fix(#682): harden callers comment scanning edge cases - #684
Merged
justrach merged 8 commits intoAug 5, 2026
Conversation
Add failing coverage for PHP and Swift trailing comments, shell comments after operators, and real calls following marker-like text in backtick, raw-string, and inline block-comment spans. These cases show why the merged prefix scanner is not yet safe to promote unchanged. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Prevent line-comment markers inside backtick/raw literals and complete inline block comments from truncating away real callers later on the line. Cover PHP and Swift markers, preserve PHP 8 attributes, and recognize shell comments after unescaped operators while keeping parameter-expansion hashes live. This keeps the scan line-local and allocation-free, preserving the existing conservative behavior for block-comment mentions while removing regressions introduced by the initial trailing-comment filter. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Cover negative-only raw, backtick, and inline block-comment spans so scanner fixes cannot trade false negatives for false callers. Preserve JavaScript template-expression calls and exercise unquoted shell parameter expansion. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Unify literal and comment handling in the whole-word caller scan so marker-like text cannot hide later code or re-admit mentions from skipped spans. Raw strings, backticks, complete inline block comments, and line comments are scanned allocation-free; JavaScript template text is ignored while ${...} expressions remain searchable.
This replaces the prefix-then-match split that handled the same spans inconsistently and traded false negatives for false positives.
Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Add failing caller coverage for braces inside JavaScript regex literals, callable R backtick identifiers, and hash-bearing R identifiers before a real call. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Cap recursive JavaScript template analysis to bound stack and worst-case rescanning on hostile single-line input. Skip regex literals while locating interpolation braces, and preserve R backtick identifiers as callable symbols without treating embedded hashes as comments. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Add failing coverage for a symbol appearing only in a JavaScript regex literal after return, where punctuation-only regex context detection scans the pattern as code. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Treat regex literals after expression-leading JavaScript keywords such as return, throw, yield, and await as non-code spans, preventing pattern text from becoming false caller matches. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 154fb86bf6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| return false; | ||
| } | ||
| if (stringLiteralEnd(line, i)) |end| { |
There was a problem hiding this comment.
For Go, raw backtick strings do not use backslash escapes, but this branch uses stringLiteralEnd (which skips \\ plus the next byte) to locate every non-template backtick literal. On a valid Go line like s := `\`; renderX() the closing backtick after the backslash is skipped, so the scanner takes the unclosed-literal path and codedb_callers drops the real call that follows.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #682.
What changed
#[...]attributes, and shell comments after unescaped operators${...}template expressions and R backtick-quoted callable identifiersWhy
lineCodePrefixcould drop genuine callers afterhttps://in Go raw strings or JavaScript templates, while PHP/Swift trailing comments were still reported. A first follow-up exposed a second failure mode: skipping those spans only in the prefix pass could re-admit names that existed solely inside literals/comments./*loses real calls after a closed inline block comment. Treating all backticks as inert loses JavaScript${renderX()}and R`renderX`(...)calls. Keeping separate prefix and match passes allowed the two scans to disagree and trade false negatives for false positives.Verification
zig build test -Dtest-filter=issue-682zig build testzig build && python3 scripts/e2e_mcp_test.py --binary zig-out/bin/codedb --project "$(pwd)"— 20/20zig build bench