bug(runner): a PUBLISHED package's stylesheet scans `components`' test files, and its own `@source` points at a directory that does not exist

[os-justin]

Filed by the domain:ui PM seat (session_01YBWFb5YgMU5dw8p2VKj16S) on behalf of the objectui#8446 dev, who measured it while landing PR #8453 and could not file it (search_issues rate-limited). ⛔ Not claimed.

Two defects in one file, both in a package that ships: packages/runner is private: false with files: [dist].

1 — it still compiles components' test-sourced classes

packages/runner/src/index.css scans ../../packages/components/src/** with no test exclusion. So after PR #8453 fixed @object-ui/components' own stylesheet, @object-ui/runner's published sheet still compiles the same eight test-sourced classes.

⇒ PR #8453 closed the leak in one published artifact and not in the other. That is not a criticism of its scope fence — the fence was mine and it was right — but it means the card is not finished at the package boundary.

2 — its own @source line resolves to nothing

Line 10 reads @source './src/**/*.{ts,tsx}'. From packages/runner/src/index.css that resolves to packages/runner/src/src/ — a directory that does not exist.

⇒ runner's own App.tsx / LayoutRenderer.tsx are not covered by that line at all. Whatever utilities they need are shipping today only if some other source names them, which is the same accident as the .flex-shrink-0 case objectui#8446 found.

⚠️ These two interact: fixing (2) adds rules (runner's real source finally gets scanned) while fixing (1) removes them. A PR doing both must show the two deltas separately, or the net will look like noise.

Instrument

⭐ The compile is CWD-sensitive, not just disk-sensitive — measured on components, the same bytes give 1385 rules from the package dir (where pnpm build runs) and 3430 from the repo root. A repo-root reading under-reported PR #8453's own removal by five of eight classes. Take every reading from the package directory, and say so.

⚠️ Tailwind emits escaped selectors (.\32 xl\:grid-cols-6, not .2xl\:grid-cols-6); grep the compiled CSS with a lit control before trusting a zero.

Related

objectui#8446 / PR #8453 (where this was found, and the two-line spelling to copy) · the siblings that already do it right: plugin-kanban/src/index.css:90-92, plugin-grid/src/index.css:90-92, fields/src/index.css:43-44

Dedup

⚠️ Not run, declared rather than hidden. The reporting dev was rate-limited (one query also returned 422 on parenthesis syntax) and this seat has not run a targeted search. No dedup claim is made. Suggested query for a triager: runner index.css @source published stylesheet scans components tests.

[os-justin]

Claim: session session_01YBWFb5YgMU5dw8p2VKj16S · branch claude/issue-8454-runner-css-source

PM dispatch (domain:ui seat). The assignee and this comment are set by the PM on the dev's behalf — the dev inherits both, posts no second claim, and never writes the assignee field.

Decision frame: both defects are mechanical — a missing exclusion and a path that resolves to a directory that does not exist. Nothing here needs a ruling, and measured cost is the whole basis. If something turns out to need one, report and stop.

⚠️ The two defects move the bundle in opposite directions: fixing the broken @source adds rules (runner's real source finally gets scanned), fixing the missing exclusion removes them. Show the two deltas separately or the net will read as noise, and a reviewer will not be able to tell which change did what.

⚠️ Take every reading from the package directory, not the repo root. Measured on components during PR #8453: the same bytes give 1385 rules from the package dir (where pnpm build runs) and 3430 from the repo root, and a repo-root reading under-reported that PR's own removal by five of eight classes.

⚠️ Tailwind emits escaped selectors — .\32 xl\:grid-cols-6, not .2xl\:grid-cols-6. Pair every grep of compiled CSS with a lit control before trusting a zero.

⛔ Scope fence: packages/runner only. The repo-wide gate is objectui#8455 and the source(none) parity question is its option A — if your sweep confirms either, report it, do not sweep it in.

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 8454,
  "status": "done",
  "branch": "claude/issue-8454-runner-css-source",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8472",
  "premise_still_valid": false,
  "summary": "Defect 2 is real and FIVE TIMES larger than the card says; defect 1 is FALSIFIED AS STATED. Tailwind resolves a relative @source against dirname(entry css) = packages/runner/src/, and @tailwindcss/postcss compiles with base = dirname(path.resolve(opts.from)) (read out of its dist). Under that arithmetic ALL FIVE @source lines named a missing directory, not just line 10: './src/**' meant packages/runner/src/src AND '../../packages/PKG/src' meant packages/packages/PKG/src. Decisive reading: deleting all five lines and rebuilding gave a BYTE-IDENTICAL artifact (same content hash index-BgwNVuMG.css, 20969 B, 219 rules). So components' test classes were never reaching this sheet through the components @source line -- that line was dead. The sheet's only real input was automatic source detection, whose base defaults to process.cwd() (packages/runner), which covers this package's own tree and nothing else: what leaked was runner's OWN tests, and what was MISSING was every utility belonging to components/react/plugin-kanban/plugin-charts. Fix repairs all five paths and adds plugin-kanban's two-line exclusion anchored one level up. Also added a compile-based guard test (base pinned to the package root) and 'node' to tsconfig.test.json types. patch changeset.",
  "tests": "ALL READINGS FROM packages/runner (where pnpm build runs), clean dist each time, on-disk file set = committed tree a407bd654 plus only the stated edit to src/index.css. DELTA 1 (paths fixed, ADDS): 20969 B / 219 rules / 228 selectors -> 136310 B / 1553 rules / 1456 selectors = +1228 / -0. DELTA 2 (exclusions, REMOVES): 136310 -> 135842 B, 1553 -> 1545 rules, 1456 -> 1447 selectors = +0 / -9 (flex-grow, flex-nowrap, h-[125px], h-[400px], invert, paused, slide-in-from-bottom, text-green-500, w-[250px]). Exclusions applied to TODAY's shipping bytes instead: -1 (.block, from the word 'block' in a prose comment in App.navigation.test.tsx). CWD CALIBRATION: same two trees from the repo root read 3315 -> 3299 = +0/-16, i.e. the repo root INVERTS THE SIGN, it does not merely under-report. WHICH SIBLING SPELLING: kanban's two lines. The file line alone accounts for all 9 removals (byte-identical artifact index-CLMWcOzp.css with or without the directory line), but the directory line is the only cover for components/src/__tests__/test-utils.tsx and page-header-action-ids.dist.spec.tsx (non-*.test.* sources the repaired components @source reaches) -- ABLATED: marker class injected into test-utils.tsx, file-line-only build ships .z-[8454] (1 hit, lit control .flex{ 1 hit), both-lines build does not (0 hits, lit control still 1). Both files restored by state. GUARD ABLATIONS from the COMMITTED implementation, HEAD blob dd5f1a187a27684fa2086293bb3f61cb5a83cc0b: (A) paths re-broken to ../../packages/... -> on-disk 6b7ec85cd7dc6fd73388e1101bffd4225d44a35b, removed-text 1->0, injected-text 0->4, vitest exit=1, 2 failed 2 passed, red tests 'resolves every @source path to a directory that exists' + 'compiles utilities that only a dependency can supply'. (B) both @source not lines deleted -> on-disk e272958df0ff0ef1f55a5f74d7965885ad2a46f5, removed-text 2->0, positive lines still 5, vitest exit=1, 1 failed 3 passed, AssertionError: expected [ '@container', ...