@gcunharodrigues/wrxn 0.18.1 → 0.18.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/hooks/sidecar.cjs

@@ -43,7 +43,7 @@ const SIDECAR_EXTRA = [
   // OR bare (password=) — never a lone trailing quote, so a path ending in "passwd" used as a JSON key
   // (e.g. "../../etc/passwd": …) is NOT misread as an assignment (it would falsely refuse a sidecar write).
   /(?:["'](?:password|passwd|pwd)["']|(?:password|passwd|pwd))\s*[:=]\s*["']?[^\s"',;)&}{]+/i,
-  /[a-z][a-z0-9+.\-]+:\/\/[^\s:/@]+:[^\s/@]+@\S+/i, // URI connection string with inline creds (scheme://user:pass@host)
+  /[a-z][a-z0-9+.\-]{1,19}:\/\/[^\s:/@]+:[^\s/@]+@\S+/i, // URI connection string with inline creds (scheme://user:pass@host); scheme bounded {1,19} so a long letter-run fails fast — no O(n²) backtrack (#66)
   /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/, // JWT (eyJ header; shorter min than the canonical JWT)
 ];
 const SECRET_PATTERNS = [...SECRET_PATTERNS_CANON, ...SIDECAR_EXTRA];

package/payload/.claude/hooks/wiki-lint.cjs

@@ -65,6 +65,27 @@ function pageBody(text) {
   return end < 0 ? '' : src.slice(end + 4);
 }
 
+// Fenced code blocks (``` or ~~~) hold ILLUSTRATIVE text — a [[slug]] written there as example syntax is
+// not a navigable wikilink, so it must not be checked for a dead target (#28). Strip whole fenced regions
+// before the scan. Line-based + anchored (`^\s{0,3}` … `{3,}`) so it stays linear — no backtracking,
+// mirroring wikilinkTargets' own ReDoS discipline. A fence closes only on the SAME marker char with no
+// trailing info; an unclosed fence runs to end-of-body (CommonMark), so its content stays stripped.
+function stripFencedCode(body) {
+  const kept = [];
+  let fence = ''; // '`' or '~' while inside a fenced block; '' when outside
+  for (const line of String(body || '').split('\n')) {
+    const m = /^\s{0,3}(`{3,}|~{3,})/.exec(line);
+    if (!fence) {
+      if (m) fence = m[1][0]; // open: drop the fence line, enter the block
+      else kept.push(line);
+    } else if (m && m[1][0] === fence && line.slice(m[0].length).trim() === '') {
+      fence = ''; // close: drop the fence line, leave the block
+    }
+    // a line inside a block (including the fences) is dropped
+  }
+  return kept.join('\n');
+}
+
 // Wikilinks are written `[[slug]]` (Obsidian style), where slug equals a target page's `name:`. An
 // optional `|alias` or `#anchor` is stripped to the bare target slug. Returns the distinct slugs.
 // The inner class excludes BOTH `]` and `[`: a real `[[slug]]` target never contains `[`, and the
@@ -74,7 +95,12 @@ function wikilinkTargets(body) {
   const out = new Set();
   const re = /\[\[([^\]\[]+)\]\]/g;
   let m;
-  while ((m = re.exec(String(body || '')))) {
+  // Strip fenced regions, THEN inline code spans (`…`): a [[slug]] in either is illustrative example syntax,
+  // not a navigable link, so it must not be checked for a dead target (#28). The inline pass uses disjoint
+  // adjacent classes (`+ / [^`\n] / `+) so it stays linear — no backtracking, per this file's ReDoS discipline;
+  // `\n` in the class keeps a span single-line so a stray backtick can't swallow real prose links below it.
+  const scannable = stripFencedCode(body).replace(/`+[^`\n]*`+/g, '');
+  while ((m = re.exec(scannable))) {
     const slug = m[1].split('|')[0].split('#')[0].trim();
     if (slug) out.add(slug);
   }