[STU-148] Fix production bug on customcode.connectio.com.au

[sgardoll]

Issue

https://linear.app/stuart-gardoll/issue/STU-148/bug-caught-on-customcodeconnectiocomau

STU-148's description is a screen recording only (Linear video upload — not accessible to this session). STU-147's Jam recording (https://jam.dev/c/8f62b047-f929-4646-b1dc-8d3993bda618) was viewable, but it documents the failures PR #60 already fixed. With no viewable recording for STU-148 itself, the single-file generation + commit pipeline was audited end-to-end instead — with an important discovery:

Production is already running the STU-147 fix. The deployed bundle (dist/assets/index-CKpVTGFk.js) contains PR #60's sanitizer strings, i.e. the site was FTP-deployed from the unmerged PR branch. So STU-148's recording almost certainly captures a defect in that deployed sanitizer — and two concrete, reproducible defects were confirmed in exactly that code.

Defects found and fixed

1. Sanitizer keeps prose between fenced blocks → "not formattable" (reproduced)

sanitizeGeneratedDart kept everything between the first and last fence line, only stripping the fence lines themselves. A multi-block LLM response like:

```dart <class A> ```
And here is the second part (see below):
```dart <class B> ```
Let me know if you need changes!

committed with the prose lines intact → FlutterFlow's dart_style rejects the push with "Custom widget code is not formattable" — the exact STU-147 symptom recurring. Reproduced before the fix; the sanitized output contained the prose verbatim.

Fix: fence lines are now paired sequentially (open/close); only content inside completed pairs survives, so outer prose, inter-block prose, and fence lines are all removed. Content after an unclosed trailing fence (truncated response) is dropped — committing cut-off Dart fails formatting anyway.

2. Raw strings falsely rejected by the pre-commit formatter gate (reproduced)

The bracket scanner treated \ as an escape inside raw strings. For valid Dart like RegExp(r'\') (a raw string holding one backslash), it skipped the closing quote, mis-scanned everything after, and blocked the commit with a bogus mismatch error (line 7: "}" closes nothing...). A false positive in a blocking pre-commit gate makes the commit impossible.

Fix: the scanner detects raw string prefixes (r/R, not part of a longer identifier) and, inside them, honors backslashes as literal characters and disables ${...} interpolation detection — matching Dart semantics.

3. createZipFromFileMap swallowed errors and returned ""

A JSZip failure produced an empty string that was pushed to FlutterFlow as the zip payload — a local packaging bug surfaced as an opaque server rejection. It now propagates; every caller already runs inside a try/catch that shows the real cause in the failure modal.

4. Successful push reported as failure on malformed response value

parsePushCodeResponse called JSON.parse(jsonResult.value) unguarded on the success path. A non-string or malformed value threw after HTTP OK, so a push that did land was shown as a commit failure (inviting a duplicate re-push). It now degrades to "no warnings" and logs.

5. Double-commit race in the confirm flow

confirmCommitToFlutterFlow cleared pendingCommitData only after the awaited commit finished. A second confirm click landing mid-commit read the same data and pushed twice concurrently. The pending data is now nulled synchronously before any await.

Overlap with STU-147 (PR #60)

PR #60 is open and unmerged, but its sanitizer is what production runs. This branch is cut from origin/main per instructions, and carries forward #60's sanitizer + its app.js wiring (import, prepareCodeForCommit sanitization + canonical widget naming, pre-commit formatter/naming gates, fileName threading, identifierToFlutterFlowFileStem export) with defect fixes 1–2 applied. Intentionally not carried: #60's listProjects endpoint/auth-error changes (independent of the sanitizer; they remain #60's alone).

Merge guidance: whichever PR merges second will conflict in app.js (sanitizer hunks) and src/flutterFlowCodeSanitizer.js — for the sanitizer file, take this branch's version (superset: #60's behavior + STU-148 fixes). The two PRs should be reconciled rather than both merged blind.

Tests

• New src/flutterFlowCodeSanitizer.test.js (26 tests): all of [STU-147] Single-file generation: fix project list 403 + widget commit failures #60's coverage, the multi-block test strengthened to assert prose removal, plus STU-148 regressions — inter-block prose dropped, truncated trailing block dropped, raw string ending in backslash accepted, raw triple-quoted strings, ${ literal in raw strings, uppercase R prefix, non-raw escape behavior preserved.
• npm test: 232/232 pass (206 baseline on main + 26 new, no regressions)
• node --check clean on app.js and all touched files
• Both STU-148 repro scripts pass against the fixed code; npm run build succeeds (rebuilt dist committed per repo convention)

Caveats

• STU-148's own recording (Linear video upload) could not be viewed; the fixes target defects proven reproducible in the code production is running, which is the most probable subject of the recording. If the video shows something else, it needs a follow-up.
• Fix 1's policy choice: multiple fenced blocks are concatenated (blank-line separated), preserving [STU-147] Single-file generation: fix project list 403 + widget commit failures #60's multi-block semantics minus prose; a truncated trailing block is discarded rather than half-committed.

Fixes STU-148

Greptile Summary

This PR strengthens generated-Dart preparation and the single-file FlutterFlow commit flow, primarily to address production failures associated with STU-148.

• Preserves literal fence markers in Dart strings and nested comments while removing Markdown wrappers and inter-block prose.
• Adds raw-string-aware lexical validation and widget file/class-name normalization.
• Improves packaging, push-response handling, project listing errors, and duplicate-confirm protection.

Confidence Score: 4/5

The PR is not yet safe to merge because malformed Dart with an unmatched bracket followed by an EOF line comment can still pass the pre-commit gate.

The scanner checks only its top frame at EOF; when that frame is a line comment it returns no error even if an unmatched bracket frame remains beneath it, allowing malformed code to reach FlutterFlow.

Files Needing Attention: src/flutterFlowCodeSanitizer.js

Important Files Changed

Filename	Overview
src/flutterFlowCodeSanitizer.js	Adds fence-aware Dart scanning, raw-string handling, nested-comment support, widget-name extraction, and bracket validation; the previously reported EOF line-comment balance defect remains.
src/flutterFlowCodeSanitizer.test.js	Adds focused regressions for fenced output, literal fences, nested comments, raw strings, and malformed lexical constructs.
app.js	Integrates sanitization and validation into single-file commits and improves file naming, packaging errors, response parsing, and confirm-flow concurrency.
src/flutterFlowArtifactValidation.js	Exposes the identifier-to-file-stem conversion needed to canonicalize generated widget filenames.
dist/index.html	Updates the production asset reference to the rebuilt application bundle.
dist/assets/index-D53cwu4I.js	Rebuilds the browser bundle with the source changes in this PR.

_{Reviews (5): Last reviewed commit: "STU-148: harden generation/commit pipeli..." | Re-trigger Greptile}

Context used:

• Knowledge Base — FlutterFlow custom code experience
• Knowledge Base — FlutterFlow artifact pipeline

[sgardoll]

@greptile review

[sgardoll]

@greptile review

[sgardoll]

@greptileai

[sgardoll]

@greptile review

[sgardoll]

@greptile review

[sgardoll]

@greptile review

[sgardoll]

@greptile review

[sgardoll]

@greptile review