fix(cli): a --no-server boot no longer reports an unknown-hostname guard ordering fault

The unknown-hostname guard read the HTTP server with
getService?.('http.server') ?? getService?.('http-server'), the same trap as
the datasource admin routes: the kernel's getService throws on a name nothing
registered, so on a boot with no server (OS_ROOT_DOMAIN set, --no-server) the
throw landed in the install catch and printed "install failed" with the
kernel's "composition/ordering fault" text. init now reads the server through
readComposedHttpServer, so that boot takes the guard's own degrade line, and
an install that throws on a composed server still warns "install failed".

Pins in serve-unknown-hostname-guard.test.ts: a real ObjectKernel boot with no
server (the degrade line once, no "install failed", no "ordering fault"), its
composed control (installed, and refusing an unmapped host), and an install
failure on a usable server still warning "install failed". The throwing
service-resolution case now expects the degrade line. slot-lookup: serve.ts
7 -> 6. The changeset names the guard's line too.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BVm1pAXVXQ3PjC42j1kPFf

Author: claude

.changeset/24022-datasource-admin-no-server.md

@@ -2,6 +2,6 @@
 '@objectstack/cli': patch
 ---
 
-`os serve --no-server` no longer reports an ordering fault for the datasource admin routes. A boot that composes no HTTP server used to print, in its boot diagnostics, `WARN [datasource-admin] route registration failed: [Kernel] Service 'http.server' not found (… a composition/ordering fault; registration order is not a contract.)`, although nothing was at fault. It now prints the routes' own degrade line, `WARN [datasource-admin] http.server unavailable; REST routes not installed`, beside the same boot's other "not mounted" lines.
+`os serve --no-server` no longer reports an ordering fault for the datasource admin routes or for the unknown-hostname guard. A boot that composes no HTTP server used to print, in its boot diagnostics, `WARN [datasource-admin] route registration failed: [Kernel] Service 'http.server' not found (… a composition/ordering fault; registration order is not a contract.)`, although nothing was at fault. With `OS_ROOT_DOMAIN` set, the same boot also printed `WARN [unknown-hostname-guard] install failed` with the same kernel text. Each now prints its own degrade line, beside the same boot's other "not mounted" lines: `WARN [datasource-admin] http.server unavailable; REST routes not installed`, and `WARN [unknown-hostname-guard] http.server unavailable; guard not installed`.
 
-What still warns: on a boot that does compose an HTTP server, a route registration that throws still prints `[datasource-admin] route registration failed` with the error. A composed boot mounts `/api/v1/datasources` as before, including under `--no-server` when the config mounts its own `HonoServerPlugin`. The plugin now reads only the canonical `http.server` service. Its old fallback to the deprecated `http-server` alias never ran: on a boot without `http.server` the canonical read threw first. So every boot that mounted these routes before still mounts them.
+What still warns: on a boot that does compose an HTTP server, a route registration that throws still prints `[datasource-admin] route registration failed` with the error, and a guard install that throws still prints `[unknown-hostname-guard] install failed` with the error. A composed boot mounts `/api/v1/datasources` and installs the hostname guard as before, including under `--no-server` when the config mounts its own `HonoServerPlugin`. Both plugins now read only the canonical `http.server` service. Their old fallback to the deprecated `http-server` alias never ran: on a boot without `http.server` the canonical read threw first. So every boot that mounted these routes or installed the guard before still does.

packages/cli/src/commands/serve-unknown-hostname-guard.test.ts

@@ -45,9 +45,21 @@
  * exported constants the middleware itself branches on, so a subdomain or a
  * probe path added to the guard is covered the moment it is added rather than
  * the day someone remembers to copy it here.
+ *
+ * ## #24022 — a boot with no HTTP server takes the degrade line
+ *
+ * `OS_ROOT_DOMAIN=… os serve <config> --no-server` printed `[unknown-hostname-guard]
+ * install failed` with the kernel's "composition/ordering fault" text, though
+ * nothing was at fault: `init` read the server with a `getService?.(…) ??
+ * getService?.(…)` chain, and the kernel's `getService` THROWS on a name
+ * nothing registered, so the throw landed in the install `catch`. `init` now
+ * reads through `readComposedHttpServer`. The last describe block boots a REAL
+ * `ObjectKernel`, so the throw it must survive is the kernel's own, and pins
+ * the composed control beside it.
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { ObjectKernel } from '@objectstack/core';
 import { HonoHttpServer } from '@objectstack/plugin-hono-server';
 
