Production stripping misses plugin factory imports, leaving unused Hotkeys font assets

从packages/devtools-bundler-core/src/remove-devtools.ts开始，重点查看getPluginReferences，并运行 issue 中独立的removeDevtools复现。检查plugins数组中的直接调用表达式是如何处理的，并查找 bundler-core 包中的相关测试。完成标准是：如果 factory import 仅在被剥离的元素中使用，则将其移除；如果在其他地方也使用，则予以保留。

TanStack Devtools version

• @tanstack/react-devtools: 0.10.14
• @tanstack/devtools-vite: 0.8.6
• @tanstack/devtools-bundler-core: 0.1.4
• @tanstack/react-hotkeys-devtools: 0.14.1
• Transitive @tanstack/devtools-ui: 0.7.2

Framework/Library version

React 19.3.1; TanStack Start 1.169.4; Vite 8.3.5 / Rolldown 1.2.7 through Vite+ 1.4.0; Node.js 26.13.0.

Describe the bug

The production transform removes <TanStackDevtools> but leaves a plugin factory's import when the factory is used directly in the plugins array:

import { TanStackDevtools } from '@tanstack/react-devtools';
import { hotkeysDevtoolsPlugin } from '@tanstack/react-hotkeys-devtools';

export const App = () => (
  <TanStackDevtools plugins={[hotkeysDevtoolsPlugin()]} />
);

hotkeysDevtoolsPlugin is used only inside the removed element, but its import survives. The equivalent inline { name: 'Hotkeys', render: <HotkeysDevtoolsPanel /> } form removes both the element and the plugin import.

This occurs with devtools() first in the Vite plugins array and the default production removal enabled.

Minimal reproduction

The following isolates the stripping bug without a browser, app configuration, or access to the downstream repository. The React imports are source text passed to the parser, so only the bundler-core package needs to be installed.

Run in an empty directory:

npm init -y
npm install --save-exact @tanstack/[email protected]

node --input-type=module <<'NODE'
import { removeDevtools } from '@tanstack/devtools-bundler-core';

const factory = `import { TanStackDevtools } from '@tanstack/react-devtools';
import { hotkeysDevtoolsPlugin } from '@tanstack/react-hotkeys-devtools';
export const App = () => <TanStackDevtools plugins={[hotkeysDevtoolsPlugin()]} />;`;

const panel = `import { TanStackDevtools } from '@tanstack/react-devtools';
import { HotkeysDevtoolsPanel } from '@tanstack/react-hotkeys-devtools';
export const App = () => <TanStackDevtools plugins={[{name: 'Hotkeys', render: <HotkeysDevtoolsPanel/>}]} />;`;

for (const [name, source] of Object.entries({ factory, panel })) {
  console.log(`${name}:\n${removeDevtools(source, 'App.tsx')?.code}`);
}
NODE

Actual output, reproduced against the installed package:

factory:
import { hotkeysDevtoolsPlugin } from '@tanstack/react-hotkeys-devtools';
export const App = () => null;

panel:
export const App = () => null;

Expected behavior

Both examples should produce export const App = () => null;, with no plugin import left behind. A factory import used elsewhere should of course be preserved.

Source investigation

In getPluginReferences, each array element is skipped unless it is an ObjectExpression:

if (!el || el.type !== 'ObjectExpression') continue

A direct hotkeysDevtoolsPlugin() entry is a CallExpression, so its identifier is never collected for the subsequent plugin-import cleanup. The logic handles calls inside an object's render property, but not calls directly inside the plugins array.

Associated production-build impact

Our production client build contains no retained devtools modules, but emits these unreferenced fonts from @tanstack/devtools-ui:

Asset	Uncompressed bytes
BricolageGrotesque-Bold-BIJrwikb.BIJrwikb.ttf	82,204
Inter-latin-BwkfbSeq.BwkfbSeq.woff2	72,920
Total	155,124 (151.49 KiB)

Neither filename is referenced by the generated client JS, CSS, HTML, or JSON. This increases emitted-output measurements; it is not evidence of an additional browser download.

The surviving static import appears to expose Vite's related unused-asset retention behavior (vitejs/vite#9073). The transform reproduction above establishes the import-cleanup gap independently of that bundler behavior.

Downstream tracking

Found while investigating mykiary/caniplay.today#293. That repository is private; the standalone reproduction above does not require access.

No upstream fix PR yet.

Terms & Code of Conduct

• I agree to follow this project's Code of Conduct
• I understand that if my bug cannot be reliable reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.