[vaibhavsrv]

Why this matters

In ods/scripts/check-dependency-pins.py, _strip_inline_comment() iterates across characters in Compose lines and Dockerfile arguments to locate unquoted # inline comments. However, it only tracked in_single and in_double quote boolean states without checking for backslash escape characters (\). When a build argument or image tag value contains an escaped quote (e.g. \" or \') inside a quoted string followed by a # character, the escaped quote prematurely toggled the quote state to False. Consequently, the subsequent # character was erroneously treated as an inline comment and stripped, corrupting valid image tags and build arguments.

This patch tracks the escaped state in _strip_inline_comment() so that backslash-escaped quote characters do not toggle quote boundaries, ensuring inline comment stripping only affects genuine unquoted comment prefixes.

Validation

• Repro baseline: Invoked _strip_inline_comment(r'ARG IMAGE="quay.io/vendor/image:tag\"#build-arg"'); confirmed baseline prematurely truncated the line at #build-arg".
• Post-fix: Verified ods/tests/test_dependency_pins_escaped_quotes.py passes with exit code 0; preserved escaped quotes in both single and double quotes while cleanly stripping genuine comments.
• Dependency pin suites: 2 passed. New-test syntax and diff checks pass; new regressions wired into Linux CI.

Overlap check

• Probe the live model on the real llama-server host port #5860 (0xacee): Addressed LLM port fallback in build-installation-context.py.
• Authenticate Windows Lemonade status probes #5862 (0xacee): Addressed LITELLM_LEMONADE_API_KEY resolution in ods-host-agent.py without overlap in check-dependency-pins.py.
• fix(pixel-gateway): strip trailing slashes on provider baseUrl when resolving completions target #5872 (vaibhavsrv): Addressed trailing slash stripping on provider baseUrl in runtime gateway.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens string scanning and comment stripping in runtime dependency pin validation, not container image execution. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5871 at 81b881c without conflicts. Production and test diffs passed together; dependency lock and runtime pin contracts remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.