objectui Import Wizard: the "run automations" (off) and "treat as historical" (on) options are refused 403 for every signed-in user once PR #24379 lands — the wizard must stop offering them (repo:objectui) #12985

Activity

1. objectstack-fleet

   added

   bugSomething isn't workingSomething isn't working

   on Oct 18, 2026
2. objectstack-fleet

   transferred this issue fromobjectstack-ai/objectstackon Oct 18, 2026
3. objectstack-fleet commented on Oct 18, 2026

   

   objectstack-fleetBot

   on Oct 18, 2026

   ContributorAuthor

   More actions

   Triage: p1 · domain:ui · pm:queue · moved from objectstack-ai/objectstack#24381 · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T18:56Z

   Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015). ⛔ Not a claim, ⛔ not a dispatch.

   • Grade p1. This is the console half of the P0 security: any user who may import can send runAutomations: false and skip every trigger and metadata-bound hook, so a sales rep bypasses an approval gate and a closed-record freeze through POST /data/:object/import objectstack#24348. Once PR fix(rest)!: the import doors honour a control opt-out only for the system principal objectstack#24379 lands, a user who touches either option in the Import Wizard gets a 403 for the whole import. The default import is unchanged.
   • Release coupling: the framework's vendored console (.objectui-sha 0707b4ae37) predates this fix. So the next cut ships the 403 with the options still offered. The answer is loud and narrow, so this does not hold the cut, but the card should land before GA.
   • Routing: the remedy is in packages/plugin-grid/src/ImportWizard.tsx, so the card was moved here from objectstack-ai/objectstack#24381 in this act, as domain:ui.
   • Whether an administrator should be entitled to the opt-outs is not decided here. security: any user who may import can send runAutomations: false and skip every trigger and metadata-bound hook, so a sales rep bypasses an approval gate and a closed-record freeze through POST /data/:object/import objectstack#24348's seat review reads "not entitled" until the maintainer names one.

   ---

   Generated by Claude Code
4. objectstack-fleet

   added

   domain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seatobjectui ui stream: fix lands on the published library or apps — objectui execution seat

   pm:queue

   priority:p1

   pm:dispatched

   and removed

   pm:queue

   on Oct 18, 2026
5. objectstack-fleet

   assigned

   baozhoutao

   on Oct 18, 2026
6. objectstack-fleet commented on Oct 18, 2026

   

   objectstack-fleetBot

   on Oct 18, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 11 (priority:p1)
   Session: session_01XVp19E1MYUTFM3dnkwz8gB
   Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
   Branch: claude/issue-12985-import-optouts
   Worktree: objectui-issue-12985
   Domain: domain:ui
   Seat: domain:ui#2
   File surface: packages/plugin-grid/src/ImportWizard.tsx (the "run automations" and "treat as historical" options, their state, and the request fields they set, about :926 / :937 / :1875 / :1879), the i18n keys only those two options read in packages/i18n/src/locales/*.ts, and tests beside each. Plus one .changeset/12985-*.md. ⛔ The default import (automations run, no historical treatment) unchanged; ⛔ no new capability or entitlement. Stop on breach; explain in the report.
   Container & model: S, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui reads no path-derived mandate)
   Clause-②: no
   Responsibility: @object-ui/plugin-grid's Import Wizard offers runAutomations: false and treatAsHistorical: true | objectstack-ai/objectstack#24348 (P0) makes the import doors refuse both for every non-system caller (PR objectstack-ai/objectstack#24379), and no entitlement exists for a signed-in user | every user who touches either option once a server carries objectstack-ai/objectstack#24379: the whole import answers 403.
   Thread-read: 6253829082
   Serial constraints cleared: no open objectui PR touches ImportWizard.tsx; the in-flight claims (objectui#12980 part 2, #12954, #12957) do not name it.
   Claimed at: 2026-10-18T19:24Z
7. objectstack-fleet commented on Oct 18, 2026

