@drafthq/draft 3.7.2 → 5.0.1

package/scripts/tools/okf-render-views.sh

@@ -226,7 +226,7 @@ render_architecture() {
     if [[ -x "$SCRIPT_DIR/okf-fix-links.sh" ]]; then
         draft_dir="$(cd "$(dirname "$out")" && pwd)"
         if [[ -d "$draft_dir/wiki" || "$(basename "$BUNDLE")" == "wiki" ]]; then
-            "$SCRIPT_DIR/okf-fix-links.sh" --file "$out" --wiki "$BUNDLE" --fix >/dev/null 2>&1 || true
+            "$SCRIPT_DIR/okf-fix-links.sh" --file "$out" --wiki "$BUNDLE" --fix >/dev/null 2>&1 || exit 1
         fi
     fi
     echo "rendered architecture view → $out ($(ordered_pages | grep -c . ) pages)"
@@ -411,13 +411,15 @@ function resolve(base, href){
     if(p==='..') out.pop(); else if(p!=='.'&&p!=='') out.push(p); }
   return out.join('/');
 }
+function escAttr(s){return esc(s).replace(/"/g,'"');}
 function inline(s, base){
   s = s.replace(/`([^`]+)`/g, function(m,c){return '<code>'+esc(c)+'</code>';});
   s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, function(m,t,u){
-    if(/^[a-z]+:\/\//.test(u)) return '<a href="'+u+'" target="_blank" rel="noopener">'+t+'</a>';
+    if(/^(https?|mailto):/i.test(u)) return '<a href="'+escAttr(u)+'" target="_blank" rel="noopener">'+t+'</a>';
+    if(/^[a-z][a-z0-9+.-]*:/i.test(u)) return t;
     var key=resolve(base,u);
     if(PAGES[key]) return '<a href="#'+key+'" data-nav="'+key+'">'+t+'</a>';
-    return '<span title="'+esc(u)+'">'+t+'</span>';
+    return '<span title="'+escAttr(u)+'">'+t+'</span>';
   });
   s = s.replace(/\*\*([^*]+)\*\*/g,'<strong>$1</strong>');
   s = s.replace(/(^|[^*])\*([^*\n]+)\*/g,'$1<em>$2</em>');
@@ -438,7 +440,7 @@ function render(md, base){
     out+='<table>';
     rows.forEach(function(r,ri){
       var cells=r.replace(/^\||\|$/g,'').split('|');
-      out+='<tr>'+cells.map(function(c){var t=ri===0?'th':'td';return '<'+t+'>'+inline(c.trim(),base)+'</'+t+'>';}).join('')+'</tr>';
+      out+='<tr>'+cells.map(function(c){var t=ri===0?'th':'td';return '<'+t+'>'+inline(esc(c.trim()),base)+'</'+t+'>';}).join('')+'</tr>';
     });
     out+='</table>'; tbl=[];
   }

package/scripts/tools/okf-validate.sh

@@ -252,6 +252,11 @@ if [[ -n "$PATH_INDEX" ]]; then
         # span lines and a line-oriented match would silently skip them.
         while IFS= read -r ref; do
             [[ -z "$ref" ]] && continue
+            case "$ref" in
+                /*|*..*)
+                    add_error "path-index escapes the bundle: $ref"
+                    continue ;;
+            esac
             if [[ ! -f "$BUNDLE/$ref" ]]; then
                 add_error "path-index references missing concept page: $ref"
             fi

package/scripts/tools/resolve-tools.sh

@@ -53,8 +53,10 @@ resolve() {
   # 2. Install marker written by `draft install` (authoritative).
   local marker="$HOME/.cache/draft/plugin-root"
   if [ -f "$marker" ]; then
-    d="$(cat "$marker" 2>/dev/null)/scripts/tools"
-    [ -d "$d" ] && { printf '%s' "$d"; return 0; }
+    local root
+    root="$(cat "$marker" 2>/dev/null || true)"
+    d="${root}/scripts/tools"
+    [ -n "$root" ] && [ -d "$d" ] && { printf '%s' "$d"; return 0; }
   fi
 
   # 3. ${CLAUDE_PLUGIN_ROOT} — set in hook/MCP contexts; harmless to probe.
@@ -66,7 +68,7 @@ resolve() {
   if command -v jq >/dev/null 2>&1 && [ -f "$reg" ]; then
     local ip
     ip="$(jq -r '.plugins | to_entries[] | select(.key|startswith("draft@")) | .value[0].installPath' \
-          "$reg" 2>/dev/null | head -1)"
+          "$reg" 2>/dev/null | head -1 || true)"
     [ -n "$ip" ] && [ -d "$ip/scripts/tools" ] && { printf '%s' "$ip/scripts/tools"; return 0; }
   fi
 

package/scripts/tools/scan-markers.sh

@@ -78,7 +78,15 @@ emit_array() {
     local first=true
     printf '['
     while IFS= read -r _ln; do
-        path="${_ln%%:*}"; rest="${_ln#*:}"; linenum="${rest%%:*}"; rest="${rest#*:}"
+        # Path may contain colons (e.g. src/foo:bar.js). The line number is the
+        # last :<digits>: separator git-grep/rg -n emit.
+        if [[ "$_ln" =~ ^(.+):([0-9]+):(.*)$ ]]; then
+            path="${BASH_REMATCH[1]}"
+            linenum="${BASH_REMATCH[2]}"
+            rest="${BASH_REMATCH[3]}"
+        else
+            continue
+        fi
         [[ -z "$path" || -z "$linenum" ]] && continue
         # Skip binaries or tool's own output directory.
         [[ "$path" == */.git/* ]] && continue

package/scripts/tools/verify-graph-binary.sh

@@ -137,12 +137,24 @@ fi
 
 STATUS="ok"
 
+# The wrappers are verified against the pinned DEFAULT_VERSION. Another version
+# (e.g. a global install on PATH, which outranks the managed one) stays usable,
+# but may speak a different dialect or CLI — say so rather than run it silently.
+VERSION="$("$MEMORY_BIN" --version 2>/dev/null | awk '{print $NF}')"
+PINNED="$(sed -n 's/^DEFAULT_VERSION="v\{0,1\}\([^"]*\)".*/\1/p' "$SELF_REPO/scripts/fetch-memory-engine.sh" 2>/dev/null | head -1)"
+if [[ -n "$PINNED" && "$VERSION" != "$PINNED" ]]; then
+  echo "WARNING: engine version $VERSION differs from the pinned $PINNED that Draft's graph tools are verified against." >&2
+  echo "         Install the pinned engine: scripts/fetch-memory-engine.sh --force" >&2
+fi
+
 if [[ $EMIT_JSON -eq 1 ]]; then
-  printf '{"status":"%s","engine_bin":"%s","source":"%s","arch":"%s"}\n' \
-    "$(json_escape "$STATUS")" "$(json_escape "$MEMORY_BIN")" "$(json_escape "$SOURCE")" "$(json_escape "$ARCH")"
+  printf '{"status":"%s","engine_bin":"%s","source":"%s","arch":"%s","version":"%s","pinned_version":"%s"}\n' \
+    "$(json_escape "$STATUS")" "$(json_escape "$MEMORY_BIN")" "$(json_escape "$SOURCE")" "$(json_escape "$ARCH")" \
+    "$(json_escape "$VERSION")" "$(json_escape "$PINNED")"
 else
   echo "Draft graph engine: $MEMORY_BIN"
   echo "  source: $SOURCE (arch=$ARCH)"
+  echo "  version: $VERSION (pinned: ${PINNED:-unknown})"
   echo "  status: $STATUS"
 fi
 

package/skills/draft/intent-mapping.md

@@ -27,7 +27,7 @@ Draft commands can be invoked using natural language. If you describe your goal
 | "debug this issue", "investigate test failure", "fix crash" | `/draft:debug` | Structured 4-stage debugging workflow |
 | "deploy checklist", "release checks", "pre-flight checks" | `/draft:deploy-checklist` | Pre-deployment verification checklist |
 | "test strategy", "design test suite", "testing targets" | `/draft:testing-strategy` | Design standard testing plan |
-| "tech debt analysis", "catalog debt", "code debt" | `/draft:tech-debt` | Technical debt audit across 6 dimensions |
+| "tech debt analysis", "catalog debt", "code debt" | `/draft:tech-debt` | Technical debt audit across 7 dimensions |
 | "weekly standup", "what did I do today", "activity summary" | `/draft:standup` | Summarize recent Git and file contributions |
 | "incident", "production outage", "mitigate bug" | `/draft:incident-response` | Triage, mitigation, and postmortem incident flow |
 | "write docs", "create readme", "api documentation" | `/draft:documentation` | Generate professional, structured docs |

package/skills/implement/SKILL.md

@@ -671,7 +671,7 @@ After a phase passes review, refresh `metadata.json.impact` so future tracks can
    "$DRAFT_TOOLS/graph-impact.sh" --repo . --file <path>
    ```
 
-   Aggregate across all files: `downstream_files` = total unique downstream files (deduped), `downstream_modules` = union of `affected_modules`, `max_depth` = max across queries, `by_category` = sum of each query's `by_category`. If the graph is absent, leave these fields as zeros / empty arrays — the snapshot still records the directly-touched files.
+   Aggregate across all files: `downstream_files` = count of the union of each query's `downstream_files` array, `downstream_modules` = union of `affected_modules`, `max_depth` = max across queries, `by_category` = sum of each query's `by_category`. If the graph is absent, leave these fields as zeros / empty arrays — the snapshot still records the directly-touched files.
 
 3. **Write metadata.json** with the populated `impact` block and `computed_at` set to the current timestamp.