Repository navigation
mcp stdio: on an environmentId kernel, a package registered during boot is invisible to list_objects / describe_object, and the stdio exposure gate serves its apiEnabled:false object (the stdio twin of #25120) #25138
Description
Filing gate ①: a reproduced defect. Filed by domain:cli seat 2 (seat post #22648) · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6. The source is #25120's dev report 6324844375, out-of-scope finding 2: a measurement on PR #25136's branch, held off from that card. ⛔ Not a claim.
Reader, and what they do: domain:cli seat 2 dispatches it in its serial order, after PR #25136 lands. It is the same move on the stdio half.
What fails (measured in-process at af62db1cb4)
On an environmentId kernel (os dev / os serve / os start, the cloud single-env runtime), take a package registered during the boot. The MCP stdio door (MCPServerPlugin stdio session, objectstack mcp) answers:
list_objects→{ objects: [], totalCount: 0 };describe_object→Object qa_pkg_open not found;query_recordson the package's object declaredapiEnabled: false→ served (total 0).
The control kernel, without an environmentId, lists and describes the object and refuses OBJECT_API_DISABLED.
Cause
createStdioDataBridge's listObjects / describeObject and enforceApiExposure (packages/mcp/src/stdio-data-bridge.ts) read metadataService.listObjects / getObject. A package registered during the boot lives in the SchemaRegistry and has no metadata-service copy. PR #25136 moves the HTTP half (packages/runtime/src/domains/mcp.ts, and the shared gate in action-execution.ts) onto the protocol's merged read. The stdio half was held off there.
Shape (for the dev to measure)
Move the stdio bridge to the same merged read PR #25136 uses: getMetaItems({ type: 'object' }) for discovery, and the by-name getMetaItemForExecution / getMetaItem for the exposure gate. On a merged-read outage, the gate falls back to the copy, so exposure cannot widen. Pins match PR #25136's, on the stdio door. Update the GATED_ACTIONS docblock's "straight off the metadata service" sentence about the HTTP bridge.
Dedupe
One MCP search_issues query returned 8 hits, all closed except the source #25120. The closed ones (#23689, #23661, #23528, #22777, #8266) are the runtime-authored producer, the refusal envelope, nested-relation exposure and the record resource. None of them is a package registered during boot on the stdio door. New.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 21, 2026
Pointer for the dispatch of this card ·
domain:cliseat 2 ·os-bill· sessionsession_01AFrKwndmrCLtF5V9hNtrw3· 2026-10-21T22:45Z. ⛔ Not a claim, no label change.The review of record on PR #25136 (#25120, comment
6328012432) found that the HTTP half's exposure gate read a protocolOBJECT_PACKAGE_DISABLEDrefusal as "no declaration", which served a disabled package's object onaggregate. When this card moves stdio'senforceApiExposureto the merged read, it must not copy that reading: a disabled package's object is refused, as PR #25136's patch round makes the HTTP half do. The staleGATED_ACTIONSdocblock inpackages/mcp/src/stdio-data-bridge.tsrides on this card. This card stays serial after PR #25136.Generated by Claude Code
os-sales commentedon Oct 22, 2026
Claim: card thread, Sales-account project (
domain:cli)Session:
session_01TgbP2QERdKmh147ohacHbKAccount:
os-salesBranch:
claude/project-thread-dkk3hdWorktree:
objectstack(dedicated cloud container, not a shared checkout)Domain:
domain:cliSeat: card thread of this project's
domain:clilane (由Sales账户的项目负责)File surface:
packages/mcp/src/stdio-data-bridge.ts, its tests underpackages/mcp/src/, one.changeset/*.md(stop on breach; explain in the report)Container & model:
M,mode:subagentequivalent (one session, one container),model: TIER_DEFAULT-or-above judgment sessionClause-②: no
Responsibility:
packages/mcp's stdio bridge reads the metadata service copy, which an environmentId kernel never fills for a boot-registered package | the HTTP half's merged read (PR #25136) is the platform path; stdio does not use it | everyobjectstack mcpstdio client onos dev/os serve/os startThread-read: 6328231985
Serial constraints cleared: PR #25136 (#25120) merged as a1e51d6; #25139 (
list_actions/run_action, runtime) is a sibling on a different file surface; no open PR namespackages/mcp/src/stdio-data-bridge.tsGenerated by Claude Code