finding(test-config): the root `vitest.config.mts` has no type program of its own — a type error in it reaches CI only through `@object-ui/console`'s type-check

[yinlianghui]

Filed unassigned by the domain:devx @ objectui execution seat (session_01BGMDbrVa8JjZcCQ7DWYH1b) at the close of round R40. Observation class: nothing is red today; this records a gap that cost one CI cycle this round and will cost more as the root config grows projects.

What was measured

PR #7291 (#7183) added a conditionally spread dist project to the root vitest.config.mts. The literal extends: true inside a conditional spread widened to boolean, while TestProjectConfiguration.extends is string | true | undefined, so the whole projects array degraded to never[]. Every local gate the dev ran was green — type-check:scripts, type-check:vitest-setup, the vitest runs — and the first push went red on CI's Type Check job with three errors, two of them reported at ../../vitest.config.mts from inside apps/console's tsc --noEmit.

Cause of the blind spot, stated in that PR's fix-round section: the root vitest.config.mts is compiled by no type program of its own. apps/console/vitest.config.ts merges it, so the console's type-check is the only compiler that reads it. tsconfig.scripts.json covers scripts/**, tsconfig.vitest-setup.json covers ./vitest.setup*.ts; neither names the root config.

PR #7309 (#7134) then edited the same file's unit project comment and added a gate that reads the config text by regex (readUnitProjectShape), which is another reader with no type relationship to the file.

Why it is a finding and not nothing

• Two PRs in one round touched this file; the lane's serial-queue entry for it (vitest.config.mts + vitest.setup.*) is one of the hottest in the lane.
• The repo's own coverage gate (scripts/check-type-check-coverage.mjs) reports every package as covered while the root config is covered only transitively and only through the console's program — a package type-check green says nothing about this file unless the console job ran.
• The failure shape is silent locally: the dev's full local gate union was green, and the red appeared only in CI.

Shape of a fix, if graded in

Either add the root config (and apps/console/vitest.config.ts, which extends it) to an existing root type program whose gate CI already runs — tsconfig.vitest-setup.json is the nearest home, if its no-@types/node rule can accommodate the config's node:path import (it may not; the setup program excludes @types/node deliberately) — or declare in the lane docs that turbo run type-check --filter=@object-ui/console is the compiler of record for the root config and must be in the local gate union of any PR touching it. The second is what this seat wrote into the #7183 close comment as a lane fact; the first is the mechanical answer.

Refs: PR #7291 (the fix round), PR #7309 (the regex reader), #7183, #7134.

[os-zhuang]

分诊 — domain:devx / priority:p3 / pm:queue / finding

锚定 (anchoring)：改的是 tsconfig 覆盖面 / lane 文档 ⇒ domain:devx。

在 origin/main a472b07 上复核 —— 覆盖缺口实测存在

两个根 type program 的 include，逐字：

tsconfig.scripts.json        "include": ["scripts/**/*.ts"]
tsconfig.vitest-setup.json   "include": ["./vitest.setup*.ts", "./vitest.setup*.tsx"]

两者都不命中 vitest.config.mts。 唯一读它的编译器：

apps/console/vitest.config.ts:3    import rootConfig from '../../vitest.config.mts';
apps/console/vitest.config.ts:11     mergeConfig(rootConfig, viteConfig),

卡片的因果链成立：根配置只被 console 的 tsc --noEmit 传递性地编译到，所以本地跑遍所有根门禁仍可能全绿而 CI 红。

⭐ 补一个卡片没量的尺度：vitest.config.mts 在磁盘上是 25187 字节。这不是一个"顺带没覆盖到的小文件"，而是一个两万五千字节、被 lane 里最热的串行队列项反复修改的配置。这条支持卡片"will cost more as the root config grows projects"的判断。

第二个 reader 也在：

scripts/unit-registry-collision.mjs:79   export function readUnitProjectShape(configText) {

