Findings

• [Major] Tailwind v4 parser drops tokens after the first @theme block — this causes silent token loss when files contain multiple theme blocks, evidence packages/core/src/brand/tailwindExtractor.ts:158
  Suggested fix:

  function extractFromV4Theme(source: string): DesignToken[] {
    const results: DesignToken[] = [];
    const themeBlockRe = /@theme\s*\{/g;
  
    for (const m of source.matchAll(themeBlockRe)) {
      const blockStart = (m.index ?? 0) + m[0].length - 1;
      const body = extractBodyAt(source, blockStart);
      if (!body) continue;
  
      const declRe = /--([\w-]+)\s*:\s*([^;]+);/g;
      for (const dm of body.matchAll(declRe)) {
        const prop = dm[1];
        const rawValue = dm[2]?.trim();
        if (!prop || !rawValue) continue;
        const tokenType = inferTypeFromCssProp(prop, rawValue);
        if (!tokenType) continue;
        results.push({ schemaVersion: 1, type: tokenType, name: prop, value: rawValue, origin: 'tailwind-config', group: prop.split('-').slice(0, 2).join('.') });
      }
    }
  
    return results;
  }

• [Major] Brace matching is not string/comment-aware, so parser can terminate early on } inside quoted values — this can truncate section parsing and produce incorrect/missing tokens, evidence packages/core/src/brand/tailwindExtractor.ts:61
  Suggested fix:

  function extractBodyAt(text: string, bracePos: number): string | null {
    if (text[bracePos] !== '{') return null;
  
    let depth = 0;
    let quote: '"' | "'" | null = null;
    let escape = false;
  
    for (let i = bracePos; i < text.length; i++) {
      const ch = text[i]!;
  
      if (quote) {
        if (escape) {
          escape = false;
          continue;
        }
        if (ch === '\\') {
          escape = true;
          continue;
        }
        if (ch === quote) quote = null;
        continue;
      }
  
      if (ch === '"' || ch === "'") {
        quote = ch;
        continue;
      }
  
      if (ch === '{') depth++;
      else if (ch === '}') {
        depth--;
        if (depth === 0) return text.slice(bracePos + 1, i);
      }
    }
  
    return null;
  }

• [Minor] Tailwind extractor tests do not cover the new v4 @theme path or multi-block behavior, so regressions in claimed v4 support are currently undetected, evidence packages/core/src/brand/tailwindExtractor.test.ts:7
  Suggested fix:

  it('extracts from multiple @theme blocks', async () => {
    const tokens = await extractFromTailwindConfig(V4_MULTI_THEME_FIXTURE);
    expect(tokens.map((t) => t.name)).toContain('color-brand');
    expect(tokens.map((t) => t.name)).toContain('font-size-base');
  });

Summary
Review mode: initial. 3 issues found in the latest diff (2 Major parser correctness/data-loss risks, 1 Minor test coverage gap). docs/VISION.md and docs/PRINCIPLES.md were not available in this checkout (Not found in repo/docs), so review used repo-visible constraints and changed lines only.

Testing
Not run (automation)

open-codesign Bot

Findings

• [Major] Brace parser is not quote/comment aware, so } inside string/comment can terminate blocks early and silently drop tokens; this can corrupt extraction output from valid Tailwind files, evidence packages/core/src/brand/tailwindExtractor.ts:57
  Suggested fix:

  function extractBodyAt(text: string, bracePos: number): string | null {
    if (text[bracePos] !== '{') return null;
  
    let depth = 0;
    let quote: '"' | "'" | null = null;
    let escape = false;
    let inLineComment = false;
    let inBlockComment = false;
  
    for (let i = bracePos; i < text.length; i++) {
      const ch = text[i]!;
      const next = text[i + 1];
  
      if (inLineComment) {
        if (ch === '\n') inLineComment = false;
        continue;
      }
      if (inBlockComment) {
        if (ch === '*' && next === '/') {
          inBlockComment = false;
          i++;
        }
        continue;
      }
      if (!quote && ch === '/' && next === '/') { inLineComment = true; i++; continue; }
      if (!quote && ch === '/' && next === '*') { inBlockComment = true; i++; continue; }
  