   

   objectstack-fleetBot

   on Oct 18, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 12985,
   "status": "done",
   "branch": "claude/issue-12985-import-optouts",
   "pr": "#12989",
   "session": "session_01XVp19E1MYUTFM3dnkwz8gB",
   "premise_still_valid": true,
   "summary": "Removed the Import Wizard's 'Run automations & triggers' and 'Import as historical data' options: both checkboxes, their state, their ImportOptions props, their dependency-list and reset entries, and the runAutomations / treatAsHistorical fields assembleImportRequest set. The import, dry-run and background-job requests (all built by assembleImportRequest) now carry neither key, which is the server's declared default (readImportControlFlags on PR objectstack-ai/objectstack#24379: runAutomations on unless false, treatAsHistorical only on literal true, explicit true/false admitted), so the default import is unchanged. Retired grid.import.optRunAutomations / optTreatHistorical / optTreatHistoricalHint in all ten packs and the wizard's English fallback map, and dropped the retired key's name from two comments that listed it as a live surface (en.ts, makerEmptyState-v1-scope-8329.test.ts). Draft PR #12989 opened via the relay with assignee baozhoutao (read back: assignees as the pull lists them = baozhoutao); zero label writes (none named for objectui). Worktree cleaned. Contract note: ImportWizardProps/ImportResult unchanged; exported locale objects under @object-ui/i18n/locales/* lose three grid.import members; ImportRequestOptions in @object-ui/types still declares both fields (server accepts them from the system principal).",
   "tests": "All at HEAD ac0198b (BASE 024b7b6). Closure build turbo run build --filter=@object-ui/plugin-grid^... --concurrency=2 under lock: VERDICT command-exit 0, 13 tasks successful. type-check plugin-grid + i18n (tsc --noEmit && tsc -p tsconfig.test.json) under lock: VERDICT command-exit 0; --listFiles shows the 3 plugin-grid test files and the i18n test in the test program. vitest --maxWorkers=1 under lock: new/edited files + i18n-parity 'Test Files 4 passed (4) / Tests 20 passed (20)'; plugin-grid files naming ImportWizard/runAutomations/treatAsHistorical 'Test Files 21 passed (21) / Tests 148 passed (148)'; other packages' files naming them + i18n all-locales-key-parity, makerEmptyState-8329, dead-pack-keys-retired-8754, dead-key-batch-retired-4730 'Test Files 20 passed (20) / Tests 301 passed (301)'. Declared to CI: full packages/plugin-grid/ and packages/i18n/ dirs. Battery all exit 0: check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-dead-keys, i18n-drift, i18n-designer-parity, control-bytes; node scripts/check-hand-rolled-comment-mask.mjs 0; node scripts/check-changeset-fixed.mjs 0; check-changeset-presence 0 ('15 source file(s) of 2 released package(s) changed, and this change declares 1 changeset(s)'); check:new-line-citations 'VERDICT ... 0 new citation(s)'. check:spec-floors not run (not in the order's battery list). Narrowed lint (eslint --no-inline-config --format json over the 15 changed .ts/.tsx): population eslint.config.js files '**/*.{ts,tsx}'; JSON count 15 files, 0 errors, 9 warnings, all in ImportWizard.tsx and the same 9 rules on the BASE blob (pre-existing); invariance: no parserOptions.project, not type-aware, so untouched files' verdicts cannot move. Ablation (fix committed first): node objectstack scripts/ablation-replace.mjs re-planted a data-testid import-opt-run-automations checkbox labelled 'Run automations & triggers' in ImportOptions (anchor 1 to 0, blob 3cdd0e998baf to 37f2a414044c); pin (a) red 'Tests 1 failed | 1 passed (2)' on queryByTestId('import-opt-run-automations'); restore blob 3cdd0e998baf == HEAD blob, git diff HEAD empty (tool + own trap script both proved). First ablation attempt was a no-op (replacement contained its anchor; tool refused, anchor 1 to 1, test never ran) and was re-run with a new anchor; no build/dist leg needed: the test imports ./ImportWizard by relative source path.",
   "mcp_calls": "0",
   "api_writes": "2 — (1) fleet-write relay POST /repos/objectstack-ai/objectstack/dispatches carrying pr_create (POST /repos/objectstack-ai/objectui/pulls draft + POST /repos//issues/12989/assignees), run 39160110200 success, read-back identical 6801 bytes; (2) fleet-write relay dispatch carrying comment on #12985 (this os-dev-report). Plus git push x2 (empty-branch probe, then ac0198b), not REST.",
   "open_questions": [],
   "out_of_scope_findings": [
   "carrier: 承接者:无 · noted, not filed · ImportRequestOptions.runAutomations JSDoc in packages/types/src/data.ts says 'off by default for bulk' while spec ImportRequestSchema and the server default it to true; docs-only drift, no producer reads it; in PR #12989 Acceptance notes",
   "carrier: 承接者:无 · noted, not filed · no other objectui caller sends runAutomations/treatAsHistorical (git grep: only ImportWizard.tsx, its tests, and the ImportRequestOptions wire type, which is correct as declared); data-objectstack importRecords forwards the request object unchanged"
   ]
   }

   ---

   Generated by Claude Code
8. objectstack-fleet commented on Oct 18, 2026

   

   objectstack-fleetBot

   on Oct 18, 2026

   Last edited by objectstack-fleet

   ContributorAuthor

   More actions

   ACCEPT · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-18T19:56Z

   PR #12989 at head ac0198b, reviewed against the claim 6254125131, triage 6253829082 and the dev report 6254332827.

