@slidev/cli 52.17.0 → 52.17.1

package/dist/{build-Cszi5hDI.mjs → build-CsQUCdtJ.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveViteConfigs } from "./serve-CgOXLPUI.mjs";
+import { n as resolveViteConfigs } from "./serve-bAegrEOc.mjs";
 import { join, resolve } from "node:path";
 import { build as build$1 } from "vite";
 import { existsSync } from "node:fs";
@@ -51,7 +51,7 @@ async function build(options, viteConfig = {}, args) {
 				dev: true
 			}));
 			server.listen(port);
-			const { exportSlides } = await import("./export-CU2GL9dm.mjs");
+			const { exportSlides } = await import("./export-_6QaMWg2.mjs");
 			const tempDir = resolve(outDir, "temp");
 			await fs$1.mkdir(tempDir, { recursive: true });
 			await exportSlides({
@@ -92,7 +92,7 @@ async function build(options, viteConfig = {}, args) {
 		"true",
 		"auto"
 	].includes(options.data.config.download)) {
-		const { exportSlides, getExportOptions } = await import("./export-CU2GL9dm.mjs");
+		const { exportSlides, getExportOptions } = await import("./export-_6QaMWg2.mjs");
 		const port = 12445;
 		const app = connect();
 		const server = http.createServer(app);

package/dist/cli.mjs

@@ -1,12 +1,12 @@
 import { i as resolveEntry, r as isInstalledGlobally } from "./resolver-BBT539iz.mjs";
-import { c as getThemeMeta, d as loadSetups, f as updateFrontmatterPatch, l as resolveTheme, o as resolveOptions, s as parser, t as createServer, u as version } from "./serve-CgOXLPUI.mjs";
+import { c as getThemeMeta, d as loadSetups, f as updateFrontmatterPatch, l as resolveTheme, o as resolveOptions, s as parser, t as createServer, u as version } from "./serve-bAegrEOc.mjs";
 import path from "node:path";
 import process from "node:process";
 import fs from "node:fs/promises";
 import { blue, bold, cyan, cyanBright, dim, gray, green, underline, yellow } from "ansis";
 import { injectPreparserExtensionLoader } from "@slidev/parser/fs";
 import equal from "fast-deep-equal";
-import { exec } from "node:child_process";
+import { execFile } from "node:child_process";
 import os from "node:os";
 import * as readline from "node:readline";
 import { verifyConfig } from "@slidev/parser";
@@ -202,7 +202,7 @@ cli.command("* [entry]", "Start a local server for Slidev", (args) => commonOpti
 			name: "e",
 			fullname: "edit",
 			action() {
-				exec(`code "${entry}"`);
+				execFile(process.env.EDITOR || "code", [entry]);
 			}
 		},
 		{
@@ -300,7 +300,7 @@ cli.command("build [entry..]", "Build hostable SPA", (args) => exportOptions(com
 	describe: "enable the inspect plugin for debugging"
 }).strict().help(), async (args) => {
 	const { entry, theme, base, download, out, inspect, "without-notes": withoutNotes, "router-mode": routerMode } = args;
-	const { build } = await import("./build-Cszi5hDI.mjs");
+	const { build } = await import("./build-CsQUCdtJ.mjs");
 	for (const entryFile of entry) {
 		const options = await resolveOptions({
 			entry: entryFile,
@@ -329,7 +329,7 @@ cli.command("format [entry..]", "Format the markdown file", (args) => commonOpti
 	}
 });
 cli.command("mcp [entry]", "Start an MCP (Model Context Protocol) server over stdio for AI agents to inspect and edit the slides", (args) => commonOptions(args).strict().help(), async ({ entry }) => {
-	const { startMcpStdioServer } = await import("./stdio-LsewwOTO.mjs");
+	const { startMcpStdioServer } = await import("./stdio-CjXw2-ks.mjs");
 	await startMcpStdioServer(await resolveEntry(entry));
 });
 cli.command("theme [subcommand]", "Theme related operations", (command) => {
@@ -369,7 +369,7 @@ cli.command("theme [subcommand]", "Theme related operations", (command) => {
 });
 cli.command("export [entry..]", "Export slides to PDF", (args) => exportOptions(commonOptions(args)).strict().help(), async (args) => {
 	const { entry, theme } = args;
-	const { exportSlides, getExportOptions } = await import("./export-CU2GL9dm.mjs");
+	const { exportSlides, getExportOptions } = await import("./export-_6QaMWg2.mjs");
 	const candidatePort = await getPort(12445);
 	let warned = false;
 	for (const entryFile of entry) {
@@ -421,7 +421,7 @@ cli.command("export-notes [entry..]", "Export slide notes to PDF", (args) => arg
 	type: "number",
 	describe: "wait for the specified ms before exporting"
 }).strict().help(), async ({ entry, output, timeout, wait }) => {
-	const { exportNotes } = await import("./export-CU2GL9dm.mjs");
+	const { exportNotes } = await import("./export-_6QaMWg2.mjs");
 	const candidatePort = await getPort(12445);
 	for (const entryFile of entry) {
 		const options = await resolveOptions({ entry: entryFile }, "export");

package/dist/{export-CU2GL9dm.mjs → export-_6QaMWg2.mjs}

@@ -78,26 +78,29 @@ async function exportNotes({ port = 18724, base = "/", output = "notes", timeout
 	const progress = createSlidevProgress(true);
 	progress.start(1);
 	if (!output.endsWith(".pdf")) output = `${output}.pdf`;
-	await page.goto(`http://localhost:${port}${base}presenter/print`, {
-		waitUntil: "networkidle",
-		timeout
-	});
-	await page.waitForLoadState("networkidle");
-	await page.emulateMedia({ media: "screen" });
-	if (wait) await page.waitForTimeout(wait);
-	await page.pdf({
-		path: output,
-		margin: {
-			left: 0,
-			top: 0,
-			right: 0,
-			bottom: 0
-		},
-		printBackground: true,
-		preferCSSPageSize: true
-	});
-	progress.stop();
-	browser.close();
+	try {
+		await page.goto(`http://localhost:${port}${base}presenter/print`, {
+			waitUntil: "networkidle",
+			timeout
+		});
+		await page.waitForLoadState("networkidle");
+		await page.emulateMedia({ media: "screen" });
+		if (wait) await page.waitForTimeout(wait);
+		await page.pdf({
+			path: output,
+			margin: {
+				left: 0,
+				top: 0,
+				right: 0,
+				bottom: 0
+			},
+			printBackground: true,
+			preferCSSPageSize: true
+		});
+	} finally {
+		progress.stop();
+		await browser.close();
+	}
 	return output;
 }
 async function exportSlides({ port = 18724, total = 0, range, format = "pdf", output = "slides", slides, base = "/", timeout = 3e4, wait = 0, dark = false, routerMode = "history", width = 1920, height = 1080, withClicks = false, executablePath = void 0, withToc = false, perSlide = false, scale = 1, waitUntil, omitBackground = false }) {
@@ -113,13 +116,16 @@ async function exportSlides({ port = 18724, total = 0, range, format = "pdf", ou
 	})).newPage();
 	const progress = createSlidevProgress(!perSlide);
 	progress.start(pages.length);
-	if (format === "pdf") await genPagePdf();
-	else if (format === "png") await genPagePng(output);
-	else if (format === "md") await genPageMd();
-	else if (format === "pptx") await genPagePptx(await genPagePng(false));
-	else throw new Error(`[slidev] Unsupported exporting format "${format}"`);
-	progress.stop();
-	browser.close();
+	try {
+		if (format === "pdf") await genPagePdf();
+		else if (format === "png") await genPagePng(output);
+		else if (format === "md") await genPageMd();
+		else if (format === "pptx") await genPagePptx(await genPagePng(false));
+		else throw new Error(`[slidev] Unsupported exporting format "${format}"`);
+	} finally {
+		progress.stop();
+		await browser.close();
+	}
 	const relativeOutput = slash(relative(".", output));
 	return relativeOutput.startsWith(".") ? relativeOutput : `./${relativeOutput}`;
 	async function go(no, clicks) {

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as createDataUtils, o as resolveOptions, r as ViteSlidevPlugin, s as parser, t as createServer } from "./serve-CgOXLPUI.mjs";
+import { a as createDataUtils, o as resolveOptions, r as ViteSlidevPlugin, s as parser, t as createServer } from "./serve-bAegrEOc.mjs";
 export { ViteSlidevPlugin, createDataUtils, createServer, parser, resolveOptions };

package/dist/{serve-CgOXLPUI.mjs → serve-bAegrEOc.mjs}

@@ -1,6 +1,6 @@
 import { a as resolveImportPath, c as toAtFS, i as resolveEntry, n as getRoots, o as resolveImportUrl, r as isInstalledGlobally, s as resolveSourceFiles, t as createResolver } from "./resolver-BBT539iz.mjs";
 import { builtinModules } from "node:module";
-import path, { basename, dirname, join, relative, resolve, win32 } from "node:path";
+import path, { basename, dirname, isAbsolute, join, relative, resolve, win32 } from "node:path";
 import process from "node:process";
 import { createServer, loadConfigFromFile, mergeConfig, parseSync } from "vite";
 import MarkdownExit from "markdown-exit";
@@ -70,7 +70,172 @@ function MarkdownItLink(md) {
 	};
 }
 //#endregion
+//#region node/virtual/deprecated.ts
+/**
+* Kept for backward compatibility, use #slidev/slides instead
+*
+* @deprecated
+*/
+const templateLegacyRoutes = {
+	id: "/@slidev/routes",
+	getContent() {
+		return [`export { slides } from '#slidev/slides'`, `console.warn('[slidev] #slidev/routes is deprecated, use #slidev/slides instead')`].join("\n");
+	}
+};
+/**
+* Kept for backward compatibility, use #slidev/title-renderer instead
+*
+* @deprecated
+*/
+const templateLegacyTitles = {
+	id: "/@slidev/titles.md",
+	getContent() {
+		return `
+<script setup lang="ts">
+import TitleRenderer from '#slidev/title-renderer'
+defineProps<{ no: number | string }>()
+console.warn('/@slidev/titles.md is deprecated, import from #slidev/title-renderer instead')
+<\/script>
+
+<TitleRenderer :no="no" />
+`;
+	}
+};
+//#endregion
+//#region node/virtual/titles.ts
+const templateTitleRendererMd = {
+	id: "/@slidev/title-renderer.md",
+	getContent({ data }) {
+		const lines = data.slides.map(({ title }, i) => `<template ${i === 0 ? "v-if" : "v-else-if"}="no === ${i + 1}">\n\n${title}\n\n</template>`);
+		lines.push(`<script setup lang="ts">`, `import { useSlideContext } from '@slidev/client/context.ts'`, `import { computed } from 'vue'`, `const props = defineProps<{ no?: number | string }>()`, `const { $page } = useSlideContext()`, `const no = computed(() => +(props.no ?? $page.value))`, `<\/script>`);
+		return lines.join("\n");
+	}
+};
+const templateTitleRenderer = {
+	id: "/@slidev/title-renderer",
+	async getContent() {
+		return "export { default } from \"/@slidev/title-renderer.md\"";
+	}
+};
+//#endregion
+//#region node/vite/common.ts
+const regexSlideReqPath = /^\/__slidev\/slides\/(\d+)\.json$/;
+const regexSlideFacadeId = /^\/@slidev\/slides\/(\d+)\/(md|frontmatter)($|\?)/;
+const regexSlideSourceId = /__slidev_(\d+)\.(md|frontmatter)$/;
+const templateInjectionMarker = "/* @slidev-injection */";
+const templateImportContextUtils = `import { useSlideContext as _useSlideContext, frontmatterToProps as _frontmatterToProps } from "@slidev/client/context.ts"`;
+const templateInitContext = `const { $slidev, $nav, $clicksContext, $clicks, $page, $renderContext, $frontmatter } = _useSlideContext()`;
+//#endregion
+//#region node/vite/importGuard.ts
+const virtualSlideMarkdownIds = /* @__PURE__ */ new Set([templateTitleRendererMd.id, templateLegacyTitles.id]);
+function createSlideImportGuardPlugin() {
+	let config;
+	let allowRoots = [];
+	return {
+		name: "slidev:slide-import-guard",
+		configResolved(resolved) {
+			config = resolved;
+			allowRoots = config.server.fs.allow.map(normalizeFsPath);
+		},
+		async transform(code, id) {
+			if (!isSlideMarkdownId(id) || !config?.server.fs.strict) return null;
+			const importer = filePathFromId(id) ?? id;
+			await Promise.all(extractImportSources(code, id).map(async ({ value, start }) => {
+				const resolved = await this.resolve(value, importer, { skipSelf: true });
+				if (!resolved || resolved.external) return;
+				const filePath = filePathFromId(resolved.id);
+				if (!filePath) return;
+				const normalized = normalizeFsPath(filePath);
+				if (isAllowedFile(normalized, allowRoots)) return;
+				if (isBareImport(value) && isDependencyFile(normalized)) return;
+				this.error(`[slidev] Import "${value}" from slide Markdown resolves outside of Vite server.fs.allow: ${normalized}`, start);
+			}));
+			return null;
+		}
+	};
+}
+function isSlideMarkdownId(id) {
+	const clean = cleanUrl$1(id);
+	return regexSlideSourceId.test(clean) || virtualSlideMarkdownIds.has(clean);
+}
+function filePathFromId(id) {
+	const clean = cleanUrl$1(id);
+	if (clean.startsWith("file://")) return fileURLToPath(clean);
+	if (clean.startsWith("/@fs/")) return clean.slice(4);
+	if (clean.startsWith("/@")) return null;
+	if (path.isAbsolute(clean)) return clean;
+	return null;
+}
+function isAllowedFile(filePath, allowRoots) {
+	return allowRoots.some((root) => isFileInRoot(root, filePath));
+}
+function extractImportSources(code, id) {
+	const result = parseSync(id, code);
+	const sources = [];
+	for (const item of result.module.staticImports) sources.push({
+		value: item.moduleRequest.value,
+		start: item.moduleRequest.start
+	});
+	for (const item of result.module.staticExports) for (const entry of item.entries) if (entry.moduleRequest) sources.push({
+		value: entry.moduleRequest.value,
+		start: entry.moduleRequest.start
+	});
+	for (const item of result.module.dynamicImports) {
+		const source = parseStringLiteral(code.slice(item.moduleRequest.start, item.moduleRequest.end));
+		if (source) sources.push({
+			value: source,
+			start: item.moduleRequest.start
+		});
+	}
+	return sources;
+}
+function cleanUrl$1(id) {
+	return id.replace(/[?#].*$/, "");
+}
+function normalizeFsPath(filePath) {
+	const absolute = path.resolve(filePath);
+	if (!existsSync(absolute)) return normalizeMissingFsPath(absolute);
+	return realpathSync.native(absolute);
+}
+function normalizeMissingFsPath(filePath) {
+	const dir = path.dirname(filePath);
+	if (dir === filePath) return filePath;
+	if (existsSync(dir)) return path.join(realpathSync.native(dir), path.basename(filePath));
+	return path.join(normalizeMissingFsPath(dir), path.basename(filePath));
+}
+function isFileInRoot(root, filePath) {
+	const relative = path.relative(root, filePath);
+	return relative === "" || !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function isDependencyFile(filePath) {
+	return filePath.split(/[\\/]/).includes("node_modules");
+}
+function isBareImport(source) {
+	return /^(?![a-z]:)[\w@](?!.*:\/\/)/i.test(source);
+}
+function parseStringLiteral(raw) {
+	const trimmed = raw.trim();
+	const quote = trimmed[0];
+	if (quote !== "\"" && quote !== "'" && quote !== "`") return null;
+	if (trimmed.at(-1) !== quote) return null;
+	if (quote === "`" && trimmed.includes("${")) return null;
+	try {
+		if (quote === "\"") return JSON.parse(trimmed);
+		return JSON.parse(`"${trimmed.slice(1, -1).replace(/"/g, "\\\"")}"`);
+	} catch {
+		return trimmed.slice(1, -1);
+	}
+}
+//#endregion
 //#region node/utils.ts
+/**
+* Whether `filePath` resolves inside any of `roots` (no `..` escape). Shared
+* containment predicate reused by the snippet (`<<<`) and `src:` deck-file
+* reads, and by the Vite slide-import guard (`isAllowedFile`).
+*/
+function isPathInsideRoots(filePath, roots) {
+	return isAllowedFile(filePath, roots);
+}
 const RE_WHITESPACE_ONLY = /^\s*$/;
 const RE_QUOTED_STRING = /^(['"])(.*)\1$/;
 const RE_WHITESPACE = /\s+/g;
@@ -243,14 +408,6 @@ function createComponentsPlugin({ clientRoot, roots }, pluginOptions) {
 	});
 }
 //#endregion
-//#region node/vite/common.ts
-const regexSlideReqPath = /^\/__slidev\/slides\/(\d+)\.json$/;
-const regexSlideFacadeId = /^\/@slidev\/slides\/(\d+)\/(md|frontmatter)($|\?)/;
-const regexSlideSourceId = /__slidev_(\d+)\.(md|frontmatter)$/;
-const templateInjectionMarker = "/* @slidev-injection */";
-const templateImportContextUtils = `import { useSlideContext as _useSlideContext, frontmatterToProps as _frontmatterToProps } from "@slidev/client/context.ts"`;
-const templateInitContext = `const { $slidev, $nav, $clicksContext, $clicks, $page, $renderContext, $frontmatter } = _useSlideContext()`;
-//#endregion
 //#region node/vite/contextInjection.ts
 const RE_EXPORT_DEFAULT_OBJECT = /export\s+default\s+\{/;
 const RE_INJECT_OPTION = /.*inject\s*:\s*([[{])/;
@@ -484,155 +641,6 @@ function createIconsPlugin(options, pluginOptions) {
 	});
 }
 //#endregion
-//#region node/virtual/deprecated.ts
-/**
-* Kept for backward compatibility, use #slidev/slides instead
-*
-* @deprecated
-*/
-const templateLegacyRoutes = {
-	id: "/@slidev/routes",
-	getContent() {
-		return [`export { slides } from '#slidev/slides'`, `console.warn('[slidev] #slidev/routes is deprecated, use #slidev/slides instead')`].join("\n");
-	}
-};
-/**
-* Kept for backward compatibility, use #slidev/title-renderer instead
-*
-* @deprecated
-*/
-const templateLegacyTitles = {
-	id: "/@slidev/titles.md",
-	getContent() {
-		return `
-<script setup lang="ts">
-import TitleRenderer from '#slidev/title-renderer'
-defineProps<{ no: number | string }>()
-console.warn('/@slidev/titles.md is deprecated, import from #slidev/title-renderer instead')
-<\/script>
-
-<TitleRenderer :no="no" />
-`;
-	}
-};
-//#endregion
-//#region node/virtual/titles.ts
-const templateTitleRendererMd = {
-	id: "/@slidev/title-renderer.md",
-	getContent({ data }) {
-		const lines = data.slides.map(({ title }, i) => `<template ${i === 0 ? "v-if" : "v-else-if"}="no === ${i + 1}">\n\n${title}\n\n</template>`);
-		lines.push(`<script setup lang="ts">`, `import { useSlideContext } from '@slidev/client/context.ts'`, `import { computed } from 'vue'`, `const props = defineProps<{ no?: number | string }>()`, `const { $page } = useSlideContext()`, `const no = computed(() => +(props.no ?? $page.value))`, `<\/script>`);
-		return lines.join("\n");
-	}
-};
-const templateTitleRenderer = {
-	id: "/@slidev/title-renderer",
-	async getContent() {
-		return "export { default } from \"/@slidev/title-renderer.md\"";
-	}
-};
-//#endregion
-//#region node/vite/importGuard.ts
-const virtualSlideMarkdownIds = /* @__PURE__ */ new Set([templateTitleRendererMd.id, templateLegacyTitles.id]);
-function createSlideImportGuardPlugin() {
-	let config;
-	let allowRoots = [];
-	return {
-		name: "slidev:slide-import-guard",
-		configResolved(resolved) {
-			config = resolved;
-			allowRoots = config.server.fs.allow.map(normalizeFsPath);
-		},
-		async transform(code, id) {
-			if (!isSlideMarkdownId(id) || !config?.server.fs.strict) return null;
-			const importer = filePathFromId(id) ?? id;
-			await Promise.all(extractImportSources(code, id).map(async ({ value, start }) => {
-				const resolved = await this.resolve(value, importer, { skipSelf: true });
-				if (!resolved || resolved.external) return;
-				const filePath = filePathFromId(resolved.id);
-				if (!filePath) return;
-				const normalized = normalizeFsPath(filePath);
-				if (isAllowedFile(normalized, allowRoots)) return;
-				if (isBareImport(value) && isDependencyFile(normalized)) return;
-				this.error(`[slidev] Import "${value}" from slide Markdown resolves outside of Vite server.fs.allow: ${normalized}`, start);
-			}));
-			return null;
-		}
-	};
-}
-function isSlideMarkdownId(id) {
-	const clean = cleanUrl$1(id);
-	return regexSlideSourceId.test(clean) || virtualSlideMarkdownIds.has(clean);
-}
-function filePathFromId(id) {
-	const clean = cleanUrl$1(id);
-	if (clean.startsWith("file://")) return fileURLToPath(clean);
-	if (clean.startsWith("/@fs/")) return clean.slice(4);
-	if (clean.startsWith("/@")) return null;
-	if (path.isAbsolute(clean)) return clean;
-	return null;
-}
-function isAllowedFile(filePath, allowRoots) {
-	return allowRoots.some((root) => isFileInRoot(root, filePath));
-}
-function extractImportSources(code, id) {
-	const result = parseSync(id, code);
-	const sources = [];
-	for (const item of result.module.staticImports) sources.push({
-		value: item.moduleRequest.value,
-		start: item.moduleRequest.start
-	});
-	for (const item of result.module.staticExports) for (const entry of item.entries) if (entry.moduleRequest) sources.push({
-		value: entry.moduleRequest.value,
-		start: entry.moduleRequest.start
-	});
-	for (const item of result.module.dynamicImports) {
-		const source = parseStringLiteral(code.slice(item.moduleRequest.start, item.moduleRequest.end));
-		if (source) sources.push({
-			value: source,
-			start: item.moduleRequest.start
-		});
-	}
-	return sources;
-}
-function cleanUrl$1(id) {
-	return id.replace(/[?#].*$/, "");
-}
-function normalizeFsPath(filePath) {
-	const absolute = path.resolve(filePath);
-	if (!existsSync(absolute)) return normalizeMissingFsPath(absolute);
-	return realpathSync.native(absolute);
-}
-function normalizeMissingFsPath(filePath) {
-	const dir = path.dirname(filePath);
-	if (dir === filePath) return filePath;
-	if (existsSync(dir)) return path.join(realpathSync.native(dir), path.basename(filePath));
-	return path.join(normalizeMissingFsPath(dir), path.basename(filePath));
-}
-function isFileInRoot(root, filePath) {
-	const relative = path.relative(root, filePath);
-	return relative === "" || !!relative && !relative.startsWith("..") && !path.isAbsolute(relative);
-}
-function isDependencyFile(filePath) {
-	return filePath.split(/[\\/]/).includes("node_modules");
-}
-function isBareImport(source) {
-	return /^(?![a-z]:)[\w@](?!.*:\/\/)/i.test(source);
-}
-function parseStringLiteral(raw) {
-	const trimmed = raw.trim();
-	const quote = trimmed[0];
-	if (quote !== "\"" && quote !== "'" && quote !== "`") return null;
-	if (trimmed.at(-1) !== quote) return null;
-	if (quote === "`" && trimmed.includes("${")) return null;
-	try {
-		if (quote === "\"") return JSON.parse(trimmed);
-		return JSON.parse(`"${trimmed.slice(1, -1).replace(/"/g, "\\\"")}"`);
-	} catch {
-		return trimmed.slice(1, -1);
-	}
-}
-//#endregion
 //#region node/vite/inspect.ts
 async function createInspectPlugin(options, pluginOptions) {
 	if (!options.inspect) return;
@@ -690,7 +698,7 @@ function createLayoutWrapperPlugin({ data, utils }) {
 }
 //#endregion
