fix: defer AuthPlugin route registration to kernel:ready hook

[Copilot]

AuthPlugin.start() synchronously looks up http-server service, but CLI registers HonoServerPlugin after config plugins — so the service doesn't exist yet and auth routes silently fail with 404.

Changes

• auth-plugin.ts: Move route registration into a kernel:ready hook (same pattern HonoServerPlugin already uses for server.listen). All plugins are guaranteed initialized+started before the hook fires, eliminating order sensitivity.

// Before: immediate lookup in start() — fails if HonoServerPlugin not yet initialized
async start(ctx) {
  const httpServer = ctx.getService<IHttpServer>('http-server'); // 💥 not registered yet
  this.registerAuthRoutes(httpServer, ctx);
}

// After: deferred to kernel:ready — all plugins done
async start(ctx) {
  ctx.hook('kernel:ready', async () => {
    const httpServer = ctx.getService<IHttpServer>('http-server'); // ✅ guaranteed available
    this.registerAuthRoutes(httpServer, ctx);
  });
}

• serve.ts: Register HonoServerPlugin before config plugins (belt-and-suspenders). Added duplicate detection (p.name === 'com.objectstack.server.hono') to skip if config already includes one.

• auth-plugin.test.ts: Tests now capture hook registrations via shared createHookCapture() helper and trigger kernel:ready to validate route setup. +1 new test, 32/32 pass.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Bug] Auth 服务 /api/v1/auth/* 路由无法访问（插件注册顺序导致未注册）</issue_title>
<issue_description>## 问题描述
在 monorepo 根目录运行 pnpm dev 启动开发环境后，无法访问 http://localhost:3000/api/v1/auth/get-session 等 Auth 服务接口。

• 实际结果：返回 404，未注册 auth 路由。
• 期望结果：可访问 api/v1/auth/* 系列接口，正常获取 session。

复现步骤

1. pnpm dev
2. 打开浏览器访问 http://localhost:3000/api/v1/auth/get-session
3. 出现 404 或无法连接

根因分析

• objectstack.config.ts 的 plugins 数组中，AuthPlugin 在 HonoServerPlugin 之前注册。
• CLI 的 serve 命令会先注册所有 config.plugins，然后最后才注册 HonoServerPlugin，导致 AuthPlugin 的路由注册时获取不到 HTTP 服务实例。
• AuthPlugin.start() 检测不到 http-server，打印 warn：No HTTP server available — auth routes not registered.

相关代码片段

import { defineStack } from '@objectstack/spec';
import { AppPlugin, DriverPlugin } from '@objectstack/runtime';
import { ObjectQLPlugin } from '@objectstack/objectql';
import { InMemoryDriver } from '@objectstack/driver-memory';
import { HonoServerPlugin } from '@objectstack/plugin-hono-server';  // ← 新增
import CrmApp from './examples/app-crm/objectstack.config';
import TodoApp from './examples/app-todo/objectstack.config';
import BiPlugin from './examples/plugin-bi/objectstack.config';
import { AuthPlugin } from '@objectstack/plugin-auth';

export default defineStack({
  manifest: {
    id: 'dev-workspace',
    name: 'dev_workspace',
    version: '0.0.0',
    description: 'ObjectStack monorepo development workspace',
    type: 'app',
  },
  plugins: [
    new ObjectQLPlugin(),
    new DriverPlugin(new InMemoryDriver()),
    new HonoServerPlugin({ port: 3000 }),  // ← 必须在 AuthPlugin 之前
    new AuthPlugin({
      secret: 'dev-secret-please-change-in-production-min-32-chars',
      baseUrl: 'http://localhost:3000',
    }),
    new AppPlugin(CrmApp),
    new AppPlugin(TodoApp),
    new AppPlugin(BiPlugin),
  ],
});

建议修复方案

1. 优先注册 HonoServerPlugin —— objectstack.config.ts 的 plugins 数组必须先注册 HTTP 服务，再注册 AuthPlugin。
2. CLI 应在遍历 config.plugins 之前注册 HonoServerPlugin。（或检测是否重复注册，避免多次实例化）
3. AuthPlugin 可用 kernel:ready hook 延迟注册路由，兼容不同插件加载顺序。
   </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Bug] Auth 服务 /api/v1/auth/* 路由无法访问（插件注册顺序导致未注册） #883

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-play	Ready	Preview, Comment	Mar 9, 2026 5:46am
spec	Ready	Preview, Comment	Mar 9, 2026 5:46am

[Copilot]

Pull request overview

This PR fixes a bug where AuthPlugin HTTP routes were silently failing (returning 404) because AuthPlugin.start() tried to look up the http-server service before HonoServerPlugin had been initialized, due to CLI registering config plugins before the Hono server plugin.

Changes:

• auth-plugin.ts: Moves HTTP route registration from start() into a deferred kernel:ready hook, ensuring all plugins have completed their init/start phases before route registration, making the plugin resilient to any plugin loading order.
• serve.ts: Registers HonoServerPlugin before config plugins in the CLI serve command (with duplicate detection via p.name === 'com.objectstack.server.hono'), and consolidates the comment for the remaining REST API and Dispatcher plugin registrations.
• auth-plugin.test.ts: Adds a createHookCapture() helper to capture and simulate kernel:ready triggers in tests, adds one new test, and updates all Start Phase tests to reflect the new deferred registration behavior.
• ROADMAP.md: Documents the bug fix in the migration notes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
packages/plugins/plugin-auth/src/auth-plugin.ts	Defers auth route registration from start() to a kernel:ready hook, making it order-independent
packages/plugins/plugin-auth/src/auth-plugin.test.ts	Adds createHookCapture() utility; updates tests to trigger kernel:ready before asserting route registration
packages/cli/src/commands/serve.ts	Moves HonoServerPlugin registration before config plugins loop; adds duplicate detection
ROADMAP.md	Adds a migration note documenting the bug fix