fix(scripts): shadcn-sync refuses to silently delete local edits, and compiles the package after it writes

[os-zhuang]

Completes the work of #3033. That PR stopped the sync writing unresolvable import paths; it did not make --update-all safe to run.

I was wrong about how the remaining failure mode shows up

#3033's description said local named-import additions "break loudly rather than silently." Building the compile check disproved that — the first thing I did with it was run --update command, expecting a type error. It passed.

command.tsx carries local additions upstream has never had:

• a sr-only DialogTitle / DialogDescription on CommandDialog — Radix requires an accessible name
• contentProps, which is the ADR-0054 C4 testability contract: it lets callers attach a stable locator to the underlying dialog element, because a data-testid spread onto CommandDialog lands on the Radix root, which renders no DOM

Syncing it deletes 38 lines, removes both, and type-checks clean — upstream drops each addition together with its usages, so the file stays self-consistent. A documented platform contract would have vanished with a green build.

So: two layers

1. Refuse before writing. Any line the local file has that the incoming version lacks is listed, and the write is skipped. --force overrides.

✗ Refusing to overwrite command.tsx — 35 local line(s) upstream does not have:
    import { Dialog, DialogContent, DialogTitle, DialogDescription } from "./dialog"
    * stable locator + ARIA name to the underlying dialog element — e.g.
    * (ADR-0054 C4). Without this, `data-testid` spread onto `CommandDialog` lands on
    … and 27 more
  Overwriting deletes these. Port them onto the new upstream version by hand,
  or re-run with --force if they are genuinely obsolete.

Comments count as local content — a comment explaining why we diverged is exactly what must not evaporate silently.

Measured across all 46 registry entries, so this discriminates rather than crying wolf:

local-only lines	components
0 — syncs cleanly	29
1–5	12
6–20	3
>20 (sidebar 24, command 22)	2

--update-all now reports skipped separately from failed.

2. Compile after writing. Both --update and --update-all then run pnpm --filter @object-ui/components type-check and say plainly whether the package still builds, printing the rollback command on failure. --no-verify skips it.

This is the backstop for whatever layer 1 doesn't model. It would not have caught command — which is exactly why layer 1 exists. Keeping both is the point: line-level refusal catches deletions, compilation catches breakage.

Neither layer rolls back for you. Auto-reverting would throw away a sync someone may want to fix by hand, so both print the command instead.

Verification

• --update command → refused, lists the ADR-0054 lines
• --update command --force → overrides, writes, 38 lines lost as predicted
• --update button (0 local-only lines) → syncs, tree left byte-identical
• fix(scripts): shadcn-sync rewrites the registry paths Shadcn actually serves, and refuses to write a file when it cannot #3033's unmapped-path guard and the resizable reclassification both still hold
• node --check + eslint clean
• Tree restored — no component file changes in this PR

No changeset — tooling only.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Jul 30, 2026 1:00pm