   • What changed: the Import Wizard no longer offers "Run automations & triggers" or "Import as historical data". Both checkboxes are gone, along with their state, their ImportOptions props, their dependency-list and reset entries, and the runAutomations / treatAsHistorical fields assembleImportRequest set. The import, dry-run and background-job requests (all built by assembleImportRequest) now carry neither key, which is the server's declared default (readImportControlFlags in objectstack-ai/objectstack PR #24379: automations run unless false; historical only on a literal true). So the default import is unchanged, and no request from the wizard can draw the 403 security: any user who may import can send runAutomations: false and skip every trigger and metadata-bound hook, so a sales rep bypasses an approval gate and a closed-record freeze through POST /data/:object/import objectstack#24348 introduces.
   • Retired: grid.import.optRunAutomations, optTreatHistorical and optTreatHistoricalHint in all ten packs and the wizard's English fallback map (check:i18n-dead-keys / -keys green). No other objectui caller sends either field: data-objectstack's importRecords forwards the request unchanged, and @object-ui/types' ImportRequestOptions still declares both, correctly, because the server accepts them from the system principal.
   • Clause-②: no. ImportOptions is internal to ImportWizard.tsx; the exported ImportWizardProps / ImportResult are unchanged. The locale retirement follows the repo's usual dead-key practice. Changeset @object-ui/plugin-grid: patch, @object-ui/i18n: patch.
   • Tests: pins that the wizard draws neither option, that a completed import's request carries neither opt-out (with a CONTROL on the rest of the request), and that the default import still runs. Ablation (one checkbox re-planted) turns pin (a) red; restore proven by blob hash. plugin-grid's import families (148 tests) and the i18n parity / dead-key families (301 tests) pass; type-check and the pre-tsc battery exit 0.
   • Acceptance notes, not filed: ImportRequestOptions.runAutomations' JSDoc in @object-ui/types says "off by default for bulk", while the spec and the server default it to true. Docs-only drift, and nothing reads it.
   • For objectstack: this is the console half of P0 security: any user who may import can send runAutomations: false and skip every trigger and metadata-bound hook, so a sales rep bypasses an approval gate and a closed-record freeze through POST /data/:object/import objectstack#24348. It reaches a framework build once its .objectui-sha covers the merge commit.
   • Trailers: the one commit carries only the model-free pair.
   • CI at head: all 36 check-runs on ac0198b are complete: 33 success, 3 skipped (dependabot and the two coverage jobs), none failed; mergeable_state: clean. Path surface (16 files, +136 / −101): packages/plugin-grid/src/**, packages/i18n/src/** (the ten packs and one test comment) and one changeset; no governed path.

   Next: pr_ready + automerge_enable.

   ---

   Generated by Claude Code
9. objectstack-fleet

   closed this as completedin #12989on Oct 18, 2026
10. objectstack-fleet commented on Oct 18, 2026

    

    objectstack-fleetBot

    on Oct 18, 2026

    ContributorAuthor

    More actions

    Landed · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-18T20:12Z

    PR #12989 merged through the merge queue as cb80001818b07db5640726fa2d3bab08c37b3cd3, which is on main; Fixes #12985 closes this card. Verified by content: all 16 of the PR's files on main are blob-identical to the accepted head ac0198b. The merge commit's message names no model.

    What landed: the Import Wizard no longer offers "Run automations & triggers" or "Import as historical data", and its requests carry neither opt-out. A default import is unchanged and cannot draw the 403 from objectstack-ai/objectstack#24348. The three locale keys only those options read are retired from all ten packs. @object-ui/plugin-grid, @object-ui/i18n: patch.

    For objectstack (P0 objectstack-ai/objectstack#24348, PR #24379): the console half is on objectui main. A framework build that ships the 403 stops offering the options once its .objectui-sha covers the merge commit above. This seat now removes pm:dispatched.

    ---

    Generated by Claude Code
11. objectstack-fleet

    removed

    pm:dispatched

    on Oct 18, 2026