Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure·2 in this wave

apps/runs-engine has 15 type errors — the only app allowlisted out of verify:app-typecheckTo do strip-non-code.mjs mis-lexes regex literals and template URLs — 2 route files brace-unbalanceTo do

Wave

Backend & Infrastructure

The critical path. Backend API is the long pole — five of the seven areas wait on its gate. Sits on top of Foundations.

TacTile › Launch TacTile › Backend & Infrastructure

0/2 done2 open7 sub-waves97 incl. sub-waves

Selected taskclear

strip-non-code.mjs mis-lexes regex literals and template URLs — 2 route files brace-unbalance

To doOwner · backendt_6769cd75

Found 2026-08-12 in round 19. Shared scan infrastructure. A fix attempt was made and deliberately REVERTED — read why before retrying.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**strip-non-code.mjs mis-lexes regex literals and template URLs — 2 route files brace-unbalance** · to do

Found 2026-08-12 in round 19. Shared scan infrastructure. A fix attempt was made and deliberately REVERTED — read why before retrying.

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure

## The brief on file

BACKEND SESSION. Filed 2026-08-12 (round 19). This is shared scan infrastructure — scripts/verify/lib/strip-non-code.mjs, consumed by verify:console-ratchet and verify:destination-visibility.

THE TWO BLIND SPOTS, both reproduced:

1. `//` INSIDE A TEMPLATE LITERAL reads as a line comment and deletes the rest of the line, braces included:
     stripSourceLines("const u = `https://${host}/x`, o = {")  ->  "const u = `https:"
   Any URL built in a template literal does this. 4+ route files contain them.

2. A QUOTE INSIDE A REGEX LITERAL opens a fake string that swallows real code:
     apps/api/tactile-api/src/routes/videos.ts:340
     `"${row.hash_id.replace(/"/g, '""')}"`
   The `"` inside /"/g opens a string that runs to the next quote, eating the substitution's closing brace.

MEASURED IMPACT: 2 of 55 files under apps/api/tactile-api/src/routes do not brace-balance after stripping — urlCheck.ts (depth -1) and videos.ts (depth -2). verify:destination-visibility already WARNS about exactly these on every run and confirms no MUST_FIND site was lost to them, so nothing is currently broken. This is latent.

A FIX WAS ATTEMPTED AND REVERTED — DO NOT REDO IT BLIND. I made the stripper template-literal-aware (a tmpl stack, template text collapsing to a space, `${...}` treated as code). It was NOT sufficient and it was actively dangerous:

 (a) NOT SUFFICIENT: without regex-literal handling, videos.ts:340 still corrupts state — the `"` inside /"/g is read as a string opener while inside the substitution. Telling a regex literal from a division needs real parse context (what token preceded the `/`), which is the point at which this stops being a scanner.
 (b) DANGEROUS: it silently moved a shipped gate. videos.ts went from 49 console call sites to 2, because the old stripper was counting console.* text that the new one classified as template content. That would have quietly invalidated .verify-baseline/console-usage.json — the file that IS the console gate.

SO IF YOU PICK THIS UP: any change here must be proved against BOTH consumers before it lands. Run `node scripts/verify/console-ratchet.mjs` and confirm it still reports 379 across 57 files with no per-file movement (it diffs every file against the baseline in both directions, so an unchanged total AND no improvement line means every individual number held). Then run `node scripts/verify/destination-visibility.mjs` and confirm 15 sites across 55 route files and that the brace-balance warning has gone.

OPTIONS, roughly in increasing cost:
 - Leave it. The consumers detect and report the failure; that is arguably the honest end state for a heuristic.
 - Regex-literal support via preceding-token heuristics (after `=`, `(`, `,`, `return`, an operator -> regex; after an identifier, `)`, `]` -> division). Covers this tree; not general.
 - Replace the hand-rolled scanner with a real tokenizer. Correct, and a much bigger dependency and behavioural-change surface for two files.

Whichever way it goes, the brace-balance invariant in destination-visibility should stay — a silent mis-scan is the failure mode both consumers exist to prevent.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend &amp; Infrastructure

strip-non-code.mjs mis-lexes regex literals and template URLs — 2 route files brace-unbalance

Backend & Infrastructure