fix(flowchart/validate): robust bracket scan for parens-in-unquoted (nested + quoted-safe)

[buger]

This PR refines the flowchart validator’s heuristic that flags parentheses inside unquoted square‑bracket node labels (FL-LABEL-PARENS-UNQUOTED).

Why

• Parentheses in unquoted [...] labels are ambiguous for Mermaid; we surface them explicitly for better DX and autofix.
• The previous sweep could double‑report or miss labels when multiple [...] segments or quotes were present on a line.

What changed

• Quote‑aware, nested‑bracket scan per line to find the correct matching ].
• Deduplication using per‑line start/end ranges to avoid repeating diagnostics already mapped by the parser.
• Keeps exclusions for typed shapes and ( … )‑wrapped content inside [].

Effect

• Correctly flags A[initialize()] only when the label is truly unquoted, even in lines with multiple labels and quotes.
• Reduces false positives and duplicate entries.

Review aids

• Build and run per‑type comparison for flowcharts:
  • npm run build && npm run compare:renderers:flowchart
  • Inspect .tmp-compare-all/flowchart/<case>/diff.json and summaries.

Supersedes

• Replaces fix(flowchart/validate): robust bracket scan for parens-in-unquoted (nested + quoted-safe) #55 which was based on a stale branch; closing that PR in favor of this clean branch off latest main.

[probelabs]

🔍 Code Analysis Results

[...]

🐛 Debug Information

Provider: google
Model: default
API Key Source: GOOGLE_API_KEY
Processing Time: 607414ms
Timestamp: 2025-11-03T08:44:04.671Z
Prompt Length: 1120357 characters
Response Length: 2722 characters
JSON Parse Success: ❌

Debug Details

⚠️ Debug information is too large for GitHub comments.
📁 Full debug information saved to artifact: visor-debug-2025-11-03T08-44-06-220Z.md

🔗 Download Link: visor-debug-95
💡 Go to the GitHub Action run above and download the debug artifact to view complete prompts and responses.

---

Powered by Visor from Probelabs

Last updated: 2025-11-03T08:44:06.388Z | Triggered by: synchronize | Commit: 2c4a530

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

🔍 Code Analysis Results

Security Issues (1)

Severity	Location	Issue
🟡 Warning	scripts/generate-previews.js:85	A command injection vulnerability exists in the `runMermaidCli` function. The shell command is constructed using a template string that includes the `filepath` variable without proper sanitization. If a file with a malicious name (e.g., `"; touch pwned; echo ".mmd`) is present in the test fixtures, it could lead to arbitrary command execution when this script is run. While this is a developer script, it poses a risk in an open-source environment where pull requests may introduce such files. 💡 Suggestion Use `child_process.execFileSync` instead of `execSync`. Pass the command and its arguments as an array to `execFileSync` to avoid shell interpretation of special characters in file paths. The arguments array should be constructed safely, for example: `execFileSync('npx', ['@mermaid-js/mermaid-cli', '-i', filepath, '-o', outSvg, ...])`.

Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	src/diagrams/flowchart/validate.ts:162-179	The logic for handling quotes and escape characters is duplicated across two loops. 💡 Suggestion Refactor the duplicated logic for scanning through quoted strings (lines 162-168 and 173-179) into a shared helper function. This will improve maintainability and reduce the risk of introducing bugs if the quote-handling logic needs to be changed in the future. For example, a function like `findMatchingBracket(line: string, startIndex: number): number` could encapsulate this logic, handling quotes and nested brackets internally.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Quality Issues (1)

Severity	Location	Issue
🟢 Info	src/diagrams/flowchart/validate.ts:162-176	The logic for handling quotes and escape characters is duplicated between the outer loop (lines 162-166) and the inner loop for finding a matching bracket (lines 170-176). This increases complexity and makes the code harder to maintain. 💡 Suggestion Refactor the duplicated quote-handling logic into a separate helper function. This function could take the current character and state (e.g., `{ inQuote: boolean, isEscaped: boolean }`) and return the updated state, reducing code duplication and improving the readability of the main loops.

🐛 Debug Information

Provider: google
Model: default
API Key Source: GOOGLE_API_KEY
Processing Time: 607414ms
Timestamp: 2025-11-03T08:44:04.671Z
Prompt Length: 1120357 characters
Response Length: 2722 characters
JSON Parse Success: ❌

Debug Details

⚠️ Debug information is too large for GitHub comments.
📁 Full debug information saved to artifact: visor-debug-2025-11-03T08-44-09-042Z.md

🔗 Download Link: visor-debug-95
💡 Go to the GitHub Action run above and download the debug artifact to view complete prompts and responses.

---

Powered by Visor from Probelabs

Last updated: 2025-11-03T08:44:09.213Z | Triggered by: synchronize | Commit: 2c4a530

💡 TIP: You can chat with Visor using /visor ask <your question>