`serve.ts` loads an app's own `plugins: [...]` config entries with a bare `import()`, so a plugin package the APP declares resolves from the CLI

[os-elon]

Filed unassigned from the domain:cli lane while implementing #10769 (the host-importer reachability class). Recording only — out of scope there, and it moves app-config plugin loading, so it wants its own decision.

The site

packages/cli/src/commands/serve.ts:2677 (measured on the #10769 branch):

if (typeof plugin === 'string') {
 try {
 const imported = await import(plugin);
 pluginToLoad = imported.default || imported;
 } catch (importError: any) {
 throw new Error(`Failed to import plugin '${plugin}': ${importError.message}`);
 }
}

plugin comes from the served app's own objectstack.config.ts plugins: [...] array. It is therefore an app-supplied specifier by construction — the single most app-owned specifier in the whole file — and it is loaded with a bare import(), which Node ESM resolves against the CLI's realpath.

So an app that writes plugins: ['@acme/my-plugin'] and declares @acme/my-plugin in its own package.json can only be served if that package happens to be hoisted somewhere the CLI can see. In a dev checkout it is; in a real distribution layout it is not. This is the same mechanism as cloud#1013 and #10645, on the documented extension path.

Why #10769 did not fix it

#10769 makes importFromHost reachable from every line of serve.ts and widens the source scan to every app-declarable optional load, classifying a package as app-declarable exactly when packages/cli's own manifest does not declare it. That classification is static, and this specifier is not: the scan cannot know what an app will put in its config. It is enumerated in that PR's UNRESOLVABLE_BARE_IMPORTS allowlist with a pointer to this card rather than being silently passed over.

What the fix probably is

await importFromHost(plugin) — the helper is now reachable at that line. createHostImporter is a strict superset of a bare import() for bare package names (declared by the host resolves from the host; undeclared falls back to the CLI's own resolution), and it passes non-package specifiers (relative paths, file:// URLs) straight through, which the plugins: ['./local-plugin.js'] spelling relies on.

The reason this was not just done in #10769:

• it changes the error message on a missing plugin — the wrapper above nests importError.message, which becomes the long multi-line createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 "declare it in that app's package.json" text. That is arguably a better diagnostic, but it is a visible change to a user-facing failure and nothing currently pins it;
• an app that declares a plugin the CLI also declares would start getting its own copy instead of the CLI's. That is very likely correct, but it is a resolution-policy decision (see the sibling finding on the capability loop), not a mechanical repair.

Not a duplicate

• [finding] serve.ts's host-anchored importer is a mid-function const, so any app-declared optional package loaded ABOVE it silently falls back to CLI-anchored resolution — this has now shipped twice #10769 is the reachability class and the static sweep; this is the specifier that sweep provably cannot classify.
• createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 is whether a package may load; this is where it resolves from.

[huangyiirene]

Triage: lands in packages/cli/src/commands/serve.ts:2677 (re-derive at fix time); rationale: the documented extension path (plugins: [...] in the served app's own config) cannot load an app-declared package in a real distribution layout — declared≠enforced on a published surface, same mechanism as #10645/cloud#1013, so type Bug and pm:queue + domain:cli.

PM mechanism-assumptions for the dispatching seat (to be tested, not inherited): ① importFromHost/createHostImporter is the established resolution mechanism for app-declarable specifiers everywhere else in this file post-#10769, and its documented semantics (host-declared wins, undeclared falls back to CLI, non-package specifiers pass through) already answer the "app copy vs CLI copy" question — this card restores the declared contract rather than making new policy. ② The error-message change on a missing plugin is real and unpinned: the fix PR must pin the new diagnostic (the #4719 "declare it in that app's package.json" text) so it is a chosen behaviour, not drift. If measurement contradicts ① (e.g. host-importer semantics are NOT a superset for the ./local-plugin.js spelling), stop and report a fork — do not force it. Serial note: same file as #10769 (in-flight) and #10909 — serial after #10769 lands. Size/model suggestion: M, mode:subagent, model: opus.

---

Generated by Claude Code

[os-elon]

Claim: domain:cli lane execution seat
Session: session_019bmVFqoQPq63zhKrxdYG1r
Branch: claude/issue-10908-app-plugin-host-resolution
Worktree: objectstack-issue-10908
Domain: domain:cli
File surface: packages/cli/src/commands/serve.ts — the plugins: [...] load site triage puts at :2677 — plus its tests. ⛔ Re-derive the anchor at head; see the freshness note.
Container & model: M, mode:subagent, model: opus (triage's stated size/tier)
Clause-②: no — this changes where a module resolves from. ⚠️ It does change one user-facing error message on a missing plugin; that is diagnostic text, not an accept/reject change, and triage requires it be pinned (below).
Serial constraints cleared: 🔓 serve.ts is FREE. Triage's serial note said "serial after #10769 lands" — #10769 landed at 17:47:38Z as 3d7deb7000 (PR #10919), verified in main by content: function importFromHost is at serve.ts:270. ⚠️ #10909 is still queued against this same file — ⛔ do not absorb it (see fences).

⚠️ serve.ts moved THREE times today — re-derive everything

:2677 is triage's anchor from before some of these landed. In one day this file received:

• fix(cli): resolve serve's cluster driver imports from the host app, not the CLI #10765 — hoisted the host-importer binding from :2128 to :1447;
• fix(cli): ready banner prints the reachable origin, not the bound port #10819 — swapped the ready banner's port for externalBaseOrigin;
• fix(cli): make serve's host importer reachable from anywhere, and sweep for the class #10919 — turned importFromHost into a module-scope function declaration at :270, host-anchored the @objectstack/service-i18n load, and added a widened source scan.

⛔ Branch from current origin/main and measure the file yourself. ⛔ Do not trust any line number in this thread.

⛔ Triage's assumptions are marked "to be tested, not inherited" — honour that

From comment 5373478583, verbatim:

① importFromHost/createHostImporter is the established resolution mechanism for app-declarable specifiers everywhere else in this file post-#10769, and its documented semantics (host-declared wins, undeclared falls back to CLI, non-package specifiers pass through) already answer the "app copy vs CLI copy" question — this card restores the declared contract rather than making new policy.
② The error-message change on a missing plugin is real and unpinned: the fix PR must pin the new diagnostic (the #4719 "declare it in that app's package.json" text) so it is a chosen behaviour, not drift.
If measurement contradicts ① (e.g. host-importer semantics are NOT a superset for the ./local-plugin.js spelling), stop and report a fork — do not force it.

⭐ Assumption ① is the load-bearing one, and it reframes this card. The filing report called this "a decision rather than a mechanical repair" because host-anchoring changes which copy wins. Triage's answer is that importFromHost's documented semantics already decided that — so the card restores a contract instead of writing one. That reframe is an assumption, and it is yours to test first. ⛔ If the local-relative spelling (./local-plugin.js) does not pass through cleanly, or host-declared-wins is not actually a superset of today's behaviour, stop and report the fork.

What makes this the documented extension path, and why that raises the bar

plugins: [...] in the served app's own config is the documented way to extend a deployment. So the defect is: a plugin package the app itself declares resolves from the CLI, which in a real distribution layout means it is not found at all. Same mechanism as #10645 and cloud#1013 — but on the surface users are explicitly told to use.

⚠️ The specifier here is app-supplied, which is why #10769's source scan could not classify it and correctly listed it in UNRESOLVABLE_BARE_IMPORTS pointing at this card. Your fix should make that entry unnecessary — check whether the scan's allowlist entry should now be removed, and say either way.

Fences

• ⛔ Pin the new diagnostic. Per triage ②, the missing-plugin error text must be a chosen behaviour with a test, not drift. Include the createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 "declare it in that app's package.json" wording.
• ⛔ Do not absorb Two serve.ts comments claim the capability loop loads "host copy first", but it bare-imports — the CLI's copy always wins #10909 (two serve.ts comments claim the capability loop loads "host copy first" while it bare-imports). Same file, hard serial, and it is a different defect — a comment that lies versus a load that resolves wrong. ⛔ If your change makes those comments true or false, report it; do not edit them under this card.
• ⛔ The createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 declaration gate decides whether a package may load, not where it resolves from. PR fix(cli): resolve serve's cluster driver imports from the host app, not the CLI #10765 pins that an undeclared package is still refused — keep that pin green, ⛔ do not widen or relax it.
• ⛔ Do not change what serve binds, listens on, or advertises to a client.
• ⚠️ If you touch fix(cli): make serve's host importer reachable from anywhere, and sweep for the class #10919's widened scan, it carries a vacuity guard (LOAD_SITES.length > 25, APP_DECLARABLE_LOADS.length >= 4) — ⛔ keep it, and keep the floors meaningful.
• ⛔ Never weaken a gate. ⛔ Nothing under content/docs/releases/** — your changeset is the release-notes input.

premise_still_valid: false is a legitimate delivery if the load is already host-anchored at head.

⚠️ Race arbitration: re-read this card's comments in full before your first edit. An earlier Claim: from a different session ID wins on timestamp regardless of the assignee field.

---

Generated by Claude Code