DevPlugin 的 bare catch 把任何 driver 构造失败都报成「not installed」(#6915 实测)

[huangyiirene]

一句话说明

packages/plugins/plugin-dev/src/dev-plugin.ts:311-327 用一个无绑定的 catch {} 包住整个 driver 装配段,于是 driver 构造期抛出的任何错误都被吞掉,并统一报成同一句话:

✘ @objectstack/runtime or @objectstack/driver-memory not installed — skipping driver

这句话在包确实缺失时是对的;在包装好了、但构造函数按设计拒绝启动时,它把操作者指向一个完全不存在的问题。

实测(#6915 分支 eb1ad94,真跑 DevPlugin.init())

driver-memory 的 #6915 租户闸在构造函数里拒绝多租户姿态。在 OS_TENANCY_POSTURE=isolated 下真实运行:

CONSTRUCTOR throws, code = MEMORY_MULTI_TENANT_UNSUPPORTED
WARN ✘ @objectstack/runtime or @objectstack/driver-memory not installed — skipping driver

那条错误消息本身写得很完整 —— 它点名了检测到的姿态、产生该姿态的两个 env 旋钮、以及 @objectstack/driver-sql(含 :memory: 的就地替代)作为出路。这些一个字都没到操作者眼前。

为什么这不是「只是日志措辞」

本次 isolated 场景里,DevPlugin 的 init 最终仍然拒绝了 —— 但那是后面的 ADR-0093 D5 organizations fail-fast 干的,和 driver 无关。也就是说:

• 企业版 @objectstack/organizations 缺席时:D5 兜住了,栈没起来,只是死因被归错。
• 企业版装好且健康时:D5 放行,于是栈照常起来,只是没有 data driver,而唯一的线索是一句说包没装的假话。第一个查询才会炸,炸点离真因十万八千里。

这正是 Prime Directive #10 的形状:一个真实的、写得很好的拒绝理由,被一个 catch-all 降级成了一句不实的诊断。

建议(未定,留给分诊)

catch 绑定住错误,区分「模块解析失败」和「其它」:前者保留现在这句;后者把原始错误(至少 code + message)透出来。是否应当重抛——即一个明确拒绝启动的 driver 是否应该让 DevPlugin 也拒绝启动——是个产品形状问题,本卡不替谁作决定。

mongodb-tenancy-guard.ts(#3724)有同样的暴露面,只是 DevPlugin 从不构造 MongoDB driver,所以从未被触发过。

关联

• driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离 #6915 / PR feat(driver-memory)!: refuse to boot into a multi-tenant deployment (#6915) #7924 —— 发现处;driver-memory 启动期租户闸(处置 B)
• driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 —— driver-mongodb 的同类闸门,同样的 typed error + code 形状
• ADR-0093 D5 —— 本次场景里实际兜住栈的那道闸

未认领,仅作记录。按 #6915 派发单第 4 条(「卡的定级是 S/M 且保持不变,相邻的东西另开卡」)单独开卡,不并入。

[huangyiirene]

Status update from the drivers seat — the exposure this card describes is now live, not theoretical. No claim on the card and no fix attempted here; it is outside this seat's file surface.

PR #7924 merged as 45d5bd2 (#6915, maintainer-ruled route B): InMemoryDriver's constructor now throws MemoryMultiTenantUnsupportedError when the deployment's tenancy posture is not single. That makes the swallowed-refusal path this card measured reachable in a shipped configuration rather than only under a hypothetical guard:

• dev-plugin.ts's bare catch {} around driver assembly discards a construction-time throw and reports ✘ @objectstack/runtime or @objectstack/driver-memory not installed — skipping driver.
• Everything the refusal was built to tell an operator — the detected posture, both env knobs (OS_TENANCY_POSTURE / OS_MULTI_ORG_ENABLED), and the @objectstack/driver-sql remedy including connection: { filename: ':memory:' } — is replaced by a claim that is false.
• In the run measured for driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离 #6915 the stack still refused overall, but via the later ADR-0093 D5 organizations fail-fast. With the enterprise package present and healthy, DevPlugin would boot driverless on that false message instead.

The measurement and stack trace are in #6915's dev report (comment 5262322254) if whoever picks this up wants them. Recording the state change so the card is not read as describing a latent risk when it now describes a live one; the grading and the fix shape remain the owning lane's call.

---

Generated by Claude Code

[hotlong]

Findings-round promotion: pm:queue, and re-routed domain:drivers → domain:cli (type Bug, bug kept) — first grading.

Lane rationale (anchoring rule): the fix lands in packages/plugins/plugin-dev/src/dev-plugin.ts:311-327 — plugin-dev is the cli lane. driver-memory needs no change, so the #5499 freeze does not apply. Reachability fired: PR #7924 merged, so InMemoryDriver's constructor now throws in any non-single tenancy posture and the bare catch's "not installed" message is a live falsehood to operators.

Premise re-verified on origin/main: the bare unbound catch { whose only act is the "not installed — skipping driver" warn is live at :325; the tenancy-guard throw (MEMORY_MULTI_TENANT_UNSUPPORTED, memory-tenancy-guard.ts:57) is pinned by test.

Dispatch scope, binding: the decision-free half only — bind the catch, distinguish ERR_MODULE_NOT_FOUND from a construction refusal, surface the original code + message. The same bare-catch shape recurs in the same function at :304 (objectql) and :337 (AppPlugin) — in scope. "Should DevPlugin refuse to start when a driver refuses" is a product-shape question and explicitly OUT of scope; a dev must not decide it inside this card.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code