fix(runtime,cli): resolve optional capability packages from the host app context (#1573)

loadCapabilities() and the CLI serve auto-register did a bare dynamic import
of capability packages (e.g. @objectstack/service-ai-studio), which resolves
relative to the framework package's own location. A private/optional package
linked into the *app's* node_modules (the tenant runtime apps/objectos, or an
enterprise objectos-ee install) is invisible there — it failed with
"Cannot find package … imported from …/framework/…", so cloud tenants never
loaded AI Studio despite declaring the dependency.

Resolve via createRequire anchored at process.cwd() (the host app), then import
the resolved path; fall back to a bare import for framework-owned packages.

Verified: createRequire from the app dir resolves @objectstack/service-ai-studio
to its dist; the old framework-relative resolution returns MODULE_NOT_FOUND.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

packages/cli/src/commands/serve.ts

@@ -1348,10 +1348,27 @@ export default class Serve extends Command {
         (p: any) => p.name === 'com.objectstack.service-ai'
             || p.constructor?.name === 'AIServicePlugin'
       );
+      // Resolve optional plugin packages from the HOST APP's context (the app
+      // being served declares them as deps — including private packages like
+      // @objectstack/service-ai-studio that the framework CLI itself does not
+      // depend on). A bare import would resolve relative to the CLI's location
+      // and miss a package linked into the app's node_modules. Falls back to a
+      // bare import for framework-owned packages.
+      const { createRequire: _createRequire } = await import('node:module');
+      const { pathToFileURL: _pathToFileURL } = await import('node:url');
+      const _nodePath = await import('node:path');
+      const _hostRequire = _createRequire(_nodePath.join(process.cwd(), 'package.json'));
+      const importFromHost = async (pkg: string): Promise<any> => {
+        try {
+          return await import(_pathToFileURL(_hostRequire.resolve(pkg)).href);
+        } catch {
+          return import(/* webpackIgnore: true */ pkg);
+        }
+      };
       if (!hasAIPlugin && tierEnabled('ai')) {
         try {
           const aiPkg = '@objectstack/service-ai';
-          const { AIServicePlugin } = await import(/* webpackIgnore: true */ aiPkg);
+          const { AIServicePlugin } = await importFromHost(aiPkg);
 
           // AIServicePlugin will auto-detect LLM provider from environment variables
           // (AI_GATEWAY_MODEL, OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY)
@@ -1379,7 +1396,7 @@ export default class Serve extends Command {
         if (!hasAIStudio) {
           try {
             const studioPkg = '@objectstack/service-ai-studio';
-            const { AIStudioPlugin } = await import(/* webpackIgnore: true */ studioPkg);
+            const { AIStudioPlugin } = await importFromHost(studioPkg);
             await kernel.use(new AIStudioPlugin());
             trackPlugin('AIStudio');
           } catch (err: unknown) {

packages/runtime/src/cloud/capability-loader.ts

@@ -19,6 +19,33 @@
  */
 
 import type { ObjectKernel } from '@objectstack/core';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { join } from 'node:path';
+
+/**
+ * Import an optional capability package, resolving it from the HOST APP's
+ * context first.
+ *
+ * The host app (a tenant runtime like apps/objectos, or an enterprise
+ * objectos-ee install) is what declares optional plugin packages — including
+ * private ones such as `@objectstack/service-ai-studio` that are NOT part of
+ * the framework's own dependency graph. A bare `import(pkg)` from this file
+ * resolves relative to the framework package's location, which cannot see a
+ * package linked into the *app's* node_modules (the failure surfaces as
+ * "Cannot find package … imported from …/framework/…"). Anchoring a
+ * `createRequire` at the app's cwd resolves it from the app's node_modules.
+ * Falls back to a bare import for framework-owned packages.
+ */
+async function importFromHost(pkg: string): Promise<any> {
+    try {
+        const req = createRequire(join(process.cwd(), 'package.json'));
+        const resolved = req.resolve(pkg);
+        return await import(pathToFileURL(resolved).href);
+    } catch {
+        return import(/* webpackIgnore: true */ pkg);
+    }
+}
 
 export interface CapabilitySpec {
     /** npm package name to import. */
@@ -161,7 +188,7 @@ export async function loadCapabilities(opts: LoadCapabilitiesOptions): Promise<s
         }
 
         try {
-            const mod: any = await import(/* webpackIgnore: true */ spec.pkg);
+            const mod: any = await importFromHost(spec.pkg);
             const Ctor = mod[spec.export];
             if (!Ctor) {
                 logger.warn?.(
@@ -187,7 +214,7 @@ export async function loadCapabilities(opts: LoadCapabilitiesOptions): Promise<s
             if (spec.extras) {
                 for (const ex of spec.extras) {
                     try {
-                        const exMod: any = await import(/* webpackIgnore: true */ ex.pkg);
+                        const exMod: any = await importFromHost(ex.pkg);
                         const ExCtor = exMod[ex.export];
                         if (ExCtor) {
                             await kernel.use(new ExCtor());