@hackerrank/astra-cli 0.1.18 → 0.1.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hackerrank/astra-cli",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Minimal zero-dependency AI coding agent for the HackerRank AI Gateway.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -105,7 +105,11 @@ export class Agent {
 
   apiMessages() {
     return this.messages
-      .filter((m) => m.role === "system" || m.role === "user" || m.role === "assistant")
+      .filter(
+        (m) =>
+          (m.role === "system" || m.role === "user") ||
+          (m.role === "assistant" && m.content !== "")
+      )
       .map((m) => ({ role: m.role, content: m.content }));
   }
 
@@ -131,7 +135,7 @@ export class Agent {
       throw err;
     }
     this.lastContextTokens = usage.prompt_tokens;
-    this.add("assistant", content, { usage });
+    if (content !== "") this.add("assistant", content, { usage });
 
     this.onStep({
       step: this.nSteps,

package/src/report.js

@@ -260,7 +260,16 @@ export function buildSummary(runs) {
 export function renderReportHtml(summary) {
   const tplPath = new URL("./report.html", import.meta.url);
   const tpl = fs.readFileSync(tplPath, "utf8");
-  const data = JSON.stringify(summary).replace(/</g, "\\u003c");
+  // The summary includes model trajectory text, which can contain arbitrary
+  // shell output. Escape HTML-sensitive characters before embedding JSON in a
+  // script block so a literal `</script>` cannot terminate it early.
+  const data = JSON.stringify(summary)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/&/g, "\\u0026")
+    .replace(/[\u2028\u2029]/g, (character) =>
+      character === "\u2028" ? "\\u2028" : "\\u2029",
+    );
   if (!tpl.includes("/*__ASTRA_DATA__*/")) {
     throw new Error("src/report.html is missing the /*__ASTRA_DATA__*/ injection marker");
   }