When writing installers/transformers/validators that search, rewrite, or regenerate files, require matching/parsing correctness: only operate on the exact structure you intend, and avoid ambiguous substring/position matches.
Practical rules:
folder + "/" rather than a raw substring) and validate dot-segments (./..) explicitly.rootDir through recursive scanners).workflow.xml vs validate-workflow.xml).Example pattern (transform guards + boundary-safe matching):
// 1) Boundary-safe path insertion
const folder = output_folder.replace(/[\\/]+$/, '');
for (const key of ['planning_artifacts', 'implementation_artifacts']) {
if (finalConfig[key]?.includes(folder + '/')) {
finalConfig[key] = finalConfig[key].replace(folder, `${folder}/${scope}`);
}
}
// 2) Syntax-scoped rewrite (Markdown link destinations)
const mdLinkRegex = /\]\((?:\.\/)?workflow\.md\)/g;
content = content.replaceAll(mdLinkRegex, `]({project-root}/${relPath}/workflow.md)`);
// 3) Filename-aware guard
const forbiddenRegex = /(^|\/|\\)workflow\.xml(\b|$)/;
if (forbiddenRegex.test(content)) offenders.push(path.relative(projectRoot, fullPath));
Outcome: fewer false positives/negatives, safer regeneration (don’t overwrite user edits unless the generator-shaped pattern matches), and transformations that remain correct as content and directory structure evolve.