From 9c30f84a4ca099a1bb806a0880cf8470ecf9dcf5 Mon Sep 17 00:00:00 2001
From: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:36:53 +0800
Subject: [PATCH] fix(scripts): shadcn-sync rewrites the registry paths Shadcn
 actually serves, and refuses to write a file when it cannot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`updateComponent` rewrote two alias shapes: `@/lib/utils` and
`@/components/ui/x`. Surveying all 46 registry entries this manifest
points at, the second one **never appears**. Shadcn moved to a different
layout, and what it serves today is:

    42 components   @/lib/utils                      ← rewritten
     8 components   @/registry/default/ui/<name>     ← missed
     2 components   @/registry/default/hooks/<name>  ← missed
     1 component    @/registry/new-york/ui/<name>    ← missed
     1 component    @/registry/default/lib/<name>    ← missed

So syncing `calendar`, `carousel`, `command`, `form`, `pagination`,
`sidebar`, `toggle-group` or `chart` left `@/registry/...` specifiers
that do not resolve from `src/ui/` — the script swapped working code for
code that cannot compile, and said `✓ Updated`. That is how `resizable`
ended up hand-patched and eventually reclassified (#3029).

Two changes:

**The rewrite table now covers what is served.** `ui/` maps to a sibling
(`./x`), `hooks/` and `lib/` step up a level (`../hooks/x`, `../lib/x`),
across any `<style>` segment. The older `@/components/ui/x` and `@/hooks/x`
forms stay in the table so a re-pointed source keeps working. Matching is
on the quoted specifier rather than on `from "…"`, so `export … from`,
dynamic `import()` and `vi.mock()` are covered.

**It fails closed.** Any `@/…` left after rewriting is now a hard refusal
to write, naming the specifier and pointing at the table. An enumerated
list of paths silently goes stale the next time Shadcn reorganises; the
guard is what makes that visible instead of catastrophic. Verified with a
hypothetical future layout (`@/registry/tokyo/blocks/button`): flagged,
while known aliases still rewrite.

Also: `--check` and `--diff` now rewrite before comparing, so import-path
style alone no longer reads as drift, and `--diff` warns when `--update`
would refuse. A registry entry shipping more than one file (`toast` ships
3) now says which files it is not writing rather than silently dropping
them.

Verified against all 46 live registry entries: every one rewrites to zero
unmapped aliases, and every rewritten relative specifier resolves on disk.
End-to-end `--update sidebar` — the entry exercising all three shapes —
now reproduces the import block already on main **exactly**, zero
difference; the remaining 21/-24 line delta is genuine upstream drift in
the component body. Restored afterwards; no component file changes here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 scripts/shadcn-sync.js | 96 ++++++++++++++++++++++++++++++++++--------
 1 file changed, 78 insertions(+), 18 deletions(-)

diff --git a/scripts/shadcn-sync.js b/scripts/shadcn-sync.js
index 6fc15e086b..73f029cb7a 100755
--- a/scripts/shadcn-sync.js
+++ b/scripts/shadcn-sync.js
@@ -92,6 +92,47 @@ async function getLocalComponents() {
   }
 }
 
+/**
+ * Registry `@/…` alias → ObjectUI relative path.
+ *
+ * Shadcn ships components with alias specifiers that assume its own repo
+ * layout, and it has changed that layout at least once: the older generation
+ * was `@/components/ui/x`, while every endpoint this manifest points at now
+ * serves `@/registry/<style>/{ui,hooks,lib}/x`. Both forms are listed so a
+ * pinned or re-pointed source keeps working.
+ *
+ * Synced files land in `packages/components/src/ui/`, so `ui/` resolves to a
+ * sibling (`./x`) while `hooks/` and `lib/` step up one level (`../hooks/x`).
+ *
+ * Matching is on the quoted specifier rather than on `from "…"`, so
+ * `export … from`, dynamic `import()` and `vi.mock()` are covered too. The
+ * backreference keeps the original quote style.
+ */
+const IMPORT_REWRITES = [
+  [/(["'])@\/registry\/[^/"']+\/ui\/([^"']+)\1/g, '$1./$2$1'],
+  [/(["'])@\/registry\/[^/"']+\/hooks\/([^"']+)\1/g, '$1../hooks/$2$1'],
+  [/(["'])@\/registry\/[^/"']+\/lib\/([^"']+)\1/g, '$1../lib/$2$1'],
+  [/(["'])@\/components\/ui\/([^"']+)\1/g, '$1./$2$1'],
+  [/(["'])@\/hooks\/([^"']+)\1/g, '$1../hooks/$2$1'],
+  [/(["'])@\/lib\/([^"']+)\1/g, '$1../lib/$2$1'],
+];
+
+function rewriteRegistryImports(content) {
+  return IMPORT_REWRITES.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), content);
+}
+
+/**
+ * Any `@/…` specifier the table above did not map. These do not resolve from
+ * `src/ui/`, so writing a file that still contains one produces a component
+ * that cannot compile — which is how `resizable` reached `customComponents`.
+ * Callers must treat a non-empty result as a hard failure, not a warning:
+ * this is the only thing standing between a Shadcn layout change and a
+ * broken build.
+ */
+function findUnmappedAliases(content) {
+  return [...new Set([...content.matchAll(/["'](@\/[^"']+)["']/g)].map((m) => m[1]))];
+}
+
 async function checkComponent(name, manifest) {
   const componentInfo = manifest.components[name];
   if (!componentInfo) {
@@ -110,7 +151,9 @@ async function checkComponent(name, manifest) {
     // Fetch latest from registry
     try {
       const registryData = await fetchUrl(componentInfo.source);
-      const shadcnContent = registryData.files?.[0]?.content || '';
+      // Rewrite before comparing, so import-path style alone does not read as
+      // a difference — the local file has already been through this transform.
+      const shadcnContent = rewriteRegistryImports(registryData.files?.[0]?.content || '');
       const shadcnLines = shadcnContent.split('\n').length;
       
