fix(mcp): the stdio door answers get_record misses and describe_object readonly as the HTTP door does - #33175

Requested by Tesla · project thread

Fixes #33030
Fixes #33156

Clause-②: no
Metadata-protocol: none

File surface (claim, as amended at review): packages/mcp/src/stdio-data-bridge.ts, packages/mcp/src/mcp-server-runtime.ts, packages/mcp/src/mcp-http-tools.ts (the get_record branch only), packages/runtime/src/domains/mcp.ts (bridge member, and the writeNeverSetsField JSDoc's last sentence), their tests, root .changeset/ (including .changeset/32530-describe-object-readonly-computed.md, one sentence).

维护者速读

• 改了什么：stdio 传输的 MCP 门现在和 HTTP /mcp 门回答一致。get_record 查不到记录（不存在或调用者无权看到）时回带编码的 RECORD_NOT_FOUND / 404，不再是一句无编码的文字；describe_object 和 objectstack://objects/{name} 资源对「表达式被字段遮蔽隐藏的存储计算字段」回 readonly: true。
• 为什么改：stdio 客户端按错误码分支，拿不到码就只能解析文字；readonly: false 会让代理去写一个引擎随后覆盖的字段，写了等于白写。
• 风险与回滚：只改 stdio 门的回答，使其等于 HTTP 门已有的回答；不放宽任何可读可写范围，隐藏的表达式和它引用的字段依然不下发。不存在与无权看到回同一个信封，不构成存在性探测。回滚 = revert 本 PR，不涉及数据。
• 先看：packages/mcp/src/mcp-server-runtime.ts 的 readObjectWithDeclaration 与 describeServedObject(def, declared)；packages/mcp/src/stdio-data-bridge.ts 的 callerObjectView（注册声明读取）；packages/mcp/src/mcp-http-tools.ts 的 get_record 空结果分支。
• 两分钟验证：pnpm --filter @objectstack/mcp exec vitest run --maxWorkers=2 src/stdio-data-bridge.not-found.test.ts src/stdio-data-bridge.object-schema-mask.test.ts，预期 42/42 通过。
• 需要你做的：无，席位落地。

What changes

• get_record (MCP stdio get_record answers a missing or hidden id with uncoded error text, while the HTTP door answers RECORD_NOT_FOUND 404 #33030). The stdio bridge's get answers a by-id miss with null by design, and the tool rendered that as Record "ID" not found in "OBJECT" with no code. The null branch now throws recordNotFoundError(objectName, recordId) (@objectstack/core, the repo's one not-found envelope) into the tool's own catch, which renders it through dataDoorErrorResult. That is the value the HTTP bridge's get throws (protocol.getData through callData) and the renderer its catch uses, so both doors render one throw through one renderer: { "error": { "code": "RECORD_NOT_FOUND", "message": "Record ID not found in OBJECT", "status": 404 } }. A missing id and an id the row filter hides reach the tool as the same empty read and answer the same bytes (no existence oracle). update_record and delete_record were already coded; pinned here, unchanged.
• describe_object and the objects resource (mcp: stdio describe_object and the objects resource serve readonly: false for a stored expression field whose expression the caller's field mask hides, while the HTTP door answers true #33156). The stdio caller view (callerObjectView) now registers, beside the view it returns, a read that answers the served object AND the declaration it was projected from, from ONE read of the definition (setDeclaredObjectRead, package-internal, keyed weakly by the view like setRuntimeObjectView). readObjectWithDeclaration(view, name) asks it; a view that registered none masks nothing, so its object is its declaration. describeServedObject(def, declared = def) judges readonly with writeNeverSetsField(declared.fields[key]), exactly as the HTTP twin does, and builds every other member from the served object. The stdio bridge's describeObject and buildObjectSchemaResource both read through it; plugin.ts already wires the resource to callerObjectView, so it needed no change.
• Why this option of the card's two. A second objectView.getObject read beside the masked one would read the definition twice, and the two reads could disagree mid-write; the registered read answers both halves from one read and serves nothing extra. Only writeNeverSetsField's boolean is read off the declaration: the expression and the field it names stay out of the answer (pinned, and ablated).

