studio-engine 0.65.2 → 0.65.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7389678882ebbd2bba6a35738f330283a2e5a226e68009a76b83f0c14b0e1351
-  data.tar.gz: de1b1a74888a3c2e47cc39da0377323c1b51c04d1aa718de9826fc338aff13a8
+  metadata.gz: 8ed062df7a9840a9633eb1c4995bc878bee401f98d85086e7943c5ec9f6b55d4
+  data.tar.gz: df0c1c7dc4e13185b3c8e3fbe7cb9243f4b310398843c43913ef0a1aa7b03762
 SHA512:
-  metadata.gz: f2c671579063631d50ac0298f2812ccde9a32a4554cc85ecf2b23368a8f51d2027f4eb03ed748c87104b7b68c9150d4fa7accec288d6b1a545ddf6233c755847
-  data.tar.gz: f2a53ef58b2bc5959d3a0c420f0cb8619b448caf496b9b437cd70e4f79ca5d8652e482338f2472ad3fd3f4b2609c0e5c47e8f0c7da3ca44d4d7b9e9828cb4f80
+  metadata.gz: ca97a89b5c1452bad931ec0a332e9fff228ea43b7ebe2249516b3f60b9bf79f03fcb3171a66c5b8c7692e25389ac15d24a8c70b0176a82921fee80b2dd80a06e
+  data.tar.gz: 97061141650afc6472e15bcaf40dc96c5175897a25f6d4aea5cfb318dd1d92100db6cb1aa52c3feb4a018fe93bb924485fdee7fe97d5989a7779dfb0959b03c0

data/CHANGELOG.md

@@ -6,6 +6,44 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Added
 
+- **A green comment-leak scan used to mean "not looked at".**
+  `test/views/erb_comment_leak_test.rb` guards the ERB comment form in
+  `app/views/**/*.erb`. It never looked inside `<script>`, and that is where this
+  gem keeps its browser programs — `studio/modals/_host`,
+  `studio/solana/_phantom_deeplink`, `layouts/studio/_head` and the modal blocks
+  between them hold **1_239 JavaScript comments, 73_913 bytes of comment body**,
+  none of it read by any guard. A review of a diff made almost entirely of those
+  comments came back green, and the reviewer's note was the honest reading of it:
+  *"don't read that green as clearance."*
+
+  `test/views/script_comment_leak_test.rb` reads them. The rule is the one the ERB
+  guard applies — no ERB open or close sequence inside a comment body — and the
+  mechanism it defends against is worse than the ERB one. A tag quoted inside an
+  ERB comment is inert, because the comment swallows it. A tag quoted inside a
+  **JavaScript** comment is not inside anything ERB knows about, so ERB opens a tag
+  right there and **runs** it: a complete tag evaluates at render, and an
+  incomplete one swallows every byte up to the next close sequence in the file,
+  deleting working JavaScript with no syntax error to show for it. Wrapping the
+  line in an HTML comment does not help — ERB runs inside those too. Describing the
+  tag in words stays legal, exactly as it is for ERB comments.
+
+  **Finding a comment is the hard half, and the first cut of this got it wrong.**
+  Anchoring `<script>` blocks on raw source let an ERB comment's *prose mention* of
+  a script tag open the block: `studio/_board_assets.html.erb` reported 19_512
+  bytes of markup as JavaScript and never saw its real program on its own terms.
+  Blocks are now anchored on a copy with ERB tags and HTML comments blanked out,
+  length preserved so offsets and line numbers still land. Inside a block the
+  walker tracks the states that can hide a comment opener — a string
+  (`"https://…"` is not a comment), a template literal, a regex (`/\/\//`) — and a
+  literal or comment that never closes is REPORTED rather than absorbed, because a
+  walker that quietly lost its place is the same green as a clean file. The
+  assertions check the input as well as the verdict: how many blocks, comments and
+  bytes the scan actually reached, and that every block it opened matches a real
+  closing tag.
+
+  Zero findings across the engine at `origin/accepted`, so this lands green with no
+  allowlist.
+
 - **`data-pin` — the pinned stack publishes itself.** `--nav-h` / `--nav-bottom`
   answer for one element. Everything else that pins has been re-deriving the
   same geometry by hand: on `mcritchie-studio`'s `/deployments` the app strip

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.65.2"
+  VERSION = "0.65.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.65.2
+  version: 0.65.3
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-28 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails