Repository navigation
Conversation
STU-368. Which packages the Flutter SDK supplies was decided by a hand-maintained name list kept in three places, and flutter_web_plugins was in none of them. Every project declaring it - which is every web-enabled project with a plugin - read it as a dependency that could not be reproduced, and the deploy was refused for a package most of its classes never imported. The project's own pubspec already says where each package comes from; the parser read those lines and threw them away. It now returns them as sourceKey/sourceValue, so the classification is exact and cannot fall behind the SDK: sdk: -> the Flutter SDK, reproduced from the name a nested version: -> a constraint written on its own line git: / path: / nested hosted: -> not expressible in the manifest SDK_DEPENDENCIES is gone. The runner's allowedSdkPackages is gone too - it independently refused the same deploy with 'Unsupported SDK package'. That allowlist was also the only validation of an sdkPackages entry, so the package name pattern now does that job; without the swap a caller-supplied name would reach the generated pubspec unchecked. The runner still writes 'sdk: flutter' itself, so that value never comes from a caller. Refusal is now scoped per class, to that class's own imports, so one git: entry no longer leaves an entire deploy uncompiled. The accept/warn split already existed and is unchanged: a real analyzer error refuses with 422, and a class that could not be compiled is pushed with its warning logged before the provisioning request. Corrects DEPLOYMENT.md, which still described the scaffolding-closure compilation that reverting a1238f0 removed, and still claimed that nothing unverified is deployed. Verified: 274/274 tests, deploy guard 9/9, proxies 30/30, build clean, dart analyze on the runner reports no issues.
- Add src/designTokens.css as the single shipping token stylesheet, extracted from the canonical custom-code-connect-hero.html :root token set. - Link the stylesheet from index.html; reuse existing /fonts/Delight-VF.ttf and DM Mono Google Fonts path. - Replace the legacy inline :root in index.html with only the layout constant --sidebar-w, preserved until its owning shell change. - Migrate legacy variable references to new tokens: --main-bg -> --bg, --navy -> --fg, --label -> --muted, --sublabel -> --muted-2, --input-bg -> --surface-sunken, --input-border -> --border, --badge-bg -> --accent-soft, --badge-text -> --accent, --glow-color -> --accent-soft. - Centralize :focus-visible and prefers-reduced-motion defaults in the token stylesheet and remove redundant local reduced-motion rules. - No generation/deploy code changed; app.js has no affected CSS var refs.
Owner
Author
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…ust the first (cherry picked from commit d5a3c92)
…can reach a class transitively (cherry picked from commit 9d338ad)
…hape (cherry picked from commit ff9bfac)
(cherry picked from commit 1ed78b6)
…t HTML (cherry picked from commit ece1237)
…pe in a Set The public deploy route accepted an unbounded sdkPackages array and deduped it with repeated result.contains scans, so an unauthenticated caller could submit a very large list for quadratic parsing work and an equally large scratch pubspec. Cap the list at maxDependenciesPerRequest (200) - the same per-request budget the dependency maps use, since every accepted name is emitted as a dependencies: entry in the generated pubspec - and reject with the same 'Too many entries in verification...' error style. Deduplicate via a Set instead, keeping insertion order and the List<String> contract. Also rebuild dist/ so the committed output carries this branch's token changes (new CSS bundle beside the unchanged JS).
… scratch-graph approximation (cherry picked from commit e300b76)
Comment on lines
+217
to
+220
| const approximate = unrepresentable.map( | ||
| (name) => | ||
| `Your project declares ${name} from a source that cannot be reproduced outside it, so the pre-deploy compile check runs against a scratch package graph that omits ${name}. Classes that do not import ${name} directly are still checked, but against that reduced graph, so their transitive package resolution may differ from your project's and the check is approximate for them.`, | ||
| ); |
Contributor
There was a problem hiding this comment.
The notice is created from every unrepresentable dependency before the code checks which classes are compiled. As a result, a deployment containing only dart: imports—or one where every class is skipped—still appears as “Verified approximately,” even though no compiled class used the reduced package graph and possibly no class was verified. This gives users an inaccurate account of verification coverage. Only emit this notice when a compiled source has a package: import affected by the reduced graph.
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/customCodeVerification.js
Line: 217-220
Comment:
**Approximation notice overstates coverage**
The notice is created from every unrepresentable dependency before the code checks which classes are compiled. As a result, a deployment containing only `dart:` imports—or one where every class is skipped—still appears as “Verified approximately,” even though no compiled class used the reduced package graph and possibly no class was verified. This gives users an inaccurate account of verification coverage. Only emit this notice when a compiled source has a `package:` import affected by the reduced graph.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Owner
Author
|
@greptileai — all findings from the previous review have been addressed (see new commits). Please re-review this PR. |
Owner
Author
|
Closing: this branch is already fully contained in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes STU-373.
What this PR does
src/designTokens.css(surfaces/ink, coral accent, state colors, type scale, weights, radii, shadows, spacing, motion, reduced-motion and focus defaults).index.html, removes the legacy inline:rootexcept--sidebar-w, and migrates legacy CSS variable references to the new tokens./fonts/Delight-VF.ttfasset and the DM Mono Google Fonts link.Verification
npm test— 274/274 passing.npm run build— production bundle built successfully,Delight-VFbundled.:roottokens are defined, the font loads, body colors resolve to the canonical OKLCH values, and reduced motion suppresses the spinner animation.Intentional deviations
The PR appears safe to merge, with only the previously reported non-blocking verification-coverage wording issue still outstanding.
Fix with agent prompt
Summary
This PR centralizes the exported design system into a shipping stylesheet, migrates legacy CSS variables, adds reduced-motion and focus defaults, and expands deployment verification and CI safeguards.
src/designTokens.css.Reviews (4) · Last reviewed commit: "fix: scope the verification skip to dire..."