@agent-native/core 0.80.4 → 0.80.6

package/corpus/templates/design/app/lib/design-systems.ts

@@ -224,8 +224,10 @@ export const DESIGN_SYSTEM_PRESETS: DesignSystemPreset[] = [
   },
 ];
 
-export function getPreset(id: string): DesignSystemPreset {
-  return (
-    DESIGN_SYSTEM_PRESETS.find((p) => p.id === id) || DESIGN_SYSTEM_PRESETS[0]
-  );
+export function getPreset(id: string): DesignSystemPreset | undefined {
+  return DESIGN_SYSTEM_PRESETS.find((p) => p.id === id);
+}
+
+export function getPresetOrDefault(id: string): DesignSystemPreset {
+  return getPreset(id) ?? DESIGN_SYSTEM_PRESETS[0];
 }

package/corpus/templates/design/app/lib/design-templates.ts

@@ -174,9 +174,21 @@ function sanitizeFontStack(value: unknown, fallback: string): string {
   if (typeof value !== "string") return fallback;
   const cleaned = value.replace(/[;{}<>]/g, "").trim();
   if (!cleaned) return fallback;
-  if (cleaned.includes(",")) return cleaned;
-  const unquoted = cleaned.replace(/["']/g, "");
-  return `"${unquoted}", ${fallback}`;
+  // Accept only font stacks composed of quoted or unquoted font family names.
+  // Each family name may be a quoted string or unquoted alphanumeric words/hyphens/underscores.
+  // This rejects unbalanced parentheses, slashes, and other CSS-injection vectors.
+  const fontFamilyPattern =
+    /^"[^"]*"|'[^']*'|[a-zA-Z0-9 \-_]+(?:\s+[a-zA-Z0-9 \-_]+)*/;
+  const fontStackPattern = new RegExp(
+    `^(${fontFamilyPattern.source})(,\\s*(${fontFamilyPattern.source}))*$`,
+  );
+  if (fontStackPattern.test(cleaned)) return cleaned;
+  // Single unquoted name: wrap in quotes and append fallback.
+  const singleName = cleaned.replace(/["']/g, "").trim();
+  if (/^[a-zA-Z0-9 \-_]+$/.test(singleName)) {
+    return `"${singleName}", ${fallback}`;
+  }
+  return fallback;
 }
 
 function sanitizeRadius(value: unknown, fallback: number): number {