fix(fields): password inputs carry an autocomplete token (objectui#13295) by objectstack-fleet[bot] · Pull Request #13300 · objectstack-ai/objectui

objectstack-fleet · 2026-10-21T05:47:35Z

Part of #13295
Clause-②: no

The card's three findings, each measured on objectui main (base 0093b2c826) first. One still needs code that can land now (the missing autocomplete on password inputs). One is already fixed on main (html lang). One is held for a seat decision (block namespaces). This PR carries the first. The card stays open for item 2, so the first line is Part of.

What changed

@object-ui/fields' PasswordField now sets autocomplete on its editable input:

current-password when the field name contains the word current, old or existing. The name is split into words at _, -, ., spaces and camelCase boundaries, so current_password, oldPassword and existing-pass all match.
new-password for every other name, including every secret.

Why the name: @objectstack/spec declares no autocomplete key on a field or an action param, so the widget derives the token from the one input every caller already gives it. Why new-password as the default instead of off: browsers ignore off on password inputs and offer the saved login password anyway. That is the wrong answer for a new password or an API key. new-password keeps the saved login out and lets a password manager suggest and save a new value. The helper is module-local, so there is no new export.

An action param of type password or secret reaches this widget through paramToField → resolveParamWidgetType. A change-password dialog therefore gets current-password and new-password with no change in app-shell.

Acceptance notes — per-item verdicts on `main`

#	Finding	Verdict on `main`	Reading
1	password dialog input is plaintext	Partly fixed on `main`; the rest is fixed in this PR	A probe rendered the real `ActionParamDialog` with `current_password` (`password`) and `tok` (`secret`) params. Both inputs came out `type="password"`, each with the show/hide toggle button beside it, and neither had an `autocomplete` attribute. `paramToField` maps `password`, `secret` and `text` to `password`, `password` and `text`. So the masking and the toggle are already on `main`, and cloud's pin bump brings them. The missing `autocomplete` is what this PR fixes.
2	five home blocks registered without a namespace	Still present; held for a decision	Importing `productBlocks` on `main` logs five `Registering component "X" without a namespace is deprecated` warnings, one each for `hero`, `stat`, `usage-bar`, `checklist` and `tile-grid`. The ruled change, `namespace: 'app-shell'` on the five calls, works. Bare `type: 'hero'` still renders, `app-shell:hero` renders too, and no warning is logged. But regenerating `KNOWN_SCHEMA_TYPES` adds five `app-shell:` keys that `objectui validate` refuses at `type`. That raises `registered-types-validate-ratchet-10859`'s `NAMESPACED_REFUSED_AT_TYPE` from 302 to 307, and that pin says it never rises. The fork goes to the seat (see the report on the card). The item-2 diff is not in this PR.
3	`html lang` stays `en` after switching to Chinese	Already fixed on `main`; no code	A probe mounted `I18nProvider` in `en`, saw `document.documentElement.lang` read `en`, called `changeLanguage('zh')`, and then read `zh`. `provider.tsx`'s `languageChanged` handler writes it, and `apps/console/index.html`'s `lang="en"` is only the first-paint value. Cloud's pin bump brings this.

Not touched here: the card's appendix items, objectui#13161 and objectui#5544.

Tests

New file packages/app-shell/src/views/ActionParamDialog.passwordParam-13295.test.tsx renders the real dialog with real widgets:

a current_password / new_password pair renders type="password" with current-password / new-password;
the name oldPassword reads as the current password;
the toggle switches the input to type="text" and back to password;
a secret param renders type="password" with new-password;
CONTROL: a text param renders type="text" with no autocomplete.

Ablation (fix committed at 94e4f8d720, then mutated). Deleting the autoComplete= line through ablation-replace.mjs (anchor count 1 → 0, blob ccc024acdfac → f634dd6ee3ec) turned the three autocomplete tests red. The toggle and text controls stayed green: Tests 3 failed | 2 passed (5). Restore: blob after restore ccc024acdfac equals the HEAD blob, and git diff HEAD is empty.

