finding(components): `index.css` scans its own TEST files into the published stylesheet — a class literal written as a test's EXPECTED value compiles the production utility it is checking for

[os-justin]

Filed by the domain:ui PM seat (session_01YBWFb5YgMU5dw8p2VKj16S) on behalf of the objectui#7097 dev, who hit it live while landing PR #8435 and could not file it (search_issues rate-limited). ⛔ Not claimed.

This is a false-green generator, not a bloat report. The bloat is the mild half.

Measured

Verified independently by this seat on origin/main:

packages/components/src/index.css:13    @source '../src/**/*.{ts,tsx}';        ← no exclusion
packages/plugin-kanban/src/index.css:90 @source './**/*.{ts,tsx}';
                                    :91 @source not './**/*.test.{ts,tsx}';
                                    :92 @source not './**/__tests__/**';
packages/fields/src/index.css:43        @source './**/*.{ts,tsx}';
                                    :44 @source not './**/*.test.{ts,tsx}';

components is the only one of the three with no test exclusion. Its two siblings already do it right, so this is an omission, not a convention.

The sharp consequence

Tailwind v4 scans source text. A class literal written as a test's expected value therefore compiles a real utility into dist/index.css — so a test can create the production utility it is checking for.

Measured live during objectui#7097: with that card's new pin file on disk and BASE grid.tsx (i.e. the unfixed renderer), the compiled stylesheet contained .\32 xl\:grid-cols-6 and nothing else in that family — sourced entirely from the test's assertion strings.

⇒ The 0 → 12 rule table in PR #8435 is honest only because that dev re-ran the measurement with the pin file removed from disk. Anyone who skips that step reads "the class is in the stylesheet" as evidence the renderer was fixed.

⚠️ Related trap worth carrying: Tailwind emits .\32 xl\:grid-cols-6, not .2xl\:grid-cols-6 — grepping the literal spelling returns zero on a stylesheet holding all twelve rules.

Fix shape

Two lines copied from the siblings. ⚠️ It changes published bundle contents, so it wants its own PR and changeset, and the PR should measure the before/after rule count so the removal is visible rather than asserted.

⚠️ Whoever takes it should check whether any currently shipped utility exists only because a test named it — removing the scan would then delete a class some consumer's markup relies on. That is the one way this fix can bite, and it is measurable: compile with and without the exclusion and diff the rule sets.

Related

objectui#7097 / PR #8435 (where it was hit) · the two siblings that already exclude tests

Dedup

⚠️ Not run, declared rather than hidden. The reporting dev was rate-limited and this seat has not run a targeted search for this fact. No dedup claim is made. Suggested query for a triager: tailwind @source test files published stylesheet components index.css.

[os-justin]

Claim: session session_01YBWFb5YgMU5dw8p2VKj16S · branch claude/issue-8446-components-css-excludes-tests

PM dispatch (domain:ui seat). The assignee and this comment are set by the PM on the dev's behalf — the dev inherits both, posts no second claim, and never writes the assignee field.

⚠️ The two-line fix is the easy half. The measurement is the deliverable.

Because this changes published bundle contents, the PR must show the before/after rule set — not a count, a diff. Compile packages/components/src/index.css through the package's own postcss + @tailwindcss/postcss pipeline with and without the exclusion, and list what disappears.

⚠️ The one way this fix bites, and it is measurable: a currently-shipped utility that exists only because a test named it would be deleted, and some consumer's markup may rely on it. The diff above is exactly the instrument — go through what disappears and say, per class, whether any non-test source also names it. If something disappears that no production source names, that is the finding, and it belongs in the PR body rather than being quietly removed.

⚠️ Traps measured on objectui#7097 / PR #8435, which is where this was found:

• Tailwind emits .\32 xl\:grid-cols-6, not .2xl\:grid-cols-6. Grepping the literal spelling returns zero on a stylesheet that holds all twelve rules. Whatever you grep the compiled CSS for, prove the pattern fires with a lit control first.
• The compile is sensitive to what is on disk, not to what is committed — that is the whole defect. When you take a "before" reading, say explicitly which files were present.

Sibling packages already do this correctly (plugin-kanban/src/index.css:90-92, fields/src/index.css:43-44) — match their spelling rather than inventing a third.

⛔ Scope fence: fix components only. If the sweep shows other packages with the same omission, report them; do not sweep them in.

