@invisibleloop/pulse 0.20.44 → 0.20.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invisibleloop/pulse",
-  "version": "0.20.44",
+  "version": "0.20.46",
   "type": "module",
   "description": "AI-first frontend framework. The spec is the source of truth.",
   "license": "MIT",

package/public/.pulse-ui-version

@@ -1 +1 @@
-0.20.44
+0.20.46

package/src/agent/workflow.md

@@ -343,6 +343,8 @@ If it still fails, it is a framework bug:
 3. If they agree, call `pulse_report_issue` without `confirmed`. Show the user the returned preview verbatim and ask for approval.
 4. Only after they approve, call it again with `confirmed: true` and the `previewId`. Never confirm on your own.
 
+Never report a security vulnerability this way — reports become public issues. If you suspect one (XSS, injection, auth or CSRF bypass, anything exploitable), tell the user to report it privately at https://github.com/invisibleloop/pulse-framework/security/advisories/new.
+
 Do not report: your own spec or API-usage errors, missing features or feature requests, design preferences, or anything you have not isolated to Pulse. Keep secrets, credentials and private user data out of every field.
 
 ---

package/src/cli/feedback.js

@@ -108,6 +108,8 @@ export function previewId(payload) {
   return crypto.createHash('sha256').update(JSON.stringify(payload)).digest('hex').slice(0, 16)
 }
 
+const SECURITY_URL = 'https://github.com/invisibleloop/pulse-framework/security/advisories/new'
+
 export function formatPreview(payload, { transport = 'proxy', endpoint = DEFAULT_ENDPOINT } = {}) {
   const dest = transport === 'gh'
     ? `GitHub issue on ${REPO}, filed with your own \`gh\` login`
@@ -116,6 +118,7 @@ export function formatPreview(payload, { transport = 'proxy', endpoint = DEFAULT
   return [
     `This report has NOT been sent. It will be published as: ${dest}.`,
     `Only the fields below are sent — no project files, paths or environment. Local paths and secret-like strings were redacted.`,
+    `This becomes a PUBLIC issue. If it is a security vulnerability, do NOT send it — tell the user to report it privately at ${SECURITY_URL}.`,
     ``,
     `Title: ${payload.title}`,
     `Pulse version: ${payload.version}`,

package/src/cli/report-server.js

@@ -22,6 +22,9 @@ const REPORTS_DIR      = path.join(ROOT, '.pulse', 'reports')
 const LOAD_REPORTS_DIR = path.join(ROOT, '.pulse', 'load-reports')
 const THIRTY_DAYS      = 30 * 24 * 60 * 60 * 1000
 
+// Report data (notably the audited URL) is untrusted when it reaches HTML.
+const esc = s => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;')
+
 // ---------------------------------------------------------------------------
 // Data — Lighthouse
 // ---------------------------------------------------------------------------
@@ -349,7 +352,7 @@ function renderPerfTab(slug, reports) {
   ${staleBanner}
   <div class="page-header">
     <div>
-      <h2 class="page-heading">${latest.url || '/' + slug}</h2>
+      <h2 class="page-heading">${esc(latest.url || '/' + slug)}</h2>
       <p class="page-meta">${count} audit${count !== 1 ? 's' : ''} · last run ${when}</p>
     </div>
     <div class="health-badge" style="color:${health[1]};border-color:${health[1]}20;background:${health[1]}10">${health[0]}</div>
@@ -480,7 +483,7 @@ function renderLoadTab(slug, reports) {
   ${localhostBanner}
   <div class="page-header">
     <div>
-      <h2 class="page-heading">${latest.url || '/' + slug}</h2>
+      <h2 class="page-heading">${esc(latest.url || '/' + slug)}</h2>
       <p class="page-meta">${count} test${count !== 1 ? 's' : ''} · last run ${when}</p>
     </div>
   </div>
@@ -517,8 +520,8 @@ function renderIndex(slugs) {
       : ''
 
     return `
-    <a href="/${slug}" class="index-card">
-      <span class="index-url">${latest?.url || latestLd?.url || '/' + slug}</span>
+    <a href="/${esc(slug)}" class="index-card">
+      <span class="index-url">${esc(latest?.url || latestLd?.url || '/' + slug)}</span>
       <span class="index-gauges">${gauges}</span>
       ${loadBadge}
     </a>`
@@ -636,7 +639,7 @@ function renderHTML({ title, content, slugs, activeSlug, activeTab, hasBoth }) {
     const loadRpts = loadLoadReports(slug)
     const ldUrl    = loadRpts[loadRpts.length - 1]?.url
     const display  = url || ldUrl || '/' + slug
-    return `<a href="/${slug}" class="sidebar-link${slug === activeSlug ? ' active' : ''}">${display}</a>`
+    return `<a href="/${esc(slug)}" class="sidebar-link${slug === activeSlug ? ' active' : ''}">${esc(display)}</a>`
   }).join('')
 