      if (quote) {
        if (escape) { escape = false; continue; }
        if (ch === '\\') { escape = true; continue; }
        if (ch === quote) quote = null;
        continue;
      }
  
      if (ch === '"' || ch === "'") { quote = ch; continue; }
      if (ch === '{') depth++;
      else if (ch === '}') {
        depth--;
        if (depth === 0) return text.slice(bracePos + 1, i);
      }
    }
  
    return null;
  }

• [Major] Tailwind v4 detection only matches bare @theme { and misses valid variants like @theme inline { / @theme static {, causing wrong parser path and token loss, evidence packages/core/src/brand/tailwindExtractor.ts:139
  Suggested fix:

  function hasTailwindV4Theme(source: string): boolean {
    return /@theme\b[^{}]*\{/.test(source);
  }

Summary
Review mode: follow-up after new commits. 2 Major issues remain in the latest PR diff (Tailwind parsing correctness/data-loss risks). docs/VISION.md and docs/PRINCIPLES.md are Not found in repo/docs in this checkout.

Testing
Not run (automation)

open-codesign Bot

Findings

• [Major] DTCG dimension is forced to spacing, which misclassifies valid non-spacing dimension tokens (for example typography.fontSize.*, radius, line-height) and can corrupt downstream token usage, evidence packages/core/src/brand/dtcgImporter.ts:14
  Suggested fix:

  const DTCG_TYPE_MAP: Partial<Record<string, TokenType>> = {
    color: 'color',
    fontFamily: 'fontFamily',
    fontSize: 'fontSize',
    shadow: 'shadow',
  };
  
  function resolveType(dtcgType: string | undefined, path: string): TokenType | null {
    if (dtcgType === 'dimension' || dtcgType === 'number') {
      return resolveTypeFromPath(path);
    }
    if (dtcgType) {
      const mapped = DTCG_TYPE_MAP[dtcgType];
      if (mapped) return mapped;
    }
    return resolveTypeFromPath(path);
  }

• [Major] CSS var block extraction stops at the first } because [^}] is not quote/comment aware, so valid declarations after } inside strings/comments are silently dropped, evidence packages/core/src/brand/cssVarExtractor.ts:39
  Suggested fix:

  function extractDeclarations(source: string): Array<{ prop: string; value: string }> {
    const results: Array<{ prop: string; value: string }> = [];
    const blockRe = /(?::root|\[data-theme[^\]]*\])\s*\{/g;
  
    for (const m of source.matchAll(blockRe)) {
      const start = (m.index ?? 0) + m[0].length - 1;
      const body = extractBodyAt(source, start); // reuse brace scanner from tailwind extractor
      if (!body) continue;
  
      const declRe = /--([\w-]+)\s*:\s*([^;]+);/g;
      for (const dm of body.matchAll(declRe)) {
        const prop = dm[1]?.trim();
        const value = dm[2]?.trim();
        if (prop && value) results.push({ prop, value });
      }
    }
  
    return results;
  }

Summary
Review mode: follow-up after new commits. 2 Major issues remain in the latest head, both in newly added extractor logic that can silently produce incorrect token outputs. docs/VISION.md and docs/PRINCIPLES.md are Not found in repo/docs in this checkout.

Testing
Not run (automation). Suggested additions: one Vitest for DTCG dimension under typography.fontSize.* and one for CSS declarations containing } in string/comment.

