Best possible solution:

Keep the PR open for ordinary maintainer review and merge once required repository gates are satisfied, preserving the narrow literal-RegExp escape contract rather than broadening semantics.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR is a refactor cleanup, not a reported runtime bug. The relevant check is source-level equivalence of the escaping helper across touched script call sites.

Is this the best way to solve the issue?

Yes, for this cleanup: a scripts-owned .mjs helper plus reuse of the existing core TS helper keeps the runtime boundaries narrow while removing duplicated local helpers. Broader alternatives such as adopting RegExp.escape or changing character-class/replacement-string semantics would be unnecessary behavior changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5ea4b412a8e8.

Label changes:

• add P3: This is a low-risk internal scripts cleanup with no user-facing behavior, config, provider, session, or channel impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor real behavior proof gate does not apply because this is a MEMBER-authored maintainer PR; the PR body still reports focused tests, formatting, Testbox changed gate, and autoreview evidence.

Label justifications:

• P3: This is a low-risk internal scripts cleanup with no user-facing behavior, config, provider, session, or channel impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor real behavior proof gate does not apply because this is a MEMBER-authored maintainer PR; the PR body still reports focused tests, formatting, Testbox changed gate, and autoreview evidence.

PR surface:

Other -10. Total -10 across 11 files.

What I checked:

• Live PR state: Live GitHub state shows this PR is open, authored by a repository MEMBER, labeled maintainer, mergeable, and based on current main; protected maintainer cleanup should not be auto-closed by this review. (11afce80e409)
• Diff contract: The PR adds scripts/lib/regexp.mjs with the same literal RegExp-constructor replacement expression used by the current duplicated helpers, then swaps touched call sites to import it. (scripts/lib/regexp.mjs:1, 11afce80e409)
• Core helper parity: Current main already exposes the same escapeRegExp replacement expression from the core TS helper, which supports the scripts/release-check.ts import direction in the PR. (src/shared/regexp.ts:2, 5ea4b412a8e8)
• Current duplicated script helpers: Current main has repeated script-local RegExp escaping helpers in audit, deprecated API guard, E2E, GitHub automation, release closeout, runtime-postbuild, and dependency risk-report paths, matching the cleanup target. (5ea4b412a8e8)
• Adjacent tests: Existing test mapping covers touched scripts such as Barnacle auto-response, real behavior proof policy, runtime postbuild, stable release closeout, transitive manifest risk reporting, OpenWebUI probe, and mock OpenAI server; the PR body also reports focused Vitest, formatting, Testbox changed gate, and autoreview proof. (scripts/test-projects.test-support.mjs:676, 5ea4b412a8e8)
• Related item search: GitHub search found only this PR for the exact regexp literal escaping cleanup and no canonical issue or superseding PR for the same work.

Likely related people:

• vincentkoc: Recent commits maintain the release, proof-policy, dependency risk-report, and E2E probe scripts that this PR touches. (role: recent area contributor; confidence: high; commits: 2800e8ecb621, e913e0739d61, d6075c1694ea; files: scripts/release-check.ts, scripts/e2e/openwebui-probe.mjs, scripts/transitive-manifest-risk-report.mjs)
• steipete: Recent script documentation and broad refactor commits touched several of the affected script surfaces, including audit, deprecated API, and release helper paths. (role: recent scripts contributor; confidence: high; commits: c8bb7330b5cf, 978fdd7d2a84, b8d08f0cfd0c; files: scripts/audit-seams.mjs, scripts/check-deprecated-api-usage.mjs, scripts/release-check.ts)
• RomneyDa: The author also has merged current-main history in nearby cleanup/refactor work and a prior Barnacle automation fix, so routing them as an area participant is supported beyond this PR alone. (role: recent adjacent contributor; confidence: medium; commits: 6b52dff22d5f, 5ea4b412a8e8, febc70036f29; files: scripts/github/barnacle-auto-response.mjs, scripts/, src/)
• Takhoffman: Earlier merged work expanded the audit-seams script and Barnacle proof-label behavior, which are both part of this cleanup surface. (role: historical audit and automation contributor; confidence: medium; commits: 5cd8d43af923, 50d996a6ec7c, 9968db65db76; files: scripts/audit-seams.mjs, scripts/github/barnacle-auto-response.mjs)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.