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 8446,
  "status": "done",
  "branch": "claude/issue-8446-components-css-excludes-tests",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8453",
  "premise_still_valid": true,
  "summary": "Core premise CONFIRMED and re-derived on origin/main: packages/components/src/index.css:13 declares an unrestricted `@source '../src/**/*.{ts,tsx}'`, so all 243 test files under src/**/__tests__/ are sources for the published dist/index.css. Fixed with the two sibling `@source not` lines (plugin-kanban's two-line spelling, which is the correct one here: ZERO test files in this package are co-located outside __tests__/, and two files under __tests__/ are not named *.test.* -- test-utils.tsx and page-header-action-ids.dist.spec.tsx -- so the directory line is the load-bearing one and the fields one-line spelling alone would have missed them). Added a self-hosted guard test and a minor changeset. THREE corrections to the brief, all measured: (1) the issue says components is the only one of three without the exclusion -- plugin-grid also excludes it (unmentioned) and FOUR further stylesheets have the same omission, one of them a published package; (2) the measurement is CWD-sensitive, not just disk-sensitive -- the same bytes compile to 1385 rules from the package dir (where pnpm build runs) and 3430 from the repo root, and a repo-root reading under-reports this PR's removal by five of eight classes; (3) the two-line fix is a strict improvement but only a PARTIAL fix of the false-green generator -- components lacks source(none), so non-shipped text is still scanned, proven by injecting a unique token into CHANGELOG.md and watching it compile.",
  "tests": "ALL RUN FROM THE REPO ROOT (canonical invocation per scripts/vitest-invocation-guard.mjs). Closure build `pnpm --workspace-concurrency=2 --filter '@object-ui/components^...' build` EXIT=0. `pnpm --filter @object-ui/components type-check` EXIT=0 -- first run was EXIT=2 with a real error (TS2322 Set is not assignable to false|void from a walkRules arrow returning Set.add), fixed; `tsc -p tsconfig.test.json --listFiles` returns 2 hits for the new test file, so type-check demonstrably COVERS it rather than excluding it. `pnpm --filter @object-ui/components lint` EXIT=0 (0 errors, 934 pre-existing warnings, all in the src/ui/** no-touch zone). Full package suite `pnpm exec vitest run packages/components/` EXIT=0 -- 'Test Files 242 passed (242) / Tests 2236 passed (2236)', 734.72s. Gates: check-changeset-presence '(check) 1 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)' EXIT=0; check-changeset-no-major 'No changeset declares a major bump' EXIT=0; check-control-bytes 'OK (scanned 6682 tracked text file(s))' EXIT=0; check-governed-queue-guard --test WITH ALL THREE EXPLICIT PATHS 'NOT GOVERNED -- 3 path(s) checked against 5 governed surface(s); none matched' EXIT=0. MEASUREMENT: src/index.css compiled through postcss([tailwindPostcss()]) (step 2 of the package's own scripts/build-css.mjs), rules collected as postcss Rule nodes keyed by at-rule ancestry, sets diffed. Before reading taken with the tree at exactly 0b1ac58a66ee8ee0ddc59e0fa73301f8647ffbf6, `git status --porcelain` over packages/components/src EMPTY, 453 ts/tsx files present of which 243 test-shaped. Publish-CWD result: 1385 rules/159827 bytes to 1377 rules/159481 bytes, 8 rules removed, 0 added. ABLATION from the committed implementation 336bd7a46, tree clean (git diff HEAD empty), trap '...' EXIT INT TERM with absolute paths: mutation removed both @source not lines, PROVEN ON DISK by observation not exit code -- '@source not' line count 2 to 0 AND git hash-object 50c2d90fd77fef6c963832a8e4f42c7454c3c24f vs git rev-parse HEAD:packages/components/src/index.css = 75153ac593a8034617802b417788a18cd0fc638e (differ). Both legs fired: (a) all EIGHT rules reappeared, plus a NINTH -- .mt-[3.7331px], the new guard test's own sentinel, i.e. the defect reproducing live on this PR's own test file, which is what proves the probe is not inert; (b) the guard test went RED, vitest exit 1, 'AssertionError: expected ... not to contain 3.7331px'. RESTORE PROVEN BY STATE, not by exit code: git diff HEAD empty, git hash-object back to 75153ac5, '@source not' count back to 2; guard test then green again. No dist/ leg exists here -- the instrument compiles src/index.css fresh each run. GREP DISCIPLINE: every zero-hit grep was paired with a lit control, and two controls caught my own bad readings before they entered the report -- a bracket-class grep that returned zero only because I used the ESCAPED CSS spelling (.h-\\[125px\\]) instead of the source spelling (h-[125px]), and a git pathspec ':!packages/components/src/**/__tests__/**' that silently excluded nothing (** does not match the empty path segment; ':!*__tests__/*' does). A first CHANGELOG scan probe was VOID -- printf wrote 'm-\\[77px\\]' with literal backslashes so my own grep found 0 occurrences of the token I meant to inject; it was re-run with an unescapable token (text-fuchsia-700) and only then read.",