正如卡片所说，它靠正则读配置文本，与该文件没有任何类型关系 —— 于是这个文件现在有两个读者，一个是间接的类型程序，一个是正则，都不是"它自己的"。

⚠️ 一个卡片提了但没测到底的坑，接手者必须先测

卡片说 tsconfig.vitest-setup.json 是"最近的家，如果它的 no-@types/node 规则能容纳配置里的 node:path import（可能不能）"。除此之外还有一个更早会绊倒人的问题：那个 program 的 include 是 ./vitest.setup*.ts 和 *.tsx —— 两个 glob 都不匹配 .mts 扩展名。所以"把根配置加进去"不只是加一条 include 项的事，还要确认该 program 的 allowImportingTsExtensions / module 设置吃不吃 .mts。⛔ 别假设改一行 include 就完事。

定级理由

priority:p3：

• 今天不红（卡片自评，复核为真：仓库当前状态下这个文件类型是好的）。
• 已经造成过一次真实成本：PR test(ci): a dist vitest project so built-artifact claims can be pinned #7291 首推被 CI 的 Type Check 拦下三个错误，其中两个报在 ../../vitest.config.mts，而 dev 本地的门禁并集全绿。
• 但已有缓解：卡片说 finding(ci): a claim about a package's BUILT artifact cannot be pinned — turbo's test task builds dependencies only, so a dist-importing test is NOT MEASURED in CI #7183 的收尾评论里已经把"turbo run type-check --filter=@object-ui/console 是根配置的记录编译器"写成 lane fact。所以这不是无人知晓的洞，是一个有口头约定、缺机械保证的洞。
• 无产品面影响。

定型：tidy / 门禁覆盖面，不踩 manual floor

⚠️ 但请注意方向：扩覆盖面是收紧，不是放松 —— 不触发"gate weakening"这条人工底线。反过来，如果有人提议"把根配置排除在覆盖统计之外让报表好看"，那才是要拦的。

⛔ 给执行席的边界

1. 卡片给的两条路不是二选一，是有优先级的。 机械答案（把文件纳入某个 CI 会跑的 type program）优于文档答案（在 lane 文档里声明记录编译器），理由就在卡片自己的第二条论据里：scripts/check-type-check-coverage.mjs 报告每个包都被覆盖，而根配置只是传递性覆盖 —— 一个说谎的覆盖率报表比没有报表更危险。文档约定修不了这一条。
2. ⚠️ 若机械答案走不通（.mts glob / @types/node 两道坎），退回文档答案时必须同时修覆盖率报表，让它明确把根配置标为"由 @object-ui/console 传递覆盖"而不是笼统地算作已覆盖。⛔ 不要只写文档就收工。
3. ⛔ 不要为了让根配置能进 tsconfig.vitest-setup.json 而给那个 program 加 @types/node。那个 program 故意不带 @types/node，vitest.setup.network-escape-guard.ts:63-68 记着理由和代价（"adding it costs 12 errors inside third-party declarations"）—— 那是别的门禁的地基，动它是另一张卡。
4. 收工判据：造一个故意的类型错误进根配置，确认在不跑 console 的 type-check 时也有门禁报红。⛔ 不做这一步就不算修好 —— 这个缺陷的性质就是"以为覆盖了但没有"。

⛔ 分诊席不认领、不派单、不写码。

---

Generated by Claude Code

[baozhoutao]

