@arnilo/prism-coding-agent 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.1] - 2026-08-29
+
+### Changed
+- Plan 035-039 changed-package cut: additive runtime performance, tooling, and documentation deltas; peer window refresh.
+
 ## [0.3.0] - 2026-08-20
 
 ### Added

package/dist/coding-checkpoint.js

@@ -16,7 +16,35 @@ export const CODING_STATE_KEY = "coding";
 const SHA256_HEX = /^[a-f0-9]{64}$/;
 const TASK_ID = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
 const BRANCH = /^[^\s]{1,255}$/;
-const TODO_LINE = /^\s*[-*]\s+\[([ xX])\]\s+(.+?)\s*$/;
+// Linear todo-line scanner replaces `/^\s*[-*]\s+\[([ xX])\]\s+(.+?)\s*$/` (CodeQL js/polynomial-redos, alert 4)
+function parseTodoLine(line) {
+    let i = 0;
+    while (i < line.length && /\s/.test(line[i]))
+        i += 1;
+    if (line[i] !== "-" && line[i] !== "*")
+        return undefined;
+    i += 1;
+    while (i < line.length && /\s/.test(line[i]))
+        i += 1;
+    if (line[i] !== "[")
+        return undefined;
+    i += 1;
+    const doneChar = line[i];
+    if (doneChar !== "x" && doneChar !== "X" && doneChar !== " ")
+        return undefined;
+    i += 1;
+    if (line[i] !== "]")
+        return undefined;
+    i += 1;
+    while (i < line.length && /\s/.test(line[i]))
+        i += 1;
+    let end = line.length;
+    while (end > i && /\s/.test(line[end - 1]))
+        end -= 1;
+    if (end <= i)
+        return undefined;
+    return { done: doneChar.toLowerCase() === "x", raw: line.slice(i, end) };
+}
 const FORBIDDEN_METADATA_KEYS = new Set([
     "credentials",
     "credential",
@@ -123,17 +151,32 @@ export function parseCodingPlanTodos(markdown, limits) {
     assertByteLimit("plan", markdown, resolved.maxPlanBytes);
     const todos = [];
     for (const line of markdown.split(/\r?\n/)) {
-        const match = TODO_LINE.exec(line);
+        const match = parseTodoLine(line);
         if (!match)
             continue;
-        const done = match[1].toLowerCase() === "x";
-        const raw = match[2].trim();
+        const done = match.done;
+        const raw = match.raw;
         assertTodoText(raw, resolved.maxTodoTextBytes);
-        const idMatch = /^\[([A-Za-z0-9._-]{1,64})\]\s+(.+)$/.exec(raw);
-        const id = idMatch?.[1] ?? `todo-${todos.length + 1}`;
-        const text = idMatch?.[2] ?? raw;
+        // Linear id-prefix parse replaces `/^\[([A-Za-z0-9._-]{1,64})\]\s+(.+)$/` (CodeQL js/polynomial-redos, alert 5)
+        let id;
+        let text = raw;
+        if (raw.startsWith("[")) {
+            const close = raw.indexOf("]", 1);
+            if (close !== -1) {
+                const candidate = raw.slice(1, close);
+                const after = raw.slice(close + 1);
+                if (candidate.length >= 1 &&
+                    candidate.length <= 64 &&
+                    /^[A-Za-z0-9._-]+$/u.test(candidate) &&
+                    /^\s/u.test(after) &&
+                    after.trim().length > 0) {
+                    id = candidate;
+                    text = after.trim();
+                }
+            }
+        }
         assertTodoText(text, resolved.maxTodoTextBytes);
-        todos.push({ id, text, done });
+        todos.push({ id: id ?? `todo-${todos.length + 1}`, text, done });
         if (todos.length > resolved.maxTodos) {
             throw new CodingCheckpointError(`Plan exceeds ${resolved.maxTodos} todo limit`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-coding-agent",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Optional coding-agent tools (shell, read, write, edit, repo_list, repo_search, glob, delete, move, opt-in Git/check/ask-user-decision, and durable plan/checkpoint helpers) package for Prism.",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,7 +28,7 @@
     "diff": "^9.0.0"
   },
   "peerDependencies": {
-    "@arnilo/prism": "^0.3.0",
+    "@arnilo/prism": "^0.3.1",
     "@arnilo/prism-workflows": "^0.3.0"
   },
   "devDependencies": {