fix: notify web listeners when new styles loaded

[Brentlok]

#467 (comment)

Summary by CodeRabbit

• Bug Fixes
  • Styles resolved by JavaScript now refresh when newly added stylesheets are discovered, including during web development startup.
  • Notifications are sent only when a new stylesheet has been processed.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (2)

AGENTS.md — auto-discovered
CONTEXT.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7a74b53f-be0b-4b91-8047-fc56aff7439c

📥 Commits

Reviewing files that changed from the base of the PR and between 26af57d and 3a9c35d.

📒 Files selected for processing (3)

• CONTEXT.md
• packages/uniwind/src/core/web/cssListener.ts
• packages/uniwind/tests/web/core/css-listener.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The web CSS listener now notifies variable subscribers after it processes newly discovered stylesheets. A test covers delayed stylesheet discovery and confirms that a scan without a new stylesheet does not notify again.

Changes

Late stylesheet notifications

Layer / File(s)	Summary
Stylesheet scan and notification packages/uniwind/src/core/web/cssListener.ts, packages/uniwind/tests/web/core/css-listener.test.ts, CONTEXT.md	The scan tracks whether it processed a stylesheet and notifies UniwindListener of StyleDependency.Variables when it did. The test checks delayed discovery and no repeat notification on a scan without a new stylesheet. CONTEXT.md describes the notification.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 3a9c3

Late-arriving web styles should now refresh CSS-variable subscribers. No issue requiring a fix before merge was identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3a9c3

Late-arriving styles now refresh existing UI consumers without an identified increase in privileges or access to sensitive data. Notification-failure recovery and application-specific exposure remain only partially established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new notification reaches all Variables subscribers of the same browser-local listener instance, not only consumers matching the discovered stylesheet. Inspected consumers refresh CSS values and component styles; application-specific sensitive uses were not established.

Trust Boundaries and Controls

• inferred — A stylesheet permitted in the document and readable through cssRules can now trigger existing rendering subscribers. This adds conditional reachability, but the inspected path does not grant stylesheet access, change identity, or introduce an authorization or credential sink. Who can inject stylesheets depends on the hosting application and was not established.

Resilience and Maintainability Implications

• inferred — If a subscriber throws, synchronous dispatch stops after advancing the revision. Because sheets are already recorded as processed, a subsequent scan without new sheets does not retry publication. Dispatch semantics predate this PR, but discovery is a new trigger. Inspected production subscriptions pass React dispatch callbacks; no concrete throwing callback or resulting security impact was established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: notifying web listeners when new stylesheets are discovered.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Notifies style subscribers when new stylesheets are discovered.

The PR appears safe to merge, with a non-blocking rerender cost and a gap in consumer-level test coverage.

Findings

1.  Unrelated sheets rerender components ▶
2.  Test misses mounted components ▶

Summary

When web discovers a new stylesheet, it now notifies variable subscribers so JavaScript-resolved styles refresh after CSS arrives. It sends the notification only when a scan processes a new readable stylesheet.

• Adds a variables notification after processing a newly discovered stylesheet.
• Covers the late stylesheet refresh and quiet scans in a web test.
• Updates the web runtime notes.

_{Reviews (1) · Last reviewed commit: "fix: notify web listeners when new style..."}