fix(lint): a double-quoted media src with an apostrophe is read whole, not reported missing

[miguel-heygen]

What changes for the user

hyperframes lint no longer reports an existing file as missing when its src is double-quoted and contains an apostrophe, for example <audio src="assets/Narrator's voice take 1.mp3">. Before, the value was cut at the apostrophe (assets/Narrator) and the lint said the rendered video would be silent. Percent-encoding the apostrophe was the only workaround. An apostrophe written as ' or ' now resolves too, as it does in the renderer.

Root cause

Lint read media src values with hand-written patterns of the form ["']([^"']+)["']: whatever quote opened the value, it stopped at the first quote of either kind. Two places did this:

• mediaSrcTagRe (utils.ts), used by the missing-audio, missing-local-asset and HEVC-preview rules;
• a private extractAttr in the duplicate-audio-track rule, which also cut Narrator's take 1.mp3 and Narrator's take 2.mp3 to the same name and dropped the second as a duplicate.

Fix

The package already has an attribute parser with browser-equivalent decoding, readDecodedAttr. Every media src read now goes through it:

• mediaSrcOf(match) reads the src of a tag that mediaSrcTagRe found, and the three rules use it;
• the duplicate-track rule uses readAttr / readDecodedAttr and its private extractAttr is gone.

mediaSrcTagRe only locates the tags now. Its quoted-value group is quote-aware ("[^"]*"|'[^']*'), so a tag whose src starts with a quote character (src="'90s theme.mp3") is no longer skipped and a missing file there is reported. Effects of reading values with the parser:

• an apostrophe written as ' / ', or &, is decoded as the renderer decodes it, so a file literally named a&b.mp3 referenced as src="a&b.mp3" is now looked up as a&b.mp3, which is what the renderer requests;
• the missing-audio check now skips scripts and comments, as the local-asset and HEVC checks already did, so a script that builds '<audio src="' + u + '">' as a string is not read as a tag;
• the duplicate-track rule now also reads unquoted attributes (data-start=0 src=assets/a.mp3), so such projects can see a layered-audio warning that main missed;
• a src= that only appears inside another attribute's text (<img alt="x src='ghost.png'">) is no longer reported as a missing file, and the duplicate-track rule no longer mistakes a leading data-var-src for the file name.

Verification

• New tests, each failing with the old code (except the script one, which pins the script masking: it fails once that masking is removed): an existing assets/Narrator's voice take 1.mp3 behind a double-quoted <audio src> is found; the same for an <img>; an apostrophe written as ' is found; two layered files Narrator's take 1.mp3 / Narrator's take 2.mp3 on one track warn as layered audio; a src= inside another attribute's text is not reported; a missing '90s theme.mp3 is reported; an audio tag built as a string in a script is not; the HEVC check finds Ann's clip.mp4.
• The lint package's tests (915) pass 3 runs in a row; typecheck, oxlint, oxfmt and the comment ratchet are clean.

Why this PR is small

It is a lint-package fix with its tests. The other open PR in this lane is in the runtime and would have to restart its review to carry it.

[github-actions]

Edit accuracy: accurate 2061 (base branch 2061), smooth 1468 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

Unstable (1)

• crop-none-px-r0-root-z50: tracking 0.05, pressJump 0, drop 40.07, reload 40.07, render 39.98, renderKey -, undo true, teleport true / tracking 0.05, pressJump 0, drop 0.13, reload 0.12, render 0.03, renderKey -, undo true, teleport true / tracking 0.05, pressJump 0, drop 0.13, reload 0.12, render 0.03, renderKey -, undo true, teleport true

[jrusso1020]

Approving at c72a9f6.

Every media src read now goes through readDecodedAttr, which is htmlparser2 with browser decoding. That is the parser already in the lint path, so the value is no longer pulled out by regex. mediaSrcTagRe only finds the tag now, and its quoted group is quote-aware. The private extractAttr in the duplicate-track rule is gone too.

What I checked

• Tests: the lint package passes 915/915 at the head. With main's utils.ts, project.ts and hevcPreviewLint.ts swapped in, 7 of the 8 new tests fail. The script-string test passes on main, as the description says.
• Mutants:
  • Using readAttr (no entity decoding) in mediaSrcOf fails the ' test.
  • Scanning raw html again in the missing-audio rule fails the script-string test.
• Probes, run through lintProject on main and on this head:

Case	main	this PR
src='assets/Say "hi".mp3', file exists	reported missing as assets/Say	clean
same, file absent	reported as assets/Say	reported as assets/Say "hi".mp3
src="assets/Say "hi".mp3", file exists	reported missing (undecoded)	clean
src="assets/Narrator's.mp3", exists / absent	reported both times	clean / reported with the decoded name
<img src='assets/a "b".png'>, absent	reported as assets/a	reported with the full name
src=""	media_missing_src only	same
src=assets/a.mp3 (unquoted), absent	not reported	not reported

Non-blocking

• Unquoted src: the missing-audio, missing-local-asset and HEVC rules still never see an unquoted src, because mediaSrcTagRe group 2 needs quotes. Main behaves the same way, so this isn't a regression. The duplicate-track rule does read unquoted values now, so the rules disagree slightly. Adding an unquoted alternative to that group, such as |[^\s"'=<>\x60]+, would close the gap, since mediaSrcOf already reads the value correctly.

CI is green (65 pass, 14 skipped).

— Rames