fix: stop a regex literal from blinding the live-caller scan

Three holes in the guard the previous commit rewrote, all found by reviewing
that commit rather than the branch.

The masker had no regex-literal awareness, and this suite is full of patterns
like /rel=["']modulepreload["']/ whose quote characters it read as string
delimiters. That desyncs the mask for the REST OF THE FILE, so every live call
below such a line vanished from the scan. Eighteen test files carry the shape,
including the app-boot tests. Demonstrated end to end: injecting a live fetch
after the regex on blog-smoke.test.js:115 left the guard fully green, while the
identical line above it redded. So the scan could report clean because it had
gone blind, which is the same class of hole the previous commit was written to
close. Telling a regex from a division needs the preceding token, so the usual
heuristic goes in, with character classes and escapes handled and division
still reading as division.

The host lookup used a 200-character raw window, which crosses statements. A
`fetch(localUrl)` followed two lines later by an assertion naming a jspm url
read as a live call, and so did a comment mentioning one. It reads the call's
actual argument list now, via the same paren matcher the guard ranges use.

And the allowlist's `live` flag was read as merely falsy, so an entry added
without the key skipped the *.live.test.* requirement while still collecting a
whole-file exemption. It must be an explicit boolean now.

Each of the three ships with the counterfactual that reproduces it, since the
previous round's lesson was that this guard's own tests were the thing not
being checked.

Author: vivek7405

test/fixtures/live-caller-scan.mjs

@@ -42,24 +42,58 @@ export const LIVE_ENTRY_POINTS = ['pinAll', 'updatePinned', 'auditPinned', 'find
 const GUARDS = ['withMockedFetch', 'withJspmDouble'];
 
 /**
- * Blank out comments, strings, and template literals, replacing each with
- * same-length filler so every index still lines up with the original source.
+ * Blank out comments, strings, template literals, and REGEX literals, replacing
+ * each with same-length filler so every index still lines up with the original
+ * source.
  *
  * Preserving offsets is what lets the guarded-range scan below run on the
  * masked text and still report positions in the real file. Blanking strings
  * matters for two different reasons: a host named inside a mock's expected-url
  * string is not a call, and an unbalanced parenthesis inside a string would
- * otherwise wreck the brace matching.
+ * otherwise wreck the paren matching.
+ *
+ * Regex literals are the subtle one, and skipping them is not a rounding
+ * error: this suite is full of patterns like
+ * `/rel=["']modulepreload["']/`, whose quote characters would otherwise be
+ * read as string delimiters. That desyncs the mask for the REST OF THE FILE,
+ * so every live call below such a line silently disappears from the scan.
+ * Eighteen test files here carry that shape, including the app-boot tests, so
+ * a masker without this is a guard that reports clean because it went blind.
+ *
+ * Telling a regex from a division needs the preceding token, since `/` is
+ * both. The usual heuristic applies: a regex may start where a VALUE may not
+ * have just ended, so after an operator, an opening bracket, a comma, a
+ * semicolon, or a keyword like `return`, but not after an identifier, a
+ * number, or a closing bracket.
  *
  * @param {string} src
  * @returns {string}
  */
+/** Keywords after which a `/` opens a regex rather than dividing. */
+const REGEX_PRECEDING_WORDS = new Set([
+  'return', 'typeof', 'instanceof', 'in', 'of', 'new', 'delete', 'void',
+  'throw', 'case', 'do', 'else', 'yield', 'await',
+]);
+
 export function maskLiterals(src) {
   const out = src.split('');
   let i = 0;
   const blank = (from, to) => {
     for (let k = from; k < to && k < out.length; k++) if (out[k] !== '\n') out[k] = ' ';
   };
+
+  /** The last token character that was not whitespace and not masked away. */
+  let prev = '';
+  /** The identifier immediately before `prev`, when `prev` ends a word. */
+  let prevWord = '';
+
+  const regexCanStartHere = () => {
+    if (!prev) return true;
+    if (/[)\]}]/.test(prev)) return false;
+    if (/[A-Za-z0-9_$]/.test(prev)) return REGEX_PRECEDING_WORDS.has(prevWord);
+    return true;
+  };
+
   while (i < src.length) {
     const c = src[i];
     const next = src[i + 1];
@@ -73,6 +107,25 @@ export function maskLiterals(src) {
       const stop = end === -1 ? src.length : end;
       blank(i, stop); i = stop; continue;
     }
+    if (c === '/' && regexCanStartHere()) {
+      // Scan to the closing delimiter, honouring escapes and character
+      // classes (a `/` inside `[...]` does not end the literal).
+      let j = i + 1;
+      let inClass = false;
+      let closed = false;
+      while (j < src.length && src[j] !== '\n') {
+        const d = src[j];
+        if (d === '\\') { j += 2; continue; }
+        if (d === '[') inClass = true;
+        else if (d === ']') inClass = false;
+        else if (d === '/' && !inClass) { closed = true; break; }
+        j++;
+      }
+      if (closed) {
+        blank(i + 1, j); prev = '/'; prevWord = ''; i = j + 1; continue;
+      }
+      // An unterminated `/` was a division after all. Fall through.
+    }
     if (c === '"' || c === "'" || c === '`') {
       let j = i + 1;
       while (j < src.length) {
@@ -82,13 +135,37 @@ export function maskLiterals(src) {
       }
       // Blank the CONTENTS but keep the quotes, so a masked string is still
       // recognisably a string and cannot merge with the token beside it.
-      blank(i + 1, j); i = j + 1; continue;
+      blank(i + 1, j); prev = c; prevWord = ''; i = j + 1; continue;
+    }
+    if (!/\s/.test(c)) {
+      if (/[A-Za-z0-9_$]/.test(c)) {
+        prevWord = /[A-Za-z0-9_$]/.test(prev) ? prevWord + c : c;
+      } else {
+        prevWord = '';
+      }
+      prev = c;
     }
     i++;
   }
   return out.join('');
 }
 
+/**
+ * Index of the `)` matching the `(` at `openIdx`, or -1.
+ * @param {string} masked @param {number} openIdx
+ */
+function matchParen(masked, openIdx) {
+  let depth = 0;
+  for (let k = openIdx; k < masked.length; k++) {
+    if (masked[k] === '(') depth++;
+    else if (masked[k] === ')') {
+      depth--;
+      if (depth === 0) return k;
+    }
+  }
+  return -1;
+}
+
 /**
  * Character ranges covered by a `withMockedFetch(` / `withJspmDouble(` call,
  * from its opening parenthesis to its match.
@@ -103,14 +180,8 @@ export function guardedRanges(masked) {
     const re = new RegExp(`\\b${guard}\\s*\\(`, 'g');
     for (const m of masked.matchAll(re)) {
       const open = m.index + m[0].length - 1;
-      let depth = 0;
-      for (let k = open; k < masked.length; k++) {
-        if (masked[k] === '(') depth++;
-        else if (masked[k] === ')') {
-          depth--;
-          if (depth === 0) { ranges.push([open, k]); break; }
-        }
-      }
+      const close = matchParen(masked, open);
+      if (close !== -1) ranges.push([open, close]);
     }
   }
   return ranges;
@@ -139,13 +210,17 @@ export function findLiveCallers(src) {
   const found = [];
 
   // A host literal has to be read from the ORIGINAL source, since masking
-  // blanks string contents. Only its position is taken from the mask, and a
-  // `fetch(` whose argument names a live host is what counts; the same host in
-  // an assertion or an importmap fixture is inert, and the suite is full of
-  // those on purpose.
+  // blanks string contents. Only the BOUNDS come from the mask, and they are
+  // the call's actual argument list rather than a fixed character window: a
+  // window crosses statement boundaries, so `fetch(localUrl)` followed two
+  // lines later by an assertion naming a jspm url read as a live call. The
+  // same host in an assertion, a comment, or an importmap fixture is inert,
+  // and this suite is full of those on purpose.
   for (const m of masked.matchAll(/\bfetch\s*\(/g)) {
-    const argStart = m.index + m[0].length;
-    const arg = src.slice(argStart, argStart + 200);
+    const open = m.index + m[0].length - 1;
+    const close = matchParen(masked, open);
+    if (close === -1) continue;
+    const arg = src.slice(open + 1, close);
     const host = LIVE_HOSTS.find((h) => arg.includes(h));
     if (host && !guarded(m.index)) found.push({ kind: 'host', what: host, line: lineAt(m.index) });
   }