Claim: PM loop round R45
Session: session_01MM7kaS4dPpYHV5BsMyu4tQ
Branch: claude/issue-7328-root-vitest-config-type-program
Worktree: objectui-issue-7328
Domain: domain:devx
File surface: one root type program's tsconfig*.json (tsconfig.vitest-setup.json if its .mts / no-@types/node constraints allow, else a new small root tsconfig wired into a root type-check:* script that CI already runs) so that vitest.config.mts and apps/console/vitest.config.ts are compiled by a program of their own; the root package.json script that runs it if one is added; scripts/check-type-check-coverage.mjs ONLY if the mechanical route fails and the coverage report must stop calling the root config "covered" (triage boundary 2); ⛔ no @types/node into tsconfig.vitest-setup.json (triage boundary 3); ⛔ no edit to vitest.config.mts's content beyond what the type program forces, and none to .github/workflows/*.yml unless a new script must be wired into an existing job (say so) (stop on breach; explain in the report)
Container & model: M, not mechanical (which program, the .mts glob, the node:path import under a program that excludes @types/node — each is a measured design choice), mode:subagent, model: opus — no path-derived tier mandate (floor sonnet · default opus · ceiling fable); default judgment tier taken
Clause-②: no
Serial constraints cleared: premise on origin/main 15789d5 at 07:52Z — vitest.config.mts present (25187 B), tsconfig.scripts.json includes only scripts/**/*.ts, tsconfig.vitest-setup.json only ./vitest.setup*.ts(x), apps/console/vitest.config.ts:3 is the only compiler path into the root config; §3's hot-file row for vitest.config.* is FREE; no open PR touches vitest.config.mts or either tsconfig (file lists read 06:27Z; #7685's 67 paths over git: 0 hits); this seat's in-flight batch (#7855 in apps/console/package.json + a scripts/__tests__/ pin; #7329 in scripts/vitest-invocation-guard.mjs + its test) is disjoint — ⚠️ #7329's test file and any new tsconfig include glob over scripts/** must not collide: the new program must NOT re-include scripts/** (that is tsconfig.scripts.json's). pm:queue → pm:dispatched + assignee written in one stroke and read back.

---

Generated by Claude Code

[baozhoutao]

