Merge remote-tracking branch 'origin/main' into claude/issue-16570-initobjects-indexes-param

Author: claude

.changeset/manifest-repository-directory-backfill.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/connector-mcp": patch
+"@objectstack/connector-openapi": patch
+"@objectstack/connector-rest": patch
+"@objectstack/connector-slack": patch
+"@objectstack/embedder-openai": patch
+"@objectstack/knowledge-memory": patch
+"@objectstack/knowledge-ragflow": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/plugin-reports": patch
+"@objectstack/plugin-sharing": patch
+"@objectstack/service-sms": patch
+"@objectstack/trigger-api": patch
+---
+
+These fourteen packages now declare `repository.directory`, so their npm pages carry a working "source" deep link to their own directory in the monorepo.
+
+npm renders that field by concatenating it onto `repository.url`. None of these fourteen manifests carried a `repository` block at all, so every one of their npm pages offered no route from the package back to its code — not a broken link, no link. That is what this publishes: the block those pages read, naming each package's own directory.
+
+Nothing else about these packages changes. No export, no runtime behaviour, no dependency and no file in the tarball other than the manifest's own `repository` key. The version bump exists because the fix is only real once it is published: the field lives in the manifest npm serves, so a corrected manifest sitting in the repository leaves the package page exactly as wrong as it was.
+
+The rule behind it is now mechanical rather than remembered — `check:manifest-repository-directory` makes a publishable (non-private) workspace manifest declare the field naming its own directory, so a package added or moved after this cannot quietly go back to having no source link.

.changeset/stranded-run-state-discriminator.md

@@ -0,0 +1,17 @@
+---
+"@objectstack/service-automation": minor
+"@objectstack/plugin-approvals": minor
+---
+
+The stranded-request inspection tells a repairable strand from a cascade-failed run — through a dedicated read-only engine member, not through the wire (#15358, ruling B′).
+
+`ApprovalService.inspectStrandedRequests` keyed on `run.status === 'failed'`, which over-reports in one direction: a **cascade-failed** run — an ancestor `failAncestors` failed while it was parked at its `subflow` node, whose pause `failSuspendedRun` consumed and journalled nothing — has the same terminal `failed` row as the #13909 strand, so both came back `runState: 'failed'`, and `restoreConsumedSuspension` re-arms one and refuses the other (`NO_CONSUMED_SUSPENSION`). The engine's discriminator (the consumed-suspension snapshot on the durable `RunRecord`) is deliberately NOT on the `ExecutionLogEntry` that `getRun` answers, because `GET /automation/:name/runs/:runId` serves that object verbatim — so the plugin could not read it, and reading its absence as "not a strand" would have called the repairable row dead.
+
+**`@objectstack/service-automation` — additive, `minor`.** `AutomationEngine.inspectConsumedSuspension(runId)` answers whether `restoreConsumedSuspension` would have a consumed suspension to put back, from the SAME two witnesses that verb reads (this process's hot journal and the durable row, reconciled by the same `rowSupersedesJournal` / `persisted` / drop-notice rules — the read is now one private method both call), and re-arms nothing. Four answers, none folded: `repairable: true` (with the pause it would re-arm and which witness answered); `SNAPSHOT_DROPPED` (the strand happened, the store could not persist the snapshot, and this process holds no hot copy — repairable only by the replica that stranded it, while it lives); `NO_CONSUMED_SUSPENSION` (cascade-failed or never paused); `RUN_SUSPENDED` (already resumable). It REJECTS when a store cannot be read — an outage is unknown, not "nothing to restore". The result type is exported as `ConsumedSuspensionInspection`. `restoreConsumedSuspension` behaves exactly as before; nothing on `ExecutionLogEntry`, the run-detail route, or `@objectstack/spec` changes.
+
+**`@objectstack/plugin-approvals` — additive on two published types, `minor`.**
+
+- `ApprovalResumeSurface` gains the optional `inspectConsumedSuspension?(runId)`, declared the way `listSuspendedRunsDurable` is: a method `AutomationEngine` already implements, widening no engine surface.
+- `StrandedRunState` splits `'failed'` three ways and keeps `'missing'` untouched: `'repairable'` (the #13909 strand — restore, then `continueRestoredRun`), `'snapshot_dropped'` (its own class: as `repairable` it over-reports, as `unrepairable` it is a false negative), and `'unrepairable'` (the cascade-failed / never-paused run, #15222's shape — nothing re-arms it). **`'failed'` stays a member, on purpose**: it is what a `failed` row is reported as when the attached surface has no `inspectConsumedSuspension` (an engine build older than this plugin, or a host double). Absence of the discriminator is fail-closed for a report — the row is reported, undifferentiated, never labelled `unrepairable` and never dropped. A thrown read counts `undetermined`, as the other two oracles' do.
+
+A consumer switching exhaustively over `StrandedRunState` gains three arms; nothing it matched before stops arriving. The inspection's summary log adds `runRepairable` / `runSnapshotDropped` / `runUnrepairable` beside the existing counts.

.claude/skills/pm-dispatch/SKILL.md

@@ -337,6 +337,7 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 - 见新 tag 族发布 ⇒ 在 cloud 立 `.objectstack-sha` bump 单。
 - bump 单单张封顶:先查同题 open 单,已有就追评刷新;工具链新形态只提请不扩面。
 - 分类动作每张三选一,外加一个修复通道。
+- ⛔ 不挂 `needs:contract-review`:随 draft PR 或 `Clause-②: yes` 认领;裁定写方向、给六态之一。
 - `pm:queue` = 有具名落点或复现的具体缺陷,或范围明确的工具/门禁修复,无可问之事。
 - `pm:queue` 也收恢复不变量的 finding 与 test-only pin。
 - `needs-user-decision` = 设计卡、feature/契约形状提案、需要 appetite 的多周程序。
@@ -552,7 +553,6 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 - same-day churn 行:当天合并 ⇒ 先核对当前 main;在飞重叠每轮求交,相交即发四句警告。
 - 被在飞重叠完全覆盖就停下回报,⛔ 不硬造 diff。
 - 翻转公开语义的裁决随卡带全仓 pin 清扫,两句缺一不可,原文见 runbook。
-- 条件性标准条款命中判据才抄:多实现面 ⇒ 共享一致性覆盖。
 - 拒收用例 ⇒ `code`+`status` 最低断言;过滤/谓词语义 ⇒ 编译面清单逐面申报,⛔ 静默略过。
 - 资源与后端:S 级机械 + M ⇒ `mode:subagent`;S 级但不机械(判断面在设计不在门禁)按 M 待遇。
 - `mode:cloud` 只保留给 L/XL、必须活过 PM 会话的工作、浏览器/dogfood 验证。

.claude/skills/pm-dispatch/references/lanes/triage.md

@@ -1,7 +1,7 @@
 # 席位章程:分诊席(Triage)
-
 见 SKILL.md 〈分诊座位职责〉;本文是本席的岗位说明,现值状态恒在座位贴,⛔ 不迁入本文。
 
 - 分诊每 fire 只取一个仓,两仓轮替:objectstack、objectui、objectstack……;仓内按最旧优先。
 - 饥饿守卫:轮次开始时任一仓最旧未路由卡超过 4 小时,该仓本轮优先,不论轮到谁。
 - ⛔ 不回退到跨仓全局最旧优先;⛔ 不因积压增设第二分诊席或改 fire 频率。
+- ⛔ 分诊不挂 `needs:contract-review`:随 draft PR 或 `Clause-②: yes` 认领;写方向、给六态之一。

.claude/skills/pm-dispatch/references/platform-readings.md

@@ -346,8 +346,8 @@
 - 判 required 集为空要读 ruleset 的 required 集本身,或看队列合并是否真在等检查。
 - ⛔ 别处写下的计数值一律先复测再用。
 - MCP `issue_write create` 落库丢掉正文尾部的署名页脚块,正文其余部分完好。
-- 同一路径吃掉标题里的尖括号跨度 ⇒ 标题占位写裸词(NAME / :id),⛔ 不写尖括号形。
 - 建卡改走 REST `POST /issues` 页脚存活;回读后 `PATCH /issues/{n}` 重送正文逐字节存下。
+- 内联双引号 JSON 建卡:标题反引号标识符被 shell 以 root 展开,正文完好 —— 内容被执行。
 - CI job 的失败 step 不必与 job 名一致 ⇒ ⛔ 不由 job 名推原因,先读 step 名再下结论。
 - Actions 日志保留把老 job 截到 post-job cleanup ⇒ 归档只剩清理输出时原因不可断言。
 - 无 `packageManager` 的目录里 corepack 运行时解析 registry `latest` ⇒ 同 SHA 前绿后红是 tag 移了。

.claude/skills/pm-dispatch/references/rest-channel.md

@@ -22,11 +22,9 @@
 - ⛔ 查重必须含 closed:卡刚关闭时最易被重开,开域查重漏掉刚关闭的同题卡即重复派发。
 - 开域查重是要申报的例外,不是默认;状态与标签列卡仍 `state=open`,那是状态读不是查重。
 - ✓ 卡与 PR 元数据 `GET .../issues/{n}` · `GET .../pulls/{n}`,assignees、labels、body 齐全。
-- MCP `list_issues` 永不返回 assignees,这条差别本身就是走 REST 的理由。
 - ✓ 整条评论线 `GET .../issues/{n}/comments?per_page=100`。
 - ✓ Timeline 事件 `GET .../issues/{n}/timeline`:cross-ref、`added_to_merge_queue`、ready_for_review。
 - ✓ PR diff `GET .../pulls/{n}` 带 Accept `application/vnd.github.diff`;文件清单 `.../pulls/{n}/files`。
-- 后者可瞬态 404 ⇒ PR 文件读取优先走 git。
 - ✓ 取某 ref 上的文件 `GET .../contents/{path}?ref=...`,raw accept。
 - ✓ 祖先与对比 `GET .../compare/{base}...{head}` —— 浅检出上本地祖先判据不可信时的正解。
 - ✓ 门禁与 workflow `GET .../commits/{sha}/check-runs` · `GET .../actions/runs`。
@@ -39,6 +37,8 @@
 - 加法写剥不掉并发席位刚挂的标签,比 MCP `issue_write` 的整组替换安全。
 - 门关席位无此端点 ⇒ 回退 = MCP 读现值、并集、整组写、读回;读回是它安全的全部理由。
 - ✓ 建卡带标签 `POST .../issues` · 改正文 `PATCH .../issues/{n}` · 认领 `POST .../issues/{n}/assignees`。
+- 请求体走文件(`-d @file`)或引号定界 heredoc(`<<'EOF'`),⛔ 永不内联双引号串。
+- 双引号内 shell 先展开反引号、`$(...)`、`$VAR`,请求尚未成形;只标题坏而正文完好即此形。
 - ✓ 请求复审 `POST .../pulls/{n}/requested_reviewers` · 开 PR `POST .../pulls` 带 `draft=true`。
 - GraphQL 池为 0 的同一分钟里开得出 draft PR ⇒ 交付不必等重置。
 - ✓ 把 `origin/main` 合进 PR head:`PUT .../pulls/{n}/update-branch`,PM 席位可用。

.github/workflows/lint.yml

@@ -3673,13 +3673,16 @@ jobs:
       # whole population rather than a rule about moves: one of the three commits
       # involved moved nothing at all — it edited `repository.url` in the same
       # JSON object with the stale `directory` line as visible hunk context, and
-      # it shipped. Humans looked and missed it twice. ⛔ It judges only manifests
-      # that DECLARE the field; whether declaring is mandatory for a publishable
-      # package is an open policy question and a maintainer's to answer, so
-      # silence is counted and never a finding. Runs its own --self-test first:
-      # this population is `git ls-files` plus a field predicate, so a changed
-      # glob or a renamed field empties it silently and the production run would
-      # print exactly what a clean tree prints. Static read of tracked manifests;
+      # it shipped. Humans looked and missed it twice. Declaration is MANDATORY
+      # for a publishable (non-private) manifest — ruled, and the 14 that
+      # declared nothing were backfilled in the same change; a private manifest
+      # publishes nothing, so its silence is exempt while a wrong value in it is
+      # still judged. Runs its own --self-test first: this population is
+      # `git ls-files` plus TWO field predicates, so a changed glob, a renamed
+      # `repository.directory` or a `name`/`private` that stops reading as
+      # publishable each empty it silently and the production run would print
+      # exactly what a clean tree prints — hence pinned floors on all four counts
+      # and a control pair on each predicate. Static read of tracked manifests;
       # no build, no network, sub-second.
       - name: Manifest repository.directory guard
         run: pnpm check:manifest-repository-directory

packages/connectors/connector-mcp/package.json

@@ -39,6 +39,11 @@
     "ai",
     "tools"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/connectors/connector-mcp"
+  },
   "files": [
     "dist",
     "README.md",

packages/connectors/connector-openapi/package.json

@@ -37,6 +37,11 @@
         "integration",
         "api"
     ],
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/objectstack-ai/objectstack.git",
+        "directory": "packages/connectors/connector-openapi"
+    },
     "files": [
         "dist",
         "README.md",

packages/connectors/connector-rest/package.json

@@ -36,6 +36,11 @@
     "integration",
     "http"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/connectors/connector-rest"
+  },
   "files": [
     "dist",
     "README.md",