       // Simple heuristic: check if significantly different
@@ -228,19 +271,29 @@ async function updateComponent(name, manifest, options = {}) {
       log(`No files found in registry for ${name}`, 'red');
       return false;
     }
-    
-    let content = registryData.files[0].content;
-    
+
+    // Only files[0] is written. Say so rather than truncating silently — a
+    // multi-file entry (e.g. `toast`) needs its extra files placed by hand.
+    if (registryData.files.length > 1) {
+      const extra = registryData.files.slice(1).map((f) => f.path || f.name || '?');
+      log(`  ⚠ Registry ships ${registryData.files.length} files; only the first is written.`, 'yellow');
+      log(`    Not written: ${extra.join(', ')}`, 'yellow');
+    }
+
     // Transform imports to match ObjectUI structure
-    content = content.replace(
-      /from ["']@\/lib\/utils["']/g,
-      'from "../lib/utils"'
-    );
-    content = content.replace(
-      /from ["']@\/components\/ui\/([^"']+)["']/g,
-      'from "./$1"'
-    );
-    
+    let content = rewriteRegistryImports(registryData.files[0].content);
+
+    // Fail closed. An unmapped `@/…` specifier does not resolve from src/ui/,
+    // so writing the file would swap working code for code that cannot
+    // compile. Better to refuse and have someone extend IMPORT_REWRITES.
+    const unmapped = findUnmappedAliases(content);
+    if (unmapped.length > 0) {
+      log(`✗ Refusing to write ${name}.tsx — unmapped registry import path(s):`, 'red');
+      unmapped.forEach((spec) => log(`    ${spec}`, 'red'));
+      log(`  Shadcn's alias layout changed. Add a rule to IMPORT_REWRITES in this script.`, 'yellow');
+      return false;
+    }
+
     // Add ObjectUI header
     const header = `/**
  * ObjectUI
@@ -332,16 +385,23 @@ async function showDiff(name) {
     const localPath = path.join(COMPONENTS_DIR, `${name}.tsx`);
     const localContent = await fs.readFile(localPath, 'utf-8');
     const registryData = await fetchUrl(componentInfo.source);
-    const shadcnContent = registryData.files?.[0]?.content || '';
-    
+    // Same transform `--update` would apply, so the two sides are comparable.
+    const shadcnContent = rewriteRegistryImports(registryData.files?.[0]?.content || '');
+
     log('Local version:', 'cyan');
     console.log(localContent.substring(0, 500) + '...\n');
-    
-    log('Shadcn version:', 'cyan');
+
+    log('Shadcn version (import paths rewritten):', 'cyan');
     console.log(shadcnContent.substring(0, 500) + '...\n');
-    
+
     log(`Local:  ${localContent.split('\n').length} lines`, 'dim');
     log(`Shadcn: ${shadcnContent.split('\n').length} lines`, 'dim');
+
+    const unmapped = findUnmappedAliases(shadcnContent);
+    if (unmapped.length > 0) {
+      log(`\n⚠ Unmapped registry import path(s) — \`--update ${name}\` would refuse:`, 'yellow');
+      unmapped.forEach((spec) => log(`    ${spec}`, 'yellow'));
+    }
   } catch (error) {
     log(`Error: ${error.message}`, 'red');
   }