build.mjs SPLICER: an unknown directive is silently kept, every blank line in every .js/.mjs is deleted, and a directive matches anywhere in a line #168

Severity: low

Where: build.mjs (spliceFile: the indexOf(initiatorStr) match, the if/else if chain with no final else, and newLines.filter((line) => line.trim().length))

What happens

1. A typo such as // SPLICER:EXTENSION:REMOVE_LIN or REMOVE_STRT is treated as an ordinary line and shipped. A misspelled REMOVE_START at least makes the matching REMOVE_END throw "Unmatched"; a misspelled REMOVE_LINE/REMOVE_FILE ships the line/file silently.
2. The final filter removes all empty lines, including those inside template literals and multi-line strings. A future `WEBVTT\n\n...` header or a multi-line user message would be altered in the shipped build only (a scan of chrome/** today finds no such literal, so this is latent).
3. indexOf matches the token inside a string or a non-comment: a locale message or a test fixture containing the text SPLICER:WEB:REMOVE_FILE empties the file.

Suggested fix

Throw on an unrecognised command; honour a directive only in comment position (/^\s*(?:\S.*)?\/\/\s*SPLICER:/); drop the blank-line filter or restrict it to lines adjacent to removed blocks.

Confidence: high.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code