fix(cloud-connection): never present env_local/proj_local as cloud environment ids (#1786)

The CLI's dev/serve default OS_ENVIRONMENT_ID=env_local names the LOCAL
kernel, not a control-plane environment. Presenting it to the cloud 404s
the bind and resurrects the phantom-environment confusion that ADR
runtime-identity-binding removes. Filter the sentinels in
resolveEnvironmentId — such runtimes are simply unbound until the
device-code registration completes.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

.changeset/local-env-sentinel.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/cloud-connection": patch
+---
+
+`resolveEnvironmentId` no longer presents the CLI's local-dev sentinel ids (`env_local` / `proj_local`) to the control plane as cloud environment ids — they identify the local kernel only. A single-environment runtime started via `objectstack dev` now reads as cleanly unbound and binds environment-less (ADR runtime-identity-binding), instead of 404-ing the bind against a non-existent cloud environment.

packages/cloud-connection/src/cloud-connection-plugin.test.ts

@@ -220,6 +220,19 @@ describe('single-environment mode (host auth, fixed env id)', () => {
         expect(res.payload.data.total).toBe(1);
     });
 
+    it("ignores the CLI's local sentinel env ids (env_local / proj_local)", async () => {
+        process.env.OS_ENVIRONMENT_ID = 'env_local';
+        const rawApp = makeRawApp();
+        const { ctx, fireKernelReady } = makeCtx({ rawApp });
+        await new CloudConnectionPlugin({ singleEnvironment: true, controlPlaneUrl: 'http://cloud.test' }).start(ctx as any);
+        await fireKernelReady();
+        const res = await rawApp.routes.get('GET /api/v1/cloud-connection/status')!(makeC('http://localhost:3000/x'));
+        expect(res.status).toBe(200);
+        // Treated as "no cloud environment", not presented to the control plane.
+        expect(res.payload.data.environmentId).toBeNull();
+        expect(res.payload.data.bound).toBe(false);
+    });
+
     it('falls back to OS_ENVIRONMENT_ID when no config id is given', async () => {
         process.env.OS_ENVIRONMENT_ID = 'env-from-env-var';
         const rawApp = makeRawApp();

packages/cloud-connection/src/cloud-connection-plugin.ts

@@ -147,7 +147,12 @@ export class CloudConnectionPlugin implements Plugin {
 
             const resolveEnvironmentId = async (c: any): Promise<string | undefined> => {
                 const fixed = (this.cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? '').trim();
-                if (fixed) return fixed;
+                // The CLI's local-dev defaults ('env_local' / 'proj_local')
+                // identify the LOCAL kernel, not a cloud environment — never
+                // present them to the control plane as one (they would 404
+                // the bind and resurrect the phantom-environment confusion
+                // ADR runtime-identity-binding removes).
+                if (fixed && fixed !== 'env_local' && fixed !== 'proj_local') return fixed;
                 if (this.cfg.singleEnvironment) {
                     // A completed bind persisted the environment id — a
                     // self-hosted runtime needs no OS_ENVIRONMENT_ID after it.