Skip to content

salvage: orphaned wip from concurrent agent (do not merge)#7791

Closed
lalalune wants to merge 1 commit into
developfrom
salvage/wip-2026-05-18-orphaned
Closed

salvage: orphaned wip from concurrent agent (do not merge)#7791
lalalune wants to merge 1 commit into
developfrom
salvage/wip-2026-05-18-orphaned

Conversation

@lalalune
Copy link
Copy Markdown
Member

@lalalune lalalune commented May 19, 2026

Relates to

Risks

Background

What does this PR do?

What kind of change is this?

Documentation changes needed?

Testing

Where should a reviewer start?

Detailed testing steps

Greptile Summary

This PR refactors the cloud-frontend, homepage, and os-homepage packages: replacing ~90 hardcoded hex brand colors (#FF5800, #0B35F1) with CSS custom properties (var(--brand-orange), var(--brand-blue)), and extracts the CheckoutPage/CheckoutResult/ProductDetail components from os-homepage/App.tsx into their own files with lazy-loading. Build tooling is also updated across all three packages.

  • CSS variable theming: All hardcoded brand-orange/blue hex values in cloud-frontend are replaced with CSS custom properties, enabling centralized theme control.
  • os-homepage code-split: Checkout and product-detail views are lazy-loaded via React.lazy/Suspense, reducing the initial homepage bundle size.
  • plugin-wallet build refactor: External dependency list is now derived dynamically from package.json instead of a hardcoded regex; rollup-plugin-visualizer is added to all three frontend packages; cloud-frontend gains a modulePreload filter to avoid eagerly preloading heavy wallet/chart chunks on the landing page.

Confidence Score: 3/5

The CSS-variable and code-splitting changes are safe; the stats.html output being deployed publicly needs to be addressed before shipping.

The vast majority of cloud-frontend changes are mechanical hex-to-CSS-variable substitutions with no logic impact. The os-homepage refactoring cleanly separates checkout and product-detail into lazy-loaded modules. The one issue worth resolving before merge is that all three packages now write dist/stats.html into their production build output, making internal bundle composition visible to anyone who visits /stats.html on the deployed sites.

All three vite.config.ts files (cloud-frontend, homepage, os-homepage) need the visualizer output relocated or excluded from deployment. packages/homepage/src/App.tsx RouteFallback color inversion is worth a second look.

Security Review

  • Bundle map public exposure: rollup-plugin-visualizer is configured with filename: "dist/stats.html" in packages/cloud-frontend/vite.config.ts, packages/homepage/vite.config.ts, and packages/os-homepage/vite.config.ts. This file is written into the production build output and will be served as a public static asset, exposing the full internal bundle composition (file paths, package names, dependency graph, chunk sizes) to anyone who navigates to /stats.html.

Important Files Changed

Filename Overview
packages/cloud-frontend/vite.config.ts Adds rollup-plugin-visualizer (outputs dist/stats.html), deduplicates three new packages, and introduces a modulePreload filter restricting preloads to vendor-react/rolldown-runtime chunks only.
packages/os-homepage/src/CheckoutPage.tsx New file extracted from App.tsx containing CheckoutPage and CheckoutResult components; auth flow and Stripe checkout logic are identical to what was in App.tsx.
packages/os-homepage/src/ProductDetail.tsx New file extracted from App.tsx; purely presentational product detail page with no logic changes.
packages/os-homepage/src/App.tsx Large refactor: checkout/product-detail code moved to separate files and lazy-loaded via Suspense; RouteFallback loading spinner added for lazy route boundaries.
packages/homepage/src/App.tsx RouteFallback background changed from BRAND_COLORS.black to BRAND_COLORS.orange and text from BRAND_COLORS.white to BRAND_COLORS.black, inverting the loading-screen color scheme.
plugins/plugin-wallet/build.ts Replaces hardcoded external list (regex + undici) with a dynamic list read from package.json dependencies and peerDependencies; only the main dist/index.js is renamed to .mjs, which matches the package.json exports.
packages/os-homepage/vite.config.ts Adds rollup-plugin-visualizer (dist/stats.html) and adds zod to the deduplication list.
packages/homepage/vite.config.ts Adds rollup-plugin-visualizer with dist/stats.html output to the build pipeline.

Comments Outside Diff (1)

  1. packages/homepage/src/App.tsx, line 16-28 (link)

    P2 Loading screen color scheme inverted

    The RouteFallback background was changed from BRAND_COLORS.black to BRAND_COLORS.orange and the color from BRAND_COLORS.white to BRAND_COLORS.black. Every lazy route navigation now flashes a bright-orange full-screen background before the chunk loads. On fast connections this can appear as an intrusive orange flash; on slow connections users stare at an orange screen. All other loading spinners in the codebase use a dark background — this is the only one with an inverted scheme. Confirm this inversion is intentional.

Reviews (1): Last reviewed commit: "salvage: orphaned wip from concurrent ag..." | Re-trigger Greptile

Greptile also left 2 inline comments on this PR.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 19, 2026

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 77666d38-7574-4ffd-9909-f14898ddcbe1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch salvage/wip-2026-05-18-orphaned

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 19, 2026

Claude encountered an error after 1s —— View job


I'll analyze this and get back to you.

@lalalune
Copy link
Copy Markdown
Member Author

Closing per maintainer decision: this PR was an automated salvage commit from a concurrent agent and was explicitly marked 'do not merge' in the title. Real changes should be cherry-picked by the owning agent into a properly-scoped PR rather than landed wholesale.

@lalalune lalalune closed this May 19, 2026
Comment on lines 149 to +155
},
react({ include: /\.(jsx|tsx|mdx)$/ }),
tailwindcss(),
visualizer({
filename: "dist/stats.html",
gzipSize: true,
brotliSize: false,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security dist/stats.html will be publicly accessible after deploy

rollup-plugin-visualizer writes dist/stats.html to the build output directory. Since that directory is deployed as a static asset tree, anyone can browse to https://elizacloud.ai/stats.html and see the full bundle treemap — exposing internal package names, file paths, relative sizes, and the complete dependency graph. The same issue exists in packages/homepage/vite.config.ts and packages/os-homepage/vite.config.ts. Consider adding dist/stats.html to the deploy ignore list, moving the output outside dist/ (e.g. tmp/stats.html), or gating the plugin on mode !== "production".

Comment on lines +428 to +436
// anywhere). The dynamic-import callsite still triggers preload via
// Vite's __vitePreload helper at navigation time.
modulePreload: {
polyfill: false,
resolveDependencies: (_filename, deps) =>
deps.filter(
(dep) =>
/vendor-react|rolldown-runtime/.test(dep) ||
dep.endsWith(".css"),
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 modulePreload filter is tied to internal Vite chunk-name conventions

The regex /vendor-react|rolldown-runtime/ matches Vite/Rolldown's current internal naming for the React vendor chunk and the module loader runtime. If the bundler ever renames these chunks (e.g. Rolldown graduates from beta and changes defaults, or the manual-chunks configuration evolves), the filter silently matches nothing and the runtime is no longer preloaded — causing a measurable regression in Time-to-Interactive on first load. Consider asserting in a build-time check that at least one rolldown-runtime and one vendor-react chunk was actually emitted, so a naming drift is caught at build time rather than silently degrading production performance.

@lalalune lalalune deleted the salvage/wip-2026-05-18-orphaned branch May 19, 2026 10:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants