@kolkrabbi/kol-shell 0.31.0 → 0.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolkrabbi/kol-shell",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "private": false,
   "description": "KOL application shell — fixed 48px NavRail + AppShell layout root, PageShell/PageHeader scaffolds, ContentFilters catalog organism, GridCard, SettingsScaffold, WalkthroughPanel, ShortcutsOverlay. App chrome (kol-framework owns site chrome). Nav items, content, shortcuts and settings are consumer-injected. Sits above @kolkrabbi/kol-{theme,component,framework}.",
   "license": "MIT",
@@ -20,10 +20,10 @@
     "react-dom": "^18.3.0 || ^19.0.0"
   },
   "devDependencies": {
-    "@kolkrabbi/kol-component": "^0.145.0",
+    "@kolkrabbi/kol-component": "^0.151.0",
     "@kolkrabbi/kol-icons": "^0.25.0",
-    "@kolkrabbi/kol-theme": "^0.112.0",
-    "@kolkrabbi/kol-framework": "^0.36.0"
+    "@kolkrabbi/kol-framework": "^0.36.0",
+    "@kolkrabbi/kol-theme": "^0.119.0"
   },
   "files": [
     "src",

package/src/CatalogPage.jsx

@@ -111,8 +111,20 @@ export default function CatalogPage({
             if (open) return null
             const cards = rows.map((item) => toCard ? toCard(item, { view: viewMode, layout }) : { title: item.title ?? item.name, detail: item.detail })
             const hidden = layout === 'list' ? new Set() : computeHiddenSet(rows, cards.findIndex((c) => c.expanded))
+            /* COLS IS A CEILING, NOT A COMMAND (CatalogPageMobileColumns,
+              * kol-monitor 2026-09-01) — the third home of the defect
+              * ContentCollectionMinColumnWidth and ContentGridMinColumnWidth
+              * closed, unreachable by either because this grid is drawn inline.
+              * `repeat(6, 1fr)` computed six 29px slivers at 390. Same idiom as
+              * ContentCollection:144 — up to 6 (grid) / 4 (list) columns, and a
+              * track may not go under the floor (160 grid / 240 list) nor demand
+              * more than the container. At monitor's desktop widths the sixth-
+              * share clears the floor, so nothing moves there. NB the 2×2
+              * expanded-card neighbour math (computeHiddenSet) stays a
+              * six-column ruling — below the ceiling the hide-set is
+              * desktop-only geometry. */
             return (
-            <div style={{ display: 'grid', gridTemplateColumns: layout === 'list' ? 'repeat(4, 1fr)' : 'repeat(6, 1fr)', gap: layout === 'list' ? 8 : 24 }}>
+            <div style={{ display: 'grid', gridTemplateColumns: layout === 'list' ? 'repeat(auto-fill, minmax(min(100%, max(240px, calc((100% - 3 * 8px) / 4))), 1fr))' : 'repeat(auto-fill, minmax(min(100%, max(160px, calc((100% - 5 * 24px) / 6))), 1fr))', gap: layout === 'list' ? 8 : 24 }}>
               {rows.map((item, i) => {
                 if (hidden.has(i)) return null
                 const c = cards[i]

package/src/Logomark.jsx

@@ -5,10 +5,39 @@ import { useState, useEffect } from 'react'
  * <img> renders a currentColor mark black in dark mode (invisible). Ported
  * verbatim from the kol-mirror cut (module-level cache; async resolve even on
  * cache hit — sync setState in an effect cascades renders).
+ *
+ * The fetched markup is SANITIZED before injection — `<style>`/`<script>`
+ * stripped, `on*` attributes dropped (LogomarkInlineStyleLeak, kol-chess
+ * 2026-09-01). An SVG *document* may legitimately carry its own `<style>` — a
+ * theme-aware favicon does — but once inlined, that `<style>` is
+ * DOCUMENT-GLOBAL: kol-chess pointed `svgUrl` at its favicon and every <svg>
+ * in the app took OS-keyed ink and ignored `data-theme`, presenting two
+ * packages away as "the theme toggle is broken". A mark that needs its own
+ * styling inlines it as attributes, not a stylesheet.
  */
 
 const svgCache = new Map()
 
