[AksharP5]

Caption editing can miss an entire transcript when a word contains ];. The old normalization also changes literal text such as ,] and rejects JavaScript escapes.

Use Acorn to find the array boundary and decode static data without executing the source. Text, word IDs, timing, and existing JSON/single-quoted syntax are preserved. Executable expressions and malformed input still return an empty transcript.

Fixes #3852.

Verification

• Reproduced five regression failures on upstream before the fix. All 96 caption tests now pass, including malformed input and non-execution checks.
• Real-browser check of parseCaptionComposition with an iframe DOM preserved x ]; y, literal ,] and ,}, hex escapes, escaped quotes, IDs, and timing. An executable initializer was rejected with zero calls.
• Studio typecheck and build, full workspace build, oxlint, oxfmt, and the fallow diff gate pass.

Four files changed. No visual styling or layout changes.

Before

Main imports none of the three words when the first contains ];. Browser regression harness using the actual Studio parser from main (a4a7cbeac) and synthetic fixture data in a live iframe DOM.

After

The same input imports all three words with literal text, IDs, and timing preserved. The harness uses this PR’s parser with the same source and DOM.

[jrusso1020]

The change looks good to me. I'm commenting instead of approving only because the branch conflicts with main. Please rebase and I'll approve.

The conflicts are in packages/studio/package.json and bun.lock: main removed bpm-detective next to where acorn is added. Both are a one-line resolution. It merges cleanly with #3900.

On the change itself:

• packages/studio/src/captions/parser.ts:128-131: letting Acorn find the array boundary (parseExpressionAt, then requiring a ; token) fixes the ];-inside-a-string case from #3852. Like the old regex, it still requires a terminating ;.
• readStaticValue accepts only literals, signed numeric literals, arrays and plain init properties. Getters, methods, shorthand, computed keys, spreads, template literals, regex and bigint all reject the transcript, and nothing is ever evaluated. Object.fromEntries makes a __proto__ key an own property, so there's no prototype risk.
• Adding acorn as a direct Studio dependency doesn't grow the bundle. Studio already ships acorn through @hyperframes/parsers (gsapParserAcorn, scriptShape, etc.), so this just makes the import explicit.

What I ran:

• vitest run src/captions: 94/94 pass.
• Mutation check: with the base parser.ts restored, 6 new cases fail (]; delimiter, ,] text, object-key text, escaped double quotes, hex/Unicode escapes, comments). The rejection cases already passed on main, which is expected because the old code also returned [] for them.

— Rames

[AksharP5]

@jrusso1020 Rebased onto main and resolved both dependency conflicts in packages/studio/package.json and bun.lock. All 96 caption tests, the workspace build, Studio typecheck, lint, and formatting pass. Ready for another look.

[jrusso1020]

Approving at 1f7a5b5. My earlier review only held back for the merge conflict, and the rebase clears it.

• The branch now sits on current main and is mergeable. The conflict in packages/studio/package.json and bun.lock is resolved: the only change in either file is the one-line acorn addition.
• I compared the PR's own patch before and after the rebase. The changes under packages/studio/src/captions are byte-identical to the version I reviewed, so my notes on the change still apply: Acorn finds the array boundary (parser.ts, parseExpressionAt plus a required ;), readStaticValue accepts only static literals, arrays and plain properties, and nothing is evaluated.

What I ran at this head:

• vitest run src/captions/parser.test.ts: 56/56 pass.
• Mutation check: with parser.ts restored from main, the same 6 new cases fail (]; delimiter, ,] text, object-key text, escaped double quotes, hex/Unicode escapes, comments).

— Rames