Found while implementing #9367 (six source-scanning gates sharing one string-aware comment
masker). That card's scope is the six gates it names, and its rulings say a seventh with the
same defect is to be reported, not fixed — so this is the report. Not fixed in that PR.
Blocked-by: #9367 (the shared masker the fix should call lands there)
The mechanism
scripts/check-org-identifier.mjs decides "is this line executable code?" per line:
// Drop any trailing line-comment so `foo(); // …session.tenantId…` is clean.constcode=line.replace(/\/\/.*$/,'');if(!PATTERN.test(code))continue;
.replace(/\/\/.*$/, '') truncates at the first double-slash on the line, whatever it
is. A URL in a string literal, or any string carrying a doubled slash, therefore deletes the
rest of the line — including the very read the gate is looking for.
The gate's own guard above it (trimmed.startsWith('//')) is fine; it is this trailing-comment
line that is string-blind.
Measured
const PATTERN = /\bsession\s*\??\.\s*tenantId\b/;
const line = " const docs = 'https://objectstack.ai/x'; return session.tenantId;";
raw line matches : true
after naive strip : false <- the read is dropped
stripped line : " const docs = 'https:"
The failure direction is silent under-reporting: the gate reports clean over a line it
truncated. AGENTS.md names this class — a verifier that silently degrades is worse than no
verifier, because it reports success.
Reachability
Not measured against the gate's real corpus. Whoever picks this up should intersect its scan
surface (author-facing source files) with lines carrying both a doubled slash inside a string
and a session.tenantId read, exactly as #9367 asks. It may well be latent today — two of the
six gates on that card were — but the mechanism is real either way, and a latent gate defect is
a gate that will go quiet the first time someone adds a URL to the wrong line.
The fix
scripts/js-comment-mask.mjs (added by #9367) exports maskComments and stripComments over
one string-, template- and regex-aware scanner. This gate wants maskComments: it reports line
numbers, and blanking keeps every offset true. That replaces the per-line .replace and the
startsWith guards together, since the scanner already knows a full-line comment from a
trailing one.
⚠️ Check the projection before converting — #9367 measured a gate whose lazy regex went from
6.4s to 5m27s on the blanking projection. This gate scans line by line, so it is not exposed to
that, but the check is cheap.
Generated by Claude Code
Found while implementing #9367 (six source-scanning gates sharing one string-aware comment
masker). That card's scope is the six gates it names, and its rulings say a seventh with the
same defect is to be reported, not fixed — so this is the report. Not fixed in that PR.
Blocked-by: #9367 (the shared masker the fix should call lands there)
The mechanism
scripts/check-org-identifier.mjsdecides "is this line executable code?" per line:.replace(/\/\/.*$/, '')truncates at the first double-slash on the line, whatever itis. A URL in a string literal, or any string carrying a doubled slash, therefore deletes the
rest of the line — including the very read the gate is looking for.
The gate's own guard above it (
trimmed.startsWith('//')) is fine; it is this trailing-commentline that is string-blind.
Measured
The failure direction is silent under-reporting: the gate reports clean over a line it
truncated. AGENTS.md names this class — a verifier that silently degrades is worse than no
verifier, because it reports success.
Reachability
Not measured against the gate's real corpus. Whoever picks this up should intersect its scan
surface (author-facing source files) with lines carrying both a doubled slash inside a string
and a
session.tenantIdread, exactly as #9367 asks. It may well be latent today — two of thesix gates on that card were — but the mechanism is real either way, and a latent gate defect is
a gate that will go quiet the first time someone adds a URL to the wrong line.
The fix
scripts/js-comment-mask.mjs(added by #9367) exportsmaskCommentsandstripCommentsoverone string-, template- and regex-aware scanner. This gate wants
maskComments: it reports linenumbers, and blanking keeps every offset true. That replaces the per-line
.replaceand thestartsWithguards together, since the scanner already knows a full-line comment from atrailing one.
6.4s to 5m27s on the blanking projection. This gate scans line by line, so it is not exposed to
that, but the check is cheap.
Generated by Claude Code