test/repo-health/live-cdn-callers.test.mjs

@@ -105,11 +105,17 @@ for (const pkg of readdirSync(join(ROOT, 'packages'), { withFileTypes: true }))
 
 const rel = (f) => f.slice(ROOT.length + 1).split(sep).join('/');
 
-test('every allowlisted LIVE caller is a *.live.test.* file that exists', () => {
+test('every allowlist entry declares itself and, if live, is a *.live.test.* file', () => {
   for (const entry of LIVE_CALLERS) {
     assert.ok(files.some((f) => rel(f) === entry.file),
       `${entry.file} is allowlisted but no such test file exists`);
     assert.ok(entry.why.length > 40, `${entry.file} needs a real reason, not a placeholder`);
+    // `live` is REQUIRED and must be boolean. Reading it as merely falsy would
+    // let an entry added without the key skip the marker check below while
+    // still collecting a whole-file scan exemption, which is the quietest
+    // possible way to reopen the hole this guard exists to close.
+    assert.equal(typeof entry.live, 'boolean',
+      `${entry.file} must state \`live: true\` or \`live: false\` explicitly`);
     if (entry.live) {
       assert.ok(entry.file.includes(LIVE_MARKER),
         `${entry.file} is allowlisted as live but the runners only skip *.live.test.* files`);
@@ -180,6 +186,46 @@ test('counterfactual: the scan does not fire on the shapes that are genuinely sa
   `), []);
 });
 
+test('counterfactual: a regex literal carrying a quote does not blind the scan', () => {
+  // The subtlest failure this guard can have, and it went undetected until a
+  // review reproduced it. A pattern like /rel=["']modulepreload["']/ has quote
+  // characters in it; a masker without regex awareness reads the first one as
+  // a string opener and desyncs for the REST OF THE FILE, so every live call
+  // below that line silently vanishes from the scan. Eighteen test files here
+  // carry that shape, including the app-boot tests.
+  const afterARegex = [
+    'const re = /<link[^>]+rel=["\']modulepreload["\']/g;',
+    'const leak = await fetch("https://api.jspm.io/generate", { method: "POST" });',
+  ].join('\n');
+  assert.deepEqual(findLiveCallers(afterARegex).map((h) => h.what), ['api.jspm.io'],
+    'a live call after a quote-bearing regex must still be seen');
+
+  // The other half: a `/` that is division must NOT be read as a regex, or the
+  // mask desyncs the other way and starts swallowing real code.
+  const withDivision = [
+    'const half = total / 2;',
+    'const other = count / 4;',
+    'await fetch("https://api.jspm.io/generate");',
+  ].join('\n');
+  assert.deepEqual(findLiveCallers(withDivision).map((h) => h.what), ['api.jspm.io']);
+});
+
+test('counterfactual: a host named near, but not inside, a fetch call is inert', () => {
+  // The scan reads the call's actual argument list, not a character window. A
+  // window crossed statement boundaries, so a local fetch followed by an
+  // assertion naming a jspm url read as a live call.
+  assert.deepEqual(findLiveCallers([
+    'const r = await fetch(localUrl);',
+    'assert.equal(r.status, 200);',
+    'assert.equal(map.dayjs, "https://ga.jspm.io/npm:dayjs@1.11.20/index.js");',
+  ].join('\n')), []);
+
+  assert.deepEqual(findLiveCallers([
+    'await fetch(baseUrl);',
+    '// TODO: point this at the double instead of ga.jspm.io one day.',
+  ].join('\n')), []);
+});
+
 test('both runners drop live files unless the network is explicitly required', () => {
   // The policy above is only worth anything because the runners enforce it, so
   // assert the enforcement rather than trusting it. A refactor that renames