@@ -0,0 +1,14 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os build` leaves `devPlugins` out of the artifact, and `os validate --target` no longer reads it as code
+
+Clause-②: yes (widening) — two accept-sets widen: `os validate --target` with `allowCode: false` now accepts a stack that declares `devPlugins`, and an unmanaged install (`os package install --install-mode unmanaged`, and the cloud-connection local installs) of a freshly built artifact of such a stack is no longer refused, because that artifact no longer carries the key. Leaving the key out of `objectstack.json` refuses nothing (every stack that built before still builds, and the published stack schema still accepts an artifact that carries it).
+Metadata-protocol: none
+
+`devPlugins` is the list a development boot (`os dev`, `os serve --dev`) adds to the plugins it loads, read off the config it loads. Nothing that boots or installs the artifact loads it, yet `os build` wrote it into `objectstack.json`, so `os package publish` and `os deploy` (which send that file) carried a development-only load list to the target. `os build` now drops it at the one place the artifact is written, as it already dropped `demoStaff`.
+
+Because the key no longer reaches a target, a target environment's restriction profile has nothing to refuse: `os validate --target` with `allowCode: false` no longer reports a row per dev-only plugin. `plugins`, `functions`, `hooks` and the other code keys are judged as before, and `os dev` / `os serve --dev` still load `devPlugins` from the config.
+
+The same goes for an unmanaged install: a freshly built artifact of a stack with `devPlugins` now installs unmanaged, where it was refused as carrying code. A bundle that still carries the key, such as an artifact built before this release, is still refused as code by an unmanaged install: the spec's classification of `devPlugins` is unchanged.
@@ -237,8 +237,8 @@ runtime-assembled manifests; `runtimeModule` is written by `objectstack build`);
 the stack rather than declare metadata items (`email` and `sms` carry no
 credentials — those stay in the environment or in Settings; `push` names each
 vendor secret by `credentialRef` and is read only when `requires` names `push`; `demoStaff` names the
-demo accounts a local `os dev` boot creates, and `os build` leaves it out of
-`objectstack.json`); and
+demo accounts a local `os dev` boot creates and `devPlugins` the plugins only a
+`--dev` boot loads, and `os build` leaves both out of `objectstack.json`); and
 `functions` and `onEnable` are code the runtime calls, not metadata it stores.
 
 ## How you verify
 
@@ -1172,6 +1172,13 @@ export default class Compile extends Command {
       // `devLogins` do; the module exports only `functions` and `meta`, so no
       // boot can read the list out of it.)
       delete finalBundle.demoStaff;
+      // `devPlugins` never reaches the artifact either, for the same reason:
+      // it is the list `os serve --dev` / `os dev` add to the boot, read off
+      // the config it loads (`stackBootPlugins`), and nothing that boots or
+      // installs the artifact loads it. Left in, `os package publish` and
+      // `os deploy` (which read this file) carried a development-only load
+      // list into a target, and a restriction profile had to read it as code.
+      delete finalBundle.devPlugins;
       // [#18431] Docs read out of `src/<pkg>/docs/` attach to the body of the
       //     package that owns them — `packages[i].manifest`, ADR-0130 D4 option
       //     B — and ⛔ never to the top level, which is the maintainer's ruling
 
@@ -79,6 +79,13 @@ describe('judgeRestrictionProfile — one refusal per dimension', () => {
     expect(rowsOf(profile({ allowCode: false }), stack)).toEqual([]);
   });
 
+  it('allowCode: false — `devPlugins` never reaches a target, so it refuses nothing; `plugins` beside it still does', () => {
+    const stack = { manifest: STACK.manifest, plugins: ['@acme/rp-plugin'], devPlugins: ['@acme/rp-dev-only-plugin'] };
+    expect(rowsOf(profile({ allowCode: false }), stack)).toEqual([
+      { rule: 'allowCode', where: "plugin '@acme/rp-plugin'", path: 'plugins[0]' },
+    ]);
+  });
+
   it('allowCode: false — a code key on the manifest is refused under its manifest path', () => {
     const stack = { manifest: { ...STACK.manifest, main: 'dist/index.mjs' } };
     expect(rowsOf(profile({ allowCode: false }), stack)).toEqual([
 
@@ -32,6 +32,8 @@
  *    so it is named here, as the profile's own docblock names it. A key that
  *    carries nothing (`functions: {}`, `plugins: []`) refuses nothing — the
  *    same `unmanagedInstallValueCarries` test that table's readers apply.
+ *    `devPlugins` is not read: `os build` leaves it out of the artifact, so it
+ *    never reaches a target (`NEVER_REACHES_TARGET` below).
  *  - `allowScheduledAutomation` — a flow of `type: 'schedule'` and every
  *    `jobs` entry (a job always carries a cron, interval or once `schedule`).
  *  - `allowedFlowNodeTypes` — every node of every flow, at every region depth
@@ -148,9 +150,20 @@ export function loadRestrictionProfile(
   return { profile: parsed.data, file };
 }
 
-/** The non-collection keys the spec classifies as code. */
+/**
+ * The keys the spec classifies as code that never reach a target, so
+ * `allowCode` does not read them. `devPlugins` is loaded only by a local
+ * development boot (`os dev` / `os serve --dev`, off the config it loads), and
+ * `os build` leaves it out of the artifact that `os package publish` and
+ * `os deploy` send — so a target never runs it, whatever its profile says.
+ * The spec table itself keeps `devPlugins: 'code'`: an unmanaged install still
+ * refuses it, which is a different question from what a target runs.
+ */
+const NEVER_REACHES_TARGET: ReadonlySet<string> = new Set(['devPlugins']);
+
+/** The non-collection keys the spec classifies as code, less the ones that never reach a target. */
 const CODE_KEYS: readonly string[] = Object.entries(UNMANAGED_INSTALL_KEY_DISPOSITIONS)
-  .filter(([, disposition]) => disposition === 'code')
+  .filter(([key, disposition]) => disposition === 'code' && !NEVER_REACHES_TARGET.has(key))
   .map(([key]) => key);
 
 type Bag = Record<string, unknown>;
@@ -180,9 +193,8 @@ function codeItems(key: string, value: unknown): Array<{ label: string; at: stri
     }
     if (isBag(value)) return Object.keys(value).map((name) => ({ label: `function '${name}'`, at: `functions.${name}` }));
   }
-  if ((key === 'plugins' || key === 'devPlugins') && Array.isArray(value)) {
-    const noun = key === 'plugins' ? 'plugin' : 'dev plugin';
-    return value.map((entry, i) => ({ label: `${noun} '${nameOf(entry, `${key}[${i}]`)}'`, at: `${key}[${i}]` }));
+  if (key === 'plugins' && Array.isArray(value)) {
+    return value.map((entry, i) => ({ label: `plugin '${nameOf(entry, `${key}[${i}]`)}'`, at: `${key}[${i}]` }));
   }
   return [{ label: `\`${key}\``, at: key }];
 }
 
@@ -18,10 +18,16 @@
  *     there, as `data` and `devLogins` do), and what it exports is what a boot
  *     can read.
  *
+ * `devPlugins` is left out the same way: it is the list a development boot
+ * (`os dev`, `os serve --dev`) adds off the config it loads, never read off the
+ * artifact, and leaving it in carried a development-only load list through
+ * `os package publish` / `os deploy` into a target. The same build measures
+ * both keys.
+ *
  * The control is the same build carrying the stack's other keys through: the
  * declared position the demo account names is in the artifact, and the
- * `functions` entry runs, so a green here is "this one key was left out", not
- * "the build wrote nothing".
+ * `functions` entry runs, so a green here is "these two keys were left out",
+ * not "the build wrote nothing".
  *
  * Runs the CLI from source (`bin/run-dev.js` under `node`), as the other build
  * suites do, so `compile.ts` is measured without a rebuild.
@@ -42,6 +48,7 @@ const CLI = resolve(HERE, '../bin/run-dev.js');
 const RUNTIME_MODULE = /^objectstack-runtime\.[a-f0-9]+\.mjs$/;
 
 const STAFF_EMAIL = 'counsel1@legal.example';
+const DEV_PLUGIN = '@acme/legal-dev-only-plugin';
 
 const CONFIG = `import { defineStack } from '@objectstack/spec';
 
@@ -60,6 +67,7 @@ export default defineStack({
   functions: { legal_score: legalScore },
   positions: [{ name: 'legal_counsel', label: 'Legal Counsel' }],
   demoStaff: [{ name: 'Legal Counsel 1', email: '${STAFF_EMAIL}', position: 'legal_counsel' }],
+  devPlugins: ['${DEV_PLUGIN}'],
 });
 `;
 