Gates (at `94e4f8d720`)

Closure build turbo run build --filter=@object-ui/app-shell^...: 28/28 tasks. type-check passed for @object-ui/fields and @object-ui/app-shell. The new test is in app-shell's tsconfig.test.json program (--listFilesOnly count 1).
Targeted vitest, one package at a time, --maxWorkers=1, all green:
- app-shell: 7 files, 113 tests. This covers the new file plus ActionParamDialog.test, ActionParamDialog.ariaRequired, paramToField.test and the two product-block files.
- fields: 4 files, 415 tests. These are the families that name PasswordField.
- others: 6 files, 717 tests.
- scripts: 3 files, 74 tests.
The full packages/fields/ and packages/app-shell/ directories are left to CI.
Narrowed eslint --no-inline-config on the two changed source files: 2 files, 0 errors, 0 warnings. The repo config enables no type-aware linting, so this diff cannot change the lint result for any file it does not touch.
Each of these exited 0: check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, control-bytes, check-hand-rolled-comment-mask, check-changeset-fixed, check-changeset-presence and check:new-line-citations.

Changeset: .changeset/13295-cloud-console-findings.md, a patch for @object-ui/fields.

Session: https://claude.ai/code/session_01XVp19E1MYUTFM3dnkwz8gB

Generated by Claude Code

…295) The password widget's editable input now sets `autocomplete`: `current-password` when the field name has a word `current`, `old` or `existing`, `new-password` otherwise. An action param of type `password` or `secret` reaches this widget through `paramToField`, so the console's change-password dialog gets the right tokens. The pin renders the real dialog; a `text` param is the control. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVp19E1MYUTFM3dnkwz8gB

github-actions · 2026-10-21T05:51:08Z

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 77 chunks)	3224.9 KB	3744.1 KB
Main entry chunk (gzip)	81.2 KB	350 KB
Entry file	`index-CP6zM4NN.js`	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (buildIdentity.js)	0.80KB	0.49KB
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	21.41KB	7.90KB
app-shell (runtime-config.js)	24.52KB	8.48KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.11KB	3.87KB
auth (ActiveOrganizationStorage.js)	27.95KB	10.04KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	45.59KB	12.03KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	20.67KB	6.12KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.72KB	2.24KB
auth (SocialSignInButtons.js)	9.74KB	3.94KB
auth (UserMenu.js)	3.39KB	1.21KB
auth (auth-gate-events.js)	1.62KB	0.83KB
auth (authStyles.js)	5.27KB	1.86KB
auth (createAuthClient.js)	42.84KB	11.66KB
auth (createAuthenticatedFetch.js)	8.54KB	3.46KB
auth (index.js)	3.63KB	1.64KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	27.26KB	8.03KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.28KB	2.60KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (commentAuthorship.js)	1.39KB	0.78KB
collaboration (index.js)	1.93KB	0.85KB
collaboration (useCollaborationTranslation.js)	6.50KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	617.43KB	150.56KB
core (index.js)	10.18KB	4.04KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	252.96KB	70.67KB
fields (index.js)	294.97KB	75.45KB
i18n (LocalizationContext.js)	2.92KB	1.42KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	2.59KB	1.22KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.52KB	2.39KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	39.35KB	12.88KB
i18n (translateFn.js)	0.20KB	0.18KB
i18n (useDisplayLocale.js)	3.52KB	1.76KB
i18n (useObjectLabel.js)	36.87KB	9.88KB
i18n (useSafeTranslation.js)	7.14KB	2.92KB
layout (index.js)	41.40KB	12.01KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	6.62KB	2.45KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	5.52KB	2.10KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	15.35KB	5.51KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.82KB	2.38KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.33KB	3.07KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	16.04KB	3.92KB
plugin-calendar (index.js)	55.56KB	16.21KB
plugin-charts (index.js)	86.06KB	23.66KB
plugin-chatbot (index.js)	238.47KB	56.30KB
plugin-dashboard (index.js)	147.53KB	39.95KB
plugin-designer (index.js)	233.95KB	50.08KB
plugin-detail (index.js)	267.56KB	71.11KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	186.64KB	48.54KB
plugin-gantt (index.js)	178.46KB	45.13KB
plugin-grid (index.js)	276.74KB	76.89KB
plugin-kanban (index.js)	64.49KB	19.83KB
plugin-list (index.js)	149.81KB	39.28KB
plugin-map (index.js)	27.17KB	9.00KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	46.66KB	13.13KB
plugin-timeline (index.js)	39.31KB	11.88KB
plugin-tree (index.js)	15.27KB	5.40KB
plugin-view (index.js)	94.54KB	24.33KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	12.07KB	3.68KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	126.45KB	41.40KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.71KB	2.11KB
react (schema-input.js)	4.31KB	2.07KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (body-dialect.js)	4.50KB	1.99KB
sdui-parser (codegen.js)	9.45KB	3.76KB
sdui-parser (dashboard-widget-options.js)	3.07KB	1.30KB
sdui-parser (index.js)	7.30KB	3.12KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	25.28KB	7.81KB
sdui-parser (provenance.js)	3.84KB	1.90KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	23.87KB	7.83KB
types (ai.js)	4.39KB	2.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	4.12KB	1.61KB
types (authoring-nodes.js)	0.20KB	0.19KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (cloud.js)	0.20KB	0.18KB
types (complex.js)	4.44KB	2.07KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (dashboard-widget-layout.js)	2.06KB	0.96KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	1.13KB	0.65KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	5.78KB	2.70KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	5.00KB	2.39KB
types (navigation.js)	0.20KB	0.18KB
types (node-slots.js)	7.18KB	2.34KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	2.52KB	1.31KB
types (plugin-scope.js)	0.20KB	0.18KB
types (product-blocks.js)	0.20KB	0.19KB
types (record-approval-decision.js)	0.20KB	0.20KB
types (record-components.js)	0.20KB	0.19KB
types (record-panels.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	4.99KB	1.96KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	19.93KB	7.26KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.48KB	3.50KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

