4 look like one underlying edit: two rows that used to name two different surfaces were collapsed onto the same name/URL and neither was dropped.

Not covered by an existing card

• Retire "Console" as the name of the end-user surface; keep a name only for the admin surface (Setup) #79 (retire "Console" as the end-user surface name) explicitly puts CLI output samples and /_console URLs in its category 3 — these stay. A duplicated sample line survives that rename as a duplicate, so Retire "Console" as the name of the end-user surface; keep a name only for the admin surface (Setup) #79 does not fix this.
• Align the docs with framework 17.0 — the pages still describe the 16.x contract #78 (the 17.0 alignment) is closed and did not touch these blocks.

Not measured

I did not probe http://localhost:3000/_account/register, the table's first row. The real boot printing no Account: line is a reason to check whether that row is still reachable, but it is a question here, not a claim.

Suggested shape

The two sample blocks should be transcribed from a real boot rather than hand-corrected, since the MCP line and the plugin count both moved. The plugin count is the kind of number that goes stale silently — consider whether the page needs an exact count at all.

---

Generated by Claude Code

[os-support-ai]

Triage: promoted to pm:queue. Scope per the card's suggested shape: transcribe both sample blocks from a real @objectstack/cli@17.0.0 boot (the card already contains a measured transcript to work from), dedupe the two Console: rows in the :57-62 table, and fix the :214-216 blockquote. On the plugin count: prefer wording that does not carry an exact number (the card is right that it goes stale silently); if a number is kept it must be the measured one with the CLI version pinned beside it. The unprobed _account/register row is a question, not a claim — verify it during the fix and report, don't assume either way.

Serial constraint (for the claiming seat): #79 (Console retirement) is pm:dispatched and will very likely touch quickstart.mdx — its category 3 keeps CLI output lines, but the files overlap. Claim this after #79's PR lands, or declare the surface intersection in the claim comment and coordinate.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 8
Session: session_01CJPxtTxoxTUnjNdTbiEaRa
Branch: claude/issue-94-quickstart-cli-output
Worktree: objectos-issue-94
Domain: domain:devx. Dispatched autonomously, 原话: 「你自主派发」.
File surface: content/docs/quickstart.mdx (English only)
Container & model: M, mode:subagent, model: opus
Clause-②: no
Serial constraints cleared: the #79 constraint triage flagged is discharged — #79 landed as 96a077c. Batch siblings #96 (faq.mdx), #99 (configure/data-sources.mdx), #101 (marketplace.mdx, field-types.mdx, reference/cli.mdx) — disjoint. ⚠️ #101 explicitly leaves this page's five in-fence occurrences to this card; do not expect it to touch them.

All three items re-verified on post-#79 main (96a077c)

#79 rewrote the descriptions in the "What's running" table, so the card's quotes are stale even though its findings are not:

• Item 1/2 stand unchanged — the banner still prints Console: twice, an Account: line, no MCP: line, Plugins: 23 loaded.
• Item 3 stands, and is now sharper. The two rows still carry the same /_console/ URL, but Retire "Console" as the name of the end-user surface; keep a name only for the admin surface (Setup) #79 gave them genuinely different descriptions: "The generated UI — and the app marketplace" and "Setup — users, roles, audit log, settings". So the duplication is no longer two identical rows; it is two distinct surfaces sharing one URL, which is the same defect glossary.mdx defines Console twice, and each entry says it is "Distinct from Console" #89 found in the glossary.

That last point matters for the fix: #89 established from objectstack source that there is one UI at /_console/ and Setup lives at /apps/setup inside it. Whoever fixes this table should decide whether the Setup row gets the deeper path or is folded into the UI row — and should read #89's resolution and the landed glossary entry before choosing, so the two pages agree.

One instruction beyond the card

⛔ Transcribe from a boot you run yourself. The card contains a measured transcript and triage says it can be worked from; I am overriding that. Today a ruling of mine was wrong because I read a route registration instead of measuring the wire path (#88), and the only thing that caught it was a dev installing the CLI and curling. A transcript copied from another card is second-hand evidence for a card whose entire subject is "the sample does not match reality".

The plugin count

Triage's guidance stands and I agree: prefer wording that carries no exact number. If a number survives it must be the measured one with the CLI version pinned beside it — otherwise this card gets re-filed the next time a plugin is added.

