Allow static theme asset script URLs in app doctor

[francisbeaudoin]

What changed

• Allow the UNSAFE_INNERHTML Liquid check to skip literal theme asset script URLs like {{ 'chat.js' | asset_url }}.
• Keep dynamic script asset URLs flagged, including {{ block.settings.script | asset_url }}.
• Add a changeset for the App Doctor false-positive fix.

Testing

• pnpm vitest packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts --run
• pnpm eslint packages/app/src/cli/services/app-doctor-engine/rules/liquid-rules.ts packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts

[Copilot]

🟢 Approval recommended

The behavior change is narrowly scoped, includes targeted test coverage, and preserves detection for dynamic script URLs.

Pull request overview

Updates the App Doctor Liquid security scanning to avoid flagging <script src> tags that load a static theme asset URL (a quoted literal piped to asset_url), reducing false positives while still flagging dynamic/merchant-controlled script URLs.

Changes:

• Add a isStaticScriptAssetUrl guard to skip UNSAFE_INNERHTML findings for <script src="{{ 'literal.js' | asset_url }}">.
• Extend Liquid AST analysis tests to cover the static-asset allowance and keep dynamic asset_url cases flagged.
• Add a patch changeset documenting the false-positive fix.

File summaries

File	Description
packages/app/src/cli/services/app-doctor-engine/rules/liquid-rules.ts	Skips UNSAFE_INNERHTML for literal asset_url script src outputs to prevent false positives.
packages/app/src/cli/services/app-doctor-engine/tests/rule-analysis.test.ts	Adds coverage ensuring static asset_url script tags are allowed while dynamic ones remain flagged.
.changeset/quiet-assets-repair.md	Records the user-facing App Doctor false-positive fix as a patch release.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.