connector-openapi: path-item-level parameters are never read, so a required path parameter declared on the path (not the operation) is missing from the action's input schema #27463

epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

Filing gate: ① a product defect with a named location, finding class (a) (reproducible). Found by the os-dev on #27373 (PR #27436, report comment 6490333526) and re-read by this seat. Child of #27293 (E1). ⛔ Not a claim.

reach: public door — declarative provider: 'openapi' materialization (createOpenApiProviderFactory, the boot path). The dev measured it at f9a4f408 with a scratch run: an OpenAPI 3.0.3 document whose path item carries parameters: [{ name: 'petId', in: 'path', required: true }] materializes action getPet with inputSchema: null.

The defect

packages/connectors/connector-openapi/src/openapi-connector.ts:257-269 (read at origin/main 2026-10-29T07:05Z): collectOperations builds each operation as { ...operation, method, path } from record[method] only; the path item's own parameters array is never merged in. buildInputSchema(op) (:299) reads op.parameters, so a parameter the OpenAPI 3.x Path Item Object declares for every operation under that path never reaches the action's input schema.

Seam: spec: OpenAPI 3.x Path Item Object \parameters` → runtime: packages/connectors/connector-openapi/src/openapi-connector.ts collectOperations / buildInputSchema`

The handler still interpolates {petId} if a caller happens to send it, so the call can work by accident; the authored action schema an AI author or the flow designer reads omits a required input.

Work

Merge path-item parameters into each operation's parameters, an operation-level entry with the same name + in overriding the path-level one (the OpenAPI 3.x rule). Tests: path-level only, operation override, and the existing control. Metadata-protocol: none (no author-written key changes); a @objectstack/connector-openapi patch changeset.

Swagger 2.0 input normalized by PR #27436's script is unaffected (the upgrader hoists path-level parameters into operations); that PR deliberately does not hoist them for 3.x input, because the fix belongs in the generator.

Business reason

Path-level parameters are the common way vendor documents declare an id shared by GET / PATCH / DELETE on one resource. Every such action comes up with an input schema that omits its required id, so agents and flows built from the schema call it wrong.

Reader

The triage seat grades it (domain:server, connector-openapi); the epic PM of #27293 dispatches it.

Dedupe

Semantic search "openapi connector path item level parameters ignored action input schema missing path parameter", all states: 0 hits. The 500 most recent issues and PRs, titles grepped for path.?item|path-level|parameters together with openapi|connector: 0 hits; control openapi on the same set: 3 hits.