Six source-scanning gates strip comments with a naive regex that a `/*` inside a string literal blinds — the repo already has the string-aware masker they should use

[os-zhuang]

Filed unassigned from the #8985 dev seat (session session_012WKSnqAaoqtW3QX7SSf1Vk, PR #9365). Found while reverse-verifying a pin I wrote; the same mechanism bit my own detector first, which is how it was noticed at all.

The mechanism

Several check-*.mjs gates decide "is this code or prose?" with

source.replace(/\/\*[\s\S]*?\*\//g, '')

That regex has no idea what a string literal is. Any source carrying /* inside a string — a glob ('src/**/*', `@objectstack/*`), a route wildcard (`/api/v1/auth/*`, `/_console/*`) — opens a phantom block comment that runs to the next real */, usually a docblock hundreds of lines further down, taking every line of real code in between with it.

The failure direction is the dangerous one: silent under-reporting. The gate reports clean over code it never looked at. AGENTS.md already names this class — "a verifier that silently degrades (reusing a stale build, skipping a check it could not run) is worse than no verifier, because it reports success."

Measured

How much real source each file loses to the naive strip, on 0a5adbaed:

file	lines	removed by the naive strip
packages/cli/src/commands/start.ts	469	265 (56%)
packages/cli/src/commands/serve.ts	4172	1058
packages/cli/src/utils/console.ts	653	209

Those totals include genuine comments, so here is the isolated proof on start.ts, which is where I hit it: --auth-secret's flag description contains the literal /api/v1/auth/*, and the phantom comment it opens closes against a docblock 250 lines later. A detector looking for a specific assignment reported the file clean while the assignment was demonstrably present on line 327 — the phantom span covered lines 133 to 384.

105 non-test source files under packages/*/src and packages/*/*/src carry a string literal containing /*, i.e. carry the trigger:

grep -rlE "['\"\`][^'\"\`]*/\*[^'\"\`]*['\"\`]" --include=*.ts packages/*/src packages/*/*/src | grep -v '\.test\.\|\.spec\.' | wc -l

Gates using the vulnerable spelling

• scripts/check-dispatcher-error-vocabulary.mjs:152 (stripComments, used at 6 call sites)
• scripts/check-error-code-casing.mjs:130
• scripts/check-error-status-conformance.mjs:248
• scripts/check-examples-live-imports.mjs:173
• scripts/check-test-source-alias.mjs:683
• scripts/check-platform-checklist.mjs:183

The fix already exists in-tree

scripts/pm/dispatch-gates.mjs exports maskComments — built on a character-class scanner that tracks strings, templates and regex literals, and blanks comment spans instead of deleting them, so line numbers survive. Its docblock was written for the neighbouring failure (comments contributing false hints). The gates above should call it rather than each keeping a private naive copy.

check-error-code-casing.mjs is halfway there already — it blanks rather than deletes, preserving line numbers — but it is still regex-based and equally blind to strings.

What is measured and what is not

Measured: the mechanism, the phantom span on a real repo file, the swallowed-line counts, the 105 triggering files, and that a correct helper exists.

Not measured: whether any of the six gates currently has a live false negative — that needs each gate's scan surface intersected with the triggering files, and then a pattern that actually falls inside a swallowed span. So this is a latent hazard with a proven mechanism, not a demonstrated live miss. Whoever picks it up should measure that intersection first; it also decides whether this is a same-day fix or a ratchet risk.

Worth noting the repair is cheap and uniform (swap the private stripComments for the shared maskComments), and that doing it may raise findings in gates that are currently under-reporting — a widening, not a regression.

---

Generated by Claude Code

[os-steve]

Triage: lands in scripts/check-*.mjs (six gate scripts swapping a private naive stripComments for the shared string-aware maskComments from scripts/pm/dispatch-gates.mjs) ⇒ domain:devx (gate tooling, not spec-orbiting). Type Task, pm:queue.

Rationale: proven mechanism (phantom comment span measured on a real file), dangerous failure direction (silent under-reporting by verifiers), cheap uniform repair that already exists in-tree. Not a finding — the fix scope is named and mechanical; the card itself correctly flags the one open measurement (whether any gate has a live false negative) as the implementer's first step, and that measurement also decides whether the swap surfaces new gate findings (a widening — if red appears, fix the newly-visible defects or ledger them per each gate's convention, ⛔ don't re-blind the gate to stay green).

Dispatch note: maskComments blanks spans (line numbers survive) — verify each converted gate still matches its own downstream line-number expectations. Size/model suggestion: M / opus (mechanically uniform, but six gates × their scan-surface assumptions deserve judgment).

---

Generated by Claude Code

[claude]

Claim: PM loop round 5
Session: session_01XqDQYVU5smx29ts9pAErja · Branch: claude/issue-9367-comment-strip-regex · Worktree: objectstack-issue-9367 · Domain: domain:devx
File surface: scripts/check-*.mjs (the six gates named on the card) — stop on breach; explain in the report
Container & model: mode:subagent, model: opus — dispatch-gates.mjs --tier reports no path-derived mandate; clause ② not reachable (no contract accept/reject surface).
Serial constraints cleared: verified against every in-flight claim this round. ⛔ Not scripts/docs-audit/affected-docs.mjs — PR #9394 holds that file unlanded. Batch siblings #9305 (content/blog/), #9373 (.github/workflows/), #9382 (content/docs/), #9386 (docs/qa/).

⚠️ Shared checkout is stale (its HEAD is a PM branch that never moves). Cut from a freshly fetched origin/main and assert git rev-parse HEAD equals origin/main before measuring. Premises below were checked from a tree asserted equal to origin/main (51a46a440).

Premise ✅: scripts/check-dispatcher-error-vocabulary.mjs present.

Gate: pnpm check:dispatcher-error-vocabulary (keyed on that script) + whatever the other five gates' own families are — ⚠️ re-derive from your ACTUAL changed paths, this card touches six scripts and the list will be longer than one line.

⭐ The verification that matters: a naive comment-strip regex fails on the cases it cannot see. For each gate you touch, prove red-before/green-after on a case the old regex mis-stripped — a string literal containing //, a regex literal, a URL, a block comment inside a template. ⛔ A green run on today's corpus proves only that today's corpus lacks the shape.

---

Generated by Claude Code