✅ Core packages should be < 50KB gzipped
✅ Component packages should be < 100KB gzipped
⚠️ Plugin packages should be < 150KB gzipped

objectstack-fleet Bot assigned baozhoutao Oct 21, 2026

github-actions Bot added tests package: app-shell package: fields labels Oct 21, 2026

objectstack-fleet Bot mentioned this pull request Oct 21, 2026

[Decision] Console home blocks registered without a namespace: raise the namespaced ratchet, arm twins, or leave bare #13301

Closed

objectstack-fleet Bot mentioned this pull request Oct 21, 2026

cloud 测试发现：修改密码弹窗输入框为明文、首页积木注册缺 namespace 告警、html lang 写死 #13295

Closed

objectstack-fleet Bot marked this pull request as ready for review October 21, 2026 06:01

objectstack-fleet Bot enabled auto-merge October 21, 2026 06:01

objectstack-fleet Bot added this pull request to the merge queue Oct 21, 2026

Merged via the queue into main with commit 813c3d9 Oct 21, 2026
37 checks passed

objectstack-fleet Bot deleted the claude/issue-13295-cloud-console-findings branch October 21, 2026 06:14

objectstack-fleet Bot mentioned this pull request Oct 21, 2026

[PM seat] domain:ui · seat 2 — 🟢 baozhoutao · session_01XVp19E1MYUTFM3dnkwz8gB · batch 1 (container restarts) · 70 landed · in flight #12625 #9771

Open

Navigation Menu

Repository navigation

fix(fields): password inputs carry an autocomplete token (objectui#13295) - #13300

fix(fields): password inputs carry an autocomplete token (objectui#13295)#13300
objectstack-fleet[bot] merged 1 commit into
mainfrom
claude/issue-13295-cloud-console-findings

objectstack-fleet Bot commented Oct 21, 2026

Uh oh!

github-actions Bot commented Oct 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

objectstack-fleet Bot commented Oct 21, 2026

What changed

Acceptance notes — per-item verdicts on main

Tests

Gates (at 94e4f8d720)

Uh oh!

github-actions Bot commented Oct 21, 2026

✅ Console Performance Budget

📦 Bundle Size Report

Size Limits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Acceptance notes — per-item verdicts on `main`

Gates (at `94e4f8d720`)