Repository navigation
排查「手抄 spec 清单 + "keep in sync" 注释」模式:一天内确认三例,全部曾静默漂移 #3786
Description
2026-07-28 一天之内,同一个缺陷形状确认了三例 —— 消费方手抄一份 spec 拥有的清单,注释写着"保持同步",没有任何机制保证 —— 且每一例都真的漂移过、都是静默失效(能力缺席,无报错):
| 实例 | 两份清单 | 漂移后果 | 修复 |
|---|---|---|---|
| #3723 | better-auth 角色注册表 vs sys_invitation.role/sys_member.role 选项 |
app 角色可请求、永不可存储 | #3747:派生 + 闸门 |
| cloud#898 | KNOWN_METADATA_CATEGORIES vs PLURAL_TO_SINGULAR |
positions[] 在发布/导出时被静默丢弃,托管环境整体缺席 |
派生 + 闸门 |
| cloud 同一清单的上一次漂移(ADR-0046) | 同上 | docs/books/themes 等被丢弃 |
当时手工补(未加闸门 → 于是有了第二次) |
另有一个刚出现的小型变种:cloud#898 自己的 CLOUD_ONLY_METADATA_CATEGORIES 把 triggers 归类为"cloud 特有",而它实为 framework METADATA_ALIASES 的键(triggers: 'hooks')—— 修手抄漂移的那次修复里又埋了一处小的分类手抄(已单开 cloud issue)。
请求:当模式排查,不是当孤立 bug
三例覆盖两个仓库、彼此独立发生,说明这不是巧合而是惯性写法。值得主动扫一遍三个仓库(framework / objectui / cloud),而不是等下一次静默失效自己冒出来:
- 注释线索:
grep -riE "keep.*in sync|kept in step|保持同步"—— 写了这句注释的地方,几乎就是没有闸门的地方; - 字面量对照:凡是硬编码的字符串数组/枚举,与
@objectstack/spec的导出(PLURAL_TO_SINGULAR、METADATA_ALIASES、字段类型清单、内置角色/身份常量等)做交集比对,找出"像是抄的"清单; - objectui 是重点嫌疑:它消费 spec 的类型/枚举清单做渲染分发,而本轮没有覆盖它。
每找到一处,修法是现成的模板(#3747 / cloud#898):从唯一来源派生;确实无法派生的,加一条「集合覆盖/不相交」断言当闸门。注释不是机制。
Metadata
Metadata
Assignees
Labels
No labels
Activity
chore: changeset for the metadata form ↔ Zod reconciliation (#3786)
fix(spec,rest): reconcile the metadata forms against their Zod — four…
feat(cli,docs): the build path reports undeclared keys too, and the g…
feat(spec,cli): report the authored object/field keys that get silent…
feat(spec,cli): publish the foundational capability slate so every ru…
os-zhuang commentedon Jul 30, 2026
objectui 侧(本 issue 点名的「重点嫌疑」)排查完结 —— objectui#3017 记录扫描结果:六处候选、当时全部内容一致、零闸门。现已全部落地:
ACTION_LOCATIONS、APPROVER_VALUE_SOURCES)→ objectui#3019 删掉第二份清单、直接 import;label 走Record<ActionLocation, string>,漏新值即编译错误。DesignerFieldType词汇改为运行时数组派生,bridge 的 27 型 Set 与FieldDesigner调色板由此不可漂移;@object-ui/types;detail 页HIDDEN_SYSTEM_FIELD_NAMES进一步改为 specFIELD_GROUP_SYSTEM_FIELDS− 审计集 派生;REFERENCE_IMPORT_TYPES与服务端同链:REFERENCE_VALUE_TYPES+'reference';FIELD_TYPE_CATEGORIES/CATEGORY_ORDER类目划分(tsc 只保证成员合法、不保证全覆盖,新类型会静默从类型下拉消失)、MetadataFieldsPage的又一份 27 型手抄(变异测试炸出来的)、multiValueFields与 specMULTI_OPTION_TYPES/MULTI_CAPABLE_TYPES逐项相同的两个 Set。附带收益:objectui 现在真实消费
FIELD_GROUP_SYSTEM_FIELDS做派生与子集断言 —— spec 这个词汇一动,objectui CI 会红,跨仓 tripwire 从此通电。遗留一项跨仓待办:布尔 token 表(
import-coerce.ts的BOOL_TRUE/BOOL_FALSE)仍是 spec 未导出的唯一手抄残留,已单开 #4173 跟踪;导出落地后 objectui 即可删掉最后一份钉扎清单。至此三仓扫描均有着落:framework(#4120)、cloud(cloud#898 及其变种)、objectui(objectui#3017)。
feat(spec): the unknown-authoring-key lint covers every metadata coll…
docs(validating-metadata): the undeclared-key rule covers top-level s…
feat(spec,objectql,rest): publish the audit-provenance and import-coe…
fix(spec,cli): config.storage was never a stack key — stop reading it…
docs(spec): correct the always-on slate's account of how cloud diverg…
feat(spec): unknown-key lint descends into nested metadata, not just …
fix(spec): type-check defineApp's navigation again — #4171 fixed only…
12 remaining items
fix(cli,spec,i18n): default-locale bundle tracks the source; promote …
feat(cli): carry the computed advisory lists on every `os build --jso…
feat(cli): carry the computed advisory lists on every `os build --jso…
feat(spec): translate dataset labels via translateDataset + a dataset…
docs(spec): correct the "silent strip" cost statement at all four sit…
refactor(spec)!: delete the seven cron-typed positions outright — no …
fix(cli): report the named export the config's default export already…
feat(spec): enumerate every repeater's row properties in the owning form
fix(cli)!: report the named export the config default export already …
feat(spec): a repeater property panel names its columns in every loca…
fix(cli,cloud-connection,types): CLI help, warnings and refusals stat…
test(spec): kernel test titles state each cited decision in words ins…
test(spec): the first data/ file group's test titles state each cited…
test(spec): the first system/ file group's test titles state each cit…
test(spec): the last system/ file group's test titles state each cite…