arcane-os 0.16.0 → 0.16.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.16.2
+
+- Scope explicit application selection and workspace resolution to the named
+  app before reading its descriptor. An unrelated invalid descriptor no longer
+  blocks that operation. Selected descriptors and unscoped discovery retain
+  their existing validation. Named resolution reports only the selected app in
+  `appIds`; unknown selections report the requested missing identifier without
+  validating or listing unrelated apps.
+
+## 0.16.1
+
+- Remove raw script elements and inline event-handler attributes at the
+  `markdown-document` insertion boundary, including nested template contents.
+  Preserve literal fenced and inline code examples, formatting, navigation,
+  and asynchronous document loading. This targeted reader correction does not
+  provide a general-purpose HTML sanitizer or alter other Markdown consumers.
+
 ## 0.16.0
 
 - Make mail hosting domain-based: use the current browser origin by default,

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.16.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.16.2` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -67,7 +67,7 @@
   "scripts": {
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
-    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
+    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
     "test:functional": "node ./bin/arcane-test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/cli.test.mjs test/dbopfs-document-library.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/update-check.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",

package/runtime/arcane/components/markdown-document.html

@@ -616,8 +616,8 @@
             return true;
         }
 
-        // MD.safeRendered owns Markdown rendering. The detached template keeps
-        // source-relative links and images coherent before insertion.
+        // MD renders Markdown; the detached fragment removes active script
+        // markup and resolves source-relative assets before insertion.
         const safeRendered=new MD(markdown).safeRendered;
         const fragment=renderedMarkdownFragment(safeRendered,sourceURL);
         const meaningful=Boolean(
@@ -648,6 +648,27 @@
         const template=document.createElement('template');
         template.innerHTML=html;
 
+        // Code examples are text nodes, so their literal markup stays intact.
+        // Visit nested template contents too, without reparsing cleaned HTML.
+        const pendingFragments=[template.content];
+        while(pendingFragments.length){
+            const fragment=pendingFragments.pop();
+            for(const element of fragment.querySelectorAll('*')){
+                if(element.localName.toLowerCase()==='script'){
+                    element.remove();
+                    continue;
+                }
+                for(const attribute of Array.from(element.attributes)){
+                    if(attribute.name.toLowerCase().startsWith('on')){
+                        element.removeAttributeNode(attribute);
+                    }
+                }
+                if(element.localName==='template'&&element.content){
+                    pendingFragments.push(element.content);
+                }
+            }
+        }
+
         for(const link of template.content.querySelectorAll('a[href]')){
             const originalHref=link.getAttribute('href')||'';
             const policy=markdownDocumentLinkPolicy(originalHref,sourceURL,pageOrigin);

package/src/workspace.mjs

@@ -216,12 +216,17 @@ function classifyRootConfig(config){
     });
 }
 
-async function discoverAppsInRoot(root,config){
+async function discoverAppsInRoot(root,config,appId){
+    if(appId!==undefined&&(!is.string(appId)||!APP_ID_PATTERN.test(appId))){
+        fail(`Invalid app id: ${String(appId)}.`,'ARCANE_USAGE');
+    }
     const appsRoot=path.join(root,'apps');
     await assertRealDirectory(appsRoot,'Workspace apps root');
     const entries=await readdir(appsRoot,{withFileTypes:true});
     const apps=[];
     for(const entry of entries.sort((left,right)=>ordinal(left.name,right.name))){
+        // A named operation validates that app, not unrelated application descriptors.
+        if(appId!==undefined&&entry.name!==appId)continue;
         if(!APP_ID_PATTERN.test(entry.name))continue;
         if(entry.isSymbolicLink())fail(`apps/${entry.name} must not be a symbolic link or junction.`);
         if(!entry.isDirectory())continue;
@@ -274,13 +279,11 @@ export async function inspectWorkspaceProfile(workspaceRoot=process.cwd()){
 }
 
 export async function selectApp(workspaceRoot=process.cwd(),appId){
-    const apps=await discoverApps(workspaceRoot);
-    if(appId!==undefined&&(!is.string(appId)||!APP_ID_PATTERN.test(appId))){
-        fail(`Invalid app id: ${String(appId)}.`,'ARCANE_USAGE');
-    }
+    const profile=await inspectWorkspaceProfile(workspaceRoot);
+    const apps=await discoverAppsInRoot(profile.workspaceRoot,profile.config,appId);
     if(appId){
         const selected=apps.find(app=>app.appId===appId);
-        if(!selected)fail(`Unknown app "${appId}". Available apps: ${apps.map(app=>app.appId).join(', ')||'[none]'}.`);
+        if(!selected)fail(`Unknown app "${appId}".`);
         return selected;
     }
     if(apps.length===0)fail('No Arcane applications were found under apps/.');
@@ -294,14 +297,11 @@ export async function resolveWorkspace({workspaceRoot=process.cwd(),appId}={}){
     const profile=await inspectWorkspaceProfile(workspaceRoot);
     const canonicalRoot=profile.workspaceRoot;
     const config=profile.config;
-    const apps=await discoverAppsInRoot(canonicalRoot,config);
-    if(appId!==undefined&&(!is.string(appId)||!APP_ID_PATTERN.test(appId))){
-        fail(`Invalid app id: ${String(appId)}.`,'ARCANE_USAGE');
-    }
+    const apps=await discoverAppsInRoot(canonicalRoot,config,appId);
     let app;
     if(appId){
         app=apps.find(item=>item.appId===appId);
-        if(!app)fail(`Unknown app "${appId}". Available apps: ${apps.map(item=>item.appId).join(', ')||'[none]'}.`);
+        if(!app)fail(`Unknown app "${appId}".`);
     }else if(apps.length===1){
         [app]=apps;
     }else if(apps.length===0){