Repository navigation
Fix the CSS guard letting through the values most worth catching - #24
Merged
DianaSensei merged 1 commit intoSep 22, 2026
Conversation
The guard tokenised a line by splitting on whitespace, quotes, braces, parentheses and commas. Parentheses and commas appear inside arbitrary values, so `max-h-[calc(100vh-13rem)]` was torn into `max-h-[calc`, `100vh-13rem` and `]`, none of which looks like a class. Same for `grid-cols-[minmax(0,1fr)_minmax(0,1.4fr)]`. That is exactly backwards: a value containing a function call is the one a host file will never spell identically, so it is the likeliest to have no rule at all. One of the two classes that caused this PR's bug was in that blind spot. Match candidate tokens instead of splitting, so a bracketed value stays whole. Covered by a test that asserts both shapes are recognised. Also corrects the header comment's claim that named utilities are "effectively safe". Auditing all four plugins against the host's compiled CSS disproved it — bottom-3, pl-1.5 and border-bad/60 had no rule either, which this PR also fixes. The offline test cannot see that half; only scripts/check-host-classes.mjs against a real host build can. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Nz2ELEkkMQzn6N429NkFy
DianaSensei
deleted the
claude/miniapp-container-logs-overflow-szzaje
branch
September 22, 2026 08:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #19, which merged before this was ready. One commit, one file.
The bug
ui/hostCssClasses.test.ts— the guard #19 added — tokenised a line by splitting on whitespace, quotes, braces, parentheses and commas.Parentheses and commas appear inside arbitrary values. So:
None of those fragments looks like a class, so both sailed through.
That is exactly backwards. A value with a function call in it is the one a host file will never spell identically, so it is the likeliest of all to have no rule at all.
max-h-[calc(100vh-13rem)]is one of the two classes that caused #19's bug in the first place, andgrid-cols-[minmax(0,1fr)_minmax(0,1.4fr)]was #20's. Both were in the guard's blind spot.The fix
Match candidate tokens instead of splitting, so a bracketed value stays whole.
Proved by putting both classes back into
ContainerLogsDialogand re-running:Both now caught. A regression test asserts it, so the tokeniser cannot quietly narrow again.
Also
Corrects the header comment's claim that named utilities are "effectively safe". Auditing all four plugins against the host's compiled CSS disproved it —
bottom-3,pl-1.5andborder-bad/60had no rule either, which #19 also fixed. The offline test cannot see that half; onlyscripts/check-host-classes.mjsagainst a real host build can, and the comment now says so.Verification
npm run typecheck— cleannpx vitest run— 54 tests passnpm run build— bundle buildsscripts/check-host-classes.mjsclean against a build of the currently released hostNote
#23 (
main) scaffolds this guard into every new plugin and already carries this fix in its template — it was written after the tokeniser was corrected, so no follow-up is needed there.The three other plugins (#20, #21, #22) merged without the offline guard; only container-manager ever had it. Their classes are verified clean by the script, but they have no test stopping a new arbitrary value creeping in. Happy to add it to each if you want that.
🤖 Generated with Claude Code
https://claude.ai/code/session_017Nz2ELEkkMQzn6N429NkFy
Generated by Claude Code