 import {
@@ -85,8 +97,11 @@ function mountGuard(opts: {
   knownHosts?: string[];
   /** Replace the env-registry with something broken, to pin the fall-throughs. */
   registryOverride?: unknown;
-  /** Force the `http.server` resolution to fail the way production tolerates. */
-  httpServer?: 'missing' | 'no-raw-app' | 'throws';
+  /**
+   * Force the `http.server` resolution to fail the way production tolerates.
+   * `install-throws`: a usable server whose raw app refuses the middleware.
+   */
+  httpServer?: 'missing' | 'no-raw-app' | 'throws' | 'install-throws';
 } = {}): Promise<Harness> {
   const server = new HonoHttpServer(0);
   const rawApp = server.getRawApp();
@@ -110,7 +125,9 @@ function mountGuard(opts: {
       ? undefined
       : opts.httpServer === 'no-raw-app'
         ? { getRawApp: () => ({}) }
-        : { getRawApp: () => rawApp },
+        : opts.httpServer === 'install-throws'
+          ? { getRawApp: () => ({ use: () => { throw new Error('middleware table sealed'); } }) }
+          : { getRawApp: () => rawApp },
     'env-registry': registry ?? undefined,
   };
 
@@ -120,7 +137,7 @@ function mountGuard(opts: {
       return services[name];
     },
     logger: {
-      warn: (msg: string) => { warnings.push(msg); },
+      warn: (msg: string, meta?: unknown) => { warnings.push(meta === undefined ? msg : `${msg} ${JSON.stringify(meta)}`); },
       info: (msg: string) => { infos.push(msg); },
     },
   };
@@ -379,10 +396,22 @@ describe('createUnknownHostnameGuardPlugin — install is soft, never fatal', ()
     expect(h.warnings.join('\n')).toContain('http.server unavailable');
   });
 
-  it('never throws out of init when service resolution fails', async () => {
+  it('never throws out of init when service resolution throws, and reads the throw as no server (#24022)', async () => {
+    // The kernel's `getService` throws on a name nothing registered, so a
+    // throwing read IS the no-server boot: the degrade line, not "install failed".
     const h = await mountGuard({ httpServer: 'throws' });
 
-    expect(h.warnings.join('\n')).toContain('install failed');
+    expect(h.warnings.join('\n')).toContain('http.server unavailable');
+    expect(h.warnings.join('\n')).not.toContain('install failed');
+    expect((await h.call('/api/v1/objects', 'nobody.objectos.ai')).status).toBe(200);
+  });
+
+  it('CONTROL: a composed server whose raw app refuses the middleware still warns "install failed", naming the error', async () => {
+    const h = await mountGuard({ httpServer: 'install-throws' });
+
+    expect(h.warnings).toHaveLength(1);
+    expect(h.warnings[0]).toContain('install failed');
+    expect(h.warnings[0]).toContain('middleware table sealed');
   });
 
   it('logs the install once the middleware is mounted', async () => {
@@ -469,3 +498,84 @@ describe('createUnknownHostnameGuardPlugin — install order is the contract', (
     expect(asked).toEqual(['nobody.objectos.ai']);
   });
 });
+
+/**
+ * #24022, on a REAL `ObjectKernel`: the throw `init` has to survive is the
+ * kernel's own, with the kernel's own "composition/ordering fault" wording. The
+ * plugin's `ctx.logger` IS the kernel's logger, so a spy on it sees the plugin's
+ * lines as well as the kernel's.
+ */
+describe('createUnknownHostnameGuardPlugin — a real kernel boot (#24022)', () => {
+  /** The one service a kernel refuses to start without. Nothing here reads data. */
+  const DATA_STUB = {
+    name: 'com.example.fx24022.data-stub',
+    version: '1.0.0',
+    init: async (ctx: { registerService(name: string, service: unknown): void }) => { ctx.registerService('data', {}); },
+    start: async () => {},
+  };
+
+  /** Boot the guard (and `extra`, registered AFTER it); every line the kernel logger was asked to warn or info. */
+  async function bootGuard(extra: Array<typeof DATA_STUB> = []) {
+    const kernel = new ObjectKernel({ logger: { level: 'silent' }, gracefulShutdown: false });
+    const logger = (kernel as unknown as { logger: { warn: (...args: unknown[]) => void; info: (...args: unknown[]) => void } }).logger;
+    const warn = vi.spyOn(logger, 'warn');
+    const info = vi.spyOn(logger, 'info');
+    const lines = (spy: typeof warn) => spy.mock.calls.map((args) => args.map((a) => (typeof a === 'string' ? a : JSON.stringify(a))).join(' '));
+    await kernel.use(DATA_STUB);
+    await kernel.use(createUnknownHostnameGuardPlugin({ rootDomain: ROOT_DOMAIN, readCloudUrl: () => '' }));
+    for (const plugin of extra) await kernel.use(plugin);
+    await kernel.bootstrap();
+    return {
+      warnings: () => lines(warn),
+      infos: () => lines(info),
+      stop: async () => { await kernel.shutdown(); warn.mockRestore(); info.mockRestore(); },
+    };
+  }
+
+  const ours = (lines: string[]) => lines.filter((l) => l.includes('[unknown-hostname-guard]'));
+
+  it('no server composed: the degrade line, once — no "install failed", no "ordering fault"', async () => {
+    const boot = await bootGuard();
+    try {
+      const warnings = boot.warnings();
+      const seen = `\n--- warnings ---\n${warnings.join('\n')}`;
+      expect(warnings.filter((w) => w.includes('install failed')), seen).toEqual([]);
+      expect(warnings.filter((w) => w.includes('ordering fault')), seen).toEqual([]);
+      const said = ours(warnings);
+      expect(said, `not exactly one [unknown-hostname-guard] line${seen}`).toHaveLength(1);
+      expect(said[0], seen).toContain('http.server unavailable; guard not installed');
+    } finally {
+      await boot.stop();
+    }
+  });
+
+  it('CONTROL: a composed server, ordered ahead by optionalDependencies, gets the guard installed and refusing', async () => {
+    const server = new HonoHttpServer(0);
+    const rawApp = server.getRawApp();
+    const serverPlugin = {
+      name: 'com.objectstack.server.hono',
+      version: '1.0.0',
+      init: async (ctx: { registerService(name: string, service: unknown): void }) => {
+        ctx.registerService('http.server', server);
+        ctx.registerService('env-registry', { resolveByHostname: async () => null });
+      },
+      start: async () => {},
+    };
+    const boot = await bootGuard([serverPlugin]);
+    try {
+      const seen = `\n--- warnings ---\n${boot.warnings().join('\n')}`;
+      expect(ours(boot.warnings()), `an [unknown-hostname-guard] warning on a composed boot${seen}`).toEqual([]);
+      expect(ours(boot.infos()).some((l) => l.includes('installed')), seen).toBe(true);
+
+      // Registered after the guard, as every route-registering plugin is.
+      rawApp.all('*', (c: { text: (body: string, status: number) => Response }) => c.text(PASSED_THROUGH, 200));
+      const res = await rawApp.fetch(new Request('http://placeholder/api/v1/objects', {
+        headers: { host: 'nobody.objectos.ai', accept: 'application/json' },
+      }));
+      expect(res.status).toBe(404);
+      expect((await res.json() as RefusalBody).error?.code).toBe('ENVIRONMENT_NOT_FOUND');
+    } finally {
+      await boot.stop();
+    }
+  });
+});

packages/cli/src/commands/serve.ts

@@ -5953,7 +5953,7 @@ export function createUnknownHostnameGuardPlugin(
     optionalDependencies: ['com.objectstack.server.hono'],
     init: async (ctx: any) => {
       try {
-        const httpServer: any = ctx.getService?.('http.server') ?? ctx.getService?.('http-server');
+        const httpServer: any = readComposedHttpServer(ctx);
         const rawApp = httpServer?.getRawApp?.();
         if (!rawApp || typeof rawApp.use !== 'function') {
           ctx.logger?.warn?.('[unknown-hostname-guard] http.server unavailable; guard not installed');

scripts/slot-lookup-baseline.json

@@ -1,7 +1,7 @@
 {
   "packages/cli/src/commands/migrate/files-to-references.ts": 1,
   "packages/cli/src/commands/migrate/value-shapes.ts": 1,
-  "packages/cli/src/commands/serve.ts": 7,
+  "packages/cli/src/commands/serve.ts": 6,
   "packages/client/src/client.hono.test.ts": 2,
   "packages/cloud-connection/src/cloud-connection-plugin.ts": 5,
   "packages/cloud-connection/src/marketplace-install-local-plugin.ts": 14,