(1387) ] to not include 'paused'. Both restored BY STATE: on-disk hash == HEAD blob AND git diff HEAD empty. Adding the guard test file itself left the artifact byte-identical (index-CLMWcOzp.css) despite six class-shaped literals in it -- it is inside the scanned tree and excluded by the new lines. PIPELINE: pnpm --workspace-concurrency=2 --filter '@object-ui/runner^...' build exit=0; pnpm --filter @object-ui/runner run type-check exit=0 and tsc --listFiles proves the new test IS in the program (1 hit, lit control App.navigation.test.tsx 1 hit, 1420 files) so it is measured not excluded; pnpm exec vitest run packages/runner/ from the REPO ROOT = 5 files / 21 tests passed; pnpm --filter @object-ui/runner run lint exit=0 (17 warnings, all pre-existing in untouched files); turbo ls --affected vs merge base = @object-ui/runner only. GATES (exit codes captured before any pipe): check:control-bytes 0, type-check:coverage 0, check:unreferenced-sources 0, check:phantom-deps 0, check:unused-deps 0, check:published-tsconfig-exclude 0, check:published-dist --all 0, check-changeset-presence 0 ('1 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'), check-changeset-no-major 0, check-changeset-fixed 0, check-changeset-overwrite 0. Repo-wide pnpm lint / full pnpm test left to CI (declared narrowing).",
  "mcp_calls": "8 -- issue_read get, issue_read get_comments, issue_read 8455, search_issues (dedup), search_issues (lit control), create_pull_request, pull_request_read, add_issue_comment. REST was probed first per the channel rule and is 403 for BOTH reads and writes in this container ('GitHub access is not enabled for this session'), and there is no gh CLI, so MCP was the only channel available -- declared switch.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT FILED -- both are refinements of the already-open objectui#8455, so filing would duplicate it. Dedup search ran and returned 0 for the dead-@source-path class, with a lit control in the same session that returned 4 hits (#8454/#8455/#8446/#3968), so the zero is a real reading. (1) objectui#8455's census records packages/fields/src/index.css as 'one line' as if adequate; that package has src/__tests__/numberInputBrowserReadings.ts, a non-*.test.* source inside its own scanned tree, so its missing directory line is ACTUALLY leaking, not stylistically absent -- and @object-ui/fields publishes a stylesheet consumers import. (2) objectui#8455's census column is only 'test exclusion', so a gate built to that shape would have passed packages/runner while all five of its positive @source lines were dead; the gate needs a SECOND assertion, that every @source base resolves. A repo-wide sweep run after this fix says every @source path in the repo now resolves, so that half has zero backlog and is cheap to add."
  ],
  "contradicts_brief": [
    "The brief and the card both predict 'fixing the broken @source ADDS rules (runner's own source finally gets scanned)'. MEASURED FALSE for that line: fixing ONLY line 10 to './**/*.{ts,tsx}' produced a byte-identical artifact (index-BgwNVuMG.css, 20969 B), because the CWD-rooted automatic root already covers packages/runner/**. The +1228 comes entirely from the four SIBLING lines, which the card does not flag as broken at all.",
    "The card's defect 1 mechanism is wrong: runner's sheet was NOT compiling components' test-sourced classes from the package dir, because '../../packages/components/src/**' resolves to packages/packages/components/src. The card's own instruction to read from the package dir is what exposes this -- the eight classes it expects are simply not there before the fix.",
    "The brief says a repo-root reading 'under-reports'. Measured here it INVERTS THE SIGN: repo root reads +0/-16 for a change that is +1228/-9 at the package dir. A repo-root reviewer would classify this PR as a pure removal.",
    "The brief says 'never run another package's suite through pnpm --filter PKG run test'. This repo's AGENTS.md records that objectui#3240 rewrote every package test script to 'vitest run --root ../.. packages/PKG/' precisely to make that safe, and scripts/vitest-invocation-guard.mjs now refuses a non-repo-root vitest root. I followed the brief anyway and ran everything from the repo root, so nothing rests on which is right -- but the two documents disagree and the repo's own guard is the mechanical one.",
    "The generic dispatch rules require every build/test to go through scripts/pm/os-verify-lock.sh. That script does not exist in objectui (scripts/pm/ holds only check-half-states.mjs); it is an objectstack path. No shared verify lock was used, and heavy work was kept serial by hand instead."
  ]
}

---

Generated by Claude Code