[nikhil-mittal-165]

Summary

Addresses code-analyzer issue 2106 (referenced as plain text on purpose, so the issue is not mentioned or auto-closed).

Root Cause

The id_pattern regex in packages/code-analyzer-flow-engine/FlowScanner/queries/optional_query.py:27 is wrong. [a-zA-Z0-9]+[a-zA-Z0-9]{15} needs at least 16 characters, so 15-character IDs never match. Because is_valid_salesforce_id (line 1136) only verifies the checksum for length 18 and returns True for any other length the pattern accepts, words of 16, 17 or 19+ characters containing two adjacent digits are falsely reported. The lookahead (?=.*[0-9][0-9]) misses valid 18-character IDs without two adjacent digits, and the optional suffix group expects 4 characters instead of 3 and is swallowed by the greedy prefix.

Fix

Corrected id_pattern to ^[a-zA-Z0-9]{5}0[a-zA-Z0-9]{9}(?:[A-Z0-5]{3})?$ so 15 and 18 char Salesforce IDs validate and other lengths are rejected; added unit tests (test_salesforce_id.py).

Testing

• Unit tests were added in this PR. The repo's unit test suite was not run during functional testing, so CI results should be relied on.

Functional Testing Evidence

Setup note: sf is not installed, so setup_local_dev.py failed at step 5 (sf plugins link). Steps 1-4 built core and the CLI. Its step 3 symlink did not take effect, so it was re-run by hand and the CLI was run with node code-analyzer/bin/run.js and Python 3.12 on PATH.

• Test 1: Python repro. python3.12 -I -c 'from queries.optional_query import is_valid_salesforce_id' on the repro strings. 0012800000AbCdE True; 00Q5g00000Xyz12 True; Region2024Totals False; Invoice2024Number False; the extra 17- and 22-character words also False - PASS.
• Test 2: CLI repro. run.js code-analyzer run --workspace flows --rule-selector flow:HardcodedId --view table. The flow has an Assignment with 0012800000AbCdE and one with Region2024Totals. A first run, before the symlink was redone, loaded a stale engine copy (old regex) and wrongly flagged Region2024Totals. After linking this branch, output was 1 (Moderate) flow:HardcodedId T.flow-meta.xml:11:1 (the 0012800000AbCdE assignment), with none for Region2024Totals - PASS.

Overall Status: PASS

Files Changed

• packages/code-analyzer-flow-engine/FlowScanner/queries/optional_query.py
• packages/code-analyzer-flow-engine/FlowScanner/tests/test_salesforce_id.py

🤖 Generated with Claude Code

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[nikhil-mittal-165]

Self-review using the refreshed Code Analyzer regression-review skill.

Findings

No production-code defect found in the regex/checksum change. The new pattern constrains the helper to the documented 15-character base form and optional three-character checksum, while the existing to18 comparison continues to reject bad 18-character checksums.

Manual validation before merge

Required:

• Run a table through both the Python helper and the packed CLI/Flow engine: valid 15-character Account/Lead/RecordType/custom-object IDs; their computed 18-character forms; a wrong checksum; lengths 14, 16, 17, and 19+; IDs without adjacent digits; and prose lookalikes such as Region2024Totals.
• Use one real Flow containing a valid ID and a lookalike in separate assignments. Verify exactly the ID is reported by flow:HardcodedId.
• Include lowercase/uppercase mixtures and suffix boundary values A, Z, 0, and 5; verify characters outside the checksum alphabet are rejected.
• Confirm the rule still intentionally matches only when the whole stringValue is an ID, so this fix does not silently claim support for IDs embedded in formulas, templates, or URLs.

Recommended:

• Add a small sample of real IDs from multiple object key prefixes to guard the fixed sixth-character invariant with production-shaped data.

Evidence checked: linked issue #2106, helper and caller behavior, checksum implementation, changed tests, and green Linux/macOS/Windows CI. The CLI run in the PR description is author-supplied evidence, not independently reproduced here.