os-dev-report

{
"issue": 7328,
"status": "done",
"branch": "claude/issue-7328-root-vitest-config-type-program",
"pr": "#8004",
"premise_still_valid": true,
"summary": "The gap is real and is now closed mechanically, but the card's phrasing needs one correction: the root vitest.config.mts was NOT outside every type program. apps/console/tsconfig.node.json has listed '../../vitest.config.mts' and 'vitest.config.ts' outright since objectui#3476. What was missing was a RUNNER: the only invocation of that program was the console's own type-check script (tsc --noEmit followed by tsc -b tsconfig.node.json --force), reached through the task runner whose type-check task waits on ^build. So the cheapest compiler in the repo that reads the root Vitest config was reachable only behind a full workspace build — which is exactly the consequence the card describes, and why the card is right that the docs answer was not enough. Delivered: a root script type-check:vitest-config running that program directly (tsc -b apps/console/tsconfig.node.json --force), one step in ci.yml's existing Type Check job in the CHEAP half beside pnpm type-check:scripts, the forced ci-cd-pipeline.md job-table row, and a behaviour pin test. A2 (a NEW small root program) was measured and REJECTED, not assumed: a minimal tsconfig.vitest-config.json over the two configs resolves the SAME nine non-node_modules files as apps/console/tsconfig.node.json, so it would only add a second option set over seven shared files — the documented 'green in one project, red in the other' hazard, and it would re-check scripts/vite-.ts, which the claim forbade. vitest.config.mts itself is untouched; the program forced no edit to it.",
"tests": "DONE CRITERION (ablation, on the committed tree at ddd41ba, restore under a trap with absolute paths): planted the #7291 shape itself — dropped ' as const' from 'extends: true as const' in the conditionally spread dist project. Mutation proven on disk, never by an editor exit code: 'PRE target-count=1 inject-count=0 PRE_HASH=77a40ce4 HEAD_BLOB=77a40ce4' / 'POST target-count=0 inject-count=1 POST_HASH=122c8e5d' / 'MUTATION PROVEN ON DISK (target 1->0, inject 0->1, blob hash moved)'. MUTATED_EXIT=1, MUTATED_error_TS_lines=3 — 'apps/console/vitest.config.ts(11,15): error TS2345: Argument of type UserConfig AND-others is not assignable to parameter of type never.' plus 'vitest.config.mts(346,7): error TS2769: No overload matches this call.' and 'vitest.config.mts(367,7): error TS2769: No overload matches this call.' — three errors, two of them at vitest.config.mts, the same shape PR #7291 recorded from CI job 100117481182, produced in 2.0s by a command that runs no task-runner build and no tsc --noEmit over the console app. Restore proven by STATE: RESTORED_HASH == HEAD_BLOB == 77a40ce4, git diff HEAD empty, git status --short empty. Control leg, unmutated at ddd41ba: UNMUTATED_EXIT=0, UNMUTATED_error_TS_lines=0. No build was needed for either leg (the program's imports are all node_modules or relative .ts), so the ablation needed no rebuild step; that is itself the measurement the card asked for. COST COMPARISON, same box, same worktree: console type-check through the task runner = 'Tasks: 36 successful, 36 total' in 2m24s (35 builds + 1 type-check); the new script = 2.0s on a worktree with no dist/ anywhere.",
"gates": "pnpm type-check:vitest-config (new) -> exit 0, 0 error TS lines, 2.0s | pnpm type-check:scripts -> exit 0 | pnpm type-check:vitest-setup -> exit 0 | turbo run type-check --filter=@object-ui/console -> exit 0, 'Tasks: 36 successful, 36 total' (under scripts/pm/os-verify-lock.sh, VERDICT command-exit 0, held 145s, waited 0s) | pnpm exec vitest run scripts/ -> exit 0, 'Test Files 108 passed (108)' / 'Tests 3255 passed (3255)' (under the same lock, VERDICT command-exit 0, held 102s, waited 0s) | node scripts/check-type-check-coverage.mjs -> exit 0, '45/46 via type-check, 0 via their own build, 0 known-broken, 1 not compiled' | pnpm lint:root -> exit 0, '32 problems (0 errors, 32 warnings)', full root scan in 6.1s so NO narrowing was applied and none is declared; grep confirms none of the 32 is in the new file | pnpm check:control-bytes -> exit 0, 'OK (scanned 6439 tracked text file(s); skipped 85 binary)' plus a self-scan of all four changed paths with grep -naP over the control-byte class, no hits | pnpm check:doc-fences -> exit 0, 'every TypeScript block in 227 document(s) is fenced ts/tsx/typescript' | pnpm docs:check-links -> exit 0, 'Links are valid across 17 scan roots.' | node scripts/check-changeset-presence.mjs -> exit 0, '4 file(s) changed, 0 of them published source of a package the release covers ... no changeset is owed' (so NO changeset, and per this repo's rule NO skip-changeset label was applied) | node scripts/check-governed-queue-guard.mjs --test on all four changed paths -> exit 0, 'NOT GOVERNED — 4 path(s) checked against 5 governed surface(s); none matched.' | TURBO_SCM_BASE=15789d5 turbo ls --affected -> '0 no packages', so no workspace package test/type-check is owed. Every exit code was captured by redirect-then-capture, never through a pipe. Live E2E (informational) is red on every branch today for the upstream reason (objectui#7990 / objectstack#16186) and is not this diff's. CI on PR #8004 had not converged when this report was filed; per the dispatch contract the report lands at draft-PR time and PM owns CI convergence.",
"line_budget": "n/a — no skills/** path in the diff, so no skills line ratchet applies. Diff size for the record: 4 files changed, 314 insertions, 1 deletion (ci.yml +29 comment/step, ci-cd-pipeline.md 1 line rewritten in place, package.json +1, the new pin test +283).",
"deviations": "1) A2 FALSIFIED and the route changed accordingly: no new tsconfig was created. The program already existed (apps/console/tsconfig.node.json, objectui#3476); only its runner was missing. A new root program was built and measured before rejecting it — green in 1.1s, and tsc --listFiles showed its non-node_modules source set is the SAME nine files, so it would have been a pure duplicate under a second option set. Reported in the PR body with the file list. 2) A2's spelling correction: vitest.config.mts imports 'path' and 'url' as BARE specifiers, not 'node:path' (grep -n 'node:' vitest.config.mts finds nothing). The consequence is unchanged — the program needs @types/node — so tsconfig.vitest-setup.json is still ruled out and was NOT touched (triage boundary 3 honoured). 3) Two files beyond the claim's declared surface, each forced: content/docs/guide/ci-cd-pipeline.md (one row rewritten — scripts/tests/ci-cd-pipeline-doc.test.ts fails when ci.yml runs a first-party command the job table does not name; it went RED on the first run and is green now), and scripts/tests/vitest-config-type-check.test.ts (new pin, the sibling of scripts-type-check.test.ts and vitest-setup-type-check.test.ts; without it the new gate's subject set lives in a file under apps/console with nothing watching it). 4) .github/workflows/ci.yml was edited — one step in the existing Type Check job, which the claim allows explicitly when a new script must be wired into an existing job. No timeout changed, no job added. 5) The claim's constraint that the new program must not re-include scripts/** is met by the include glob (nothing new re-includes it); note for the record that scripts/vite-.ts are in the chosen program TRANSITIVELY, as they already were before this PR — the option set over them is unchanged because the program is unchanged. 6) Process: the branch was pushed AFTER the first commit rather than as an empty routing probe before the first edit. Push returned exit 0 with no 403, so nothing was masked, but the probe step was skipped and is reported rather than buried. 7) scripts/check-type-check-coverage.mjs was NOT touched — A4 verified: its subject is workspace PACKAGES (it walks pnpm-workspace.yaml and asks per package), so it models no repo-root file and makes no claim about vitest.config.mts in either direction. The triage's fallback was conditional on a mechanical failure that did not occur.",
"files_changed": [
"package.json",
".github/workflows/ci.yml",
"content/docs/guide/ci-cd-pipeline.md",
"scripts/tests/vitest-config-type-check.test.ts"
],
"open_questions": [],
"readers": "git grep -l on the config filename over scripts/ apps/ .github/ tsconfig*.json package.json turbo.json returns 22 paths: .github/workflows/ci.yml, apps/console/tsconfig.node.json, apps/console/vite.config.ts, apps/console/vitest.config.ts, scripts/tests/helpers/attached-docs.ts, scripts/tests/helpers/vitest-config-program.ts, scripts/tests/package-scripts-vitest-projects.test.ts, scripts/tests/side-effects-declaration-consistency.test.ts, scripts/tests/turbo-test-inputs.test.ts, scripts/tests/turbo-type-check-inputs.test.ts, scripts/tests/unconsumed-widget-option-claim-6186.test.ts, scripts/tests/unit-registry-absence-collision.test.ts, scripts/tests/vitest-config-alias-targets-3944.test.ts, scripts/tests/vitest-config-type-check.test.ts (new), scripts/tests/vitest-invocation-guard.test.ts, scripts/tests/vitest-setup-type-check.test.ts, scripts/check-package-self-import.mjs, scripts/unit-registry-collision.mjs, scripts/vitest-invocation-guard.mjs, tsconfig.scripts.json, tsconfig.vitest-setup.json, turbo.json. Every test-file reader among them ran in the pnpm exec vitest run scripts/ union above (108 files, 3255 tests, all green). Note the dispatch named scripts/tests/unit-registry-collision*.test.ts; the file on disk is scripts/tests/unit-registry-absence-collision.test.ts and that is the one that ran.",
"mcp_calls": "3 — one search_issues (dedup), one create_pull_request, one issue_write; plus this comment. Every card and PR READ went through unauthenticated repo-scoped REST (the zero-quota channel); REST /search is 403 in this session, so the dedup search used MCP as the dispatch prescribes.",
"out_of_scope_findings": [
"filed as objectui#8005 (label finding + domain:devx, unassigned, no pm:queue): nothing audits the repo-ROOT TypeScript sources for tsc-program coverage. Measured on the branch — all 11 root .ts/.mts/.tsx sources are in a program a CI job runs, and zero are uncovered — but that number is 11 only because six separate cards each noticed one family by hand (objectui#3494 scripts/, objectui#3476 the console configs, objectui#3515 vitest.setup.*, objectui#4471 and objectui#4477 e2e/ and the playwright configs, objectui#7328 this one). check-type-check-coverage.mjs's population is workspace packages, so a root file is outside it by construction; what exists instead is one pin test per family, each blind to a filename the others do not name."
]
}

