feat(plugin-hono-server): add CORS origin matcher with wildcard support

- Implemented `matchOriginPattern` function to match origins against wildcard patterns.
- Created `createOriginMatcher` function to handle single, array, and comma-separated patterns.
- Updated CORS handling in `HonoServerPlugin` to reflect request origin when credentials are true and wildcard is used.

test(plugin-hono-server): add tests for origin pattern matching

- Added unit tests for `matchOriginPattern` and `createOriginMatcher` functions covering various matching scenarios.

chore(plugin-hono-server): add vitest configuration for testing

- Created `vitest.config.ts` for the plugin to facilitate testing.

chore: update package versions to 4.0.4 across multiple plugins and services

- Updated dependencies and version numbers in `package.json` files for various plugins and services to 4.0.4.
- Updated changelogs to reflect the changes made in each package.

fix: improve schema build script for CI environments

- Enhanced cleanup logic in `build-schemas.ts` to handle filesystem race conditions with retries and exponential backoff.

chore: update shared types to version 4.0.4

- Updated `@objectstack/types` package version to 4.0.4 and updated changelog.

Author: hotlong

.github/copilot-instructions.md

@@ -1,6 +1,9 @@
 # 📜 ObjectStack Copilot Instructions
 
 > **Last synced with repo structure:** 2026-04-13
+>
+> **Sync note:** A parallel `CLAUDE.md` exists at the repo root for Claude Code.
+> Keep both files in sync when updating project-wide AI instructions.
 
 **Role:** You are the **Chief Protocol Architect** for the ObjectStack ecosystem.
 **Context:** This is a **metadata-driven low-code platform** monorepo (pnpm + Turborepo).
@@ -87,7 +90,7 @@ objectstack-ai/spec/
 │   ├── app-crm/           # Advanced: full CRM with relations
 │   └── plugin-bi/         # Plugin example: BI dashboard
 │
-├── skills/                # 🤖 AI skill definitions (for Copilot/Cursor)
+├── skills/                # 🤖 AI skill definitions (for Claude Code, Copilot, Cursor)
 │   ├── objectstack-schema/
 │   ├── objectstack-query/
 │   ├── objectstack-api/

.github/prompts/OVERVIEW.md

@@ -114,16 +114,22 @@ ObjectStack AI Prompts
 
 ## 🚀 使用方式 (Usage)
 
-### GitHub Copilot 集成
+### AI 编码助手集成
 
-这些提示词会被 GitHub Copilot 自动加载：
+这些提示词兼容多个 AI 编码助手：
+
+- **Claude Code**（推荐）：从代码库上下文自动加载
+- **GitHub Copilot**：在代码库中工作时自动加载
+- **Cursor**：可引用这些提示词获取上下文感知帮助
+
+提示词会根据以下内容自动加载：
 
 ```
 .github/
 └── prompts/
-    ├── data-protocol.prompt.md      ← 编辑数据协议时自动加载
-    ├── ui-protocol.prompt.md        ← 编辑UI协议时自动加载
-    ├── system-protocol.prompt.md    ← 编辑系统协议时自动加载
+    ├── data-protocol.prompt.md      ← 编辑数据协议时加载
+    ├── ui-protocol.prompt.md        ← 编辑UI协议时加载
+    ├── system-protocol.prompt.md    ← 编辑系统协议时加载
     └── ...
 ```
 

.github/prompts/README.md

@@ -142,9 +142,15 @@ These prompts help with specific development tasks:
 
 ## 🎯 How to Use These Prompts
 
-### For GitHub Copilot
+### For AI Coding Assistants
 
-These prompts are automatically loaded by GitHub Copilot when working in the repository. They provide context-aware assistance based on:
+These prompts are compatible with multiple AI coding assistants:
+
+- **Claude Code** (Recommended): Automatically loaded from the repository context
+- **GitHub Copilot**: Automatically loaded when working in the repository
+- **Cursor**: Can reference these prompts for context-aware assistance
+
+They provide context-aware assistance based on:
 - The file you're editing
 - The protocol layer you're working on
 - The task you're performing