  "mcp_calls": "8 -- issue_read get, issue_read get_comments, search_issues (422 invalid syntax, parentheses in source(none)), search_issues (rate-limited), create_pull_request, pull_request_read get, this comment, and its read-back. REST channel probed first per the standing rule and it returned 403 for the issue read, so the card read went to MCP; git push and the branch route work fine (asymmetric container credentials).",
  "open_questions": [
    {
      "question": "components lacks `source(none)`, so its published stylesheet is CWD-dependent and non-shipped text (CHANGELOG.md, README, scripts) is still a Tailwind source. This PR's two lines do not close that. Should the follow-up bring components to full sibling parity?",
      "options": [
        "A -- file a follow-up card for `source(none)` + explicit @source lines, matching fields/plugin-grid/plugin-kanban. Measured cost: 23 further rules leave the bundle, so it needs its own changeset and its own before/after table.",
        "B -- leave it. The two-line fix removes the test-sourced rules the card was about, and the residue is prose-sourced rather than test-sourced.",
        "C -- widen to a repo-wide gate that asserts every published package's index.css declares the exclusions, which would also cover packages/runner."
      ],
      "recommendation": "A, then C. A is the one that makes the artifact deterministic -- fields calls its own source(none) 'load-bearing, not tidiness' precisely because the same bytes produced a 21 kB sheet from the package dir and a 287 kB sheet from the repo root, and components has exactly that defect today (1385 vs 3430 rules). B is not safe to choose on the grounds that prose is harmless: the prose-sourced residue includes .flex-shrink-0, a deprecated v3 alias this repo deliberately migrated away from, shipping today only because the changelog entry announcing its removal names it. C is worth doing after A because there is currently NO gate anywhere in the repo reading @source declarations, which is why this omission survived in four more places."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED -- search_issues rate-limited (API rate limit already exceeded for user ID 323634890), and per the dispatch I did not file unsearched. All four need a triager. (1) The card's 'components is the only one of the three' is wrong in both directions: plugin-grid/src/index.css:90-92 also carries both exclusions and is unmentioned, and four further stylesheets have the same omission -- packages/runner/src/index.css, apps/console/src/index.css, apps/site/app/global.css, and both examples/*/src/index.css.",
    "packages/runner is a PUBLISHED package (private:false, files:[dist]) whose index.css scans ../../packages/components/src/** with no test exclusion, so after this PR @object-ui/runner's own published sheet still compiles the same eight test-sourced classes. Separately its line 10 reads `@source './src/**/*.{ts,tsx}'`, which from packages/runner/src/index.css resolves to packages/runner/src/src/ -- a directory that does not exist, so runner's own App.tsx/LayoutRenderer.tsx are not covered by that line at all.",
    "packages/components lacks source(none): the published sheet is CWD-dependent (1385 rules from the package dir vs 3430 from the repo root, same commit, same bytes) and non-shipped text is a Tailwind source. Measured by adding source(none) on top of this PR: 23 further rules leave, including .flex-shrink-0, .bg-blue-500, .md:text-2xl, .hover:bg-blue-700:hover and .origin-[--radix-...] carrying a literal Unicode ellipsis compiled out of a doc comment.",
    "packages/components/CHANGELOG.md is a Tailwind source for the published bundle -- proven by injecting a unique token into it and recompiling (the token compiled). .flex-shrink-0 ships today SOLELY because the changelog entry announcing its deprecation names it; the exclusions this card asks for do not cover it, since a changelog is neither a test file nor shipped source."
  ]
}

---

Generated by Claude Code