@pugi/cli 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/tui/repl-splash-mascot.js

@@ -89,21 +89,33 @@ export function loadPugMascotAnsi() {
         //    icon, clipboard, hyperlinks, color-palette change). Drop them
         //    so a corrupted asset cannot rename the operator's terminal tab
         //    or smuggle a hyperlink into the splash region.
-        // 2. Drop CSI ? <mode> [hl] for mouse-tracking and screen-buffer
-        //    switch modes (1000, 1001, 1002, 1003, 1004, 1005, 1006, 1015,
-        //    1049, 47, 1047, 1048). These would either start swallowing
-        //    mouse input or flip the terminal into the alternate screen.
+        // 2. Drop ALL CSI ? <numbers and semicolons> [lh] (DEC private-mode
+        //    set / reset). The legitimate chafa output for a splash is
+        //    truecolor SGR (`CSI 38;2;R;G;B m`) plus cursor-positioning —
+        //    no private-mode toggle ever appears там legitimately. A
+        //    permissive deny-all pattern covers every disruptive private
+        //    mode in one regex:
+        //      - cursor visibility (25)
+        //      - alt-screen buffer  (47, 1047, 1048, 1049)
+        //      - mouse tracking     (1000, 1001, 1002, 1003, 1004, 1005, 1006, 1015)
+        //      - bracketed paste    (2004)
+        //      - focus reporting    (1004)
+        //      - multi-mode forms   (e.g. `CSI ? 47 ; 1049 h` — legal per
+        //        xterm ctlseqs but missed by the previous single-mode regex)
+        //      - any future private mode a corrupt asset might emit
+        //    Allowlisting the modes the splash needs is impossible because
+        //    the splash needs ZERO of them — chafa renders glyph-by-glyph,
+        //    not via private-mode toggles. A pure deny-all is strictly
+        //    safer than enumerating known-bad modes one-by-one.
         // 3. Drop CSI 6 n (cursor-position report). Would inject a fake
         //    CPR into the operator's stdin stream.
         // 4. Drop CSI [23]J / CSI [23]K (full screen / line clear). A
         //    chafa render uses cursor-positioning per row, not bulk
         //    erases; bulk clears would wipe whatever the operator already
         //    had on screen above the splash.
-        // The cursor-hide/show wrappers (CSI ? 25 [lh]) are handled by
-        // the same CSI-?-mode pattern as the mouse / alt-screen modes.
         const stripped = raw
             .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
-            .replace(/\x1b\[\?(?:25|47|1000|1001|1002|1003|1004|1005|1006|1015|1047|1048|1049)[lh]/g, '')
+            .replace(/\x1b\[\?[0-9;]+[lh]/g, '')
             .replace(/\x1b\[6n/g, '')
             .replace(/\x1b\[[23]?[JK]/g, '');
         if (stripped.trim().length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pugi/cli",
-  "version": "0.1.0-beta.23",
+  "version": "0.1.0-beta.25",
   "description": "Pugi CLI - terminal-native software execution system",
   "homepage": "https://pugi.io",
   "repository": {
@@ -53,8 +53,8 @@
     "turndown": "^7.2.4",
     "undici": "^8.3.0",
     "zod": "^3.23.0",
-    "@pugi/personas": "0.1.2",
-    "@pugi/sdk": "0.1.0-beta.23"
+    "@pugi/sdk": "0.1.0-beta.25",
+    "@pugi/personas": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",