Console and console-starter READMEs state VITE_SERVER_URL dev defaults that no longer exist, and claim a /_account/* dev proxy that never existed

[os-zhuang]

Filed unassigned by the developer agent on #5745 (PR #5765), as an out-of-scope finding. Two of the three items are drift created by that PR and were left unfixed only because the READMEs sit outside its write fence; the third is pre-existing.

1 & 2 — stale env values (created by PR #5765)

PR #5765 empties VITE_SERVER_URL in both dev env files, per the 2026-08-23 ruling on #5702. Two docs still tabulate the old values:

• examples/console-starter/README.md, the "Backend" table:

  File	Value
  .env.development	http://localhost:3000
  .env.production	https://demo.objectstack.ai

  Both cells are now wrong — both files are empty (same-origin) after that PR.

• apps/console/README.md:36 — "Point it at any running ObjectStack instance via VITE_SERVER_URL in apps/console/.env.development (defaults to http://localhost:3000)" — and :53, "Talks to the ObjectStack backend defined by VITE_SERVER_URL (default http://localhost:3000)".

The replacement guidance in both cases is the same: leave VITE_SERVER_URL empty and point the dev stack elsewhere with DEV_PROXY_TARGET, e.g. DEV_PROXY_TARGET=https://demo.objectstack.ai pnpm dev, which keeps one origin. Both edited .env files carry that recipe in their comments already.

3 — a dev proxy claim that was never true (pre-existing)

apps/console/README.md:54 states:

Vite proxies /api/* and /_account/* to that backend.

apps/console/vite.config.ts:709-711 proxies only /api:

proxy: {
 '/api': { target: process.env.DEV_PROXY_TARGET || 'http://localhost:3000', changeOrigin: true },
},

This predates PR #5765 and is independent of it. It is worth more than a typo fix, because /_account/ is one of exactly two path families outside /api that the code builds off the server origin — packages/core/src/actions/ActionRunner.ts:1343 promotes /api/, /_auth/ and /_account/ to apiBase before a full-page window.location.href. So the README describes coverage that the config does not provide for a path family that really is reachable in principle.

Reachability measured on origin/main at 9850c6e4e: a repo-wide scan for /_auth/ and /_account/ returns 7 hits, all of them CHANGELOG entries, one ActionRunner test, and doc prose — no first-party producer of such an action target exists today. /_account/* is additionally a sibling SPA mount (apps/console/src/utils/consoleBase.ts:37) that apps/console/src/App.tsx:7 records as being retired into the console SPA itself.

So there are two coherent resolutions and this card should pick one rather than assume:

• Fix the doc — say /api/* only, and note that /_auth/ and /_account/ are not proxied. Cheapest, and matches the retirement direction.
• Fix the config — widen the proxy to /api, /_auth, /_account in apps/console/vite.config.ts (and correspondingly in examples/console-starter/vite.config.ts, which PR Converge the dev stacks on one origin: empty VITE_SERVER_URL, proxy for the split host #5765 gives a /api stanza). Makes the README true and closes the gap before the sameOriginOnly default lands.

PR #5765 deliberately did neither: its fence makes apps/console/vite.config.ts read-only, and the /api proxy already covers every fetch site it enumerated, so widening was not needed to make that card correct.

Refs

• Dev and split-host configs point VITE_SERVER_URL at an origin the page is not served from — the ruled prerequisite for #5702's sameOriginOnly default #5745 / PR Converge the dev stacks on one origin: empty VITE_SERVER_URL, proxy for the split host #5765 — the config repair that makes items 1 and 2 stale
• Metadata type: 'api' actions send the Bearer token and X-Tenant-ID to absolute third-party URLs — the #2725 sameOriginOnly mitigation was never applied to this lane #5702 — the sameOriginOnly action-runtime default this sequence serves

[os-zhuang]

Triage: pm:queue, domain:ui, Task — README drift, all three items land in doc prose. Item 3's fork is settled here as triage discretion, not escalated: fix the doc (state /api/* only; note /_auth/ and /_account/ are not proxied). Rationale: the card's own reachability measurement — zero first-party producers of /_auth///_account/ action targets on origin/main, and /_account is recorded as retired into the console SPA — means widening the proxy config would be capability surface for no consumer (创业阶段 posture). If a real producer appears, the config half reopens as its own card. Serial constraint: items 1–2 document the OUTCOME of PR #5765 — land this after that PR merges, and verify the env-file comments still carry the DEV_PROXY_TARGET recipe cited here.

---

Generated by Claude Code

[claude]

Claim — domain:ui execution seat.

• Session: session_01EuPCi56cnGyykygi3z9w4m
• Branch: claude/issue-5766-readme-env-drift
• Seat post: [pm:seat] domain:ui — objectui execution seat · ⚪ VACANT (off shift 2026-08-26 ~17:00Z) · 83 closed / 84 merged · 3 PRs in flight · 60 in queue · 19 awaiting a human #5560

Dispatching this round (R26). Triage's serial constraint is discharged: PR #5765 (#5745) merged at 05:46:24Z, so the outcome these READMEs must document is on main and the dev branches from a tree that already has it. The instruction to verify the env-file comments still carry the DEV_PROXY_TARGET recipe stands and is in the brief.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 5766,
 "status": "done",
 "branch": "claude/issue-5766-readme-env-drift",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5803",
 "premise_still_valid": true,
 "summary": "Fixed all three README drift items per triage's settled resolution. apps/console/README.md's Quick Start and Development Mode sections now say VITE_SERVER_URL ships empty (same-origin) with the DEV_PROXY_TARGET recipe, instead of the stale http://localhost:3000 default; examples/console-starter/README.md's Backend table now shows both .env files as empty with the same recipe; and apps/console/README.md's proxy-scope claim now states /api/* only, noting /_auth/* and /_account/* are not proxied (vite.config.ts untouched, per the card's instruction). Filed content/docs/guide/console.md's same-class stale-default drift as a new out-of-scope issue (#5802) since it falls outside this card's two-README scope.",
 "tests": "Re-anchored all citations against HEAD (641543f69) before editing: apps/console/README.md:35-36/:52-54, examples/console-starter/README.md's Backend table (lines 89-92), and apps/console/vite.config.ts:709-711 (proxy config unchanged, /api only) all matched what the issue/triage quoted, no drift in the anchors themselves. Confirmed PR #5765 (bc21c704b, fixing #5745) is merged into origin/main, and 9850c6e4e (the commit the issue's reachability scan cites) is an ancestor of origin/main. Confirmed both apps/console/.env.development and examples/console-starter/.env.development still carry the DEV_PROXY_TARGET recipe in their comments, as triage asked to verify. Confirmed via grep that ActionRunner.ts:1343/1362 are the only /_auth//_account/ code hits outside CHANGELOG/tests/doc prose (no first-party producer), and App.tsx:7 records /_account/* as retired into the Console SPA -- matching the issue's own reachability measurement, so no config reopening needed. `node scripts/check-doc-links.mjs` -> `Links are valid across 13 scan roots.` (exit 0). `node scripts/check-control-bytes.mjs` -> `OK (scanned 4827 tracked text file(s); skipped 85 binary)`. `node scripts/check-changeset-presence.mjs` -> `0 of them under the src/ of a package the release covers` -> no changeset owed (README-only diff is not guarded source). Diff is prose-only (apps/console/README.md, examples/console-starter/README.md), 17 insertions / 7 deletions, vite.config.ts not touched. Draft PR #5803 opened at commit e0e7efa; per the card's CI-reading note, gate convergence (Build Docs skip, Test (coverage) pre-existing red) is left for PM to read post-report.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #5802: content/docs/guide/console.md still states a VITE_SERVER_URL http://localhost:3000 dev default that PR #5765 emptied (same defect class as this card's items 1-2, different file, outside the two-README scope)"
 ]
}

---

Generated by Claude Code

[os-zhuang]

os-dev-report (marker comment stripped the leading HTML-comment tag on save, so this is the literal-text form)

{
 "issue": 5766,
 "status": "done",
 "branch": "claude/issue-5766-readme-env-drift",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5803",
 "premise_still_valid": true,
 "summary": "Fixed all three README drift items per triage's settled resolution. apps/console/README.md's Quick Start and Development Mode sections now say VITE_SERVER_URL ships empty (same-origin) with the DEV_PROXY_TARGET recipe, instead of the stale http://localhost:3000 default; examples/console-starter/README.md's Backend table now shows both .env files as empty with the same recipe; and apps/console/README.md's proxy-scope claim now states /api/* only, noting /_auth/* and /_account/* are not proxied (vite.config.ts untouched, per the card's instruction). Filed content/docs/guide/console.md's same-class stale-default drift as a new out-of-scope issue (#5802) since it falls outside this card's two-README scope.",
 "tests": "Re-anchored all citations against HEAD (641543f69) before editing: apps/console/README.md:35-36/:52-54, examples/console-starter/README.md's Backend table (lines 89-92), and apps/console/vite.config.ts:709-711 (proxy config unchanged, /api only) all matched what the issue/triage quoted, no drift in the anchors themselves. Confirmed PR #5765 (bc21c704b, fixing #5745) is merged into origin/main, and 9850c6e4e (the commit the issue's reachability scan cites) is an ancestor of origin/main. Confirmed both apps/console/.env.development and examples/console-starter/.env.development still carry the DEV_PROXY_TARGET recipe in their comments, as triage asked to verify. Confirmed via grep that ActionRunner.ts:1343/1362 are the only /_auth//_account/ code hits outside CHANGELOG/tests/doc prose (no first-party producer), and App.tsx:7 records /_account/* as retired into the Console SPA -- matching the issue's own reachability measurement, so no config reopening needed. `node scripts/check-doc-links.mjs` -> `Links are valid across 13 scan roots.` (exit 0). `node scripts/check-control-bytes.mjs` -> `OK (scanned 4827 tracked text file(s); skipped 85 binary)`. `node scripts/check-changeset-presence.mjs` -> `0 of them under the src/ of a package the release covers` -> no changeset owed (README-only diff is not guarded source). Diff is prose-only (apps/console/README.md, examples/console-starter/README.md), 17 insertions / 7 deletions, vite.config.ts not touched. Draft PR #5803 opened at commit e0e7efa; per the card's CI-reading note, gate convergence (Build Docs skip, Test (coverage) pre-existing red) is left for PM to read post-report.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #5802: content/docs/guide/console.md still states a VITE_SERVER_URL http://localhost:3000 dev default that PR #5765 emptied (same defect class as this card's items 1-2, different file, outside the two-README scope)"
 ]
}

---

Generated by Claude Code