@mandujs/core 0.54.26 → 0.54.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.54.26",
+  "version": "0.54.28",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",

package/src/devtools/client/catchers/network-proxy.ts

@@ -56,6 +56,8 @@ const DEFAULT_OPTIONS: Required<NetworkProxyOptions> = {
   ignorePatterns: [
     // DevTools 자체 요청
     /__mandu/,
+    // DevTools 에러 리포트 엔드포인트 (자기추적/피드백 루프 방지)
+    /__kitchen/,
     // HMR
     /__vite/,
     /\.hot-update\./,

package/src/devtools/client/components/overlay.tsx

@@ -195,7 +195,20 @@ export function ErrorOverlay({
     const handleKeyDown = (e: KeyboardEvent) => {
       if (e.key === 'Escape') {
         onClose();
-      } else if (e.key === 'i' || e.key === 'I') {
+        return;
+      }
+      // Don't hijack single-letter shortcuts while the user is typing in an
+      // editable element, or when a modifier is held (e.g. real Ctrl/Cmd+C).
+      const target = e.target as HTMLElement | null;
+      const isEditable = !!target && (
+        target.tagName === 'INPUT' ||
+        target.tagName === 'TEXTAREA' ||
+        target.isContentEditable
+      );
+      if (isEditable || e.ctrlKey || e.metaKey || e.altKey) {
+        return;
+      }
+      if (e.key === 'i' || e.key === 'I') {
         onIgnore();
       } else if (e.key === 'c' || e.key === 'C') {
         onCopy();

package/src/devtools/client/persistence.ts

@@ -142,6 +142,12 @@ export class PersistenceManager {
           activeTab: 'unknown',
         },
       });
+      // A repeatedly-failing flush (e.g. a non-quota storage error) must not
+      // let pendingEvents grow unbounded. Keep only the most recent batch.
+      const cap = this.config.maxPersistEvents;
+      if (this.pendingEvents.length > cap) {
+        this.pendingEvents = this.pendingEvents.slice(-cap);
+      }
     }
   }
 

package/src/devtools/server/source-context.ts

@@ -174,11 +174,22 @@ export class SourceContextProvider {
    * 안전한 경로 확인 (Path Traversal 방지)
    */
   private resolveSafePath(file: string): string | null {
+    // Reject absolute inputs outright: path.resolve(root, "/etc/passwd")
+    // returns "/etc/passwd", escaping the project root.
+    if (path.isAbsolute(file)) {
+      return null;
+    }
+
     const absolutePath = path.resolve(this.options.projectRoot, file);
     const normalizedRoot = path.normalize(this.options.projectRoot);
-
-    // 확인된 경로가 프로젝트 루트 내에 있는지 확인
-    if (!absolutePath.startsWith(normalizedRoot)) {
+    // Compare with a trailing separator so a sibling sharing the root's
+    // prefix (e.g. "/app/project-secrets" vs root "/app/project") is NOT
+    // treated as inside the root. Allow the root itself.
+    const rootWithSep = normalizedRoot.endsWith(path.sep)
+      ? normalizedRoot
+      : normalizedRoot + path.sep;
+
+    if (absolutePath !== normalizedRoot && !absolutePath.startsWith(rootWithSep)) {
       return null;
     }
 

package/src/devtools/worker/worker-manager.ts

@@ -245,6 +245,8 @@ export class WorkerManager {
         { source: '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,}', label: 'EMAIL' },
         { source: '\\\\+?[1-9]\\\\d{1,14}', label: 'PHONE' },
         { source: '\\\\b(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\b', label: 'IP' },
+        { source: '\\\\b(?:\\\\d{4}[- ]?){3}\\\\d{4}\\\\b', label: 'CARD' },
+        { source: '\\\\b\\\\d{3}-\\\\d{2}-\\\\d{4}\\\\b', label: 'SSN' },
       ];
 
       function applyPattern(text, pattern) {