From 8bb1d7b7913f331f28422d6a07ee39161bc8c792 Mon Sep 17 00:00:00 2001
From: Leonard <leonard@hermes.local>
Date: Sat, 15 Aug 2026 17:54:03 +0000
Subject: [PATCH] fix(auditing): reject call-tracking placeholders in website
 phone extraction

_valid_phone() rejects all-same-digit numbers (999-999-9999, 000-000-0000)
that call-tracking widgets emit before they are wired; _phone_from_text now
scans past an invalid first match instead of returning it. Selftest covers
placeholder rejection and visible-text-wins-over-tel: semantics.
---
 implementation/auditing/multi_scraper.py | 28 +++++++++++++++++++-----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/implementation/auditing/multi_scraper.py b/implementation/auditing/multi_scraper.py
index d912f6b..b3ef609 100644
--- a/implementation/auditing/multi_scraper.py
+++ b/implementation/auditing/multi_scraper.py
@@ -130,16 +130,26 @@ async def scrape_google(query, coords, business=""):
     return None
 
 
+def _valid_phone(num):
+    """10 US digits, not an all-same-digit placeholder (999-999-9999, the
+    value call-tracking widgets emit before they're wired)."""
+    d = re.sub(r"\D", "", num)
+    return len(d) == 10 and len(set(d)) > 1
+
+
 def _phone_from_text(text):
-    """First standalone US phone number in rendered text.
+    """First standalone, non-placeholder US phone number in rendered text.
 
     Lookarounds reject a phone-like substring glued to other digits (the
-    raw-HTML path that previously returned JS artifact numbers).
+    raw-HTML path that previously returned JS artifact numbers);
+    _valid_phone rejects all-same-digit call-tracking placeholders.
     """
-    m = re.search(r"(?<!\d)(\(\d{3}\)\s*\d{3}[-.]\d{4})(?!\d)", text)
-    if not m:
-        m = re.search(r"(?<!\d)(\d{3}[-.]\d{3}[-.]\d{4})(?!\d)", text)
-    return m.group(1) if m else None
+    for pat in (r"(?<!\d)(\(\d{3}\)\s*\d{3}[-.]\d{4})(?!\d)",
+                r"(?<!\d)(\d{3}[-.]\d{3}[-.]\d{4})(?!\d)"):
+        for mm in re.finditer(pat, text):
+            if _valid_phone(mm.group(1)):
+                return mm.group(1)
+    return None
 
 
 def _jina_markdown(website_url):
@@ -395,6 +405,12 @@ def _selftest():
     # JS artifact: phone-like substring glued to other digits -> reject
     assert _phone_from_text("var id=1234567890123;") is None
     assert _phone_from_text("no numbers here") is None
+    # call-tracking placeholder (all-same digit) -> reject
+    assert _phone_from_text("Call (999) 999-9999 now") is None
+    # visible text wins over tel: href (audit semantics: report what's displayed;
+    # tel: vs visible discrepancies are audit FINDINGS, not extraction noise)
+    txt = 'Call: (916) 238-3838 <a href="tel:9165716448">call</a>'
+    assert _phone_from_text(txt) == "(916) 238-3838"
     print("[SELFTEST] phone extraction: PASS")