Garry Tan 3f53b9e173 fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation ... Three live vectors found by the ship review army, all red-first tested: unquoted style attributes skipped the remote-url neutralizer entirely; CSS ident/string escapes (@\69mport, url(\68ttps://…)) defeated the literal-match patterns Chromium happily decodes; and HTML entities in style attribute values (https) decoded to fetchable schemes before CSS parsing. Style-attr values are now entity-decoded in one browser- faithful pass, escape-bearing at-rules and function tokens are dropped fail-closed, and output is re-encoded double-quoted. 21 new test rows.		2026-08-14 17:11:48 -07:00
..
migrations	fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation	2026-08-14 17:11:48 -07:00
SKILL.md	v1.46.0.0 feat: gstack v2 foundation — catalog tokens drop 56%, eval-first floor covers all 51 skills (#1712)	2026-05-26 16:50:03 -07:00
SKILL.md.tmpl	fix: avoid tilde-in-assignment to silence Claude Code permission prompts (#993)	2026-04-16 14:49:56 -07:00