Uh oh!
There was an error while loading. Please reload this page.
test(app-shell): pin the @anon metadata seed scope enumeration - #6103
Merged
Conversation
Recovers objectui#5746's measurement harness and lands it as a regression pin. Test-only: no provider behaviour moves. The harness mounts the REAL console boot path — real `AuthProvider`, real `ConnectedShell` #4042 session gate, real `MetadataProvider` — with only the auth server and the metadata adapter doubled, and nothing writing `objectui:metadata:*` by hand, so it cannot agree with a key format the provider does not actually produce. Re-measured on current `main` before anything was changed; every reading #5746 recorded still reproduces: S1 window (a) writes=1 anon-writes=0 -> SHUT S2 window (b) objectui:metadata:app:org_a:@anon S3 degenerate B rendered "setup,crm,hr-secret" -> HIT on A's key S4 guest objectui:metadata:app:@none:@anon S5 preview objectui:metadata:app:@none:@anon S1-S5 now ASSERT those readings instead of only reporting them, including the `@anon` seed the guest and preview boots write. That write is the observation #5828 carries and is deliberately NOT "fixed" here: whether it matters turns on whether `/meta/*` READS are permission-filtered on a stub-auth or marketplace-preview deployment, which nobody has measured. objectstack#11373 measured that anonymous /meta WRITES are refused (401) on a platform-default boot — a different door on a different boot, so it does not settle it. S6 is new and is the pin that can fail. #5746's load-bearing correction is that #5744's `purgePreviousUserClientState` does NOT cover the seed read — React runs child effects before parent effects, so `MetadataProvider`'s seed read precedes `AuthProvider`'s purge — which leaves #5198's principal-scoped key as the sole protection on that boot. S6 boots two DISTINCT bearers in one tab and asserts B misses A's entry. Ablating `principalScope()` to ignore the token turns S6 red alone (`expected '08dtegw0taozhy' not to be '08dtegw0taozhy'`, B renders `setup,crm,hr-secret`) while S0-S5 stay green, which is the predicted direction. Both instrument defects #5746 caught are preserved and re-measured. Restoring the `this === sessionStorage` guard drives S0's counter-probe red with zero recorded writes, confirming jsdom still hands out `sessionStorage` as a Proxy. Part of #5828 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CSoz9uGhaaSgiq3hshtN7L
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
This was referenced Aug 24, 2026
yinlianghui
marked this pull request as ready for review
August 24, 2026 17:19
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #5828
Test-only. Recovers the objectui#5746 measurement harness from the unmerged
branch
claude/issue-5746-anon-seed-scope-measurementand lands it as aregression pin. No provider behaviour moves; no published surface widens.
⛔ #5828 remains open — this PR is not its answer. The card's deciding
question is server-side and still unowned: on a stub-auth or marketplace-preview deployment, is
/meta/*READ permission-filtered per user? objectstack#11373 measured that anonymous
/meta/*WRITES are refused (401, nothing persisted) on a platform-defaultboot — a different door on a different boot, so it does not settle this.
Why this pin exists
objectui#5746's load-bearing correction: objectui#5744's
purgePreviousUserClientStatedoes not cover the seed read. React runs childeffects before parent effects, so
MetadataProvider's seed read precedesAuthProvider's purge. Verified in the tree on this branch —MetadataProvider.tsxreads the seed and only then callsdropForeignPrincipalEntries():That leaves objectui#5198's principal-scoped cache key as the sole protection
on that boot, and it was unpinned in the tree until now.
What the harness is, and what was preserved
It mounts the real console boot path — real
AuthProvider, realConnectedShell#4042 session gate, realMetadataProvider— with only the authserver (an
AuthClientdouble) and the metadata adapter doubled, and nothingwriting
objectui:metadata:*by hand, so it cannot agree with a key format theprovider does not produce. Nothing further was stubbed to stabilise it.
