dsh-unlag 1.9.75 → 1.9.77

package/client.js

@@ -287,9 +287,17 @@ window.__ModuleLoader__.load({
       const covered = new Set();
       const sources = [];
       for (const batch of batches) {
-        const url = typeof batch?.url === 'string' ? batch.url : '';
+        // A batch is read field by field: the list can be the page's own boot object, and a batch
+        // whose fields cannot be read leaves that address unproven rather than the page broken.
+        let url = '';
+        let listed = [];
+        try {
+          url = typeof batch?.url === 'string' ? batch.url : '';
+          listed = Array.isArray(batch?.entries) && batch.entries.every((id) => typeof id === 'string') ? batch.entries : [];
+        } catch {
+          return held('row');
+        }
         if (url === '') continue;
-        const listed = Array.isArray(batch.entries) && batch.entries.every((id) => typeof id === 'string') ? batch.entries : [];
         const ids = listed.length > 0 ? listed : bundledIds(url);
         if (ids.length === 0) return held('row');
         let resolved = null;
@@ -303,7 +311,12 @@ window.__ModuleLoader__.load({
       }
       if (sources.length === 0) return held('graph');
       for (const entry of entries) {
-        const id = typeof entry === 'string' ? entry : entry?.id;
+        let id = '';
+        try {
+          id = typeof entry === 'string' ? entry : entry?.id;
+        } catch {
+          return held('covers');
+        }
         if (typeof id !== 'string' || !covered.has(id)) return held('covers');
       }
       // Reading these bodies here would need a parser the page does not have and would not prove

package/index.js

@@ -1616,6 +1616,13 @@ function parseAsScript(body, name) {
  * @param rows the startup script addresses, as the next document would request them.
  */
 export async function verifyStartupRows(graph, fetchBody, rows, budgetMs = MAX_VERIFY_MS) {
+  // A startup list is checked against the plugin set, so a set that cannot be read at all leaves
+  // nothing to check against: approving anyway would vouch for addresses nothing backs, and the
+  // next document would die on the first one that answers 404. An empty set is still a readable
+  // one — a row it no longer names is served from the retained bundle and reported as left out.
+  if (graph === null || typeof graph !== 'object' || !Array.isArray(graph.entries)) {
+    return { status: 'blocked', reason: 'list', detail: 'the plugin list cannot be read, so no startup row can be checked against it' }
+  }
   const entries = new Map(
     (Array.isArray(graph?.entries) ? graph.entries : [])
       .filter((row) => typeof row?.id === 'string' && row.id !== '')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.75",
+  "version": "1.9.77",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",