getTokenIndexes puts the section token into a regex unescaped

[Jamie-BitFlight]

What happens

src/readme-editor.ts, getTokenIndexes:

const startRegExp = new RegExp(startTokenFormat.replace('%s', token));
const stopRegExp = new RegExp(endTokenFormat.replace('%s', token));

The token is inserted raw. Any regex metacharacter in it changes the pattern.

Example in this repo

README.md and README.example.md carry <!-- start [.github/ghadocs/examples/] --> markers. In the pattern, [...] becomes a character class and . matches any character, so those markers can never match themselves.

Impact today

None reachable: every name in README_SECTIONS is plain letters. It becomes live the moment a section name carries ., [, ( or similar, and scripts/verify-readme-contract.mjs builds its patterns the same way.

Suggested direction

Escape the token before building the pattern, in the editor and in the verifier alike.

[Jamie-BitFlight]

Groomed

Reproduced on main: updating a section named a.b rewrites the axb section. No real run reaches this today, because every README_SECTIONS name is plain letters. Ships in PR A, since PR A rewrites the pattern builder anyway.

Acceptance criteria

• The token is regex-escaped before it goes into the start and end patterns. This applies in src/readme-editor.ts and in scripts/verify-readme-contract.mjs.
• A test checks that a.b does not match axb, and that [x] matches only the literal [x].

---

Generated by Claude Code

[Jamie-BitFlight]

🎉 This issue has been resolved in version 2.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