 //#region package.json
-var version = "52.17.0";
+var version = "52.17.1";
 //#endregion
 //#region node/integrations/addons.ts
 async function resolveAddons(addonsInConfig) {
@@ -986,22 +994,31 @@ const debug = createDebug("slidev:options");
 async function resolveOptions(entryOptions, mode) {
 	const entry = await resolveEntry(entryOptions.entry);
 	const rootsInfo = await getRoots(entry);
-	const loaded = await parser.load({
+	const initialLoaded = await parser.load({
 		userRoot: rootsInfo.userRoot,
-		roots: [rootsInfo.userRoot]
+		roots: [rootsInfo.userRoot],
+		allowedRoots: uniq([rootsInfo.userWorkspaceRoot, rootsInfo.userRoot])
 	}, entry, void 0, mode);
-	let themeRaw = entryOptions.theme || loaded.headmatter.theme;
+	let themeRaw = entryOptions.theme || initialLoaded.headmatter.theme;
 	themeRaw = themeRaw === null ? "none" : themeRaw || "default";
 	const [theme, themeRoot] = await resolveTheme(themeRaw, entry);
 	const themeRoots = themeRoot ? [themeRoot] : [];
 	const themeMeta = themeRoot ? await getThemeMeta(theme, themeRoot) : void 0;
-	const config = parser.resolveConfig(loaded.headmatter, themeMeta, entryOptions.entry);
-	const addonRoots = await resolveAddons(config.addons);
+	const initialConfig = parser.resolveConfig(initialLoaded.headmatter, themeMeta, entryOptions.entry);
+	const addonRoots = await resolveAddons(initialConfig.addons);
 	const roots = uniq([
 		...themeRoots,
 		...addonRoots,
 		rootsInfo.userRoot
 	]);
+	const loaded = await parser.load({
+		userRoot: rootsInfo.userRoot,
+		roots,
+		allowedRoots: uniq([rootsInfo.userWorkspaceRoot, ...roots])
+	}, entry, void 0, mode);
+	const config = parser.resolveConfig(loaded.headmatter, themeMeta, entryOptions.entry);
+	config.theme = themeRaw;
+	config.addons = initialConfig.addons;
 	if (entryOptions.download) config.download ||= entryOptions.download;
 	if (entryOptions.routerMode) config.routerMode = entryOptions.routerMode;
 	debug({
@@ -2043,7 +2060,12 @@ function createMonacoWriterPlugin({ userRoot }) {
 							console.error(`[Slidev] Unauthorized file write: ${file}`);
 							return;
 						}
-						const filepath = path.join(userRoot, file);
+						const filepath = path.resolve(userRoot, file);
+						const rel = path.relative(userRoot, filepath);
+						if (rel.startsWith("..") || path.isAbsolute(rel)) {
+							console.error(`[slidev] Refusing monaco write outside project root: ${file}`);
+							return;
+						}
 						console.log("[Slidev] Writing file:", filepath);
 						await fs$1.writeFile(filepath, content, "utf-8");
 					}
@@ -2128,7 +2150,7 @@ function findRegion(lines, regionName) {
 	return null;
 }
 const RE_SNIPPET_IMPORT = /^<<<[ \t]*(\S.*?)(#[\w-]+)?[ \t]*(?:[ \t](\S+?))?[ \t]*(\{.*)?$/;
-function resolveSnippetImport(lineText, userRoot, slide) {
+function resolveSnippetImport(lineText, userRoot, slide, allowedRoots = [userRoot]) {
 	const match = lineText.trimStart().match(RE_SNIPPET_IMPORT);
 	if (!match) return null;
 	let [, filepath = "", regionName = "", lang = "", meta = ""] = match;
@@ -2136,6 +2158,7 @@ function resolveSnippetImport(lineText, userRoot, slide) {
 	const src = slash(filepath.startsWith("@/") ? path.resolve(userRoot, filepath.slice(2)) : path.resolve(dir, filepath));
 	lang = lang.trim() || path.extname(filepath).slice(1);
 	meta = meta.trim();
+	if (!isPathInsideRoots(src, allowedRoots)) throw new Error(`Code snippet path escapes the project root: ${src}`);
