dsh-plugin-lookatstudy 0.22.1 → 0.22.2

package/lib/{inflate-DIKUrTRi.mjs → inflate-C-hhR5be.mjs}

@@ -1,11 +1,22 @@
 //#region src/vendor/inflate.ts
+/** Default hard OUTPUT ceiling (audit B11): wire-side caps bound only the
+*  compressed bytes, but DEFLATE can expand ~1032:1 — without an output
+*  ceiling a crafted arXiv PDF or epub wedges the host in a synchronous
+*  multi-GB grow loop (the same event-loop-freeze class as the 0.22.1 TJ
+*  regex fix). */
+const INFLATE_MAX_OUTPUT = 67108864;
 /** Growable output buffer; back-references read bytes this pass already wrote. */
 var Out = class {
+	maxBytes;
 	buf = /* @__PURE__ */ new Uint8Array(1024);
 	len = 0;
+	constructor(maxBytes) {
+		this.maxBytes = maxBytes;
+	}
 	pushByte(b) {
+		if (this.len + 1 > this.maxBytes) throw new Error("inflate: 输出超过上限 (audit B11 解压炸弹护栏)");
 		if (this.len === this.buf.length) {
-			const next = new Uint8Array(this.buf.length * 2);
+			const next = new Uint8Array(Math.max(this.len + 1, Math.min(this.buf.length * 2, this.maxBytes)));
 			next.set(this.buf);
 			this.buf = next;
 		}
@@ -60,7 +71,7 @@ var Huffman = class {
 	count = new Array(16).fill(0);
 	symbols = [];
 	constructor(lengths) {
-		for (const l of lengths) this.count[l]++;
+		for (let li = 0; li < lengths.length; li++) this.count[lengths[li]]++;
 		this.count[0] = 0;
 		const offs = new Array(16).fill(0);
 		for (let len = 1; len < 16; len++) offs[len] = offs[len - 1] + this.count[len - 1];
@@ -254,10 +265,11 @@ function inflateBlock(br, out, lit, dist) {
 		}
 	}
 }
-/** Decompress a raw DEFLATE stream (zip method 8, no zlib header). Throws on truncation/corruption. */
-function inflateRaw(src) {
+/** Decompress a raw DEFLATE stream (zip method 8, no zlib header). Throws on
+* truncation/corruption and on exceeding the output ceiling. */
+function inflateRaw(src, maxBytes = INFLATE_MAX_OUTPUT) {
 	const br = new BitReader(src);
-	const out = new Out();
+	const out = new Out(maxBytes);
 	for (;;) {
 		const bfinal = br.readBit();
 		const btype = br.readBits(2);
@@ -299,13 +311,13 @@ function inflateRaw(src) {
 	}
 }
 /** Decompress a zlib (RFC 1950) stream: 2-byte header + raw deflate (+ ignored adler32). */
-function inflateZlib(src) {
+function inflateZlib(src, maxBytes = INFLATE_MAX_OUTPUT) {
 	if (src.length < 6) throw new Error("inflate: zlib 流过短");
 	const cmf = src[0], flg = src[1];
 	if ((cmf & 15) !== 8) throw new Error("inflate: 非 deflate 的 zlib CM");
 	if ((cmf << 8 | flg) % 31 !== 0) throw new Error("inflate: zlib 头校验失败");
 	if (flg & 32) throw new Error("inflate: 预置字典不支持");
-	return inflateRaw(src.subarray(2));
+	return inflateRaw(src.subarray(2), maxBytes);
 }
 //#endregion
 export { inflateZlib as n, inflateRaw as t };

package/lib/{pptx-parser-B9IDkiGM.mjs → pptx-parser-BooxpGV4.mjs}

@@ -1,4 +1,4 @@
-import { n as readZipText, t as readZip } from "./zip-reader-KnRrq0av.mjs";
+import { n as readZipText, t as readZip } from "./zip-reader-BakpZwuD.mjs";
 //#region src/vendor/pptx-parser.ts
 function decodeEntities(s) {
 	return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");

package/lib/{zip-reader-KnRrq0av.mjs → zip-reader-BakpZwuD.mjs}

@@ -1,4 +1,4 @@
-import { t as inflateRaw } from "./inflate-DIKUrTRi.mjs";
+import { t as inflateRaw } from "./inflate-C-hhR5be.mjs";
 //#region src/vendor/zip-reader.ts
 const EOCD_SIG = 101010256;
 const CEN_SIG = 33639248;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-lookatstudy",
-  "version": "0.22.1",
+  "version": "0.22.2",
   "packageManager": "pnpm@11.7.0",
   "description": "Turn any markdown, local folder, or GitHub learning repo into a guided course inside DeepSeek Harness: gated skill-tree progression, BKT mastery tracking, SM-2 spaced repetition.",
   "type": "module",
@@ -46,7 +46,8 @@
     "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.0-rc.0",
     "@deepseek-ai/dsh-tools": ">=0.1.0-rc.0",
     "@deepseek-ai/schemastery": ">=0.1.0-rc.0",
-    "react": ">=18"
+    "react": ">=18",
+    "react-dom": ">=18"
   },
   "exports": {
     ".": {