git-watchtower 2.3.19 → 2.3.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.19",
+  "version": "2.3.21",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/state/store.js

@@ -209,15 +209,47 @@ class Store {
   }
 
   /**
-   * Get a copy of the current state
+   * Get a snapshot of the current state.
+   *
+   * The top-level object is a shallow copy (so adding/removing top-level
+   * keys on the returned object does not mutate the store). Map values
+   * (sparklineCache, branchPrStatusMap, aheadBehindCache) are also
+   * shallow-cloned so that consumers — most importantly the web
+   * dashboard's getSerializableState — can iterate or mutate the
+   * snapshot without the store's live data shifting underneath them.
+   *
+   * If you need the live, by-reference Map for in-place mutation
+   * followed by setState() (the polling cache-prune pattern), use
+   * `get(key)` instead.
+   *
    * @returns {State}
    */
   getState() {
-    return { ...this.state };
+    const snapshot = { ...this.state };
+    if (snapshot.sparklineCache instanceof Map) {
+      snapshot.sparklineCache = new Map(snapshot.sparklineCache);
+    }
+    if (snapshot.branchPrStatusMap instanceof Map) {
+      snapshot.branchPrStatusMap = new Map(snapshot.branchPrStatusMap);
+    }
+    if (snapshot.aheadBehindCache instanceof Map) {
+      snapshot.aheadBehindCache = new Map(snapshot.aheadBehindCache);
+    }
+    return snapshot;
   }
 
   /**
-   * Get a specific state value
+   * Get a specific state value by-reference.
+   *
+   * IMPORTANT: returns the live value, not a copy. For Map values
+   * (sparklineCache, branchPrStatusMap, aheadBehindCache) this is
+   * deliberate — the polling layer mutates these in place and then
+   * calls setState({key: sameMap}) to notify subscribers. Code that
+   * doesn't intend to mutate should treat the result as read-only,
+   * or copy it first (e.g. `new Map(store.get('sparklineCache'))`).
+   *
+   * For an isolation-safe snapshot, prefer `getState()`.
+   *
    * @template {keyof State} K
    * @param {K} key - State key
    * @returns {State[K]}

package/src/ui/ansi.js

@@ -296,8 +296,15 @@ const NON_SGR_CSI_RE = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x6c\x6e-\x7e]/g;
 
 // Match OSC sequences: ESC ] ... terminator (BEL or ESC \). These set
 // terminal title, hyperlinks, etc. — all undesirable in untrusted input.
+// The trailing `|$` alternation also matches an UNTERMINATED OSC tail
+// (`\x1b]0;evil-text` with no \x07 / \x1b\\ before EOF). Without it,
+// the literal payload survived sanitisation as visible text — ESC_RE
+// stripped the leading `\x1b]` since `]` is in the `\\-_` range, but
+// "0;evil-text" remained. Per ECMA-48, an unterminated OSC at EOF is
+// effectively an open control string, so dropping it entirely is the
+// safe default.
 // eslint-disable-next-line no-control-regex
-const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\|$)/g;
 
 // Match other 2-byte ESC sequences (Fe codes 0x40-0x5F) excluding CSI ([)
 // and OSC (]) which are handled separately above.