 	if (!(fs.existsSync(src) && fs.statSync(src).isFile())) throw new Error(`Code snippet path not found: ${src}`);
 	let content = fs.readFileSync(src, "utf8");
 	if (regionName) {
@@ -2151,7 +2174,12 @@ function resolveSnippetImport(lineText, userRoot, slide) {
 		src
 	};
 }
-function MarkdownItSnippet(md, { userRoot, data: { watchFiles, slides } }) {
+function MarkdownItSnippet(md, { userRoot, userWorkspaceRoot, roots, data: { watchFiles, slides } }) {
+	const allowedRoots = [...new Set([
+		userWorkspaceRoot,
+		userRoot,
+		...roots ?? []
+	].filter(Boolean))];
 	md.block.ruler.before("fence", "snippet_import", (state, startLine, _endLine, silent) => {
 		const pos = state.bMarks[startLine] + state.tShift[startLine];
 		const max = state.eMarks[startLine];
@@ -2164,7 +2192,7 @@ function MarkdownItSnippet(md, { userRoot, data: { watchFiles, slides } }) {
 			console.warn(yellow(`[markdown-it-snippet] Snippet syntax is not supported in ${state.env.id || "unknown source"}. Skipped.`));
 			return false;
 		}
-		const snippet = resolveSnippetImport(lineText, userRoot, slide);
+		const snippet = resolveSnippetImport(lineText, userRoot, slide, allowedRoots);
 		if (!snippet) return false;
 		const { content, filepath, src } = snippet;
 		let { lang, meta } = snippet;
@@ -2870,6 +2898,16 @@ function createSlidevMcpServer(ctx) {
 }
 //#endregion
 //#region node/integrations/drawings.ts
+/**
+* Whether `key` is a safe bare slide id that can be joined onto `dir` without
+* escaping it. `loadDrawings` only ever produces numeric keys, so writes
+* should only ever accept numeric keys too.
+*/
+function isSafeDrawingKey(dir, key) {
+	if (!/^\d+$/.test(key)) return false;
+	const rel = relative(dir, join(dir, `${key}.svg`));
+	return !rel.startsWith("..") && !isAbsolute(rel);
+}
 function resolveDrawingsDir(options) {
 	return options.data.config.drawings.persist ? resolve(dirname(options.entry), options.data.config.drawings.persist) : void 0;
 }
@@ -2899,6 +2937,10 @@ async function writeDrawings(options, drawing) {
 	await fs$1.mkdir(dir, { recursive: true });
 	return Promise.all(Object.entries(drawing).map(async ([key, value]) => {
 		if (!value) return;
+		if (!isSafeDrawingKey(dir, key)) {
+			console.warn(`[slidev] Ignoring drawing with unsafe key: ${key}`);
+			return;
+		}
 		const svg = `${SVG_HEAD}\n${value}\n</svg>`;
 		await fs$1.writeFile(join(dir, `${key}.svg`), svg, "utf-8");
 	}));

package/dist/{stdio-LsewwOTO.mjs → stdio-CjXw2-ks.mjs}

@@ -1,5 +1,5 @@
 import { n as getRoots } from "./resolver-BBT539iz.mjs";
-import { i as createSlidevMcpServer, s as parser, u as version } from "./serve-CgOXLPUI.mjs";
+import { i as createSlidevMcpServer, s as parser, u as version } from "./serve-bAegrEOc.mjs";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region node/mcp/stdio.ts
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@slidev/cli",
   "type": "module",
-  "version": "52.17.0",
+  "version": "52.17.1",
   "description": "Presentation slides for developers",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -114,9 +114,9 @@
     "yaml": "^2.9.0",
     "yargs": "^18.0.0",
     "zod": "^3.25.76",
-    "@slidev/parser": "52.17.0",
-    "@slidev/client": "52.17.0",
-    "@slidev/types": "52.17.0"
+    "@slidev/types": "52.17.1",
+    "@slidev/client": "52.17.1",
+    "@slidev/parser": "52.17.1"
   },
   "devDependencies": {
     "@hedgedoc/markdown-it-plugins": "^2.1.4",