---

Generated by Claude Code

[baozhoutao]

ACCEPT — PR #8004, head ddd41bab9; flip and arming on CI convergence

domain:devx @ objectui execution seat, PM session session_01MM7kaS4dPpYHV5BsMyu4tQ, R45, 2026-09-06T08:13Z. Report reviewed against GitHub and the tree, ⛔ not against its narrative.

item	reading (mine)
PR shape	draft ✅ · base main ✅ · first line Fixes #7328 ✅ · 4 files ✅
A2 falsified, and the route is better for it	apps/console/tsconfig.node.json already includes ../../vitest.config.mts, vitest.config.ts, vite.config.ts and ../../scripts/vite-*.ts (since #3476) — the gap was a RUNNER, not a program. A new root program was built, measured to resolve the same nine sources, and rejected as a duplicate option set over shared files. vitest.config.mts untouched; tsconfig.vitest-setup.json untouched (boundary 3)
The fix, read	package.json +1: "type-check:vitest-config": "tsc -b apps/console/tsconfig.node.json --force"; .github/workflows/ci.yml +29: one step Type-check the root Vitest config → pnpm type-check:vitest-config in the cheap half of the existing Type Check job beside type-check:scripts (the claim allowed the workflow edit for exactly this); ci-cd-pipeline.md: the job-table row now names the command (forced by ci-cd-pipeline-doc.test.ts, which went red first)
The pin, read (+283)	resolves the program with TypeScript's own API: no config diagnostics; every root vitest.config.* source in the program and none left out; the merging consumer included; allowJs off so the config's @ts-expect-error stays live; the script exists, invokes tsc directly (not turbo), runs in ci.yml's type-check job after install and BEFORE the build, does not displace the console's own type-check
Done criterion (triage boundary 4)	the #7291 shape planted (as const dropped from the conditionally spread extends: true) → exit 1 with three error TS lines, two at vitest.config.mts, in 2.0 s with no build and no console type-check; mutation and restore proven by blob hash; unmutated exit 0. Cost comparison: the old route was 36 turbo tasks / 2m24s
Gates	new script 0 · type-check:scripts · type-check:vitest-setup · console type-check 36/36 · scripts/ suite 108 files / 3255 tests · coverage gate unchanged (its population is packages — A4 read correctly, boundary 2's fallback not needed) · lint:root 0 errors · control-bytes · doc-fences · doc-links · changeset-presence none owed · governed guard NOT GOVERNED ×4 (.github/** is not among the five governed surfaces) · turbo ls --affected 0 packages
Deviations accepted	two files beyond the claimed surface, each forced by a red pin (the job-table doc row; the new pin file as the sibling of the two existing type-check pins); the bare path / url specifiers correction (same consequence: @types/node needed)
Out of scope	#8005 filed (nothing audits repo-root TS sources for program coverage; today's 11 are covered only because six cards each noticed one family)
CI on ddd41bab9 at 08:13Z	19 success, 3 skipped, 7 in progress

On all-green: flip ready, wait for the post-flip guard, arm, confirm added_to_merge_queue. On MERGED: content probe on re-fetched origin/main ("type-check:vitest-config" in package.json; pnpm type-check:vitest-config in ci.yml; the pin file present; control — "type-check:scripts" still present), card closes via Fixes, strip pm:dispatched, clear assignee.

---

Generated by Claude Code

[baozhoutao]

Armed. PR #8004 flipped ready 08:41:03Z on all-green-but-the-base-red lane (standing-down note 5557977945, anchor #7990); post-flip guard success (30 runs); auto-merge enabled; added_to_merge_queue 08:42:15Z read from the REST timeline. Landing stroke on MERGED per the ACCEPT above.

---

Generated by Claude Code