Tests

• packages/mcp/src/stdio-data-bridge.not-found.test.ts, new top-level describe on the file's existing engine double (its find made row-filtering, so no new double enters the check:engine-double-contract ledger): over the long-lived server start() attaches stdio to, the real createStdioDataBridge:
  • a missing id answers isError and the coded envelope;
  • a hidden id (a row only its owner reads) answers the same envelope, and the read ran as the caller;
  • CONTROL: the owner is served that row;
  • PARITY: for both ids, the stdio tools/call result equals, deep-equal, the HTTP /mcp result from handleHttpRequest (real Streamable HTTP transport) over a bridge whose get throws recordNotFoundError, the value mcp-coded-refusal.test.ts pins as the HTTP face's answer;
  • update_record and delete_record on both ids answer the same envelope.
• packages/mcp/src/stdio-data-bridge.object-schema-mask.test.ts, new top-level describe with the HTTP twin's fixture (marked_up is a stored expression over hidden_cost, which the member may not read):
  • precondition: the member's served object carries marked_up without its expression and no hidden_cost;
  • stdio describe_object and the resource (wired as plugin.ts wires it: callerObjectView over stdioObjectView) answer the full readonly map, marked_up: true, with no hidden_cost token and no record. expression text anywhere, and no expression member on marked_up;
  • the tool and the resource answer the same fields.
• packages/runtime/src/domains/mcp-object-schema-mask.test.ts: a PARITY case on the existing real-layer harness (real ObjectQL over SqlDriver, real SecurityPlugin, the real /mcp entry) holding the same readonly map for the same member over the authored fields. Neither package depends on the other (the reason the two describeServedObject twins exist), so the doors' parity is that one literal, pinned on each side.

Acceptance notes

• Deviation from the order's wording, declared. The order names errorResultWithCode for the null branch. The PR throws into the catch, which renders through dataDoorErrorResult, the renderer the HTTP door's own throw takes. For RECORD_NOT_FOUND the two produce the same bytes today (mcp-coded-refusal.test.ts pins both shapes); the catch path keeps them equal if the /data door ever adds a member (declaredCode, userMessage) to this code.
• DELIBERATE CORRECTION of a pending release note. .changeset/32530-describe-object-readonly-computed.md (pending, landed with PR fix(mcp,runtime): describe_object serves readonly: true where a write never sets the value #33150) described the stdio door and the objects resource as judging the served field, which this PR makes false. Its two sentences "On the HTTP transport, readonly is judged on the field as declared, … and the expression itself stays hidden. Over stdio and on the resource, which hold only the object as the caller is served it, the expression case answers true where the caller is shown the expression." now read: "On every transport, the resource included, readonly is judged on the field as declared, so a stored expression the caller is not shown (it names a field they cannot read) still answers true, and the expression itself stays hidden." check-empty-changeset.mjs --base origin/main is red on that file by design (DELIBERATE CORRECTION class); confirmation is the seat's record.
• The HTTP twin's JSDoc. writeNeverSetsField's last sentence in packages/runtime/src/domains/mcp.ts said the stdio twin "has only the masked object to ask"; it now says the stdio bridge and the resource ask the declared field too (readObjectWithDeclaration). Prose only.
• Same class, outside the cards: the record resource. objectstack://objects/{name}/records/{id} on a miss answers {"error":"Record \"ghost\" not found in \"task\""} with no code / status (measured over the long-lived server at this head), while its two sibling resources answer { error, code, status } and its own catch already adds them for a thrown coded refusal (mcp-server-runtime.ts, bridgeResources, record_by_id). Reported to the seat as a finding; not fixed here.
• Skills-docs: not owed (Metadata-protocol: none, no narrowing arm); skill-md.ts restates neither the not-found wording nor readonly.
• Serial. #33150 merged before the mcp: stdio describe_object and the objects resource serve readonly: false for a stored expression field whose expression the caller's field mask hides, while the HTTP door answers true #33156 half started (28a2f0f5, merged into this branch once); protocol-stdout.ts and cli/src/commands/serve.ts (fix(cli): with the stdio MCP transport on, a host plugin's console output while serving a call reaches stderr #33159) untouched.

Verification

All readings at head 59ccee50 (base 28a2f0f5) unless named. Head 532a02e5 adds only the two prose edits above; its re-run gates are in the last block.

Generated by Claude Code