+/* strip what must never escape into the host document: stylesheets (global
+ * once inlined), scripts and event handlers (this is a fetch → innerHTML
+ * boundary). DOMParser is the correct tool; the regex fallback only runs if
+ * the markup does not even parse as SVG. */
+function sanitizeSvg(svg) {
+  try {
+    const doc = new DOMParser().parseFromString(svg, 'image/svg+xml')
+    if (doc.querySelector('parsererror')) throw new Error('unparseable')
+    doc.querySelectorAll('style, script').forEach((el) => el.remove())
+    doc.querySelectorAll('*').forEach((el) => {
+      for (const a of [...el.attributes]) if (/^on/i.test(a.name)) el.removeAttribute(a.name)
+    })
+    return new XMLSerializer().serializeToString(doc)
+  } catch {
+    return svg
+      .replace(/<(style|script)[\s\S]*?<\/\1\s*>/gi, '')
+      .replace(/\son[a-z]+\s*=\s*("[^"]*"|'[^']*')/gi, '')
+  }
+}
+
 export default function Logomark({ svgUrl, size = 20, className = '', ...props }) {
   const [svgContent, setSvgContent] = useState(() => svgCache.get(svgUrl) || null)
 
@@ -16,7 +45,7 @@ export default function Logomark({ svgUrl, size = 20, className = '', ...props }
     if (!svgUrl) return
     let active = true
     Promise.resolve(
-      svgCache.get(svgUrl) ?? fetch(svgUrl).then(res => res.text()).then(svg => { svgCache.set(svgUrl, svg); return svg })
+      svgCache.get(svgUrl) ?? fetch(svgUrl).then(res => res.text()).then(raw => { const svg = sanitizeSvg(raw); svgCache.set(svgUrl, svg); return svg })
     )
       .then(svg => { if (active) setSvgContent(svg) })
       .catch(() => {})

package/src/SettingsShortcuts.jsx

@@ -15,6 +15,12 @@ import { SettingsRow } from '@kolkrabbi/kol-component'
  * token by nature — the value cell is `whitespace-nowrap` and the label yields
  * (SettingsShortcutsComboWrap, kol-monitor 2026-08-27: `⌘ K` broke as `⌘` over
  * `K` in the six-column grid — the cell was squeezed to min-content, not full).
+ * `labelWidth="auto"` is what MAKES the label yield
+ * (SettingsShortcutsComboOverflow, kol-monitor 2026-09-01): the row's default
+ * is a fixed 160px label, which in this grid's ~176px columns left the combo
+ * cell 4px — every combo was painting into the 48px column gap, and the first
+ * one longer than the gap (`⌥ then 1–5`) reached the neighbour's labels. The
+ * label truncates, the combo hugs, an over-long combo clips at the column edge.
  *
  * @param {Array}    sections    `[{ section, items: [{ id, label, combo }] }]`
  * @param {Function} comboLabel  (combo) => string (default: the combo as given)
@@ -26,7 +32,7 @@ export default function SettingsShortcuts({ sections = [], comboLabel = (c) => c
         <div key={section} style={{ display: 'flex', flexDirection: 'column', gap: 4 }}>
           <span className="kol-eyebrow text-strong mb-2">{section}</span>
           {items.map((k) => (
-            <SettingsRow key={k.id ?? k.label} label={k.label} align="fill">
+            <SettingsRow key={k.id ?? k.label} label={k.label} align="fill" labelWidth="auto">
               <span className="text-fg-32 kol-helper-12 whitespace-nowrap">{comboLabel(k.combo)}</span>
             </SettingsRow>
           ))}