build.cf release

[karishnu]

Summary

Adds in-memory static analysis for browser-rendered projects, enabling code quality checks without requiring a sandbox environment.

Changes

• Added new InMemoryAnalyzer service with language-specific analyzers:
  • JavaScriptAnalyzer: Syntax validation using acorn parser
  • HTMLAnalyzer: Tag matching and structure validation using htmlparser2
  • CSSAnalyzer: Brace/comment/string balance checking
• Added HTMLCSSCrossValidator for cross-file validation (checks CSS class/ID usage)
• Modified BaseCodingBehavior to use in-memory analysis for browser-rendered projects
• Updated serializeStaticAnalysis to format issues when rawOutput is not available
• Added acorn and htmlparser2 dependencies

Motivation

Browser-rendered projects don't have a sandbox environment to run traditional static analysis tools. This change enables code quality feedback for these projects by performing analysis directly in the worker.

Testing

• Test with browser-rendered template projects
• Verify static analysis detects:
  • JavaScript syntax errors
  • HTML tag mismatches and unclosed tags
  • CSS brace/comment/string balance issues
  • Undefined CSS classes/IDs used in HTML

Breaking Changes

None - this is an additive feature that only affects browser-rendered projects.

[github-actions]

Claude finished @karishnu's task in 1m 35s —— View job

---

Code Quality & Security Review

Recommendation: ✅ APPROVE

PR Summary

This PR adds in-memory static analysis for browser-rendered projects, enabling code quality checks (JavaScript syntax, HTML tag matching, CSS brace balancing, and CSS class/ID cross-validation) without requiring a sandbox environment.

PR Description

• Updated: Yes
• Notes: Generated comprehensive description with summary, changes, motivation, testing, and breaking changes sections.

Addressed Issues

• None identified (this appears to be a new feature addition)

---

Code Quality

Critical: None

High: None

Medium:

1. CSS Analyzer String Escape Handling (worker/services/static-analysis/analyzers/CSSAnalyzer.ts:42)

   • The escape check line[i - 1] !== '\\' doesn't account for escaped backslashes (e.g., \\"). This is a minor edge case but worth noting for completeness.

2. InMemoryAnalyzer creates new instance per call (worker/agents/core/behaviors/base.ts:642)

   • A new InMemoryAnalyzer is instantiated on every runInMemoryAnalysis() call. Consider caching the analyzer instance since it's stateless.

Low:

1. Inconsistent file extension checking - HTMLCSSCrossValidator uses .endsWith() while InMemoryAnalyzer uses extension extraction with lastIndexOf. Both work correctly but the approach is inconsistent.

2. HTMLAnalyzer line tracking in callbacks - Line numbers are tracked via ontext callback, but newlines in tag attributes won't be counted, potentially causing slight line number inaccuracies. This is a known limitation of the approach.

---

Security

Critical: None

High: None

Medium: None

Low:

1. ReDoS consideration - The regex patterns in HTMLCSSCrossValidator are straightforward and don't appear to have ReDoS vulnerabilities. The patterns are well-bounded.

---

Architecture & Design

Positives:

• Clean interface design with IStaticAnalyzer, LanguageAnalyzer, and CrossFileValidator
• Good separation of concerns between single-file analyzers and cross-file validators
• Proper re-export of types from sandboxTypes.ts avoiding type duplication
• Smart handling of utility framework classes (Tailwind patterns) to reduce false positives
• Correct caching behavior - only caching full analysis, not scoped analysis

Notes:

• The PR correctly imports and re-exports existing CodeIssue, StaticAnalysisResponse, and LintSeverity types from sandboxTypes.ts rather than duplicating them
• The serializeStaticAnalysis changes ensure proper formatting when rawOutput is not available (as is the case with in-memory analysis)
• The fetchAllIssues method correctly short-circuits for browser-rendered projects, avoiding unnecessary sandbox calls

---

Testing

• No automated tests included in this PR
• Recommended manual testing:
  • Test with a browser-rendered template project
  • Verify JavaScript syntax errors are detected
  • Verify HTML tag mismatches are reported
  • Verify CSS brace balance issues are caught
  • Verify undefined CSS class warnings appear for custom classes (but not for Tailwind utilities)

---

Final Recommendation

✅ Approve - This is a well-structured feature addition with clean architecture. The code follows existing patterns, properly reuses types, and handles edge cases like utility CSS frameworks. The identified issues are minor and don't block merging.