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- **Claude Code integration (`CLAUDE.md`)** — Added root `CLAUDE.md` file so that [Claude Code](https://docs.anthropic.com/en/docs/claude-code) automatically loads the project's system prompt when launched in the repository. Content is synced with `.github/copilot-instructions.md` and includes build/test quick-reference commands, all prime directives, monorepo structure, protocol domains, coding patterns, and domain-specific prompt references. This complements the existing GitHub Copilot instructions and `skills/` directory.
+
 ### Changed
 - **Skills Module Structure Refactor** — Refactored all skills in `skills/` directory to follow shadcn-ui's fine-grained layering pattern. Each skill now has:
   - **Concise `SKILL.md`** — High-level overview with decision trees and quick-start examples, referencing detailed rules
@@ -26,6 +29,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - Preserved skill independence — Each skill remains independently installable/referenceable (no global routing required)
 
 ### Fixed
+- **Studio: Package switcher not filtering object list** — Fixed a bug where switching packages in the Studio left sidebar did not change the displayed object list. The root cause was in `ObjectStackProtocolImplementation.getMetaItems()`: after filtering items by `packageId` via `SchemaRegistry.listItems()`, the code merged in ALL runtime items from MetadataService without respecting the `packageId` filter, effectively overriding the filtered results. The same issue existed in `HttpDispatcher.handleMetadata()` where the MetadataService fallback path also ignored `packageId`. Both paths now correctly filter MetadataService items by `_packageId` when a package scope is requested.
+- **MetadataPlugin driver bridging fallback** — Fixed `MetadataPlugin.start()` so the driver service scan fallback (`driver.*`) is reached when ObjectQL returns `null` (not just when it throws). Previously, `setDatabaseDriver` was never called in environments where ObjectQL was not loaded.
+- **Auth trustedOrigins test alignment** — Updated `plugin-auth` tests to match the auto-default `http://localhost:*` behavior added in PR #1152 for better-auth CORS support. When no `trustedOrigins` are configured, the implementation correctly defaults to trusting all localhost ports for development convenience.
+- **Docs build: lucide-react module resolution** — Added Turbopack `resolveAlias` in `apps/docs/next.config.mjs` so MDX content files in `content/docs/` (outside the app directory) can resolve `lucide-react`. Turbopack starts module resolution from the file's directory, which doesn't have access to the app's `node_modules/`.
+- **Client Hono integration test timeout** — Fixed `afterAll` hook timeout in `client.hono.test.ts` by racing `kernel.shutdown()` against a 10s deadline. The shutdown can hang when pino's worker-thread flush callback never fires in CI, so the race ensures the hook completes within the 30s vitest limit.
 - **CI: Replace `pnpm/action-setup@v6` with corepack** — Switched all GitHub Actions workflows (`ci.yml`, `lint.yml`, `release.yml`, `validate-deps.yml`, `pr-automation.yml`) from `pnpm/action-setup@v6` to `corepack enable` to fix persistent `ERR_PNPM_BROKEN_LOCKFILE` errors. Corepack reads the exact `packageManager` field from `package.json` (including SHA verification), ensuring the correct pnpm version is used in CI. Also bumped pnpm store cache keys to v3 and added a pnpm version verification step.
 - **Broken pnpm lockfile** — Regenerated `pnpm-lock.yaml` from scratch to fix `ERR_PNPM_BROKEN_LOCKFILE` ("expected a single document in the stream, but found more") that was causing all CI jobs to fail. The previous merge of PR #1117 only included workflow cache key changes but did not carry over the regenerated lockfile.
 - **service-ai: Fix navigation item labels using deprecated i18n object format** — Replaced `{ key, defaultValue }` i18n objects with plain string labels in `AIServicePlugin`'s Setup App navigation contributions, completing the `I18nLabelSchema` migration from [#1054](https://github.com/objectstack-ai/framework/issues/1054).