open-codesign Bot

Findings

• [Major] Tailwind v4 --text-* size tokens are misclassified as color because text is matched before font-size checks, which corrupts downstream token typing, evidence packages/core/src/brand/tailwindExtractor.ts:185
  Suggested fix:

  function inferTypeFromCssProp(prop: string, value: string): TokenType | null {
    if (/font-size|text-size|^text-(xs|sm|base|lg|xl|2xl|3xl|4xl)$/.test(prop)) return 'fontSize';
    if (/font-family/.test(prop)) return 'fontFamily';
    if (/line-height|leading/.test(prop)) return 'lineHeight';
    if (/radius|rounded/.test(prop)) return 'radius';
    if (/shadow/.test(prop)) return 'shadow';
    if (/spacing|gap|padding|margin|space/.test(prop)) return 'spacing';
    if (/color|bg|text-color|border-color|fill|stroke|ring/.test(prop) || looksLikeColor(value)) return 'color';
    return null;
  }

• [Major] CSS var inference classifies any --border-* token as color before radius/spacing checks, causing non-color tokens (for example --border-radius-md) to be typed incorrectly, evidence packages/core/src/brand/cssVarExtractor.ts:9
  Suggested fix:

  function inferType(prop: string, value: string): TokenType | null {
    const p = prop.toLowerCase();
  
    if (/radius|rounded|border-radius/.test(p)) return 'radius';
    if (/font-size|text-size|text-sm|text-base|text-lg|text-xl/.test(p)) return 'fontSize';
    if (/font-family|font-sans|font-mono|font-serif|typeface/.test(p)) return 'fontFamily';
    if (/spacing|space|gap|padding|margin|indent|offset/.test(p)) return 'spacing';
    if (/shadow|elevation/.test(p)) return 'shadow';
    if (/line-height|leading/.test(p)) return 'lineHeight';
    if (/color|palette|brand|accent|fg|bg|foreground|background|fill|stroke|ring|border-color/.test(p))
      return 'color';
    if (looksLikeColor(value)) return 'color';
  
    return null;
  }

Summary

• Review mode: follow-up after new commits. 2 Major issues remain in the latest head, both introduced in new token-extractor logic and both can silently produce wrong token types.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation): pnpm is unavailable in this runner.

open-codesign Bot

Findings

• [Major] Tailwind v4 mode detection misses valid @theme variants (for example @theme inline { ... } / @theme static { ... }), so those files fall back to v3 parsing and can return incomplete or empty token results. Evidence packages/core/src/brand/tailwindExtractor.ts:185, packages/core/src/brand/tailwindExtractor.ts:293.
  Suggested fix:

  function hasTailwindV4Theme(source: string): boolean {
    // Match plain `@theme {}` and keyword forms like `@theme inline {}`.
    return /@theme\b[^\{]*\{/.test(source);
  }

Summary

• Review mode: follow-up after new commits.
• 1 Major issue found in the latest head.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation): pnpm is unavailable in this runner.

open-codesign Bot

Findings

• [Major] Silent token drop on unresolved DTCG type inference can hide import failures and lose user token data, conflicting with the project rule to surface errors with context; evidence packages/core/src/brand/dtcgImporter.ts:63.
  Suggested fix:

  const tokenType = resolveType($type, name);
  if (!tokenType) {
    throw new Error(`Unsupported DTCG token type/path: type=${$type ?? 'unknown'} path=${name}`);
  }

• [Major] $value can be undefined but still gets serialized and emitted, producing an invalid runtime token payload (value may become undefined) instead of a validated string; evidence packages/core/src/brand/dtcgImporter.ts:57, packages/core/src/brand/dtcgImporter.ts:60.
  Suggested fix:

  const rawValue = record['$value'];
  if (rawValue === undefined) {
    throw new Error(`DTCG token missing $value at path: ${pathSegments.join('.')}`);
  }
  
  const value = serializeValue(rawValue);

Summary

• Review mode: follow-up after new commits
• 2 issues found in current head diff, both in DTCG import error handling/validation.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation): pnpm is unavailable in this runner environment.

Findings

• No high-confidence issues found in added/modified lines of this update.

Summary

• Review mode: follow-up after new commits
• No new issues identified in the latest head commit range.
• Constraint checks on this diff: direct provider SDK imports not found, new dependencies/license changes not found, and no UI-token hardcoding violations found in app source touched by this update.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation): pnpm is unavailable in this runner, so tests could not be executed here.

open-codesign Bot