fix(actions): one source for the /actions envelope rule, and redirectUrl finally works

[os-zhuang]

Follow-up to #2963 (objectstack#3913). That PR fixed the symptom in the two places it appeared; this one removes the reason it could appear at all, and fixes a third bug found while doing so.

The rule existed twice, and drifted

The /actions response wraps twice — the route's own {success, data} inside the dispatcher's — and a failure has three shapes, only one of which res.ok catches:

{                          ← transport envelope
  success: true,
  data: {                  ← action envelope
    success: true,
    data: { … }            ← what the handler actually returned
  }
}

That rule was hand-rolled in useConsoleActionRuntime.serverActionHandler and again in RecordDetailView's copy of the same handler. Four hand-rolled readings produced three distinct bugs:

1. A failed action reported as success — the copy that didn't inspect the inner envelope was the console's main action path, so a failure fired the green "completed" toast on every list and page surface. (Fixed in fix(actions): a failed server action no longer reports as success (green toast) #2963.)
2. React Task: Refactor Monorepo to Support Lazy-Loaded Plugins #31 crash — the nested {message, code} object handed to toast.error() as a React child. (Fixed in fix(actions): a failed server action no longer reports as success (green toast) #2963.)
3. redirectUrl never fired — fixed here.

Both handlers now call interpretActionResponse from utils/actionResponse, and actions-envelope.ratchet.test.ts fails if a third hand-rolled copy appears. The ratchet also asserts it is still scanning the two known callers, so it can't start passing vacuously if the files move.

redirectUrl was unreachable, not merely wrong

A script action can return { redirectUrl: 'https://…' } to ask the console to open a URL. Both handlers read it off body.data — the action envelope, one level too shallow:

{ success: true, data: { success: true, data: { redirectUrl: '…' } } }
                 ^^^^ read here          ^^^^ actually lives here

body.data is constructed by the server and only ever holds success / data, so body.data.redirectUrl was always undefined. There was no handler-side workaround — that level isn't reachable from a handler's return value at all.

An opensInNewTab action was worse than a no-op: it pre-opens a tab on a spinner page for popup-blocker safety, and with no redirect to drive it to, that tab sat on the spinner forever.

What is deliberately NOT changed

ActionResult.data still carries the action envelope, not the payload. resultDialog field paths in the wild may have adapted to that depth (apiHandler's own comment describes exactly that class of workaround), so re-pointing it silently would break configs. Flagging it rather than doing it — happy to follow up if you want it corrected properly with a migration note.

Testing

• Full app-shell suite: 1929 passed (234 files).
• type-check clean; eslint 0 errors on changed files.
• New utils/__tests__/actionResponse.test.ts (10 cases) pins all three failure shapes and the double-wrap read; one new case in useConsoleActionRuntime.test.tsx drives redirectUrl end-to-end through window.open.
• Verified the new tests actually catch the bug: reverting readActionPayload to the old shallow read fails 3 of them, and they pass with it.

🤖 Generated with Claude Code

https://claude.ai/code/session_011AvZj6cLX7APd7roh2eK4F

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Jul 29, 2026 12:33pm

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	27.9 KB	350 KB
Entry file	index-CqQ7rt-_.js	—
Status	PASS	—

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	8.20KB	2.97KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	7.57KB	2.97KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	22.10KB	4.37KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.12KB	3.41KB
auth (LoginForm.js)	17.86KB	5.29KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.43KB	2.09KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	35.76KB	9.11KB
auth (createAuthenticatedFetch.js)	4.37KB	1.69KB
auth (index.js)	2.25KB	1.01KB
auth (org-roles.js)	6.72KB	2.85KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	4.91KB	0.87KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	18.38KB	4.49KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	3.65KB	1.42KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.25KB	0.53KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	450.17KB	97.92KB
core (index.js)	2.16KB	0.78KB
create-plugin (index.js)	9.28KB	2.98KB
data-objectstack (index.js)	129.13KB	32.55KB
fields (index.js)	221.06KB	54.17KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.32KB	1.77KB
i18n (index.js)	2.46KB	0.96KB
i18n (pickLocalized.js)	1.70KB	0.83KB
i18n (provider.js)	5.37KB	1.72KB
i18n (useObjectLabel.js)	25.17KB	5.80KB
i18n (useSafeTranslation.js)	3.26KB	1.44KB
layout (index.js)	38.45KB	10.67KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	4.42KB	1.27KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	1.77KB	0.77KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	6.84KB	2.42KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	3.67KB	1.12KB
permissions (evaluator.js)	4.41KB	1.44KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.55KB	0.71KB
plugin-ai (index.js)	15.71KB	3.79KB
plugin-calendar (index.js)	44.90KB	12.35KB
plugin-charts (index.js)	57.26KB	16.24KB
plugin-chatbot (index.js)	179.93KB	42.67KB
plugin-dashboard (index.js)	109.60KB	28.33KB
plugin-designer (index.js)	210.56KB	42.56KB
plugin-detail (index.js)	216.52KB	53.02KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	103.32KB	25.08KB
plugin-gantt (index.js)	162.26KB	39.53KB
plugin-grid (index.js)	179.45KB	47.03KB
plugin-kanban (index.js)	47.82KB	13.18KB
plugin-list (index.js)	98.19KB	23.17KB
plugin-map (index.js)	16.80KB	5.24KB
plugin-markdown (index.js)	13.65KB	4.67KB
plugin-report (index.js)	37.77KB	10.00KB
plugin-timeline (index.js)	25.03KB	7.11KB
plugin-tree (index.js)	8.36KB	2.81KB
plugin-view (index.js)	85.47KB	20.82KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.55KB	0.67KB
providers (UploadProvider.js)	11.71KB	3.53KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	3.19KB	1.38KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	18.70KB	6.09KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.00KB	0.55KB
sdui-parser (codegen.js)	4.09KB	1.74KB
sdui-parser (index.js)	2.16KB	0.94KB
sdui-parser (parse.js)	10.04KB	2.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	4.69KB	1.48KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	0.77KB	0.41KB
types (disclosure.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (index.js)	1.86KB	0.91KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	0.20KB	0.18KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.04KB	1.93KB
types (system-fields.js)	2.39KB	1.17KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	0.75KB	0.46KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped