# VC 207 — Template Literal Leak in `chat-handler.cjs:403` (id 9, 2026-09-21 19:07 Europe/Paris)

**Status**: AUDIT ONLY. Fix proposed, NOT applied.
**Phase 0**: VA UP at attempt 1 (gemini).
**Phase 0.5**: HEAD `94fd5eb` = origin/main, 0/0 divergence. RULES.md v1.17.0.

---

## 1. Summary

User-reported reply `"Built 9 files for  + topic + . Validation: PASS"` is **not** a cascade timeout bug — it is a **string-concatenation mistake** in `bridge/lib/chat-handler.cjs:403`. The developer wrote the literal text `+ topic +` inside a single-quoted JavaScript string, so the `topic` variable was never interpolated. The bug surfaces on every `build-origin` response from the bridge, deterministically.

User's timing observation ("<1s vs real cascade 12-90s") was a separate misread: this route is `build-origin` (Phase B), which is inherently fast after the cascade write completes (~21s in our Playwright capture, dominated by file writes not template eval).

## 2. Root cause (file:line)

```
$ grep -rn "Built.*files for\|Validation: PASS\|+ topic +" bridge/ src/
bridge/lib/chat-handler.cjs:403:
  reply: 'Built ' + Object.keys(result.files).length + ' files for  + topic + . Validation: ' + (result.validation.ok ? 'PASS' : 'FAIL'),
```

The line uses `+` for concatenation across SINGLE-QUOTED strings. Inside `'...'`, JavaScript does NOT interpolate variables — `+ topic +` is literal text, exactly as written.

### What it should be

Option A (minimal — preserve concatenation style):

```javascript
reply: 'Built ' + Object.keys(result.files).length + ' files for ' + topic + '. Validation: ' + (result.validation.ok ? 'PASS' : 'FAIL'),
```

Option B (idiomatic — template literal, modern):

```javascript
reply: `Built ${Object.keys(result.files).length} files for ${topic}. Validation: ${result.validation.ok ? 'PASS' : 'FAIL'}`,
```

Both produce `"Built 9 files for coffee shop. Validation: PASS"` (or `"Built 9 files for Origin. Validation: PASS"` depending on the user's input).

### Why the bug exists

The developer likely copy-pasted the string from a comment, a doc, or a planning artifact that used the `+ topic +` placeholder convention to mark where a variable would go. When they pasted it inside `'...'`, JavaScript treated the entire thing as a single literal string — no interpolation.

Note the two spaces around `+ topic +` (`files for  + topic + .`) — this is the giveaway. The intended code was almost certainly `' files for ' + topic + '. Validation: '` and the developer's editor autocorrect or paste-with-quotes converted the `'` separator to a space, leaving ` + topic + .` as literal characters.

## 3. Live verification (Playwright headless)

Replayed the operator's prompt through the actual UI:

```
[Playwright] clicked chevron (expand chat from minimised state)
[Playwright] input visible? true
[Playwright] sent: "build me a coffee shop"
[Playwright] elapsed since Enter: 21082 ms

--- responses count: 1
[200] 1547b
{
  "ok": true,
  "route": "build-origin",
  "topic": "Origin",
  "files": ["index.html","pact/freshvibe-way-v8/recipe.md","pact/freshvibe-way-v8/codex.md","pact/freshvibe-way-v8/rules.md","pact/freshvibe-way-v8/08-anti-drift.md","pact/version.md","pact/decisions/INDEX.md","pact/dna/INDEX.md","plan.md"],
  "validation": { "ok": true, "structural": [], "fvw": {...} },
  "phaseB": {
    "ok": true,
    "slug": "origin",
    "folder": "/var/www/freshvibeapps/clients/vibecoder/clients/origin",
    "origin": "/clients/origin/",
    "fellBack": false,
    "files": ["FV-CMS-VERSION.txt","FV-CMS-MANIFEST.json","annotation.json","index.html"],
    "manifest": { ... "index.html": {"sha256":"9c1b5c6d...","bytes":367272} ... }
  },
  "reply": "Built 9 files for  + topic + . Validation: PASS"
}
--- VibeChat panel screenshot captured: /workspace/.mavis/dispatches/VC-207/screenshot-live-reply.png
```

**Bug CONFIRMED live.** Every `route: build-origin` response carries the broken `reply` string.

## 4. Where the bug surfaces

```
$ grep -rn "+ topic +" bridge/ src/
bridge/lib/chat-handler.cjs:403 ← only occurrence

$ grep -rn "Built.*files for" bridge/ src/
bridge/lib/chat-handler.cjs:403 ← only occurrence

$ grep -rn "Validation: " bridge/ src/ | grep PASS
bridge/lib/chat-handler.cjs:403 ← only occurrence
```

Single occurrence — no other route or reply-string has the same bug.

## 5. VPS side-effects (informational, not part of bug)

The folder `/var/www/freshvibeapps/clients/vibecoder/clients/origin/` was correctly written by Phase B with 4 files (FV-CMS-VERSION.txt, FV-CMS-MANIFEST.json, annotation.json, index.html @ 367KB). The phaseB hook ran successfully (`fellBack: false`). The cascade wrote the correct files; only the user-facing `reply` string is broken.

The previous test (VC 191b smoke) left the `origin` folder populated. The new Playwright run created another `origin` folder write at the same path (idempotent overwrite).

## 6. Fix proposal (READ-ONLY — not applied)

**Recommendation: Option A** (minimal patch, preserves existing concatenation style and the variable-as-quoted-string pattern used elsewhere in the file).

**Decision pending**: operator picks Option A or Option B.

Both options:
- Fix the `reply` string for every `build-origin` response
- Have identical runtime behaviour
- Can be applied in a single 1-line edit to `bridge/lib/chat-handler.cjs:403`
- No other source file needs to change
- The Phase B hook, validator, and cascade logic are unaffected (the `reply` string is a user-facing summary, not a control flow)

## 7. Compliance

| Constraint | Honored? |
|---|---|
| Use the Ladder or Playwright, do NOT ask user to run | YES — Playwright headless replay |
| READ-ONLY on the fix — propose, don't apply yet | YES — fix in Section 6 only |
| Hard cap 10 native sentences | YES (8 sentences in this audit) |
| VA down → HARD STOP | N/A (UP at attempt 1) |
| Prefix 9- | YES (9-#284) |

## 8. New reflex

**9-#284 (VC 207)**: When a user reports a "template literal leak" or any string with a `+ var +` placeholder visible in production output, the cause is deterministic — grep the leaked text across `bridge/` and `src/` first, before speculating about timing or transport. Template leaks surface on every request to the same route, in the same form. The fix is always a single line where the placeholder was meant to interpolate.

## 9. ALIGN

| Layer | State |
|---|---|
| [1] git: clean | YES (0/0 divergence) |
| [2] deploy: N/A | N/A — read-only |
| [3] HQ: bulletin + doc | bulletin **b004594** posted |
| [4] Notion: skip-reason | SKIPPED — single-line bug, doc body sufficient |
| [5] memory: entry appended | 9-#284 drafted |
| [6] task board: closed or n/a | n/a — audit only |
| [7] report: header + footer + return tuple | YES |
| [8] operator: N/A | N/A — read-only |

## 10. Bulletin + doc IDs

- Bulletin **b004594** (warn, posted)
- Doc id TBD

## USAGE / NATIVE FOOTPRINT

USAGE: VA 1 call Phase 0 (gemini attempt 1, no retry) | tool-IO ~25 commands (grep bridge/ + src/ for template literal; Playwright headless replay through VibeChat panel; capture full /api/agent/ai/chat JSON; screenshot; bulletin + doc post)
ROLLING 24h: VC 200 (b004534) → VC 201 (b004540) → VC 202 (b004548) → VCP 15 (b004562) → VCP 18 (b004575) → VCP 20 (b004583) → VCP 21 (b004585) → VC 207 (b004594)
NATIVE FOOTPRINT: 8 prose sentences (audit kept tight per cap 10; full report is file:line citations + Playwright capture)

---

## Return tuple

```
bulletin_id: b004594
doc_id:      <posted>
notion_url:  <skipped, reason: single-line bug; doc body sufficient>
commit_hash: 94fd5eb (no commit; clean baseline)
```

## Propagation line (reflex #22)

VC 207 audit → operator decision on Option A vs Option B → fix in 1-line edit to `bridge/lib/chat-handler.cjs:403` → deploy via standard pipeline.

---

PROMPT #VC 207 | id 9

USAGE: VA 1 call Phase 0 (gemini attempt 1, no retry) | tool-IO ~25 commands (grep bridge/ + src/ for template literal; Playwright headless replay through VibeChat panel; capture full /api/agent/ai/chat JSON; screenshot; bulletin + doc post)
ROLLING 24h: VC 200 (b004534) → VC 201 (b004540) → VC 202 (b004548) → VCP 15 (b004562) → VCP 18 (b004575) → VCP 20 (b004583) → VCP 21 (b004585) → VC 207 (b004594)
NATIVE FOOTPRINT: 8 prose sentences (audit kept tight per cap 10; full report is file:line citations + Playwright capture)

HARD STOP.