Skip to content

refactor(lint): remove the head_leaked_text rule - #3385

Merged
miguel-heygen merged 1 commit into
mainfrom
fix/head-leaked-text-css-comments
Aug 21, 2026
Merged

refactor(lint): remove the head_leaked_text rule#3385
miguel-heygen merged 1 commit into
mainfrom
fix/head-leaked-text-css-comments

Conversation

@miguel-heygen

@miguel-heygen miguel-heygen commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

What

Remove the head_leaked_text lint rule, its seven helpers, its eight now-dead patterns and
its test fixtures. Net -478 lines.

Refs #3384.

Why

Telemetry, over 30 days of real usage:

lint runs 13,953
runs where this rule fired 31 (0.22%)
streaks (findings that survived an edit) 8
average edits survived 2.88
worst case 11 edits

A streak is a finding that was still there after the user edited and re-linted. Rules whose
findings are genuinely actionable get fixed once and vanish:

rule severity avg edits survived
font_family_without_font_face error 1.04
invalid_parent_traversal_in_asset_path error 1.02
media_missing_id error 1.05
gsap_non_transform_motion error 1.05
head_leaked_text error 2.88

This one averages nearly three failed attempts, and one person fought it through eleven
edits. It is also the only high-streak rule that is an error — the other two rules with
comparable streaks are warnings, where a stubborn finding is annoying rather than blocking.

So it is rare and punishing: 0.22% of runs, and when it hits, people cannot get past it.

That is what you would expect from the defect in #3384, where the reported snippet points at
an innocent CSS rule rather than at the text that actually caused it.

The triggering case

A prose CSS comment naming a tag was enough:

/* the <body> rule below sets the base font */
body { font-family: system-ui; }

HEAD_CONTENT_PATTERN ends the head at the first <body in raw source, so that token
inside a comment truncated the capture mid-<style>. The unclosed style tag then defeated
HEAD_BLOCKS_TO_IGNORE_PATTERN, which requires a matching close, and the stylesheet's real
rules reached ORPHAN_CSS_RULE_PATTERN. One mechanism produced both symptoms: the false
positive, and the misleading snippet.

Why removed rather than repaired

I wrote the repair first — mask <style>/<script>/comment regions with same-length
whitespace before finding the boundary, so offsets stay valid for snippets. It worked, with
three regression tests. I discarded it because repairing the detector does not address what
the telemetry shows: even when this rule is right, people cannot act on it.

The rule has been in place since 2026-06-25 (#1727), moved into @hyperframes/lint on
06-27 (#1756), and was hardened twice since, including a false-positive fix in July (#2413)
that added a regression test for a <g>-shaped CSS comment. So the fragility was known and
had already been patched once at exactly this seam; <body> and </head> were simply the
tokens that test did not cover. This would have been the third patch of the same shape.

If this failure mode is worth catching later, the right place is a rendered-pixel check
rather than a regex over raw HTML.

Test plan

  • Unit tests added/updated (removed)
  • Manual testing performed
  • Documentation updated (if applicable)

Before / after on the reported case

$ npx hyperframes@0.8.5 lint          # before
✗ head_leaked_text: Detected leaked code or CSS text around the document `<head>` ...
◇  1 error(s), 0 warning(s)

$ bun packages/cli/src/cli.ts lint    # after, same project
◆  Linting t/index.html
◇  0 errors, 0 warnings

Nothing else moved

Same audit over the 643 shipped registry files, lint untouched vs this branch:

baseline: 643 files, 614 errors, 0 head_leaked_text
branch:   643 files, 614 errors

Identical. The 614 are pre-existing findings from other rules. Note this corpus is curated
content and was never strong evidence on its own — the telemetry above is the real argument.

Other checks

  • vitest packages/lint — 495 passed, 14 files
  • oxlint + oxfmt on both touched files — clean, including four test fixtures that became
    orphaned and were removed with it
  • Pre-commit hooks (fallow, typecheck, commitlint) — green

Kept deliberately

VISIBLE_MARKUP_COMMENT_PATTERN stays: it belongs to visible_markup_comment, a different
rule, and is untouched.

The rule fired on legitimate content and blocked check. A prose CSS
comment naming a tag, such as "the <body> rule below sets the base
font", was enough: HEAD_CONTENT_PATTERN ends the head at the first
<body> in raw source, so the token inside the comment truncated the
capture mid-<style>. The unclosed style tag then defeated the
strip-ignorable-blocks pass, and the stylesheet's own rules reached the
orphan-CSS matcher, which reported a valid nearby rule as the leak.

Removed rather than repaired. Across all 643 shipped registry files it
fires zero times, so it has never caught anything real here, while
producing at least one confirmed false positive that blocked a working
cloud render. It is an error, not a warning, so the cost of a false
positive is a blocked pipeline. Leaked text of this kind is also visible
in the very first preview frame, which is a faster and more reliable
signal than a regex over raw source.

Takes its seven helpers and eight now-dead patterns with it, plus four
orphaned test fixtures. VISIBLE_MARKUP_COMMENT_PATTERN is kept; it
belongs to visible_markup_comment.

Refs #3384
@miguel-heygen
miguel-heygen merged commit a897806 into main Aug 21, 2026
75 of 76 checks passed
@miguel-heygen
miguel-heygen deleted the fix/head-leaked-text-css-comments branch August 21, 2026 04:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant