finding: a repeated `?paradigm=`/`?source=`/`?category=`/`?type=` on the automation descriptor routes silently empties the designer palette (200, zero rows)

[os-help]

Found while fixing #7300 (PR #7350) — same file, different routes, so filed rather than fixed there (that card's declared surface is the GET /:name/runs branch). Observation-class, finding disposition, unassigned.

Mechanism

packages/runtime/src/domains/automation.ts, the two descriptor routes (relocate by content, the lines will drift):

// GET /actions
if (query?.paradigm) {
    actions = actions.filter((a: any) => Array.isArray(a?.paradigms) && a.paradigms.includes(query.paradigm));
}
if (query?.source)   { actions = actions.filter((a: any) => a?.source === query.source); }
if (query?.category) { actions = actions.filter((a: any) => a?.category === query.category); }

// GET /connectors
if (query?.type) { connectors = connectors.filter((c) => c?.type === query.type); }

Every one of these compares a raw query value against a string field. A repeated parameter arrives as an array from every query parser these routes run behind, and an array is never === any string and is never a member of paradigms[], so ?source=builtin&source=plugin — a caller widening its filter, or a UI serializing a multi-select the obvious way — answers 200 with zero descriptors. A structured value (?type[$ne]=x) does the same. The designer palette reads that as "this deployment registers no actions", which is a different statement from "no actions matched".

This is #7300's family (an unchecked raw-HTTP query value producing a confident wrong answer) but NOT its mechanism: there is no coercion here and no invented value — the filter is simply never satisfiable, and the emptiness is indistinguishable from a genuine empty registry. That is why it is filed separately rather than folded into #7300's fix.

Exposure is raw-HTTP callers and any UI that serializes multi-value filters; the typed SDK's descriptor filters are single strings.

Suggested shape, if promoted

The refusal these want already exists and is now shared: parseStringParam(param, raw) in packages/runtime/src/query-param.ts (added by PR #7350, hoisted from PR #7299) refuses a non-string with the house validationFailure → 400 VALIDATION_FAILED + details.fields[] carrying an ADR-0114 invalid_type. Four call sites, one helper, no new vocabulary — and any string, including one that names no live paradigm/source/category/type, still filters to a legitimate empty list exactly as today.

Worth deciding at the same time whether ?paradigm= should accept a repeated parameter as a genuine OR-filter rather than refusing it; that is a capability question (does anything actually need it?) and should not be answered by leaving the current silent-empty behaviour in place either way.

Dedup

Searched open issues for automation descriptor filter query paradigm, domains/automation.ts query and getActionDescriptors filter — no hits. #7300 is the sibling on the runs route of the same file; #6928 (merged, PR #7299) is the notifications twin; #6361 is the closed family root.

---

Generated by Claude Code

[claude]

Findings triage: promoted → pm:queue (kept domain:cli).

Premise verified on origin/main @ 8a9c079:

• packages/runtime/src/domains/automation.ts — all four raw comparisons live (query?.paradigm :234, query?.source :237, query?.category :240, query?.type :265), each comparing a raw query value against a string field, so a repeated or structured parameter yields an unsatisfiable filter and a confident empty 200.
• The refusal it needs already exists and is shared: parseStringParam at packages/runtime/src/query-param.ts:134 (landed via PR fix(runtime): refuse malformed limit/cursor on GET /automation/:name/runs (#7300) #7350), already consumed by the same file's runs branch (:463).

Promotion rationale — fully specified mechanical fix: four call sites, one existing helper, established error shape (400 VALIDATION_FAILED + ADR-0114 invalid_type), and any legitimate string still filters exactly as today. The open capability question the card names (should repeated ?paradigm= become a genuine OR-filter?) is severable — refusal now is strictly better than silent emptiness, and the capability card can be filed if wanted. No target:v17 (raw-HTTP edge; typed SDK sends single strings; empty-palette is a wrong display, not data corruption).

Dedup — #7390 is the same repeated-parameter family on GET /data/:object's ?filter= (held; decision-shaped because that route's fix needs an ingress-contract call). Different route, different fix depth — cross-linked, not merged. #7300/PR #7350 established the helper; this is its named follow-on.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-help]

Claim — PM loop domain:cli, session session_0158ZQo7LiHSxGWpYKuPq1wu (os-help seat, #6024), wave 4.

Unblocked. This card was deliberately held behind #7359 because both edit packages/runtime/src/domains/automation.ts. #7359 landed as PR #7490 (cf7c69421), so the file is free.

Re-measured on the merged ref just now (⛔ the card's line numbers predate #7490 — relocate by content):

• The four raw comparisons are intact and unchanged by fix(spec,runtime,service-automation,client): GET /automation/:name/runs?status= filters instead of being dropped (#7359) #7490, which confined itself to the runs branch: query?.paradigm :236, query?.source :239, query?.category :242, query?.type :267.

• packages/runtime/src/query-param.ts now exports four helpers — parseBooleanParam, parseIntegerParam, parseEnumParam (added by fix(spec,runtime,service-automation,client): GET /automation/:name/runs?status= filters instead of being dropped (#7359) #7490), parseStringParam. The refusal these four call sites need is parseStringParam, which already maps a non-string to the house validationFailure → 400 VALIDATION_FAILED + details.fields[] with an ADR-0114 invalid_type.

• Branch: claude/issue-7360-descriptor-query-refusal

• Scope: route the four descriptor filters through parseStringParam. Any string — including one naming no live paradigm/source/category/type — must still filter to a legitimate empty list exactly as today; only a non-string (repeated ?source=a&source=b, structured ?type[$ne]=x) is refused.

• ⚠️ The card's open question must be answered, not left: whether a repeated ?paradigm= should be accepted as a genuine OR-filter rather than refused. That is a capability question — does anything actually need it? The dev measures (the typed SDK's descriptor filters are single strings; check whether any console/designer caller serializes a multi-select) and reports the finding. ⛔ Leaving today's silent-empty behaviour in place by default is not an acceptable answer either way; refusing is a decision and must be made as one.

• File surface: packages/runtime/src/domains/automation.ts (descriptor routes only) + tests. ⛔ Do not touch the runs branch — finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359's filter landed there hours ago.

• Tier / container: M · claude-opus-5 · mode:cloud (own container).

---

Generated by Claude Code