   const tabs = activeSlug && hasBoth ? `
@@ -656,7 +659,7 @@ function renderHTML({ title, content, slugs, activeSlug, activeTab, hasBoth }) {
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${title} — Pulse Reports</title>
+  <title>${esc(title)} — Pulse Reports</title>
   <style>${CSS}</style>
 </head>
 <body>
@@ -718,6 +721,6 @@ http.createServer((req, res) => {
   res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' })
   res.end(renderHTML({ title, content, slugs, activeSlug: slug, activeTab, hasBoth }))
 
-}).listen(PORT, () => {
+}).listen(PORT, '127.0.0.1', () => {
   console.log(`\n⚡ Pulse report server running at http://localhost:${PORT}\n`)
 })

package/src/cli/scaffold.js

@@ -488,7 +488,7 @@ Run these steps in order — do not declare work done without them:
 
 ## If Pulse itself is broken
 
-If a documented Pulse feature or tool misbehaves and you have reduced it to a minimal repro that involves only Pulse, tell the user, give them the workaround, and offer to report it with \`pulse_report_issue\`. Preview first, show the user the redacted report verbatim, and send only after they approve. Do not report your own mistakes, spec errors or feature requests.
+If a documented Pulse feature or tool misbehaves and you have reduced it to a minimal repro that involves only Pulse, tell the user, give them the workaround, and offer to report it with \`pulse_report_issue\`. Preview first, show the user the redacted report verbatim, and send only after they approve. Do not report your own mistakes, spec errors or feature requests. Never report a security vulnerability this way (reports are public): tell the user to report it privately at https://github.com/invisibleloop/pulse-framework/security/advisories/new.
 
 ## Writing tests
 
@@ -582,7 +582,7 @@ Run these steps in order — do not declare work done without them:
 
 ## If Pulse itself is broken
 
-If a documented Pulse feature or tool misbehaves and you have reduced it to a minimal repro that involves only Pulse, tell the user, give them the workaround, and offer to report it with \`pulse_report_issue\`. Preview first, show the user the redacted report verbatim, and send only after they approve. Do not report your own mistakes, spec errors or feature requests.
+If a documented Pulse feature or tool misbehaves and you have reduced it to a minimal repro that involves only Pulse, tell the user, give them the workaround, and offer to report it with \`pulse_report_issue\`. Preview first, show the user the redacted report verbatim, and send only after they approve. Do not report your own mistakes, spec errors or feature requests. Never report a security vulnerability this way (reports are public): tell the user to report it privately at https://github.com/invisibleloop/pulse-framework/security/advisories/new.
 
 ## Writing tests
 

package/src/mcp/server.js

@@ -1081,7 +1081,7 @@ The generated file uses @invisibleloop/pulse/testing (renderSync / render). Do N
       : []
 
     const specName = path.basename(file, '.js')
-    const importPath = path.relative(path.dirname(testFile), file).replace(/\.js$/, '.js')
+    const importPath = path.relative(path.dirname(testFile), file)
 
     const lines = []
     lines.push(`import { describe, it } from 'node:test'`)
@@ -1632,6 +1632,8 @@ server.registerTool(
   {
     description: `Report a bug in the Pulse framework itself (not in the user's own code). Use only after you have confirmed the problem is Pulse's — e.g. a documented feature misbehaves, a Pulse tool returns a wrong result, or a component renders incorrectly from valid input — and have a minimal repro. Do not report your own mistakes or missing features.
 
+Never use this for a security vulnerability — reports become public issues; tell the user to report it privately at https://github.com/invisibleloop/pulse-framework/security/advisories/new.
+
 Two steps. First call (no confirmed): returns the redacted report for you to show the user verbatim — nothing is sent. If the user agrees, call again with the same fields plus confirmed: true and the previewId from step one. Never set confirmed without the user's explicit approval. Do not put secrets, credentials or private user data in any field.`,
     inputSchema: {
       title:       z.string().min(8).max(120).describe('One-line summary of the bug'),

package/src/md/index.js

@@ -17,6 +17,20 @@ import { highlight } from './highlight.js'
 // HTML escaping
 // ---------------------------------------------------------------------------
 
+/**
+ * Remove an ATX heading's optional closing sequence ("## Title ##" → "Title").
+ * Done by hand rather than with /\s+#+\s*$/, which backtracks quadratically on
+ * long runs of whitespace.
+ */
+function stripClosingHashes(text) {
+  let end = text.length
+  while (end > 0 && /\s/.test(text[end - 1])) end--
+  let start = end
+  while (start > 0 && text[start - 1] === '#') start--
+  if (start === end || start === 0 || !/\s/.test(text[start - 1])) return text
+  return text.slice(0, start).trimEnd()
+}
+
 function esc(s) {
   return String(s)
     .replace(/&/g, '&')
@@ -147,10 +161,14 @@ function parseBlocks(text) {
       continue
     }
 
-    // ATX heading  (# through ######)
-    const headMatch = line.match(/^(#{1,6})\s+(.*?)(?:\s+#+\s*)?$/)
-    if (headMatch) {
-      blocks.push({ type: 'heading', level: headMatch[1].length, content: headMatch[2] })
+    // ATX heading  (# through ######). This must accept every line the paragraph
+    // loop below treats as "a heading starts here" (/^#{1,6}\s/): if the two
+    // disagree, neither claims the line and the parser never advances.
+    // The marker is matched on its own, with the text taken from what follows, so
+    // there is no overlapping whitespace/content regex to backtrack.
+    const headMarker = line.match(/^#{1,6}(?=\s)/)
+    if (headMarker) {
+      blocks.push({ type: 'heading', level: headMarker[0].length, content: stripClosingHashes(line.slice(headMarker[0].length).trimStart()) })
       i++; continue
     }
 
@@ -219,9 +237,12 @@ function parseBlocks(text) {
       if (/^\d+[.)]\s/.test(l))                       break
       paraLines.push(l); i++
     }
-    if (paraLines.length > 0) {
-      blocks.push({ type: 'paragraph', content: paraLines.join(' ') })
+    if (paraLines.length === 0) {
+      // Nothing above claimed this line and the paragraph loop refused it. Never
+      // loop without consuming input — treat it as text and move on.
+      paraLines.push(lines[i]); i++
     }
+    blocks.push({ type: 'paragraph', content: paraLines.join(' ') })
   }
 
   return blocks
@@ -311,6 +332,8 @@ function markdownToHtml(text) {
  * @returns {{ html: string, frontmatter: Record<string, string> }}
  */
 export function parseMd(source) {
+  // Normalise line endings first: CRLF files otherwise leave a stray "\r" on every line.
+  source = String(source).replace(/\r\n?/g, '\n')
   const { frontmatter, body } = extractFrontmatter(source)
   return { html: markdownToHtml(body), frontmatter }
 }

package/src/runtime/index.js

@@ -869,7 +869,8 @@ function viewErrorFallback(err) {
 }
 
 function isValidEmail(value) {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)
+  // 254 is the RFC 5321 maximum; the cap also bounds the regex's worst case.
+  return value.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)
 }
 
 // ---------------------------------------------------------------------------

package/src/server/index.js

@@ -1659,9 +1659,15 @@ function matchRoute(router, pathname) {
  */
 function routeToRegex(route) {
   const params  = []
+  // Split on :params so every literal segment can be regex-escaped ("." in
+  // /feed.xml must not match any character).
   const pattern = route
-    .replace(/:([^/]+)/g, (_, name) => { params.push(name); return '([^/]+)' })
-    .replace(/\//g, '\\/')
+    .split(/(:[^/]+)/)
+    .map(part => {
+      if (part.startsWith(':')) { params.push(part.slice(1)); return '([^/]+)' }
+      return part.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')
+    })
+    .join('')
 
   return {
     pattern: new RegExp(`^${pattern}\\/?$`),
@@ -2221,7 +2227,7 @@ function streamErrorScript(err, dev, nonce = '') {
       `</div>`
     : `<div style="padding:2rem;text-align:center;font-family:system-ui,sans-serif;color:#666">Something went wrong.</div>`
 
-  return `<script nonce="${nonce}">(function(){var r=document.getElementById('pulse-root');if(r)r.innerHTML=${JSON.stringify(inner)};})()</script>`
+  return `<script nonce="${nonce}">(function(){var r=document.getElementById('pulse-root');if(r)r.innerHTML=${JSON.stringify(inner).replace(/</g, '\\u003c')};})()</script>`
 }
 
 function errorPage500() {

package/src/testing/html.js

@@ -64,14 +64,15 @@ function parseAttrs(str) {
 }
 
 function decodeEntities(str) {
+  // &amp; must be decoded last: decoding it first turns "&amp;lt;" into "<".
   return str
-    .replace(/&amp;/g,  '&')
     .replace(/&lt;/g,   '<')
     .replace(/&gt;/g,   '>')
     .replace(/&quot;/g, '"')
     .replace(/&#0?39;/g, "'")
     .replace(/&apos;/g, "'")
     .replace(/&nbsp;/g, ' ')
+    .replace(/&amp;/g,  '&')
 }
 
 /**