The unprobed row

http://localhost:3000/_account/register is the table's first row and the card explicitly did not probe it. The real boot printing no Account: line is a reason to check, not a conclusion. Probe it and report what you get — if it 404s, that is a finding bigger than this card and should stop you rather than be fixed in passing.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 94,
 "status": "needs_decision",
 "branch": "claude/issue-94-quickstart-cli-output",
 "pr": null,
 "premise_still_valid": true,
 "summary": "All four defects the card names are confirmed against a boot I ran myself (裁决 1): CLI 17.0.0, clean home, `os start --port 3877`. The real readiness banner prints ONE `Console:` line, an `MCP:` line, NO `Account:` line, and `Plugins: 30 loaded` followed by a 30-name plugin list the card's transcript did not include. But I stopped short of editing, because 裁决 3's probe came back 404 and a second, independent blocker turned up. (1) `http://localhost:3877/_account/register` returns `{\"error\":\"Not found\"}` — and so does `/_account/login`, `/_account/`, every `/_account/*`. This is not a bug: under ADR-0048 the platform apps moved into one-app packages, `serve.ts` registers `@objectstack/account` via `createAccountAppPlugin` as a kernel plugin, its dist ships no static assets, and the shipped console bundle contains ZERO `/_account/` strings (the old redirect-to-`/_account/login` is gone). The `/_account/` HTTP surface has been RETIRED; sign-in and registration are now in-console routes (`/login`, `/register` are literal route strings in the bundle). That decides the table's first row, and it also falsifies three files outside my scope — `index.mdx:52`, `build/marketplace.mdx:90`, `resources/glossary.mdx:206` (the `Surface` entry that just landed via #100). Per 裁决 3 I stopped rather than fix it in passing. (2) Path B cannot be transcribed at all: `npx @objectstack/cli@17.0.0 init my-app -t app --install` then `npm run dev` FAILS TO COMPILE — the template's own `my_app_item` declares no `sharingModel` and trips the CLI's own `security-owd-unset` author-time rule. No dev server, no banner. `latest` on npm IS 17.0.0, so a reader following the page verbatim hits this. Filed as objectstack#9666. Net: item 1's banner is fully measured and ready to write; item 2 is unmeasurable until the scaffold is fixed; items 3 and 4 hinge on the `/_account/` ruling. Editing only item 1 would ship a page whose Path A banner is correct while the table one screen below still sends readers to a 404 and the blockquote still double-names Console UI — so no PR. The pushed branch carries zero commits; content/docs/quickstart.mdx is untouched.",
 "tests": "No turbo task was run and no verification is claimed: I modified zero files, so `type-check`/`build`/the three translation checks would have been a green run of `origin/main` reported as if it were mine. Evidence gathered instead, all first-hand:\n\n(a) PATH A BOOT — `@objectstack/cli@17.0.0` installed into a scratch dir (`node -p require(...).version` -> `17.0.0`), booted `os start --port 3877 --home ...` on a clean home. Real readiness banner, verbatim:\n\n ✓ Server is ready\n\n ➜ API: http://localhost:3877/\n ➜ Console: http://localhost:3877/_console/\n ➜ MCP: http://localhost:3877/api/v1/mcp\n connect an AI client (Claude Code, Cursor, …) · skill: http://localhost:3877/api/v1/mcp/skill\n\n Config: objectstack.config.ts\n Mode: production\n Driver: SqlDriver(better-sqlite3) → .../clean-home/data/objectstack.db\n Tenancy: single\n Plugins: 30 loaded\n HonoServer, Marketplace, PlatformObjects, Auth, @objectstack/setup, @objectstack/account, Security, Audit, com.objectstack.runtime.default-datasource, com.objectstack.metadata, ObjectQL, empty, RestAPI, Dispatcher, MCPServerPlugin, QueueServicePlugin, JobServicePlugin, CacheServicePlugin, SettingsServicePlugin, EmailServicePlugin, StorageServicePlugin, SmsServicePlugin, SharingServicePlugin, MessagingServicePlugin, AnalyticsServicePlugin, ExternalDatasourceServicePlugin, ExternalValidationPlugin, DatasourceAdminServicePlugin, DatasourceAdminRoutes, ConsoleUI\n\nNote the header block above it also prints `🎯 Environment: env_local` and a `🖥️ Console:` line the page's sample lacks entirely. Exactly ONE ConsoleUI in the loaded list — confirming item 4's double-naming is a doc defect, not a real pair.\n\n(b) HTTP PROBES on that server — `404 /_account/register`, `404 /_account/`, `404 /_account/login`, `404 /_account/sign-in`, `404 /account/register`; `200 /_console/`, `200 /api/v1/health`, `200 /api/v1/ready`, `401 /api/v1/mcp`, `302 /` -> `location: /_console/`. Body of the 404 is `{\"error\":\"Not found\"}` (the API's JSON handler, not an HTML page).