@@ -91,15 +99,22 @@ function build(cwd: string): Promise<{ code: number; stdout: string; stderr: str
   });
 }
 
-describe('`os build` leaves the demo accounts out of the artifact (#25777)', () => {
-  it('writes no `demoStaff` into objectstack.json, and a deployment that loads the artifact reads none', async () => {
-    const run = await build(dir);
+/** The one build both cases read: `os build --json` in the fixture directory. */
+let built: Promise<{ artifactPath: string; text: string; artifact: Record<string, unknown> }> | undefined;
+function buildOnce() {
+  built ??= build(dir).then((run) => {
     expect(run.code, `os build --json failed:\n${run.stdout}\n${run.stderr}`).toBe(0);
-
     const payload = JSON.parse(run.stdout) as { output?: string };
     const artifactPath = String(payload.output);
     const text = readFileSync(artifactPath, 'utf8');
-    const artifact = JSON.parse(text) as Record<string, unknown>;
+    return { artifactPath, text, artifact: JSON.parse(text) as Record<string, unknown> };
+  });
+  return built;
+}
+
+describe('`os build` leaves the demo accounts out of the artifact (#25777)', () => {
+  it('writes no `demoStaff` into objectstack.json, and a deployment that loads the artifact reads none', async () => {
+    const { artifactPath, text, artifact } = await buildOnce();
 
     expect(Object.keys(artifact)).not.toContain('demoStaff');
     expect(text).not.toContain(STAFF_EMAIL);
@@ -121,3 +136,19 @@ describe('`os build` leaves the demo accounts out of the artifact (#25777)', ()
     expect(await (functions as Record<string, (input: unknown) => unknown>).legal_score({})).toBe(7);
   }, 180_000);
 });
+
+describe('`os build` leaves the dev-only plugins out of the artifact', () => {
+  it('writes no `devPlugins` into objectstack.json, and a deployment that loads the artifact reads none', async () => {
+    const { artifactPath, text, artifact } = await buildOnce();
+
+    expect(Object.keys(artifact)).not.toContain('devPlugins');
+    expect(text).not.toContain(DEV_PLUGIN);
+
+    const loaded = (await loadArtifactBundle(artifactPath)) as Record<string, unknown> | null;
+    expect(loaded, 'the runtime loader could not load the artifact').toBeTruthy();
+    expect(Object.keys(loaded!)).not.toContain('devPlugins');
+
+    // Control: the stack's other keys survived the same build.
+    expect((artifact.objects as Array<{ name: string }>).map((o) => o.name)).toEqual(['legal_matter']);
+  }, 180_000);
+});
@@ -70,13 +70,18 @@ const json = (r: Run): Record<string, any> => {
   }
 };
 
-/** One item per dimension: a hook and its function, a scheduled flow, and a record flow with a script node. */
+/**
+ * One item per dimension: a hook and its function, a scheduled flow, and a
+ * record flow with a script node. Plus a dev-only plugin, which `os build`
+ * leaves out of the artifact, so no target runs it and `allowCode` reads none.
+ */
 const STACK = `{
   manifest: { id: 'com.example.rpt', namespace: 'rpt', version: '1.0.0', name: 'Rpt', type: 'app', engines: { protocol: '^18' } },
   requires: ['automation', 'triggers'],
   objects: [{ name: 'rpt_doc', label: 'Doc', sharingModel: 'private', fields: { title: { type: 'text', label: 'Title' } } }],
   hooks: [{ name: 'rpt_audit', object: 'rpt_doc', events: ['beforeInsert'], handler: 'rpt_audit_fn' }],
   functions: { rpt_audit_fn: async () => {}, rpt_calc: () => 1 },
+  devPlugins: ['@acme/rpt-dev-only-plugin'],
   flows: [
     {
       name: 'rpt_nightly', label: 'Nightly', type: 'schedule', status: 'active',
@@ -147,7 +152,7 @@ describe('os validate --target <restriction profile file>', () => {
     expect(json(r).valid).toBe(true);
   }, 60_000);
 
-  it('allowCode: false refuses the hook, both functions and the script node — each row naming allowCode once', async () => {
+  it('allowCode: false refuses the hook, both functions and the script node — each row naming allowCode once; the dev-only plugin is not refused', async () => {
     const r = await run([config, '--json', '--target', profileFile('no-code', { ...OPEN, allowCode: false })]);
     expect(r.code, r.stdout).toBe(1);
     expect(json(r).valid).toBe(false);