Re-measured on current
mainbefore anything was changedEvery reading objectui#5746 recorded still reproduces (7c96c94):
writes=1 anon-writes=0— SHUTobjectui:metadata:app:org_a:@anonsetup,crm,hr-secret— HIT on A's keyobjectui:metadata:app:@none:@anonpreviewModebootobjectui:metadata:app:@none:@anonS1–S5 now assert those readings instead of only reporting them into a file.
That deliberately includes the
@anonseed the guest and preview boots write:that write is the observation #5828 carries and is not "fixed" here, because
whether it is a defect depends on the unanswered server-side question above. A pin
asserting today's behaviour is what lets a future ruling be executed safely.
S6 — the new assertion, and the ablation that proves it can fail
S3 already showed what a principal-blind key does, but both of its principals
degenerate to
@anon, so it cannot detect the loss of #5198. S6 is the same shapewith two distinct bearers in one tab and no sign-out in between. It asserts B's
seed read goes to B's own principal scope and MISSES A's entry, with a
counter-probe first that A really did leave a
hr-secret-bearing seed behind.Predicted direction, recorded before running — ablate
principalScope()toignore the token while leaving the
@anonbranch intact, so only discriminationamong real principals is removed; predict S6 red alone, failing first at
expect(seedRead.principal).not.toBe(aPrincipal). The counter-hypothesis carriedover from objectstack#11373's "403, not 200" was that a second independent layer
(
dropForeignPrincipalEntries, or #5744's purge) would answer instead and leaveS6 green — which would have meant the pin cannot fail.
Observed — matched the prediction; no second layer intervened:
Ablation ran under
trap … EXIT INT TERMwith a cwd-independent restore; themutation was proved on disk by grepping the injected text and the removed
text, and
git diff HEADis empty afterwards.Both instrument defects re-measured, not inherited
Either would otherwise produce a false "no writes anywhere" green.
sessionStorageas a Proxy, sothis === sessionStorageis never true inside a
Storage.prototypemethod. Restoring that guard in theinstrument drove S0's counter-probe red with
expected 0 to be greater than 0— zero writes recorded. Still handled (store identified by key prefix, with
localStorageasserted to hold noobjectui:metadata:*key) and still commented.vi.restoreAllMocks()does not undo a reassigned property. Handled bythe module-level
appFetchNeverLandsflag reset inbeforeEachand by theexplicit
restoreInstrument?.()inafterEach. Deleting thebeforeEachresetdrove S4, S5 and S6 red (
expected [] to deeply equal [ 'objectui:metadata:app:@none:@anon' ]),confirming the reset is load-bearing. Still commented.
One change the recovery required
The harness did not apply cleanly at the type level. Its
boot()helperrestated the preview prop as
{ simulatedRole: string }, which is wider thantoday's
PreviewModeOptions['simulatedRole']('user' | 'admin' | 'viewer'), sotype-checkfailed withTS2322. Fixed contract-first — the helper now uses thepublished
PreviewModeOptionsrather than a local widened restatement.Gates, at
c1dc883f8pnpm --filter @object-ui/app-shell type-check(tsc --noEmit && tsc -p tsconfig.test.json)pnpm exec vitest run packages/app-shell/src/console/__tests__/anonSeedScope-5746.enumeration.test.tsxTest Files 1 passed (1),Tests 7 passed (7)pnpm exec eslintover the merge-base deltapnpm check:esm-specifiers(a step inside theType Checkjob)pnpm check:self-import·pnpm check:phantom-depsnode scripts/check-changeset-presence.mjsnode scripts/check-changeset-fixed.mjs·check-changeset-no-major.mjsnode scripts/check-control-bytes.mjsnode scripts/check-type-check-coverage.mjs·check-lint-coverage.mjsWhole-package vitest for
app-shellwas not run — it is ~784 s and holds thecontainer's shared verify lock. The full farm is CI's run.
Generated by Claude Code