Skip to content

fix: avoid false positives in import-protection plugin - #6708

Merged
schiller-manuel merged 1 commit into
mainfrom
fix-import-protection-false-positive
Feb 19, 2026
Merged

fix: avoid false positives in import-protection plugin#6708
schiller-manuel merged 1 commit into
mainfrom
fix-import-protection-false-positive

Conversation

@schiller-manuel

@schiller-manuelschiller-manuel commented Feb 19, 2026

Copy link
Copy Markdown
Collaborator

Summary by CodeRabbit

  • Tests

    • Added new test coverage for boundary-safe and factory-safe import patterns.
    • Enhanced test setup with real browser navigation for improved reliability.
  • Bug Fixes

    • Improved violation detection to reduce false positives in pre-transform resolution paths.
  • Refactor

    • Enhanced violation handling with optional silent mode for internal import lookups.

@coderabbitai

coderabbitaiBot commented Feb 19, 2026

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

The PR introduces boundary-safe and factory-safe server-function patterns in e2e tests, adds a silent mode to the import-protection plugin for pre-transform resolutions to reduce false positives, exports the SERVER_FN_LOOKUP constant, and updates test infrastructure to use real browser navigation for SSR transforms.

Changes

Cohort / File(s)Summary
Test Route and Violation Handlers
e2e/react-start/import-protection/src/routes/index.tsx, e2e/react-start/import-protection/src/violations/boundary-safe.ts, e2e/react-start/import-protection/src/violations/factory-safe/...
Added test route with new UI blocks displaying boundary-safe and factory-safe server function types; introduced three boundary-safe helpers (safeServerOnly, safeServerFn, safeIsomorphic) that leverage TanStack React Start APIs, and a factory-safe pattern using middleware to supply request-scoped context via createSecretFactoryServerFn.
Import-Protection Plugin Silent Mode
packages/start-plugin-core/src/import-protection-plugin/plugin.ts
Added optional silent flag to suppress violation reporting for internal/pre-transform resolutions; introduced isPreTransformResolve detector to identify pre-transform paths and wired silent handling through marker violations, specifier denials, and file-based denials to reduce false positives during dev-time pre-transform passes.
Start Compiler Plugin Export
packages/start-plugin-core/src/start-compiler-plugin/plugin.ts
Exported SERVER_FN_LOOKUP constant to enable external module access for server-function lookup keys.
E2E Test Infrastructure and Coverage
e2e/react-start/import-protection/tests/violations.setup.ts, e2e/react-start/import-protection/tests/import-protection.spec.ts
Replaced HTTP fetch-based warmup logic with real headless Chromium browser navigation for SSR/client-env transforms; added tests for boundary-safe and factory-safe patterns to verify no false positives in dev and build environments; removed forced non-null assertions on trace elements.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • feat: serverfn abstraction #5040: Introduces server-function abstraction and createServerFn plugin/compiler infrastructure that directly underlies the factory-safe and boundary-safe patterns added in this PR.
  • fix: createIsomorphicFn compilation #6220: Fixes createIsomorphicFn compilation handling, which is used in the boundary-safe pattern (safeIsomorphic) introduced here.
  • feat: import protection #6688: Extends import-protection implementation alongside changes to packages/start-plugin-core and e2e tests, sharing direct code-level overlap.

Suggested labels

package: start-plugin-core, package: react-start

Poem

🐰 Silent whispers in the plugin's core,
Factory-safe and boundary patterns explore,
Pre-transforms hush with gentle care,
Real browsers now traverse the air,
Testing flourishes, no false alarms more!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and specifically summarizes the main change: fixing false positives in the import-protection plugin through silent flag implementation and pre-transform resolution detection.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix-import-protection-false-positive

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.


Comment @coderabbitai help to get the list of available commands and usage tips.

@nx-cloud

nx-cloudBot commented Feb 19, 2026

Copy link
Copy Markdown
Contributor

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.


