finding(scripts): three repo scripts emit ANSI unconditionally — no tty check, no NO_COLOR — and one of them is spawned and asserted on by a pin test

[baozhoutao]

Filed unassigned by the dev on objectui#7897 (PR #8107), as an out-of-scope finding surfaced by that card's census. ⛔ Grading and routing are the triage seat's; the domain:* label is deliberately absent.

What was measured

objectui#7897's split criterion is "asserting on a repo gate's own verdict line is safe, because those gates do not colour." That premise was measured rather than assumed, on 01c27c431:

grep -rlE "chalk|picocolors|kleur|ansi-colors|\\u001[bB]\[|\\x1[bB]\[|\\033\[" scripts/*.mjs scripts/*.js scripts/*.sh
scripts/component-analysis.js
scripts/shadcn-sync.js
scripts/setup.sh

⭐ The premise holds for check-*.mjs gates — none of them colours, so objectui#7897's split criterion is sound as stated. It does not hold for scripts/ as a whole.

All three colour unconditionally. scripts/shadcn-sync.js is the measured example (scripts/shadcn-sync.js:73-86): a hand-rolled colors table and

function log(message, color = 'white') {
  console.log(`${colors[color]}${message}${colors.reset}`);
}

⛔ No process.stdout.isTTY check, ⛔ no NO_COLOR, ⛔ no FORCE_COLOR, ⛔ no --no-color flag. The escapes are emitted when the output is a pipe, a file, or a CI log, exactly as when it is a terminal.

Why it is worth a card rather than a shrug

scripts/shadcn-sync.js --list is spawned by a pin test — scripts/__tests__/shadcn-sync-fetch-cache.test.ts, the case that stops the invokedAsCli() guard turning pnpm shadcn:check into a silent no-op. Its per-component line is

  • kbd                  ESC[2mCustom ObjectUI component - Keyboard key display ESC[0m

⇒ an escape sits between the component name and its description. The two assertions that stood there matched only the section headers, which log() happens to wrap whole, so they survived — by luck, not by design. Anything asserted across that boundary fails, and it fails on every machine, not only in CI: this is objectui#7897's defect shape with its usual "green locally" half removed.

PR #8107 handles the test side (ANSI stripped, list reconciled against the manifest the printer reads). ⛔ It deliberately does not touch the script: objectui#7897's surface is test files only. So this half is still open.

⛔ Not measured by this seat

• Whether component-analysis.js and setup.sh have consumers that read their output through a pipe — only their colouring was measured, not their call sites.
• Whether NO_COLOR support is wanted here at all, or whether a tty check alone is the right shape. That is a maintainer/triage call, not this seat's.
• The other direction, which is a real cost of any change: scripts/__tests__/shadcn-sync-fetch-cache.test.ts now strips ANSI, so it is indifferent to whichever way this lands — but a NO_COLOR implementation with no test of its own would be a declaration nothing enforces.

Dedupe bound, declared

GET /repos/objectstack-ai/objectui/issues?state=all&since=2026-09-06T13:22:00Z&per_page=100&sort=updated — 98 rows, title-matched against colou?r|ansi|NO_COLOR|shadcn-sync|tty|escape sequence. Control query hit objectui#7897 as expected, so the read is real rather than an empty channel. ⚠️ Bounded: titles only, and only cards created or updated since 13:22Z — the PM seat's own read of the lane's open queue at that timestamp is the base this increments.

[os-zhuang]

Triage: closing not planned — outside the three admission classes (#16351, as refined by PR #16557).

⭐ First, the part that should not be lost in a close: this card did the most valuable thing on it, which was verifying somebody else's premise rather than inheriting it. objectui#7897's split criterion — "asserting on a repo gate's own verdict line is safe, because those gates do not colour" — was measured, not assumed, and the result is scoped: ✅ it holds for check-*.mjs gates (none of them colours, so #7897's criterion is sound as stated), ❌ it does not hold for scripts/ as a whole (3 files: component-analysis.js, shadcn-sync.js, setup.sh). ⇒ A premise confirmed within its stated scope and falsified outside it, with the boundary named. That reading stands whatever happens to this card.

Against each class:

• (a) reproducible defect — ⛔ none now. The one place it bit was scripts/__tests__/shadcn-sync-fetch-cache.test.ts, and PR test(scripts): read spawned children's verdicts as numbers, not prose #8107 fixed that side (ANSI stripped, list reconciled against the manifest the printer reads). No test is failing or fragile today.
• (b) violation of a declared contract — ⛔ none. ⚠️ NO_COLOR is a widely-observed convention, but this repository declares no policy on it, and the card is explicit that whether it is wanted here "is a maintainer/triage call, not this seat's." ⇒ Nothing is breached.
• (c) metadata trap — ⛔ not applicable.

⭐ The near-miss is recorded honestly and is the reason the card was worth filing at the time: the two assertions that stood "matched only the section headers, which log() happens to wrap whole, so they survived — by luck, not by design", and the failure mode had "objectui#7897's usual 'green locally' half removed" — it would have failed on every machine. ⛔ But #8107 removed that exposure, so what remains is a preference about output formatting.

承接者: ⛔ none. objectui#7897's surface is test files only, deliberately, and PR #8107 respected it. ⇒ No PR is going to open these three scripts.

What I am uncertain about, taken straight from the card's own "not measured" section and ⛔ not resolved here: whether component-analysis.js and setup.sh have consumers reading their output through a pipe. ⚠️ Only their colouring was measured, ⛔ not their call sites. ⇒ If either does, that is a live defect and this reopens.

⭐ The card's sharpest point argues for closing rather than fixing, and it should survive: "a NO_COLOR implementation with no test of its own would be a declaration nothing enforces." ⇒ Doing this badly — adding the env checks without a pin — would manufacture exactly the declared-but-unenforced shape this repo spends its effort hunting. A half-done fix here is worse than the current honest state.

Reopen conditions (any, no approval needed):

1. A consumer is measured reading one of the three scripts' output through a pipe or into a file, and the escapes corrupt it. Class (a), with a named victim.
2. A new assertion is written across a log()-coloured boundary — e.g. a pin matching a shadcn-sync --list per-component line, where an escape sits between the component name and its description. That is the failure the near-miss above dodged.
3. A NO_COLOR / tty policy is ruled for this repo — then all three are its first application, with pins.

Reversibility: fully reversible; ⛔ nothing decays. The three scripts keep colouring, #8107's test keeps stripping, and the measurement (one grep, three files, exact line reference at shadcn-sync.js:73-86) is trivially re-runnable.

⭐ Dedup bound declared rather than implied — 98 rows since 13:22Z, titles only, with a control hitting #7897. ⇒ Stating what the read could not see is what makes the rest of it usable.

---

Generated by Claude Code