A full audit of HotCRM (objectstack-ai/hotcrm, ~18k lines of metadata) found ~20 shipped instances of one bug class — metadata referencing something that doesn't exist — all of which pass objectstack validate and objectstack lint cleanly and fail silently at runtime:
object: 'user' in a bulk-action lookup and four dashboard filters (the platform object is sys_user)- App navigation targeting
sys_approval_process, which @objectstack/plugin-approvals never registers
bulkActions: ['mass_update', 'mass_delete', 'assign_owner'] — no such actions defined- Page headers and KPI cards referencing fields that don't exist on the object (
{account}, total_revenue, …)
- A hook filtering
crm_lead on a campaign field that doesn't exist; another hook writing contact_email/contact_phone to an object without those fields
- Agent skills listing 11 tools with no definitions, a hand-off to a nonexistent skill, and agents referencing knowledge indexes defined nowhere
- Chart
yAxis naming raw fields instead of dataset measures
- Navigation-exposed objects (
crm_forecast, crm_knowledge_article) granted by no profile — permission-denied for every user including admin
- Translation bundles keyed to nonexistent fields (
assigned_to, budget, image_url, …) and select-option translations keyed by display label or by values that aren't in the field's option list (direct-mail vs direct_mail, planned vs planning)
The existing lint already checks some neighboring classes (validate-dashboard-action-refs, validate-widget-bindings, validate-flow-template-paths, validate-capability-references), but none of the categories above are covered. HotCRM comments document earlier instances of the same class being found and fixed one at a time.
A full audit of HotCRM (objectstack-ai/hotcrm, ~18k lines of metadata) found ~20 shipped instances of one bug class — metadata referencing something that doesn't exist — all of which pass
objectstack validateandobjectstack lintcleanly and fail silently at runtime:object: 'user'in a bulk-action lookup and four dashboard filters (the platform object issys_user)sys_approval_process, which@objectstack/plugin-approvalsnever registersbulkActions: ['mass_update', 'mass_delete', 'assign_owner']— no such actions defined{account},total_revenue, …)crm_leadon acampaignfield that doesn't exist; another hook writingcontact_email/contact_phoneto an object without those fieldsyAxisnaming raw fields instead of dataset measurescrm_forecast,crm_knowledge_article) granted by no profile — permission-denied for every user including adminassigned_to,budget,image_url, …) and select-option translations keyed by display label or by values that aren't in the field's option list (direct-mailvsdirect_mail,plannedvsplanning)The existing lint already checks some neighboring classes (
validate-dashboard-action-refs,validate-widget-bindings,validate-flow-template-paths,validate-capability-references), but none of the categories above are covered. HotCRM comments document earlier instances of the same class being found and fixed one at a time.