\n\n(c) CONTROL FOR (b) — `/_console/zzz-nonexistent-garbage` also returns 200. So `/_console/` 200s are SPA fallback and prove nothing about a specific path; the `/_account/` 404s are meaningful precisely because they are NOT caught by any fallback.\n\n(d) SOURCE CORROBORATION (read-only, `git -C /home/user/objectstack show origin/main:...`) — `packages/cli/src/commands/serve.ts:2230` comments \"ADR-0048 — the platform apps (Setup/Account) moved out of plugin-auth's manifest into their own one-app packages\" and loads `['@objectstack/account','createAccountAppPlugin']`. There is no static mount and no `AccountUI` symbol anywhere in `packages/`. `packages/cli/CHANGELOG.md:23524` records the OLD bug with this same symptom being fixed (`/_account/login` -> 200); that mount is now gone again, deliberately.\n\n(e) SHIPPED-BUNDLE GREP — `@objectstack/console/dist` contains zero `_account/login` or `_account/register` occurrences, and does contain the literal route strings `\"/login\"`, `\"/register\"`, and the pattern `apps/:appName`.\n\n(f) PATH B — `init` exits 0 and prints `✓ Scaffold validated (namespace: my_app)`, then `npm run dev` (which runs `objectstack dev`) dies at `→ Running author-time rules (40)...` with `✗ Author-time rules failed (1 issue) • object \"my_app_item\": ... declares no sharingModel (OWD) ... rule: security-owd-unset at objects[0].sharingModel` / `✗ Compile failed — fix errors above before starting dev server`. `npm view @objectstack/cli dist-tags` -> `{\"latest\":\"17.0.0\",\"rc\":\"17.0.0-rc.6\"}`.\n\nTeardown: server killed by process-group id (PGID 1085, never by name); ports 3877/3000/3002 confirmed dead; both scratch installs and the clean home deleted; worktree removed without --force from a clean tree with 0 commits.",
 "open_questions": [
 {
 "question": "The `/_account/` HTTP surface no longer exists in CLI 17.0.0 — it was retired into the console SPA under ADR-0048, not broken. This is the 裁决-3 finding and it is bigger than this card: it falsifies the quickstart table's first row (my scope) AND three files outside it — `content/docs/index.mdx:52` (the surface table, `**Account** (`/_account/`)`), `content/docs/build/marketplace.mdx:90` (\"register one at `/_account/register`\", a page #101 is editing right now), and `content/docs/resources/glossary.mdx:206` (the `Surface` entry that #100 landed hours ago, still naming `/_account/` as one of the HTTP entry points). It also makes this page's line 13 — \"Both produce a running server with the UI + Account\" — false, and puts the blockquote's \"Account UI\" plugin name in question (the package IS loaded; only its HTTP surface is gone). How should this be handled?",
 "options": [
 "A — Escalate as its own corpus-wide card and hold #94 until it lands. One authoritative ruling on what replaces `/_account/*` is applied to all four files at once; #94 then becomes the pure copy-fix it was filed as. Cost: #94 waits.",
 "B — Widen #94's scope to all four files and let me fix them together. Cost: collides with #101, which owns `marketplace.mdx` this round, and re-opens `glossary.mdx` one round after #100 closed it.",
 "C — Keep #94 at its filed scope, rule only on the quickstart table's first row now, and file the other three separately. Cost: the corpus carries two different stories about `/_account/` until the follow-up lands.",
 "D — Fold the first row away silently as part of the dedupe. Rejected: this is exactly the 'fixed in passing' that 裁决 3 forbids, and it would leave `index.mdx` and `glossary.mdx` asserting a surface that does not exist."
 ],
 "recommendation": "A. On REAL BUSINESS NEED: the concrete user-visible harm is a reader being sent to a 404 on their first five minutes with the product, and that harm is identical on all four pages — fixing one is not meaningfully better than fixing none. On LONG-TERM SOUNDNESS: `/_account/` is a URL contract that changed upstream; the docs' job is to track the contract, and the contract-first fix is one ruling on 'what is the account surface now', applied everywhere, rather than four independent guesses. #89/#100 just demonstrated the cost of the alternative — a rename that fixed the word in one place left the URL wrong in another, and that is the same shape again. On HARD TO GET WRONG: a single ruling recorded once (glossary `Surface` entry) that every other page cites is the structure that keeps the next agent from re-deriving it from whichever page they happen to open — which is precisely how the two contradictory glossary sentences in #89 came to exist. B is tempting for throughput but knowingly collides with an in-flight sibling; C institutionalises the inconsistency this corpus keeps paying for."
