backpass 0.1.10 → 0.1.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "backpass",
3
- "version": "0.1.10",
3
+ "version": "0.1.11",
4
4
  "packageManager": "pnpm@11.5.0",
5
5
  "description": "Gradient descent for your agent memory - analyzes past agent session transcripts and proposes evidence-backed edits to AGENTS.md / CLAUDE.md",
6
6
  "type": "module",
@@ -26,7 +26,10 @@ export function injectPayload(template, payload, toolVersion) {
26
26
  .replace(/\u2029/g, "\\u2029");
27
27
  const tag = `<script>window.__BACKPASS_PROPOSAL__ = ${json};</script>`;
28
28
  if (!template.includes("</head>")) return `${tag}\n${template}`;
29
- return template.replace("</head>", `${tag}\n</head>`);
29
+ // A function replacer, not a string one: a string second argument to `replace` treats
30
+ // `$&`, `` $` ``, `$'`, and `$$` in it as replacement patterns, and `tag` embeds
31
+ // untrusted proposal text that can contain any of those sequences verbatim.
32
+ return template.replace("</head>", () => `${tag}\n</head>`);
30
33
  }
31
34
 
32
35
  export function renderApplySurface(proposal, state, toolVersion) {