Repository navigation
The back-compat capability derivation refreshes label/description on ANY existing sys_capability row, including admin-authored ones — the comment above it says the opposite #5876
Description
Found while implementing #4967 Part 1 (PR #5875). Out of scope there, filed for triage.
What
bootstrapSystemCapabilities' seed loop updates label/description on whatever row it
finds for a derived name, without looking at managed_by:
packages/plugins/plugin-security/src/bootstrap-system-capabilities.ts (~100):
for (const def of byName.values()) {
const existing = await tryFind(ql, 'sys_capability', { name: def.name }, 1);
if (existing[0]?.id) {
// Keep label/description fresh, but do NOT clobber admin edits — only
// platform-owned display fields are reconciled. `scope` is an
// admin-editable classification face …, so it is seed-once …
if (await tryUpdate(ql, 'sys_capability', { id: existing[0].id, label: def.label, description: def.description })) {The comment claims admin edits are not clobbered. What #2909 T3 actually made seed-once is
scope, and only scope. For a derived name (as opposed to a curated platform one)
def.label is humanize(name) and def.description is Capability name. — so an
existing row's authored label/description are overwritten with a humanized placeholder
on every boot, whoever authored them.
Measured
PR #5875 added a pin that exercises exactly this shape (it is there to justify a design
choice in that PR, not to cover this defect):
packages/plugins/plugin-security/src/bootstrap-declared-capabilities.test.ts,
REVERSE: dropping that name from the list lets the derivation overwrite the admin row —
a row { name: 'showcase.export_data', label: 'Admin Made', managed_by: 'admin' } comes
out of the derivation pass labelled Showcase Export Data.
Reachability
Narrow but real, and it needs the admin row to pre-exist the grant:
- an admin creates capability
Xin Setup (managed_by:'admin'— the only provenance the
ADR write-guard leaves admin-writable); - an app whose bootstrap permission set grants
XviasystemPermissions[]is installed; - every boot from then on rewrites that row's
label/descriptionto humanized text.
The reverse order is NOT reachable: once the derivation has created the managed_by:'platform'
placeholder, the package/platform write-guard blocks the admin from editing it at all, so
the more obvious "admin renames a derived capability" path fails earlier and differently.
Worth deciding as part of the same question: whether the derived pass should reconcile
display fields on a row it did not create at all, or only on rows it owns
(managed_by:'platform' created by itself) — the curated half of the loop has a real reason
to refresh (the platform's own definitions ship new copy), the derived half does not.
Not touched by #5875, which only stops refused declarations from suppressing the
derivation; the clobber above is on a different path and predates it.
Activity
claude commentedon Aug 6, 2026
分诊:
pm:queue+domain:identity落点锚定:修复落在
packages/plugins/plugin-security/src/bootstrap-system-capabilities.ts的 seed 循环(正文点名的 ~100 行tryUpdate),plugin-security属 identity 车道 ⇒domain:identity。⛔ 未按标题里的 "capability" 词汇猜domain:spec/engine-core——sys_capability的声明面确在别处,但这条缺陷的写入方只有这一个文件,单文件收口。判
pm:queue而非finding,三条依据:bootstrap-declared-capabilities.test.ts里REVERSE: dropping that name from the list lets the derivation overwrite the admin row恰好走的就是这个形状({name:'showcase.export_data', label:'Admin Made', managed_by:'admin'}被改写成Showcase Export Data)。修法只需在tryUpdate前读managed_by,不是设计题;scope。留着它,下一个读这段代码的人会据注释做出错误推断;查重:三仓 open issue/PR 搜
sys_capability/managed_by/bootstrapSystemCapabilities,唯一相邻的 #2776(Permission Model v2 parking lot)带tracking+status:parked,按分诊范围排除且非同题 ⇒ 无重复,不设Blocked-by:。与 PR #5875 是不同代码路径(#5875 只管「被拒声明不再压制派生」),立单者已声明,核对属实。过时前提检查:
git log origin/main -- packages/plugins/plugin-security/src/bootstrap-system-capabilities.ts最近一次触碰仍在 #5875 之前,正文引用的代码形状在 main 上现存,前提成立。managed_by守卫,消除 clobber),若实现中认为该收窄成「只 reconcile 自己创建的managed_by:'platform'行」,那属于策略变更 —— 请在 PR 正文说明,或另起决策件,⛔ 不要在同一 PR 里静默扩面。本评论来自分诊座位 Routine(#5474 试点),不构成认领。
Generated by Claude Code
baozhoutao commentedon Aug 6, 2026
认领:PM 循环第 5 轮(
domain:identity车道)会话:
session_01JwwiU9bjhwy2SWj13ho8uv分支:
claude/issue-5876-derived-pass-managed-by-guardWorktree:
objectstack-issue-5876域:
domain:identity文件面:
packages/plugins/plugin-security/src/bootstrap-system-capabilities.ts+ 测试 +.changeset/*按分诊指引窄修派发(
tryUpdate前按managed_by守卫,消除对 admin/authored 行的每 boot clobber);「派生 pass 是否根本不该碰它没创建的行」的宽问按分诊要求不静默扩面。验收挂点用 PR #5875 留下的 REVERSE pin(改红为绿)。同日 churn 仅 #5875 自身(已合并),基于新 main 实施。Generated by Claude Code
baozhoutao commentedon Aug 6, 2026
复核 ACCEPT(PM,
session_01JwwiU9bjhwy2SWj13ho8uv,第 5 轮):交付 PR #5934。managed_by守卫,宽问按分诊要求未扩面且在 PR 正文单列(并留下有价值的观察:对派生半边「只碰 platform 行」≡「只碰自己创建的行」,真正未决的是 curated 半边要不要越过 admin 行 —— 该问题连同可达性判断留给未来决策件,未为未定行为写 pin,克制正确)。skippedAuthored进启动摘要不 warn([convention] best-effort 降级导致"看起来正常、实则不持久"时不应记 warn——把 #4460 的点状修复定成规则 #4632 判定正确:能力照常解析、作者文案本就是更好的那份);provenance 缺失按「证不出是我们的 = 不是」处理(字段 required + default 'admin',fail-safe 方向对)。CI 全绿(21 checks,FAILED: none),转 ready 入合并队列。
Generated by Claude Code
fix(plugin-security): count and warn the derived capability skip that…
fix(security): the derived capability seeder owns its row by the same…