Skip to content

fix(md-copy): leading semicolon on the injected payload (ASI safety)#7

Closed
phase3dev wants to merge 1 commit into
mainfrom
fix/asi-leading-semicolon
Closed

fix(md-copy): leading semicolon on the injected payload (ASI safety)#7
phase3dev wants to merge 1 commit into
mainfrom
fix/asi-leading-semicolon

Conversation

@phase3dev

Copy link
Copy Markdown
Owner

Summary

Addresses the Codex PR-review note on #6 (P2): prefix the injected webview payload with a leading ;.

When the self-contained IIFE is appended to webview/index.js after a bundle whose final statement is an expression with no trailing semicolon, JavaScript would parse it as a call on that expression (lastExpr(function(){...})()) and throw before the webview app initializes. The leading ; makes the patch safe regardless of the bundle's final token. This matches the design's "robust across builds" intent.

Not triggered by the current 2.1.170 bundle (it ends with }); this is forward-hardening.

Regenerated the three embeds (bash / node / python) from the updated source.

Test plan

  • New node-exec test: append the block after a no-semicolon bundle and confirm it runs without throwing (tests/test_md_patcher.py)
  • python3 -m unittest discover -s tests (86 cases)
  • python3 tools/gen-embeds --check --strict · bash -n / ShellCheck / node --check

🤖 Generated with Claude Code

When appended after a bundle whose final statement is an expression with no
trailing semicolon, the IIFE would parse as a call on that expression and throw
before the webview app initializes. Prefix the payload with ';' so the patch is
safe regardless of the bundle's final token. Regenerated the three embeds; adds a
node-exec test on a no-semicolon bundle.

Not triggered by the current 2.1.170 bundle (it ends with '}'); this hardens
against future builds. Codex PR review, P2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@phase3dev

Copy link
Copy Markdown
Owner Author

Superseded by #8. The leading-; ASI fix this PR added to #6's payload is already on main: the md-copy redesign in #8 rewrote the injected payload (which is why this PR now conflicts) and ships the leading ; in the source (webview-inject.js) and all three generated embeds (bash/node/python), plus the identical regression test test_appended_block_is_asi_safe_after_no_semicolon_bundle (tests/test_md_patcher.py). Nothing here is missing from main, so closing rather than merging.

@phase3dev phase3dev closed this Jun 11, 2026
@phase3dev phase3dev deleted the fix/asi-leading-semicolon branch June 11, 2026 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant