buninu 0.5.0 → 0.7.0

package/apps/jsgotty/tests/touch-drag-browser.test.js

@@ -0,0 +1,106 @@
+// Opt-in real bundled-xterm integration; no browser/dependency downloads.
+// CHROMIUM_HEADLESS=/path/to/chromium-headless-shell node --test tests/touch-drag-browser.test.js
+const test=require('node:test');
+const assert=require('node:assert/strict');
+const fs=require('node:fs');
+const path=require('node:path');
+const http=require('node:http');
+const {spawn}=require('node:child_process');
+const {once}=require('node:events');
+const WebSocket=require('ws');
+const root=path.join(__dirname,'../static');
+test('touch double-tap drag and image-menu right click use bundled xterm', {skip:!process.env.CHROMIUM_HEADLESS,timeout:60000},async()=>{
+ const bundle=fs.readFileSync(path.join(root,'js/gotty.js'),'utf8').replace('(i.nc = void 0));','(i.nc = void 0)); window.TestGoTTYXterm = i(634).GoTTYXterm;');
+ const server=http.createServer((req,res)=>{
+  if(req.url==='/index.css'){res.setHeader('Content-Type','text/css');res.end(fs.readFileSync(path.join(root,'css/index.css')));}
+  else if(req.url==='/bundle.js'){res.setHeader('Content-Type','text/javascript');res.end(bundle);}
+  else if(req.url==='/gestures.js'){
+   const source=fs.readFileSync(path.join(root,'js/kitty.js'),'utf8');
+   res.setHeader('Content-Type','text/javascript');
+   res.end(source.slice(source.indexOf('  function reportTouchMouse('),source.indexOf('  function ensureContextMenu('))+source.slice(source.indexOf('  function ensureContextMenu('),source.indexOf('  function bindImageContextMenu('))+source.slice(source.indexOf('  function bindImageContextMenu('),source.indexOf('  function bindImageContextMenu(')+source.slice(source.indexOf('  function bindImageContextMenu(')).indexOf('\n  function ',5))+'\nbindTouchScrolling();bindImageContextMenu();');
+  }
+  else if(req.url==='/keyboard.js'){res.setHeader('Content-Type','text/javascript');res.end(fs.readFileSync(path.join(root,'js/kitty-keyboard.js')));}
+  else res.end('<!doctype html><div id="terminal"><div id="fixture" style="width:800px;height:600px"></div></div><link rel="stylesheet" href="/index.css"><script src="/keyboard.js"></script><script src="/bundle.js"></script><script>window.wrapper=new TestGoTTYXterm(document.getElementById("fixture"));window.sent=[];wrapper.onInput(b=>sent.push(new TextDecoder().decode(b)));wrapper.kittyKeyboard.android=true;</script>');
+ });
+ server.listen(0,'127.0.0.1');await once(server,'listening');
+ const child=spawn(process.env.CHROMIUM_HEADLESS,['--no-sandbox','--disable-gpu','--remote-debugging-port=0','http://127.0.0.1:'+server.address().port],{detached:true,stdio:['ignore','ignore','pipe']});
+ let ws;
+ try{
+  const endpoint=await new Promise((resolve,reject)=>{let log='';const timer=setTimeout(()=>reject(Error('Browser startup timeout: '+log)),15000);child.on('error',reject);child.on('exit',code=>{clearTimeout(timer);reject(Error('Browser exited '+code+': '+log));});child.stderr.on('data',b=>{log+=b;const m=log.match(/DevTools listening on (ws:\/\/[^\s]+)/);if(m){clearTimeout(timer);resolve(m[1]);}});});
+  const u=new URL(endpoint);let tab;
+  for(let i=0;i<50;i++){tab=(await (await fetch('http://'+u.host+'/json/list')).json()).find(x=>x.type==='page');if(tab)break;await new Promise(r=>setTimeout(r,100));}
+  ws=new WebSocket(tab.webSocketDebuggerUrl);await once(ws,'open');let id=0;const pending=new Map();ws.on('message',data=>{const m=JSON.parse(data);if(pending.has(m.id)){const {resolve,reject}=pending.get(m.id);pending.delete(m.id);m.error?reject(m.error):resolve(m.result);}});
+  const call=(method,params)=>new Promise((resolve,reject)=>{pending.set(++id,{resolve,reject});ws.send(JSON.stringify({id,method,params}));});
+  for(let i=0;i<50;i++){const r=await call('Runtime.evaluate',{expression:'Boolean(window.wrapper)',returnByValue:true});if(r.result.value)break;await new Promise(r=>setTimeout(r,100));}
+  const result=await call('Runtime.evaluate',{awaitPromise:true,returnByValue:true,expression:`(async()=>{
+   const term=wrapper.term;
+   const write=s=>new Promise(r=>term.write(s,r));
+   const equal=(a,b)=>{if(JSON.stringify(a)!==JSON.stringify(b))throw Error(JSON.stringify({actual:a,expected:b}));};
+   await write('\\x1b[?1002h\\x1b[?1006h');
+   const terminal=document.getElementById('fixture');terminal.__gottyXterm=term;
+   const screen=term.element.querySelector('.xterm-screen'), rect=screen.getBoundingClientRect();
+   const state={placements:new Map()};
+   const xtermElements=()=>({screen});
+   const DEFAULT_TOUCH_SCROLL_THRESHOLD=24;
+   const removePlacementNode=node=>node.remove();
+   eval(await (await fetch('/gestures.js')).text());
+   const touch=(type,x=30,y=30,count=1)=>{
+    const point=new Touch({identifier:1,target:screen,clientX:rect.left+x,clientY:rect.top+y});
+    const touches=type==='touchend'||type==='touchcancel'?[]:count===1?[point]:[point,new Touch({identifier:2,target:screen,clientX:rect.left+x+30,clientY:rect.top+y})];
+    const event=new TouchEvent(type,{bubbles:true,cancelable:true,touches,changedTouches:[point]});
+    screen.dispatchEvent(event);return event.defaultPrevented;
+   };
+   const codes=()=>sent.map(s=>{const m=s.match(/<([0-9]+);[0-9]+;[0-9]+([Mm])/);return m?m[1]+m[2]:s;});
+   let focusCalls=0;const originalFocus=term._core.focus;term._core.focus=function(...args){focusCalls++;return originalFocus.apply(this,args);};
+   const firstTap=()=>{touch('touchstart');touch('touchend');
+    // Browser compatibility mouse sequence after an ordinary tap.
+    for(const type of ['mousedown','mouseup'])screen.dispatchEvent(new MouseEvent(type,{bubbles:true,clientX:rect.left+30,clientY:rect.top+30,button:0,buttons:type==='mousedown'?1:0}));};
+   sent.length=0;firstTap();equal(codes(),['0M','0m']);
+   const focusBeforeDrag=focusCalls;
+   if(!touch('touchstart'))throw Error('Second press must suppress compatibility click');
+   equal(codes(),['0M','0m','0M']); // still held, no premature release
+   touch('touchmove',80,70);touch('touchend',80,70);
+   equal(codes(),['0M','0m','0M','32M','0m']);
+   equal(focusCalls,focusBeforeDrag);
+   sent.length=0;firstTap();touch('touchstart');touch('touchend');
+   equal(codes(),['0M','0m','0M','0m']); // ordinary double click
+   for(const cancel of [()=>touch('touchcancel'),()=>touch('touchstart',30,30,2),()=>window.dispatchEvent(new Event('blur')),()=>state.cancelTouchGesture()]){
+    sent.length=0;firstTap();touch('touchstart');cancel();touch('touchend');equal(codes(),['0M','0m','0M','0m']);
+   }
+   sent.length=0;firstTap();touch('touchstart');
+   touch('touchmove',-200,-200);touch('touchend',-200,-200);
+   equal(codes(),['0M','0m','0M','32M','0m']); // release outside grid still reaches application
+   sent.length=0;touch('touchstart');touch('touchmove',30,90);touch('touchend',30,90);
+   if(!codes().length||codes().some(x=>!x.startsWith('64')))throw Error('Single touch must remain scrolling: '+codes());
+   sent.length=0;touch('touchstart');touch('touchmove',30,90);touch('touchend',30,90);
+   if(codes().some(x=>x==='0M'))throw Error('Scroll must not arm double tap');
+   // Use precisely the existing image context-menu path, with its original location.
+   const node=document.createElement('div');node.style.zIndex='0';node.getBoundingClientRect=()=>({left:0,top:0,right:1000,bottom:1000});state.placements.set('image',node);
+   screen.dispatchEvent(new MouseEvent('contextmenu',{bubbles:true,cancelable:true,clientX:rect.left+30,clientY:rect.top+30,button:2}));
+   if(state.contextMenu.root.hidden)throw Error('Menu missing');
+   const focusBeforeRight=focusCalls;
+   sent.length=0;state.contextMenu.rightButton.click();equal(focusCalls,focusBeforeRight);equal(codes(),['2M','2m']);
+   if(!state.contextMenu.root.hidden||!state.placements.has('image'))throw Error('Right click must hide menu and preserve image');
+   await write('\\x1b[?1002l');state.cancelTouchGesture();sent.length=0;
+   firstTap();touch('touchstart');touch('touchmove',80,70);touch('touchend');
+   if(codes().some(x=>/^[032][Mm]$/.test(x)))throw Error('No application mouse reporting outside mouse mode');
+   state.cancelTouchGesture();state.placements.clear();
+   term.focus();const textarea=term.textarea;
+   screen.dispatchEvent(new MouseEvent('contextmenu',{bubbles:true,cancelable:true,clientX:rect.left+30,clientY:rect.top+30,button:2}));
+   if(document.activeElement!==textarea)throw Error('Context menu must keep textarea focused for native paste');
+   const data=new DataTransfer();data.setData('text/plain','paste-check');sent.length=0;
+   textarea.dispatchEvent(new ClipboardEvent('paste',{bubbles:true,cancelable:true,clipboardData:data}));
+   if(!sent.join('').includes('paste-check'))throw Error('Paste stopped working');
+   equal(getComputedStyle(textarea).touchAction,'none');
+   equal(getComputedStyle(screen).touchAction,'manipulation');
+   touch('touchstart');
+   if(document.activeElement!==textarea)throw Error('Touch must not blur the input');
+   touch('touchend');
+   wrapper.close();return 'ok';
+  })()`});
+  assert.equal(result.exceptionDetails,undefined,JSON.stringify(result.exceptionDetails));assert.equal(result.result.value,'ok');
+ }finally{
+  ws?.close();if(child.pid){try{process.kill(-child.pid,'SIGTERM');}catch{}}
+  server.closeAllConnections();await new Promise(r=>server.close(r));
+ }
+});

package/apps/jsgotty/tests/wheel-browser.test.js

@@ -0,0 +1,60 @@
+// Opt-in real bundled-xterm integration; no browser/dependency downloads.
+// CHROMIUM_HEADLESS=/path/to/chromium-headless-shell node --test tests/kitty-keyboard-browser.test.js
+const test=require('node:test');
+const assert=require('node:assert/strict');
+const fs=require('node:fs');
+const path=require('node:path');
+const http=require('node:http');
+const {spawn}=require('node:child_process');
+const {once}=require('node:events');
+const WebSocket=require('ws');
+const root=path.join(__dirname,'../static');
+test('shipped xterm reports horizontal, vertical and diagonal wheel events', {skip:!process.env.CHROMIUM_HEADLESS,timeout:60000},async()=>{
+ const bundle=fs.readFileSync(path.join(root,'js/gotty.js'),'utf8').replace('(i.nc = void 0));','(i.nc = void 0)); window.TestGoTTYXterm = i(634).GoTTYXterm;');
+ const server=http.createServer((req,res)=>{
+  if(req.url==='/bundle.js'){res.setHeader('Content-Type','text/javascript');res.end(bundle);}
+  else if(req.url==='/keyboard.js'){res.setHeader('Content-Type','text/javascript');res.end(fs.readFileSync(path.join(root,'js/kitty-keyboard.js')));}
+  else res.end('<!doctype html><div id="fixture" style="width:800px;height:600px"></div><script src="/keyboard.js"></script><script src="/bundle.js"></script><script>window.wrapper=new TestGoTTYXterm(document.getElementById("fixture"));window.sent=[];wrapper.onInput(b=>sent.push(new TextDecoder().decode(b)));wrapper.kittyKeyboard.android=true;</script>');
+ });
+ server.listen(0,'127.0.0.1');await once(server,'listening');
+ const child=spawn(process.env.CHROMIUM_HEADLESS,['--no-sandbox','--disable-gpu','--remote-debugging-port=0','http://127.0.0.1:'+server.address().port],{detached:true,stdio:['ignore','ignore','pipe']});
+ let ws;
+ try{
+  const endpoint=await new Promise((resolve,reject)=>{let log='';const timer=setTimeout(()=>reject(Error('Browser startup timeout: '+log)),15000);child.on('error',reject);child.on('exit',code=>{clearTimeout(timer);reject(Error('Browser exited '+code+': '+log));});child.stderr.on('data',b=>{log+=b;const m=log.match(/DevTools listening on (ws:\/\/[^\s]+)/);if(m){clearTimeout(timer);resolve(m[1]);}});});
+  const u=new URL(endpoint);let tab;
+  for(let i=0;i<50;i++){tab=(await (await fetch('http://'+u.host+'/json/list')).json()).find(x=>x.type==='page');if(tab)break;await new Promise(r=>setTimeout(r,100));}
+  ws=new WebSocket(tab.webSocketDebuggerUrl);await once(ws,'open');let id=0;const pending=new Map();ws.on('message',data=>{const m=JSON.parse(data);if(pending.has(m.id)){const {resolve,reject}=pending.get(m.id);pending.delete(m.id);m.error?reject(m.error):resolve(m.result);}});
+  const call=(method,params)=>new Promise((resolve,reject)=>{pending.set(++id,{resolve,reject});ws.send(JSON.stringify({id,method,params}));});
+  for(let i=0;i<50;i++){const r=await call('Runtime.evaluate',{expression:'Boolean(window.wrapper)',returnByValue:true});if(r.result.value)break;await new Promise(r=>setTimeout(r,100));}
+  const result=await call('Runtime.evaluate',{awaitPromise:true,returnByValue:true,expression:`(async()=>{
+   const term=wrapper.term;
+   const write=s=>new Promise(r=>term.write(s,r));
+   const equal=(a,b)=>{if(JSON.stringify(a)!==JSON.stringify(b))throw Error(JSON.stringify({actual:a,expected:b}));};
+   await write('\\x1b[?1002h\\x1b[?1006h');
+   const screen=term.element.querySelector('.xterm-screen'), rect=screen.getBoundingClientRect();
+   const wheel=(deltaX,deltaY,mods={})=>{
+    sent.length=0;
+    const event=new WheelEvent('wheel',{clientX:rect.left+20,clientY:rect.top+20,deltaX,deltaY,deltaMode:1,bubbles:true,cancelable:true,...mods});
+    screen.dispatchEvent(event);
+    if(term._core.coreMouseService.areMouseEventsActive&&!event.defaultPrevented)throw Error('Wheel default was not prevented');
+    return sent.map(s=>Number(s.match(/<([0-9]+);/)[1]));
+   };
+   equal(wheel(-1,0),[66]);equal(wheel(1,0),[67]);
+   equal(wheel(0,-1,{shiftKey:true}),[68]);equal(wheel(0,1,{shiftKey:true}),[69]);
+   equal(wheel(0,-1),[64]);equal(wheel(0,1),[65]);
+   equal(wheel(1,-1),[67,64]);
+   equal(wheel(-1,0,{shiftKey:true,altKey:true,ctrlKey:true}),[94]);
+   for(let bits=0;bits<8;bits++) {
+    const mods={shiftKey:!!(bits&1),altKey:!!(bits&2),ctrlKey:!!(bits&4)};
+    for(const [dx,dy,code] of [[0,-1,64],[0,1,65],[-1,0,66],[1,0,67]])
+     equal(wheel(dx,dy,mods),[code+(bits<<2)]);
+   }
+   await write('\\x1b[?1002l');equal(wheel(1,0),[]);
+   wrapper.close();return 'ok';
+  })()`});
+  assert.equal(result.exceptionDetails,undefined,JSON.stringify(result.exceptionDetails));assert.equal(result.result.value,'ok');
+ }finally{
+  ws?.close();if(child.pid){try{process.kill(-child.pid,'SIGTERM');}catch{}}
+  server.closeAllConnections();await new Promise(r=>server.close(r));
+ }
+});

package/apps/jsmdcui/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 All notable user-visible changes to jsmdcui are documented here.
 
+## [0.19.4] - 2026-10-26
+
+### Fixed
+
+- Catch failures during Go regexp conversion as well as compilation, and
+  bound the converter's nested-group recursion. An excessively nested rule
+  is disabled individually instead of throwing from `SyntaxDefinition` or
+  causing the loader to silently discard the entire syntax definition.
+  Other rules remain usable; this does not limit input line length.
+
+## [0.19.3] - 2026-10-26
+
+### Fixed
+
+- Restore Dockerfile highlighting and improve compatibility with Micro's
+  syntax definitions by translating Go regular-expression flags and POSIX
+  character classes into JavaScript equivalents. Scoped flags retain their
+  scope rather than changing the entire expression.
+- Fix nested highlighting regions, especially HTML and XML attributes:
+  closing a quoted attribute now returns to the surrounding tag, and closing
+  the tag returns to normal text. Unfinished attributes still carry their
+  highlighting state across lines.
+- Replace recursive region scanning with an iterative scanner so long,
+  minified lines can be highlighted through their final token without stack
+  exhaustion or truncation.
+- Prevent zero-width region cycles and cyclic syntax/state trees from looping
+  indefinitely. Zero-width matches advance safely over Unicode characters,
+  and NUL characters or isolated surrogate units do not leak region state.
+  These guards do not impose a timeout on an individual JavaScript RegExp.
+
+### Added
+
+- Add syntax samples and a reproducible comparison against Micro's Go
+  highlighter, including JavaScript, Python and Markdown with upstream syntax
+  definitions. See [the comparison guide](tests/syntax-parity/README.md) for
+  generating the HTML comparison locally; generated HTML is not bundled.
+
+### Changed
+
+- Markdown heading tests detect Bun's actual raw-HTML parsing behavior instead
+  of relying on version checks, accommodating the slash-tag behavior change
+  while preserving fail-closed coverage. The heading suites were verified on
+  Bun 1.4.0 through 1.4.4.
+
 ## [0.19.2] - 2026-09-21
 
 ### Added

package/apps/jsmdcui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsmdcui",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "description": "Markdown as a Common UI for Terminals and Web Browsers",
   "type": "module",
   "main": "./src/index.js",

package/apps/jsmdcui/src/highlight/go-regexp.js

@@ -0,0 +1,83 @@
+// Adapt Go regexp syntax without changing the upstream syntax definitions.
+// Scoped JS modifiers preserve flag changes across alternatives, but not out
+// of their enclosing group. They add no capturing groups. Modifiers are only
+// emitted where flags differ from those in effect, so flag-free patterns
+// do not depend on engine support for them.
+export function convertGoRegexp(pattern) {
+  const source = String(pattern);
+  if (!/\(\?[ims-]|\[\^?\]|\(\?P<|\[:[a-z]+:\]/.test(source)) return source;
+  let i = 0;
+  function expression(inherited, active, nested = false, depth = 0) {
+    // Bound syntax-rule recursion, not the length of text being highlighted.
+    if (depth > 256) throw new RangeError('Go regexp nesting exceeds 256 groups');
+    const flags = new Set(inherited);
+    let output = '', wrapped = false;
+    function open() {
+      const on = 'ims'.split('').filter(f => flags.has(f) && !active.has(f)).join('');
+      const off = 'ims'.split('').filter(f => !flags.has(f) && active.has(f)).join('');
+      if (!on && !off) return;
+      output += `(?${on}${off ? '-' + off : ''}:`;
+      wrapped = true;
+    }
+    function close() { if (wrapped) output += ')'; wrapped = false; }
+    while (i < source.length) {
+      const ch = source[i];
+      if (ch === ')' && nested) { i++; close(); return output; }
+      if (ch === '|') { close(); output += '|'; i++; continue; }
+      const directive = ch === '(' && source.slice(i).match(/^\(\?([ims]*)(?:-([ims]+))?\)/);
+      if (directive && (directive[1] || directive[2])) {
+        close();
+        for (const f of directive[1]) flags.add(f);
+        for (const f of directive[2] || '') flags.delete(f);
+        i += directive[0].length;
+        continue;
+      }
+      if (!wrapped) open();
+      if (ch === '\\') { output += source.slice(i, i + 2); i += 2; continue; }
+      if (ch === '[') {
+        output += source[i++];
+        if (source[i] === '^') output += source[i++];
+        // Go permits a literal ] as the first member of a character class.
+        if (source[i] === ']') { output += '\\]'; i++; }
+        while (i < source.length) {
+          const posix = source.slice(i).match(/^\[:([a-z]+):\]/);
+          if (posix && POSIX_CLASSES[posix[1]] !== undefined) {
+            output += POSIX_CLASSES[posix[1]]; i += posix[0].length; continue;
+          }
+          const c = source[i++]; output += c;
+          if (c === '\\' && i < source.length) output += source[i++];
+          else if (c === ']') break;
+        }
+        continue;
+      }
+      if (ch === '(') {
+        const scoped = source.slice(i).match(/^\(\?([ims]*)(?:-([ims]+))?:/);
+        const childFlags = new Set(flags);
+        if (scoped) {
+          for (const f of scoped[1]) childFlags.add(f);
+          for (const f of scoped[2] || '') childFlags.delete(f);
+          output += '(?:'; i += scoped[0].length;
+        } else {
+          const prefix = source.slice(i).match(/^\(\?(?:[:=!]|<[=!]|<[^>]+>|P<[^>]+>)/);
+          output += prefix ? prefix[0].replace('(?P<', '(?<') : '(';
+          i += prefix ? prefix[0].length : 1;
+        }
+        output += expression(childFlags, flags, true, depth + 1) + ')';
+        continue;
+      }
+      output += ch; i++;
+    }
+    close();
+    return output;
+  }
+  return expression(new Set(), new Set());
+}
+
+// Class contents, not nested [...] expressions: e.g. [[:alnum:]._-].
+const POSIX_CLASSES = {
+  alnum: 'A-Za-z0-9', alpha: 'A-Za-z', ascii: '\\x00-\\x7F',
+  blank: ' \\t', cntrl: '\\x00-\\x1F\\x7F', digit: '0-9',
+  graph: '!-~', lower: 'a-z', print: ' -~',
+  punct: '!-/:-@\\[-`{-~', space: '\\t\\n\\v\\f\\r ',
+  upper: 'A-Z', word: 'A-Za-z0-9_', xdigit: 'A-Fa-f0-9',
+};

package/apps/jsmdcui/src/highlight/highlighter.js

@@ -8,9 +8,7 @@ export class Highlighter {
   highlightLine(line, state = null, progress = null) {
     const text = String(line);
     const changes = new Map([[0, state?.group ?? "default"]]);
-    const nextState = state
-      ? scanRegion(changes, text, 0, state, this.rules, progress)
-      : scanTop(changes, text, 0, this.rules, progress);
+    const nextState = scanLine(changes, text, state, this.rules, progress);
     return {
       changes: normalizeChanges(changes, text.length),
       state: nextState,
@@ -29,16 +27,18 @@ export class Highlighter {
   }
 }
 
-export function resolveRules(rules, definitions, seen) {
+export function resolveRules(rules, definitions, seen, ancestors = new Set()) {
+  if (ancestors.has(rules) || ancestors.size >= 128) return [];
+  const path = new Set(ancestors); path.add(rules);
   const out = [];
   for (const rule of rules) {
     if (rule.type === "include") {
       if (seen.has(rule.include)) continue;
       seen.add(rule.include);
       const def = definitions.find((candidate) => candidate.filetype === rule.include);
-      if (def) out.push(...resolveRules(def.rules, definitions, seen));
+      if (def) out.push(...resolveRules(def.rules, definitions, seen, path));
     } else if (rule.type === "region") {
-      out.push({ ...rule, rules: resolveRules(rule.rules ?? [], definitions, new Set(seen)) });
+      out.push({ ...rule, rules: resolveRules(rule.rules ?? [], definitions, new Set(seen), path) });
     } else {
       out.push(rule);
     }
@@ -53,67 +53,67 @@ export function flattenRules(rules, definitions, seen) {
   });
 }
 
-function scanTop(changes, line, pos, rules, progress = null) {
-  let cursor = pos;
+// Iterative state machine: adjacent tokens on a minified line must not consume
+// call-stack depth. A state repeated at an unchanged position steps forward.
+function scanLine(changes, line, region, rootRules, progress) {
+  let cursor = 0, previous = -1;
+  const visited = new Set();
+  const parents = new Set();
+  for (let r = region; r; r = r.parent) {
+    if (parents.has(r) || parents.size >= 128) { region = null; changes.set(0, "default"); break; }
+    parents.add(r);
+  }
   while (cursor <= line.length) {
-    progress?.(cursor);
-    const regionStart = findFirstRegion(rules, line, cursor, progress);
-    if (!regionStart) {
-      applyPatterns(changes, line, cursor, line.length, rules, "default", progress);
-      changes.set(line.length, "default");
-      progress?.(line.length);
+    if (cursor !== previous) { visited.clear(); previous = cursor; }
+    if (visited.has(region)) {
+      // A zero-width child can end and reopen forever at the same position.
+      // Skip one character in the current region, like a zero-width match.
+      cursor = advanceIndex(line, cursor);
+      continue;
+    }
+    if (visited.size >= 256) {
+      // Fresh object states from malformed externally supplied trees.
+      // Discard this line's unfinished region; do not poison subsequent lines.
+      changes.set(cursor, "default"); changes.set(line.length, "default");
       return null;
     }
-
-    applyPatterns(changes, line, cursor, regionStart.start, rules, "default", progress);
-    changes.set(regionStart.start, regionStart.region.limitGroup ?? "default");
-    changes.set(regionStart.end, regionStart.region.group);
-    progress?.(regionStart.end);
-
-    const state = scanRegion(changes, line, regionStart.end, regionStart.region, rules, progress);
-    if (state) return state;
-    return null;
-  }
-  return null;
-}
-
-function scanRegion(changes, line, pos, region, rootRules, progress = null) {
-  let cursor = pos;
-  const rules = region.rules ?? [];
-  while (cursor <= line.length) {
+    visited.add(region);
     progress?.(cursor);
-    const end = findMatch(region.end, line, cursor, region.skip, progress);
+    const rules = region?.rules ?? rootRules;
+    const end = region ? findMatch(region.end, line, cursor, region.skip, progress) : null;
     const nested = findFirstRegion(rules, line, cursor, progress);
-
     if (end && (!nested || end.start <= nested.start)) {
       applyPatterns(changes, line, cursor, end.start, rules, region.group, progress);
       changes.set(end.start, region.limitGroup ?? region.group);
       changes.set(end.end, parentGroup(region));
       progress?.(end.end);
-      if (region.parent) return scanRegion(changes, line, end.end, region.parent, rootRules, progress);
-      return scanTop(changes, line, Math.max(end.end, end.start + 1), rootRules, progress);
+      const parent = region.parent ?? null;
+      cursor = parent ? end.end : Math.max(end.end, advanceIndex(line, end.start));
+      region = parent;
+      continue;
     }
-
     if (nested) {
-      applyPatterns(changes, line, cursor, nested.start, rules, region.group, progress);
-      changes.set(nested.start, nested.region.limitGroup ?? region.group);
-      const child = { ...nested.region, parent: region };
-      changes.set(nested.end, child.group);
+      applyPatterns(changes, line, cursor, nested.start, rules, region?.group ?? "default", progress);
+      changes.set(nested.start, nested.region.limitGroup ?? nested.region.group);
+      region = region ? { ...nested.region, parent: region } : nested.region;
+      changes.set(nested.end, region.group);
       progress?.(nested.end);
-      const state = scanRegion(changes, line, nested.end, child, rootRules, progress);
-      if (state) return state;
-      cursor = Math.max(nested.end + 1, nextChangeAfter(changes, nested.end));
+      cursor = nested.end;
       continue;
     }
-
-    applyPatterns(changes, line, cursor, line.length, rules, region.group, progress);
-    changes.set(line.length, region.group);
+    applyPatterns(changes, line, cursor, line.length, rules, region?.group ?? "default", progress);
+    changes.set(line.length, region?.group ?? "default");
     progress?.(line.length);
     return region;
   }
   return region;
 }
 
+// AdvanceStringIndex for Unicode regexps, including isolated surrogate units.
+function advanceIndex(text, index) {
+  return index + (text.codePointAt(index) > 0xFFFF ? 2 : 1);
+}
+
 function applyPatterns(changes, line, start, end, rules, fallbackGroup, progress = null) {
   if (end < start) return;
   const length = end - start;
@@ -161,18 +161,12 @@ function findMatch(regex, line, pos, skip, progress = null) {
   const global = globalize(regex);
   global.lastIndex = pos;
   let match;
-  if (!progress) {
-    match = global.exec(masked);
-    if (!match) return null;
-    const start = match.index ?? 0;
-    return { start, end: start + match[0].length };
-  }
   while ((match = global.exec(masked)) !== null) {
     const start = match.index ?? 0;
     const end = start + match[0].length;
     progress?.(start);
     if (start >= pos) return { start, end };
-    if (match[0].length === 0) global.lastIndex++;
+    global.lastIndex = Math.max(global.lastIndex, advanceIndex(masked, start));
   }
   progress?.(line.length);
   return null;
@@ -189,7 +183,7 @@ function findAllMatches(regex, line, start, end, progress = null) {
       if (matchStart >= end) break;
       const matchEnd = matchStart + match[0].length;
       if (match[0].length === 0) {
-        global.lastIndex++;
+        global.lastIndex = advanceIndex(line, matchStart);
         continue;
       }
       if (matchEnd > start) out.push({ start: Math.max(matchStart, start), end: Math.min(matchEnd, end) });
@@ -202,7 +196,7 @@ function findAllMatches(regex, line, start, end, progress = null) {
     if (matchStart >= end) break;
     progress?.(matchStart);
     if (match[0].length === 0) {
-      global.lastIndex++;
+      global.lastIndex = advanceIndex(line, matchStart);
       continue;
     }
     if (matchEnd <= start || matchStart >= end) continue;
@@ -229,13 +223,6 @@ function parentGroup(region) {
   return region.parent?.group ?? "default";
 }
 
-function nextChangeAfter(changes, index) {
-  for (const key of [...changes.keys()].sort((a, b) => a - b)) {
-    if (key > index) return key;
-  }
-  return index + 1;
-}
-
 function globalize(regex) {
   const flags = new Set(regex.flags.split(""));
   flags.add("g");

package/apps/jsmdcui/src/highlight/parser.js

@@ -1,4 +1,5 @@
 import { basename } from "node:path";
+import { convertGoRegexp } from "./go-regexp.js";
 
 export class SyntaxHeader {
   constructor({ filetype = "", filename = "", header = "", signature = "" } = {}) {
@@ -195,15 +196,17 @@ function parseRule(rule) {
 
 function compileRegex(pattern) {
   if (!pattern) return null;
-  const translated = translateGoRegexp(pattern);
   try {
-    return new RegExp(translated, "u");
-  } catch {
+    // Conversion may reject an excessively nested rule. Keep that failure
+    // local to this regexp rather than dropping the entire syntax definition.
+    const translated = convertGoRegexp(translateGoRegexp(pattern));
     try {
-      return new RegExp(translated);
+      return new RegExp(translated, "u");
     } catch {
-      return null;
+      return new RegExp(translated);
     }
+  } catch {
+    return null;
   }
 }
 

package/apps/jsmdcui/tests/go-regexp.test.js

@@ -0,0 +1,98 @@
+import {test, expect} from 'bun:test';
+import {convertGoRegexp} from '../src/highlight/go-regexp.js';
+import {SyntaxDefinition,parseHeaderYaml} from '../src/highlight/parser.js';
+const regex = s => new RegExp(convertGoRegexp(s), 'u');
+test('Go flags apply to the remaining alternatives, preserving precedence', () => {
+  const r = regex('^a(?i)b$|^c$');
+  expect(r.test('aB')).toBe(true);
+  expect(r.test('AB')).toBe(false);
+  expect(r.test('C')).toBe(true);
+  expect(r.test('aC')).toBe(false);
+});
+test('flag changes stay inside groups and can be disabled', () => {
+  const r = regex('^(a(?i)b|c)d$');
+  expect(r.test('aBd')).toBe(true);
+  expect(r.test('Cd')).toBe(true);
+  expect(r.test('CD')).toBe(false);
+  expect(regex('^(?i)a(?-i)b$').test('Ab')).toBe(true);
+  expect(regex('^(?i)a(?-i)b$').test('AB')).toBe(false);
+  expect(regex('^(?i:a(?-i:b))c$').test('Abc')).toBe(true);
+  expect(regex('^(?i:a(?-i:b))c$').test('ABC')).toBe(false);
+});
+test('capture numbers, scoped flags, escaped literals and class brackets survive', () => {
+  expect(regex('^(?i)(a)(b)$').exec('AB').slice(1)).toEqual(['A','B']);
+  expect(regex('(?i:a)+').test('AAA')).toBe(true);
+  expect(regex('\\(\\?i\\)').test('(?i)')).toBe(true);
+  const url = regex('(https?|ftp|ssh)://\\S*[^])>\\s,.]');
+  expect(url.exec('https://example.com)')[0]).toBe('https://example.com');
+  expect(regex('(?s)^a.b$').test('a\nb')).toBe(true);
+  expect(regex('(?m)^b$').test('a\nb\nc')).toBe(true);
+  expect(convertGoRegexp('\\bword\\b')).toBe('\\bword\\b');
+});
+test('all bundled syntax regexes compile, and Dockerfile keywords match', async () => {
+  const root = new URL('../runtime/syntax/', import.meta.url).pathname;
+  const failures = [];
+  function walk(rules, file) {
+    for (const r of rules) {
+      if (r.type === 'pattern' && !r.regex) failures.push(file+': '+r.source);
+      if (r.type === 'region') {
+        for (const k of ['start','end','skip']) if (r.source[k] && !r[k]) failures.push(file+': '+r.source[k]);
+        walk(r.rules,file);
+      }
+    }
+  }
+  for await (const file of new Bun.Glob('*.yaml').scan(root)) {
+    const source = Bun.YAML.parse(await Bun.file(root+'/'+file).text());
+    const header = parseHeaderYaml(source);
+    for (const [key,re] of [['filename','fileNameRegex'],['header','headerRegex'],['signature','signatureRegex']])
+      if (header[key] && !header[re]) failures.push(file+': '+key);
+    const def = new SyntaxDefinition(header,source);
+    walk(def.rules,file);
+    if (file === 'dockerfile.yaml') {
+      expect(header.matchFileName('/tmp/Dockerfile')).toBe(true);
+      const keyword = def.rules.find(r=>r.group==='type.keyword').regex;
+      for (const line of ['FROM debian','run echo hi','COPY . /app']) expect(keyword.test(line)).toBe(true);
+      expect(keyword.test('FROMAGE debian')).toBe(false);
+    }
+  }
+  expect(failures).toEqual([]);
+});
+test('mixed and negated POSIX classes retain ASCII Go semantics',()=>{
+ expect(regex('^[[:alnum:].%_+-]+@[[:alnum:].-]+$').test('a.b+tag@example.com')).toBe(true);
+ expect(regex('^[^[:space:]]+:$').test('Subject:')).toBe(true);
+ expect(regex('^[^[:space:]]+:$').test('Bad Header:')).toBe(false);
+ expect(regex('^[{[:space:]]-block([[:space:]{}]|$)').test(' -block ')).toBe(true);
+ expect(regex('^[x[:space:]]$').test('\t')).toBe(true);
+ expect(regex('^[x[:space:]]$').test('\u00a0')).toBe(false);
+ expect(regex('^[x[:punct:]]$').test('[')).toBe(true);
+ expect(regex('^[x[:punct:]]$').test('A')).toBe(false);
+});
+test('modifiers are emitted only where flags change',()=>{
+ expect(convertGoRegexp('[]a]')).toBe('[\\]a]');
+ expect(convertGoRegexp('(?P<x>a)')).toBe('(?<x>a)');
+ expect(convertGoRegexp('[[:alpha:]_]')).toBe('[A-Za-z_]');
+ expect(convertGoRegexp('(?i)\\b(select|from)\\b')).toBe('(?i:\\b(select|from)\\b)');
+ expect(regex('^(?i)a(?-i:b)$').test('Ab')).toBe(true);
+ expect(regex('^(?i)a(?-i:b)$').test('AB')).toBe(false);
+});
+
+test('converter bounds nested groups without limiting adjacent groups',()=>{
+ expect(()=>convertGoRegexp('(?i)'+'('.repeat(50000)+'x'+')'.repeat(50000))).toThrow('nesting exceeds');
+ expect(regex('(?i)'+'('.repeat(256)+'x'+')'.repeat(256)).test('X')).toBe(true);
+ expect(()=>convertGoRegexp('(?i)'+'(x)'.repeat(50000))).not.toThrow();
+});
+
+test('conversion failure disables only its rule and preserves the loaded syntax',async()=>{
+ const {loadSyntaxDefinitions}=await import('../src/highlight/parser.js');
+ const {Highlighter}=await import('../src/highlight/highlighter.js');
+ const deep='(?i)'+'('.repeat(50000)+'x'+')'.repeat(50000);
+ const source={filetype:'guarded',detect:{filename:'\\.guarded$'},rules:[{bad:deep},{keyword:'(?i)hello'},{invalid:'['}]};
+ const def=new SyntaxDefinition(parseHeaderYaml(source),source);
+ expect(def.rules[0].regex).toBeNull();expect(def.rules[2].regex).toBeNull();
+ expect(def.rules[1].regex.test('HELLO')).toBe(true);
+ const runtime={list:type=>type===1?[{name:'guarded',text:async()=>JSON.stringify(source)}]:[]};
+ const defs=await loadSyntaxDefinitions(runtime);
+ expect(defs.map(d=>d.filetype)).toEqual(['guarded']);
+ expect(defs[0].header.matchFileName('example.guarded')).toBe(true);
+ expect(new Highlighter(defs[0],defs).highlightLine('HELLO').changes.get(0)).toBe('keyword');
+});