fix(executor): step over comments instead of reading them as tokens

Treating a comment end as the answer was too blunt: `/* c */ if (x)` is a
control-flow head, and calling it a method left a statement-position regex
scanned as division — the failure the comment guard was added to prevent,
moved one shape over. The scan now steps back over comments to the token
that precedes them, so the dot in `p./* c */catch(fn)` is still found and
a keyword after a comment is still a head.

A condition's environment read is placed the same way references are: an
occurrence inside a string, a template, or a regex is text and mounts
nothing, while any executable read — whatever its shape — keeps the map.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/variables/resolver.test.ts

@@ -280,6 +280,33 @@ describe('VariableResolver function block inputs', () => {
     expect(resolvedConditions[1].value).toContain('environmentVariables.OPENAI_API_KEY')
   })
 
+  it('counts an environment read only where it can execute', async () => {
+    const { ctx, resolver } = createResolver()
+    const conditionBlock = createBlock('condition', 'Condition', BlockType.CONDITION)
+    const conditions = [
+      // Reads, in the shapes a pattern would have to anticipate.
+      { id: 'c1', title: 'if', value: `environmentVariables?.FLAG === 'on'` },
+      { id: 'c2', title: 'else if', value: 'Object.keys(environmentVariables).length > 0' },
+      // Mentions: text, not code.
+      { id: 'c3', title: 'else if', value: `'environmentVariables.FLAG' === 'x'` },
+      { id: 'c4', title: 'else if', value: '`environmentVariables` === "x"' },
+      { id: 'c5', title: 'else if', value: `/environmentVariables/.test('x')` },
+    ]
+
+    const result = await resolver.resolveInputs(
+      ctx,
+      conditionBlock.id,
+      { conditions: JSON.stringify(conditions) },
+      conditionBlock
+    )
+
+    expect(
+      (result.conditions as Array<Record<string, unknown>>).map(
+        (condition) => condition._readsEnvironmentVariables
+      )
+    ).toEqual([true, true, false, false, false])
+  })
+
   it('preserves legacy condition outcomes end to end through the boundary compiler', async () => {
     const environmentVariables = {
       API_KEY: 'token',
@@ -947,6 +974,28 @@ describe('VariableResolver function block inputs', () => {
     expect(code).toContain(`Number('' + JSON.stringify(globalThis["__blockRef_1"]) + '')`)
   })
 
+  it('steps over a comment rather than reading it as the preceding token', async () => {
+    const { block, ctx, resolver } = createResolver('javascript')
+
+    const result = await resolver.resolveInputsForFunctionBlock(
+      ctx,
+      'function',
+      {
+        code: [
+          `/* lead */ if (params.a) /['"]/.test('<producer.result>')`,
+          `const n = params.p./* mid */catch(() => 0) / 2 + Number('<producer.result>')`,
+        ].join('\n'),
+      },
+      block
+    )
+
+    // A comment before a control-flow keyword leaves it a head; one hiding a property dot
+    // still leaves the call a call.
+    const code = result.resolvedInputs.code as string
+    expect(code).toContain(`.test('' + JSON.stringify(globalThis["__blockRef_0"]) + '')`)
+    expect(code).toContain(`Number('' + JSON.stringify(globalThis["__blockRef_1"]) + '')`)
+  })
+
   it('does not read a method named after a keyword as a control-flow head', async () => {
     const { block, ctx, resolver } = createResolver('javascript')
 

apps/sim/executor/variables/resolver.ts

@@ -46,7 +46,7 @@ import type { SerializedBlock, SerializedWorkflow } from '@/serializer/types'
 export const CONDITION_READS_ENVIRONMENT_KEY = '_readsEnvironmentVariables'
 
 /** The sandbox global holding the run's secrets, in whatever shape an expression reaches it. */
-const ENVIRONMENT_MAP_IDENTIFIER = /\benvironmentVariables\b/
+const ENVIRONMENT_MAP_IDENTIFIER = /\benvironmentVariables\b/g
 
 /** Key used to carry pre-resolved context variables through the inputs map. */
 export const FUNCTION_BLOCK_CONTEXT_VARS_KEY = '_runtimeContextVars'
@@ -362,7 +362,7 @@ export class VariableResolver {
               // the environment map is indistinguishable from one that merely quotes trigger
               // data containing the word, and the handler decides what to mount from this.
               [CONDITION_READS_ENVIRONMENT_KEY]:
-                typeof value === 'string' && ENVIRONMENT_MAP_IDENTIFIER.test(value),
+                typeof value === 'string' && this.readsEnvironmentMap(value),
               value:
                 typeof value === 'string'
                   ? await this.resolveTemplateWithoutConditionFormatting(
@@ -1181,6 +1181,28 @@ export class VariableResolver {
     )
   }
 
+  /**
+   * Whether a Condition expression reads the run's secrets off the environment map.
+   *
+   * The name is only a read where it can execute, so each occurrence is placed with the same
+   * scanner that decides how references are spliced — a mention inside a string, a template,
+   * or a regex is text and mounts nothing. No shape of the read itself is assumed:
+   * `environmentVariables?.FLAG` and `Object.keys(environmentVariables)` both count, because
+   * narrowing an expression that does reach the map would route the run down a branch the
+   * author did not write, silently, while admitting one too many only costs the narrowing.
+   */
+  private readsEnvironmentMap(expression: string): boolean {
+    ENVIRONMENT_MAP_IDENTIFIER.lastIndex = 0
+    let match = ENVIRONMENT_MAP_IDENTIFIER.exec(expression)
+    while (match !== null) {
+      if (this.getCodeStringQuoteContext(expression, match.index, 'javascript') === null) {
+        return true
+      }
+      match = ENVIRONMENT_MAP_IDENTIFIER.exec(expression)
+    }
+    return false
+  }
+
   /**
    * Whether the `(` at this index opens a control-flow head rather than a value.
    *
@@ -1204,19 +1226,27 @@ export class VariableResolver {
 
     // `p.catch(fn)` is a method call whose name happens to be a keyword, and what follows its
     // `)` is an operator, not a statement. A control-flow head can never be a property access,
-    // and a comment can hide the dot (`p./* c */catch(fn)`), so a comment ending here is read
-    // as the method call it usually is: the wrong guess there costs a division scanned as a
-    // regex, while this way it costs nothing a regex-free line would notice.
-    let before = start
-    while (before > 0 && WHITESPACE_CHAR.test(template[before - 1])) {
-      before--
-    }
-    if (template[before - 1] === '/' && template[before - 2] === '*') {
-      return false
+    // and a comment can stand between the two (`p./* c */catch(fn)`), so a comment is stepped
+    // over rather than treated as an answer — `/* c */ if (x)` is still a head.
+    let before = this.skipWhitespaceBackward(template, start)
+    while (template[before - 1] === '/' && template[before - 2] === '*') {
+      const opening = template.lastIndexOf('/*', before - 2)
+      if (opening < 0) {
+        return true
+      }
+      before = this.skipWhitespaceBackward(template, opening)
     }
     return template[before - 1] !== '.'
   }
 
+  private skipWhitespaceBackward(template: string, index: number): number {
+    let cursor = index
+    while (cursor > 0 && WHITESPACE_CHAR.test(template[cursor - 1])) {
+      cursor--
+    }
+    return cursor
+  }
+
   private matchesKeywordAt(template: string, index: number, keyword: string): boolean {
     if (!template.startsWith(keyword, index)) {
       return false