 },
 {
 "question": "For the table's duplicate `/_console/` rows (item 3), does the Setup row take the deeper path or fold into the UI row? I have the evidence but did not act on it, since the table cannot be edited until the `/_account/` question above is settled.",
 "options": [
 "A — Give Setup the deeper path `http://localhost:3000/_console/apps/setup`. Confirmable, and it agrees with the glossary entry #100 landed ('at `/apps/setup` inside the UI served at `/_console/`').",
 "B — Fold the two rows into one UI row and drop the separate Setup row, mentioning Setup in the description."
 ],
 "recommendation": "A, with one caveat stated plainly. The dispatch's bar was 'confirmable from source or from a running server, else fold'. It IS confirmable, but NOT by the probe that looks like it confirms it: `/_console/apps/setup` returns 200, and so does `/_console/zzz-nonexistent-garbage`, so the 200 is SPA fallback and worthless as evidence. The real confirmation is that the shipped console bundle carries the literal route pattern `apps/:appName`, and the landed glossary independently states `/apps/setup`. Those two agree, and A makes this page agree with the glossary rather than quietly diverging from it — which was the whole point of being told to read #89 first. If the maintainer wants a stricter bar than 'route pattern in the bundle', B is safe and loses little."
 },
 {
 "question": "The plugin count (裁决 2). My boot measured `Plugins: 30 loaded` on CLI 17.0.0 with an empty kernel. 裁决 2 prefers wording carrying no exact number; if one survives it must be measured with the CLI version pinned beside it. Which does the maintainer want for the `What's loaded out of the box` blockquote?",
 "options": [
 "A — No number at all: 'Either path gives you these plugins automatically', then the name list. Cannot go stale.",
 "B — Number pinned to the version: 'Either path gives you these plugins automatically — 30 on CLI 17.0.0', then the list.",
 "C — Keep a bare count. Rejected by 裁决 2 and by this card's own existence."
 ],
 "recommendation": "A. On REAL BUSINESS NEED: no reader decision depends on the count being 30 rather than 23 — the list of what they get is the useful part, and the number is decoration that this card proves carries a maintenance cost. On LONG-TERM SOUNDNESS: 30 is measured on an EMPTY kernel; the moment the reader installs an app from the marketplace it is wrong for them too, so even a correctly-pinned number is only true of a state the reader leaves immediately. On HARD TO GET WRONG: a number with a version pin (B) still invites the next editor to update the number and forget the pin, which is a silent falsehood; removing the number removes the failure mode instead of documenting it. Note that whichever is chosen, the blockquote's name list needs rewriting from the measured list regardless — it currently names `Console UI` twice while the real boot loads exactly one `ConsoleUI`, and it omits the MCP, SMS, Sharing, Messaging, Analytics and datasource plugins the boot actually loads."
 }
 ],
 "out_of_scope_findings": [
 "filed as objectstack-ai/objectstack#9666: `os init -t app` scaffold does not compile on CLI 17.0.0 — the template's own `my_app_item` declares no `sharingModel` and trips the CLI's own `security-owd-unset` author-time rule, so quickstart Path B never reaches a dev server. Includes the secondary point that `init` prints `✓ Scaffold validated` for a scaffold the next command rejects.",
 "NOT filed, reported here for the PM to shape (裁决 3 said stop and report, not file): the `/_account/` retirement falsifies `content/docs/index.mdx:52`, `content/docs/build/marketplace.mdx:90` and `content/docs/resources/glossary.mdx:206`. `marketplace.mdx` is #101's this round and `glossary.mdx` was closed by #100 hours ago, so this needs the PM's routing rather than a card from me.",
 "observation, not filed: `os init` prints `Next steps: npx objectstack validate / dev / generate` while quickstart Path B tells the reader to run `pnpm dev`. Both work (the scaffold's `dev` script is `objectstack dev`), so this is cosmetic drift, not a defect — noting it only because it sits inside the block item 2 will rewrite."
 ]
}

---

Generated by Claude Code