fix(css-modules): 🐛 Prevent builder CSS name overwrites

[punkbit]

Why?

The CSS Module build process was checking for file name conflicts twice, e.g. once for each output target format (ESM/CJS). Since the check looks at source files that don't change between formats, doing it once is more than enough.

How?

• Move name collision check earlier (outside targets loop)
• Introduce new CI/CD LLM reviewer rule

Contribution checklist?

• You've done enough research before writing
• You have reviewed the PR
• The commit messages are detailed
• The build command runs locally
• Assets or static content are linked and stored in the project
• For documentation, guides or references, you've tested the commands

Security checklist?

• All user inputs are validated and sanitized
• No usage of dangerouslySetInnerHTML
• Sensitive data has been identified and is being protected properly
• Build output contains no secrets or API keys

Preview?

ESM

CJS

[changeset-bot]

🦋 Changeset detected

Latest commit: 4c8bed5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clickhouse/click-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Claude finished @punkbit's task in 1m 13s —— View job

---

PR Review

• Gather context and read changed files
• Review plugins/css-colocate/utils.ts
• Review plugins/css-colocate/index.ts
• Review .llm/CONVENTIONS.md additions
• Review changeset
• Post final review

---

✅ Looks great! No blocking issues found — nice work!

Summary: Clean, well-scoped fix. The collision check correctly runs once before copyCssFiles is called (so it actually prevents the overwrite rather than just detecting it post-hoc). The logic in preventCssNameOverwrites is sound — it compares relative paths from .css-modules-temp/ against relative paths from src/, which correctly catches the Button.module.css → Button.css collision scenario. The CONVENTIONS.md addition is a genuinely useful guardrail.

💡 Suggestion (non-blocking)

• index.ts:73 — The inline // WARN: comment duplicates the JSDoc already on the function in utils.ts. Can safely be trimmed to just // Check runs once — source file names are format-independent. or removed entirely since the function name is self-documenting.

[github-actions]

Claude finished @punkbit's task in 1m 30s —— View job

---

PR Review

• Read CLAUDE.md and .llm/CONVENTIONS.md
• Review full diff vs origin/main
• Check curly lint fix in utils.ts
• Review remaining changed files
• Post final review

---

✅ Looks great! The linter fix was applied and the core change is solid.

Summary: The curly-brace fix from @hoorayimhelping's suggestion is in — all bare single-line if bodies now have braces. The core fix (moving preventCssNameOverwrites outside the formats loop) is correct and properly guards against collisions before any file copying begins. The virtual-modules.ts type-narrowing improvement (catch (e: any) → catch (e) with instanceof Error guard) is a welcome bonus.

💡 Suggestions (non-blocking)

• index.ts:77 — The // WARN: comment is one very long run-on line and duplicates the JSDoc already on preventCssNameOverwrites in utils.ts. Could be trimmed to just // Runs once — source file names are format-independent. or removed entirely.

• utils.ts:54, import-inject.ts — The curly-brace style is inconsistent within the PR: virtual-modules.ts uses the multi-line form, while the other files use same-line {continue;} / {return;}. Both satisfy the curly rule, but aligning on one style would be cleaner. Fix this →

[workflow-authentication-public]

📚 Storybook Preview Deployed

✅ Preview URL: https://click-nbgd3jow8-clickhouse.vercel.app

Built from commit: c00f0af1258700566e3bce6ffb89c37dc20b0877