View your CI Pipeline Execution ↗ for commit 24a018b

CommandStatusDurationResult
nx affected --targets=test:eslint,test:unit,tes...❌ Failed14m 43sView ↗
nx run-many --target=build --exclude=examples/*...✅ Succeeded22sView ↗

☁️ Nx Cloud last updated this comment at 2026-02-19 23:55:05 UTC

@pkg-pr-new

Copy link
Copy Markdown
More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/arktype-adapter@6708

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/eslint-plugin-router@6708

@tanstack/history

npm i https://pkg.pr.new/TanStack/router/@tanstack/history@6708

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/nitro-v2-vite-plugin@6708

@tanstack/react-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router@6708

@tanstack/react-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-devtools@6708

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-ssr-query@6708

@tanstack/react-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start@6708

@tanstack/react-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-client@6708

@tanstack/react-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-server@6708

@tanstack/router-cli

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-cli@6708

@tanstack/router-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-core@6708

@tanstack/router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools@6708

@tanstack/router-devtools-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools-core@6708

@tanstack/router-generator

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-generator@6708

@tanstack/router-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-plugin@6708

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-ssr-query-core@6708

@tanstack/router-utils

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-utils@6708

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-vite-plugin@6708

@tanstack/solid-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router@6708

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-devtools@6708

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-ssr-query@6708

@tanstack/solid-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start@6708

@tanstack/solid-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-client@6708

@tanstack/solid-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-server@6708

@tanstack/start-client-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-client-core@6708

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-fn-stubs@6708

@tanstack/start-plugin-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-plugin-core@6708

@tanstack/start-server-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-server-core@6708

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-static-server-functions@6708

@tanstack/start-storage-context

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-storage-context@6708

@tanstack/valibot-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/valibot-adapter@6708

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/TanStack/router/@tanstack/virtual-file-routes@6708

@tanstack/vue-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router@6708

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-devtools@6708

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-ssr-query@6708

@tanstack/vue-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start@6708

@tanstack/vue-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-client@6708

@tanstack/vue-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-server@6708

@tanstack/zod-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/zod-adapter@6708

commit: 24a018b

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@e2e/react-start/import-protection/tests/violations.setup.ts`:
- Line 4: The combined import "import { chromium, type FullConfig } from
'@playwright/test'" violates lint rules; separate the type-only specifier into
its own import. Replace the single import with two imports: one importing the
runtime symbol chromium and another importing the type FullConfig using "import
type { FullConfig } from '@playwright/test'"; update any usages of chromium and
FullConfig accordingly (symbols: chromium, FullConfig).
In `@packages/start-plugin-core/src/import-protection-plugin/plugin.ts`:
- Around line 749-767: The code reads (_options as Record<string, unknown>).scan
without guarding that _options may be undefined in the resolveId hook; change
the isPreTransformResolve check to safely access scan (e.g. use optional
chaining or a null-check) so that the expression becomes importer.includes('?' +
SERVER_FN_LOOKUP) || !!((_options as Record<string, unknown>)?.scan), keeping
the rest of the logic in isPreTransformResolve intact and referencing the
existing symbols (_options, isPreTransformResolve, SERVER_FN_LOOKUP).

import path from 'node:path'
import { spawn } from 'node:child_process'
import type { FullConfig } from '@playwright/test'
import { chromium, type FullConfig } from '@playwright/test'

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix Playwright import style to satisfy lint rules.
The linter flags inline type specifiers and member ordering. Split the type-only import into its own line.

✅ Suggested fix
-import { chromium, type FullConfig } from '@playwright/test'+import { chromium } from '@playwright/test'+import type { FullConfig } from '@playwright/test'
📝 Committable suggestion

‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
import{chromium,typeFullConfig}from'@playwright/test'
import{chromium}from'@playwright/test'
importtype{FullConfig}from'@playwright/test'
🧰 Tools
🪛 ESLint

[error] 4-4: Member 'FullConfig' of the import declaration should be sorted alphabetically.

(sort-imports)


[error] 4-4: Prefer using a top-level type-only import instead of inline type specifiers.

(import/consistent-type-specifier-style)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@e2e/react-start/import-protection/tests/violations.setup.ts` at line 4, The
combined import "import { chromium, type FullConfig } from '@playwright/test'"
violates lint rules; separate the type-only specifier into its own import.
Replace the single import with two imports: one importing the runtime symbol
chromium and another importing the type FullConfig using "import type {
FullConfig } from '@playwright/test'"; update any usages of chromium and
FullConfig accordingly (symbols: chromium, FullConfig).

@schiller-manuel
schiller-manuel merged commit f453943 into mainFeb 19, 2026
5 of 6 checks passed
@schiller-manuel
schiller-manuel deleted the fix-import-protection-false-positive branch February 19, 2026 23:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@schiller-manuel@tannerlinsley