objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

Description

@yinlianghui

Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

Fact

In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

if (s.startsWith('[') && s.endsWith(']')) {
try {
const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
return JSON.parse(json);
} catch {
return []; // <- any unparseable element collapses the whole set
}
}

An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

ctx = { data: { type: 'text', a: 'text' } }
data.type in [data.a] -> false // both sides hold 'text'
console.warn calls -> 0

Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

Why observation-class (label finding, no pm:queue)

No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

Possible directions (not deciding here)

Dedup

Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


Generated by Claude Code

Metadata

Metadata

Assignees

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
    }
    } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
    })();
    (function(){
    try {
    var __m = "github.com";
    var __re = new RegExp('^' + "github\\.com" + '
    
    Skip to content

    objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

    Description

    @yinlianghui

    Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

    Fact

    In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

    if (s.startsWith('[') && s.endsWith(']')) {
    try {
    const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
    return JSON.parse(json);
    } catch {
    return []; // <- any unparseable element collapses the whole set
    }
    }
    

    An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

    Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

    ctx = { data: { type: 'text', a: 'text' } }
    data.type in [data.a] -> false // both sides hold 'text'
    console.warn calls -> 0
    

    Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

    Why observation-class (label finding, no pm:queue)

    No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

    It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

    Possible directions (not deciding here)

    Dedup

    Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


    Generated by Claude Code

    Metadata

    Metadata

    Assignees

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
      Skip to content

      objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

      Description

      @yinlianghui

      Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

      Fact

      In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

      if (s.startsWith('[') && s.endsWith(']')) {
      try {
      const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
      return JSON.parse(json);
      } catch {
      return []; // <- any unparseable element collapses the whole set
      }
      }
      

      An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

      Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

      ctx = { data: { type: 'text', a: 'text' } }
      data.type in [data.a] -> false // both sides hold 'text'
      console.warn calls -> 0
      

      Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

      Why observation-class (label finding, no pm:queue)

      No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

      It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

      Possible directions (not deciding here)

      Dedup

      Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


      Generated by Claude Code

      Metadata

      Metadata

      Assignees

      Type

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions

        , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
        Skip to content

        objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

        Description

        @yinlianghui

        Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

        Fact

        In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

        if (s.startsWith('[') && s.endsWith(']')) {
        try {
        const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
        return JSON.parse(json);
        } catch {
        return []; // <- any unparseable element collapses the whole set
        }
        }
        

        An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

        Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

        ctx = { data: { type: 'text', a: 'text' } }
        data.type in [data.a] -> false // both sides hold 'text'
        console.warn calls -> 0
        

        Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

        Why observation-class (label finding, no pm:queue)

        No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

        It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

        Possible directions (not deciding here)

        Dedup

        Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


        Generated by Claude Code

        Metadata

        Metadata

        Assignees

        Type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
          Skip to content

          objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

          Description

          @yinlianghui

          Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

          Fact

          In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

          if (s.startsWith('[') && s.endsWith(']')) {
          try {
          const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
          return JSON.parse(json);
          } catch {
          return []; // <- any unparseable element collapses the whole set
          }
          }
          

          An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

          Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

          ctx = { data: { type: 'text', a: 'text' } }
          data.type in [data.a] -> false // both sides hold 'text'
          console.warn calls -> 0
          

          Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

          Why observation-class (label finding, no pm:queue)

          No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

          It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

          Possible directions (not deciding here)

          Dedup

          Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


          Generated by Claude Code

          Metadata

          Metadata

          Assignees

          Type

          Projects

          No projects

            Milestone

            No milestone

            Relationships

            None yet

            Development

            No branches or pull requests

            Issue actions

            , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
            Skip to content

            objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

            Description

            @yinlianghui

            Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

            Fact

            In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

            if (s.startsWith('[') && s.endsWith(']')) {
            try {
            const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
            return JSON.parse(json);
            } catch {
            return []; // <- any unparseable element collapses the whole set
            }
            }
            

            An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

            Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

            ctx = { data: { type: 'text', a: 'text' } }
            data.type in [data.a] -> false // both sides hold 'text'
            console.warn calls -> 0
            

            Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

            Why observation-class (label finding, no pm:queue)

            No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

            It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

            Possible directions (not deciding here)

            Dedup

            Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


            Generated by Claude Code

            Metadata

            Metadata

            Assignees

            Type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

              Description

              @yinlianghui

              Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

              Fact

              In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

              if (s.startsWith('[') && s.endsWith(']')) {
              try {
              const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
              return JSON.parse(json);
              } catch {
              return []; // <- any unparseable element collapses the whole set
              }
              }
              

              An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

              Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

              ctx = { data: { type: 'text', a: 'text' } }
              data.type in [data.a] -> false // both sides hold 'text'
              console.warn calls -> 0
              

              Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

              Why observation-class (label finding, no pm:queue)

              No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

              It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

              Possible directions (not deciding here)

              Dedup

              Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


              Generated by Claude Code

              Metadata

              Metadata

              Assignees

              Type

              Projects

              No projects

                Milestone

                No milestone

                Relationships

                None yet

                Development

                No branches or pull requests

                Issue actions

                , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                Skip to content

                objectui: metadata-admin predicate in with a non-literal element silently becomes an empty set — membership false for every row, no diagnostic #4266

                Description

                @yinlianghui

                Out-of-scope finding from the objectui#4049 development session (PR #4264). Not in that PR's scope#4049 rules on parseLiteral's tail return s, and this is a different code path (the array branch's catch). Unassigned, filed for triage.

                Fact

                In packages/app-shell/src/views/metadata-admin/predicate.ts, the in branch matches ^(.+?)\s+in\s+(\[.*\])$ and hands the bracketed text to parseLiteral. That always takes the array branch, which JSON-parses after normalising single quotes:

                if (s.startsWith('[') && s.endsWith(']')) {
                try {
                const json = s.replace(/'([^']*)'/g, (_, inner) => JSON.stringify(inner));
                return JSON.parse(json);
                } catch {
                return []; // <- any unparseable element collapses the whole set
                }
                }
                

                An element that is not a JSON literal — a path, a bare identifier, a trailing comma — makes JSON.parse throw, the catch returns [], and [].includes(anything) is false. So the predicate is false for every row, with nothing in the console.

                Measured (objectui worktree, main @ 11c1e71e8; temporary vitest probe, deleted):

                ctx = { data: { type: 'text', a: 'text' } }
                data.type in [data.a] -> false // both sides hold 'text'
                console.warn calls -> 0
                

                Note the failure is whole-set, not per-element: data.type in ['text', data.a] also collapses to [], so one bad element silently discards the good ones next to it.

                Why observation-class (label finding, no pm:queue)

                No producer emits this today: every in predicate in the four metadata-admin forms of the installed @objectstack/spec 17.0.0-rc.5 (objectForm / pageForm / viewForm / actionForm) uses literal string arrays. The file header is also explicit that it supports a declared subset (path in ['a','b']), so a path inside the brackets is outside it — a subset boundary, not a broken contract.

                It is recorded because it is the same family as objectstack#6936 and objectui#4049 — a silently wrong verdict where the symptom is "the field is not there" — and it is covered by neither. #6936's warning hangs on resolveValue; #4049's new diagnostic sits at parseLiteral's tail, and the array branch provably never reaches that tail (operator coverage measured in PR #4264). Severity judged at filing time is unreliable in both directions, so this is left for the triage seat to grade.

                Possible directions (not deciding here)

                Dedup

                Searched open objectui issues before filing: predicate evaluator in-operator array JSON parse failure empty array silent membership metadata-admin — 0 hits; metadata-admin predicate.ts parseLiteral array branch catch returns empty array — 0 hits. Related but distinct: objectui#4049 (the == / != right-hand side, the tail return), objectstack#6936 (unresolvable path via resolveValue, fixed), objectstack#5149 (fail-open family). Parallel agents cannot see each other's same-hour filings — race-close this one if a twin exists.


                Generated by Claude Code

                Metadata

                Metadata

                Assignees

                Type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions