@hraness/slopcamera 3.10.2 → 3.10.3

package/README.md

@@ -365,15 +365,3 @@ to support development and opens no browser. `support dismiss` opts out across
 the local suite, `support snooze` pauses the notice for 30 days, and
 `HRANESS_SUPPORT_AUDIENCE=off` disables ambient notices. Agents follow the
 [support reference](skills/slopcamera/references/support.md).
-
-## Former name
-
-<details>
-<summary>Historical Atet release evidence</summary>
-
-SlopCamera was called Atet until September 2026.
-[Atet v3.2.3](https://github.com/hraness/atet/releases/tag/v3.2.3) and its
-[original archive](https://github.com/hraness/atet/releases/download/v3.2.3/hraness-atet-3.2.3.tgz)
-still install Atet, not SlopCamera.
-
-</details>

package/apps/desktop/application/operation.ts

@@ -4,7 +4,7 @@ import type { z } from "zod";
 
 import type { ApplicationContext } from "./context";
 
-export const SLOPCAMERA_APPLICATION_TOOL_VERSION = "slopcamera-3.10.2" as const;
+export const SLOPCAMERA_APPLICATION_TOOL_VERSION = "slopcamera-3.10.3" as const;
 
 export const OPERATION_KINDS = [
   "scene.audit",

package/apps/desktop/cli/asset-ingest.ts

@@ -93,6 +93,31 @@ function isWithin(root: string, candidate: string): boolean {
   return pathRelative === "" || (!pathRelative.startsWith("..") && !isAbsolute(pathRelative));
 }
 
+function svgRootAttributes(contents: string): string | undefined {
+  let offset = 0;
+  const whitespace = /\s+/uy;
+  const skipWhitespace = (): void => {
+    whitespace.lastIndex = offset;
+    offset += whitespace.exec(contents)?.[0].length ?? 0;
+  };
+  skipWhitespace();
+  const declaration = /<\?xml[^>]*>\s*/iuy;
+  declaration.lastIndex = offset;
+  offset += declaration.exec(contents)?.[0].length ?? 0;
+
+  // Consume each comment once. A repeated lazy regex can reconsider every
+  // earlier comment terminator when the SVG root is missing.
+  while (contents.startsWith("<!--", offset)) {
+    const end = contents.indexOf("-->", offset + 4);
+    if (end === -1) return undefined;
+    offset = end + 3;
+    skipWhitespace();
+  }
+  const root = /<svg(?=[\s>])([^>]*)>/iuy;
+  root.lastIndex = offset;
+  return root.exec(contents)?.[1];
+}
+
 function validateSvg(bytes: Uint8Array): boolean {
   if (bytes.length > MAX_SVG_BYTES) return false;
   let contents: string;
@@ -101,8 +126,7 @@ function validateSvg(bytes: Uint8Array): boolean {
   } catch {
     return false;
   }
-  const start = contents.trimStart();
-  if (!/^(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*<svg(?:\s|>)/iu.test(start)) return false;
+  if (svgRootAttributes(contents) === undefined) return false;
   if (
     /<!DOCTYPE|<!ENTITY|<\?xml-stylesheet|<\s*(?:script|foreignObject|iframe|object|embed)\b/iu.test(contents)
     || /\s+on[a-z][a-z0-9_-]*\s*=/iu.test(contents)
@@ -227,13 +251,13 @@ export function parseSvgIntrinsicSize(bytes: Uint8Array): OverlayIntrinsicSize {
     throw new CliError("invalid-data", "SVG overlay is not valid UTF-8.");
   }
   if (!validateSvg(bytes)) throw new CliError("invalid-data", "SVG overlay failed the safe SVG profile.");
-  const root = /^(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*<svg\b(?<attributes>[^>]*)>/iu.exec(contents.trimStart());
-  if (root?.groups?.attributes === undefined) {
+  const attributes = svgRootAttributes(contents);
+  if (attributes === undefined) {
     throw new CliError("invalid-data", "SVG overlay omits its root element.");
   }
-  const width = svgLength(svgAttribute(root.groups.attributes, "width"));
-  const height = svgLength(svgAttribute(root.groups.attributes, "height"));
-  const viewBox = svgAttribute(root.groups.attributes, "viewBox")
+  const width = svgLength(svgAttribute(attributes, "width"));
+  const height = svgLength(svgAttribute(attributes, "height"));
+  const viewBox = svgAttribute(attributes, "viewBox")
     ?.split(/[\s,]+/u)
     .filter(Boolean)
     .map(Number);

package/apps/desktop/cli/commands.ts

@@ -365,7 +365,7 @@ import {
   workflowRunStore,
 } from "./workflow-runs";
 
-export const SLOPCAMERA_VERSION = "3.10.2";
+export const SLOPCAMERA_VERSION = "3.10.3";
 
 // Legacy direct renders predate per-target output contracts. Keep them
 // bounded generously enough for long-form production while preventing one