From 87e2693911d4c4b6d46e33b26d3c6c1d460dc2b4 Mon Sep 17 00:00:00 2001
From: brainstorm-os <founder@getbrainstorm.online>
Date: Mon, 13 Jul 2026 14:46:49 +0200
Subject: [PATCH] chore(lint): extend the control-face ratchet to the shell
 renderer (Settings)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The control-face gate — native `<input>/<textarea>/<select>` must ride a shared
face class (`.bs-input`/`.bs-select`) so a field lines up pixel-exact beside the
button/select next to it — only scanned `apps/`. But the shell renderer uses the
SAME faces (its `<TextField>` emits `.bs-input`), and Settings is exactly where
"the input is a different height from the button beside it" keeps getting filed.
So the design system's own privileged surface was the one place the ratchet
couldn't see.

Widen the scan to `packages/shell/src/renderer`, exempting its `ui/` folder (the
shell's local primitive home — the sanctioned place a raw `<input>` is wrapped
into a face, mirroring how the app scan exempts `packages/sdk`). Nine current
Settings/Welcome/Help offenders are grandfathered into the baseline; the ratchet
now fails any NEW hand-rolled shell control and shrinks as these nine migrate to
`<TextField>`/`<SelectMenu>` when next touched.

No feature files change — this is the enforcement mechanism, not the migrations.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tools/check-control-faces.mjs     | 23 +++++++++++++++++++----
 tools/control-faces-baseline.json | 13 ++++++++++++-
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/tools/check-control-faces.mjs b/tools/check-control-faces.mjs
index e1fa6e8d..b8e1195d 100644
--- a/tools/check-control-faces.mjs
+++ b/tools/check-control-faces.mjs
@@ -15,10 +15,13 @@
  * Biome 1.9 can't express a custom "this element must carry that class" rule,
  * so this is a grep-grade gate with a shrinking baseline (same shape as
  * `check-app-reactivity.mjs`). A native text-like form control must carry a
- * recognized face class (`bs-input`, or `bs-select` for a select). Every app
- * file that currently has a non-compliant control is grandfathered in
- * `control-faces-baseline.json`. The gate fails when:
- *   - a NON-baselined app file gains a non-compliant control (the ratchet:
+ * recognized face class (`bs-input`, or `bs-select` for a select). It scans
+ * both the `apps/` tree AND the privileged shell renderer
+ * (`packages/shell/src/renderer`, minus its `ui/` primitive home) — Settings
+ * lives there and drifts the same way. Every file that currently has a
+ * non-compliant control is grandfathered in `control-faces-baseline.json`.
+ * The gate fails when:
+ *   - a NON-baselined file gains a non-compliant control (the ratchet:
  *     new code and new apps must compose from the primitive), or
  *   - a baselined file no longer has one (migrated — drop it from the baseline
  *     so the list can only shrink).
@@ -32,6 +35,14 @@ import { fileURLToPath } from "node:url";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
 const APPS_DIR = join(ROOT, "apps");
+/** The privileged shell renderer rides the SAME face classes (its `<TextField>`
+ *  emits `.bs-input` / `.bs-select`), so Settings controls must line up with
+ *  their neighbours just like an app's do — this is where the "input drifts from
+ *  the button beside it" complaint actually lands. Its `ui/` folder is the
+ *  primitive home (the shell's local equivalent of `packages/sdk`) where a raw
+ *  `<input>` is legitimately wrapped into a face, so it's exempt like the SDK. */
+const SHELL_RENDERER_DIR = join(ROOT, "packages/shell/src/renderer");
+const SHELL_PRIMITIVES_DIR = join(SHELL_RENDERER_DIR, "ui");
 const BASELINE_PATH = join(ROOT, "tools", "control-faces-baseline.json");
 
 /** `<input type=...>` kinds that are NOT field-faces — they get their own
@@ -92,6 +103,10 @@ const offenders = [];
 for (const file of walk(APPS_DIR)) {
 	if (hasHandRolledControl(readFileSync(file, "utf8"))) offenders.push(toPosix(file));
 }
+for (const file of walk(SHELL_RENDERER_DIR)) {
+	if (file.startsWith(SHELL_PRIMITIVES_DIR)) continue; // the primitives' own raw inputs
+	if (hasHandRolledControl(readFileSync(file, "utf8"))) offenders.push(toPosix(file));
+}
 offenders.sort();
 
 const baseline = JSON.parse(readFileSync(BASELINE_PATH, "utf8")).files;
diff --git a/tools/control-faces-baseline.json b/tools/control-faces-baseline.json
index 5bf61a39..7d6d8d49 100644
--- a/tools/control-faces-baseline.json
+++ b/tools/control-faces-baseline.json
@@ -1,3 +1,14 @@
 {
-  "files": ["apps/mailbox/src/ui/composer.tsx"]
+  "files": [
+    "apps/mailbox/src/ui/composer.tsx",
+    "packages/shell/src/renderer/help/help-searchbar.tsx",
+    "packages/shell/src/renderer/settings/ai-panel.tsx",
+    "packages/shell/src/renderer/settings/billing-section.tsx",
+    "packages/shell/src/renderer/settings/browser-privacy-panel.tsx",
+    "packages/shell/src/renderer/settings/data-section.tsx",
+    "packages/shell/src/renderer/settings/mcp-panel.tsx",
+    "packages/shell/src/renderer/settings/notifications-section.tsx",
+    "packages/shell/src/renderer/settings/sync-section.tsx",
+    "packages/shell/src/renderer/welcome/welcome.tsx"
+  ]
 }