Scan Hardcoded Strings

Scan Hardcoded Strings Skill

Scans the VS Code extension's webview UI code for candidate hardcoded (non-localized) UI strings and writes a triage report. This is an informational inventory tool, not a CI gate — it never exits non-zero and never modifies source files.

When to Use This Skill

Use this skill when you need to:

• Audit UI text after adding or changing a webview panel or a section of extension.ts's get*Html methods, to catch strings that were typed directly instead of routed through localization
• Build or refresh a localization backlog before a release
• Periodically re-run as a maintenance/audit pass to see whether the backlog of non-localized strings is growing or shrinking
• Investigate a specific UI surface (e.g. a webview panel) that appears not to translate correctly under a non-English locale

It complements two existing scripts that only check consistency of strings already wired through localization (scripts/validate-localization.js / npm --prefix vscode-extension run lint:l10n, and vscode-extension/scripts/validate-l10n.mjs / npm --prefix vscode-extension run validate:l10n) — neither of those, nor anything else in the repo, detects a plain string literal that never calls localize(/t(/ vscode.l10n.t( in the first place. A separate, stricter AST-based CI gate for new instances of this may exist as an independent effort; this skill is not that gate — it is a full-codebase inventory for manual triage.

Running the Check

node .github/skills/scan-hardcoded-strings/scan-hardcoded-strings.js

# Machine-readable JSON output
node .github/skills/scan-hardcoded-strings/scan-hardcoded-strings.js --json

The script will:

1. Recursively scan every *.ts file (excluding *.test.ts) under vscode-extension/src/webview/, plus only the get*Html(...) method bodies in vscode-extension/src/extension.ts (not the whole file — this keeps out unrelated string literals like GitHub issue Markdown templates or VS Code panel titles), after blanking out /* ... */ block/JSDoc comments so example markup in a doc comment isn't mistaken for real UI text
2. Flag string/template literals in UI-rendering positions — assignments to .textContent/.innerText/.innerHTML/.title/.placeholder (a direct literal or a conditional/ternary RHS whose branches are literals), aria-label="..."/title="..."/placeholder="..." HTML attributes (or the same three set via .setAttribute('title', '...')), a literal document.createTextNode('...') argument, text inside <div>, <button>, <vscode-button>, <label>, <h1>–<h6>, <p>, <span>, <td>, <th>, <option>, <summary>, <caption>, <li>, <title>, and SVG's <text> tags in template literals (tolerating simple nested inline tags like <a>/<strong>/<span>, which are also matched as a literal's own root tag so e.g. el.innerHTML = '<strong>Save changes</strong>' isn't missed, and void/structural tags like <input>/<br> that never need a closing tag), and the UI-text argument of a known shared DOM helper call (el(...), iconHeading(...), createButton(...) from vscode-extension/src/webview/shared/domUtils.ts) — that argument may be several string/template literals joined by +, or a top-level ternary or ??/|| fallback of (recursively) literal/+-joined branches, not just a single direct literal
3. Skip anything already wrapped in localize(, localizeFormat(, t(, or vscode.l10n.t(, and anything that doesn't look like prose (pure numbers/symbols, URLs, CSS values, HTML character references like ·/•, a narrow denylist of single CSS-keyword tokens — not every single lowercase word; the letter check itself is Unicode-aware, so non-English text isn't exempted) — but recover string literals that are themselves a whole ternary branch, or the fallback side of a || default, inside an interpolation's expression, e.g. `${flag ? 'Enable Overrides' : 'Disable Overrides'}` or `${msg || '<em>No message</em>'}` (a *plain* quoted literal that is merely an argument to some other call in the same interpolation, e.g. `${buttonHtml('btn-refresh')}`, is left alone — but a *template* literal there, e.g. `${escapeHtml(`${a} · ${b} AIU`)}`, is still recovered, since a template literal builds display text while a plain quoted string is routinely a lookup key/id), checking each recovered literal on its own so one non-prose branch can't suppress another genuine one
4. Print a console report grouped by file, with line numbers and snippets
5. Write the same findings to hardcoded-strings-report.md at the repo root
6. Set process.exitCode = 0 rather than forcing process.exit() — this script informs, it does not gate, and letting the process exit naturally avoids truncating buffered output when piped (e.g. in CI or --json | ...). Any unexpected error during the scan is caught and logged to stderr rather than crashing with a non-zero exit code, preserving that contract.