fix(vite): don't inject source attrs into angle brackets inside strings/comments - #8

The bug

The Vite plugin's JSX scanner (transformJsx) matches <Tag with a raw-text
regex over the whole file — it doesn't know about string/comment context. When
a < happens to sit after an operator-like character, isLikelyJsx() waves it
through and a data-solid-source="..." attribute gets injected into whatever it
landed on, even inside a string.

A real-world trigger is a CLI command built with a template literal containing a
<owner>/<repo> placeholder:

const ghCmd = () =>
  `gh secret set ${shq(name())} --repo ${shq(repo() || "<owner>/<repo>")} --body ${shq(key())}`

<repo> matches the regex; isLikelyJsx() walks back, sees the / before it
(treated as an operator), and decides it's JSX. The plugin rewrites the string to:

... "<owner>/<repo data-solid-source="src/.../CIInstructions.tsx:94:..." >" ...

The injected " terminates the JS string and the downstream Babel parse dies:

[plugin:solid] Unexpected token, expected "," (94:91)

The fix

Add buildLiteralMask() — a small linear scanner that marks every character
living inside a string literal, template-literal text, or comment. The match
loop now skips any < whose position is masked.

Template-literal interpolations (${ ... }) are treated as code, so genuine
JSX inside an interpolation still gets its source/component attributes. Handles
single/double quotes, escapes, line/block comments, and nested ${}.

Regex literals are intentionally not tracked — disambiguating regex from
division needs a real tokenizer, and <tag> inside a regex literal is far rarer
than inside strings/comments. Noted as a known limitation in the code.

Tests

bun test → 62 pass. New regression cases in tests/vite-plugin.test.ts:

• angle brackets inside a plain string → no injection
• the <owner>/<repo> placeholder inside a template literal → string left
  intact, sibling real JSX still gets a source attr
• angle brackets inside // and /* */ comments → no injection
• JSX inside a ${ } interpolation → still injected

Verified end-to-end against the file that surfaced this: the rebuilt plugin
leaves the placeholder untouched and the output parses cleanly.

Summary by CodeRabbit

• Bug Fixes

  • Fixed JSX attribute injection to correctly skip angle brackets appearing in string literals, template literals, and comments.

• Tests

  • Added comprehensive test coverage for edge cases involving angle brackets within literals and comments.