[isamu]

Summary

Closes #43.

• The image-placeholder pattern /!\[([^\]]+)\]\(\/?__too_be_replaced_image_path__\)/g retried every ![ and scanned to the end each time. A markdown argument with many ![ and no ] therefore took quadratic time and blocked the event loop. CodeQL reports this as js/polynomial-redos (alerts 2 and 3).
• The new src/core/imagePlaceholders.ts has two functions:
  • findImagePlaceholders returns the same matches with one forward scan. A prompt holds no ], so the only candidate ending at a given ] starts at the first ![ after the previous ].
  • replaceImagePlaceholders rebuilds the document from those matches.
• plugin.ts now replaces from the matches it already found, instead of matching a second time.

Items to Confirm

• Behaviour preservation is shown by keeping the old pattern as the oracle in tests/imagePlaceholders.test.ts. On seeded generated documents built from !, [, ], the placeholder targets and near-misses, both the matches and the replaced document must equal the pattern's.
• The speed test uses a wall-clock budget (BUDGET_MS). At a fifth of the test's input length, the old pattern took seconds.
• This touches src/core/plugin.ts, and so does chore: prettier を入れて整形をそろえる (2026-10-18) #41 (Prettier), so whichever lands second needs main merged in. The CodeQL failure on chore: prettier を入れて整形をそろえる (2026-10-18) #41 is these same two alerts, counted as new there because chore: prettier を入れて整形をそろえる (2026-10-18) #41 reformats the lines. It should clear once this is on main.

Verification

• yarn lint, yarn build, yarn typecheck and yarn test pass (no format script on main yet).
• Mutating each decision in the scanner: the empty-prompt check, the slash form, re-finding ![, the prompt start and the tail copy each turn the tests red. Resuming at close + 1 instead of the match end is equivalent, because the targets hold no ] or ![.

User Prompt

• Inspect the other plugin repos the same way as GUIChatPluginSpreadsheet, then fix what was found (excluding the scoria backlog this time).

🤖 Generated with Claude Code

work in GUIChatPluginSpreadsheet

[isamu]

CODEX VERDICT: LGTM

Read SHA: 1cde03c.

• correctness and edge cases: none
• security (injection / path traversal / code evaluation): none
• tests: does a test go red if the new behaviour breaks: none
• API / schema / wire / on-disk compatibility: none
• consistency with the rest of the codebase: none
• behaviour preservation: the scanner returns exactly the old pattern's matches and replacement for every input: none
• complexity: the scan is linear in the worst case, including inputs with many "]" and no "![", or many "![" and no "]": none
• tests: the oracle comparison cannot pass vacuously and the time budget is not flaky: none

Checks run: yarn test (18/18 passed), yarn typecheck, yarn lint, yarn build. Lint has only the existing six warnings outside this change's new code. Additional random comparison against the old regex passed for 100,000 inputs. The seeded oracle corpus exercised 65 matching documents and 65 matches. No mutation sweep was run.

FINDINGS COMPLETE: I read every hunk of the diff and this is every finding I have.