Garry Tan 3f53b9e173 fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation ... Three live vectors found by the ship review army, all red-first tested: unquoted style attributes skipped the remote-url neutralizer entirely; CSS ident/string escapes (@\69mport, url(\68ttps://…)) defeated the literal-match patterns Chromium happily decodes; and HTML entities in style attribute values (https) decoded to fetchable schemes before CSS parsing. Style-attr values are now entity-decoded in one browser- faithful pass, escape-bearing at-rules and function tokens are dropped fail-closed, and output is re-encoded double-quoted. 21 new test rows.		2026-08-14 17:11:48 -07:00
..
src	fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation	2026-08-14 17:11:48 -07:00
test	fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation	2026-08-14 17:11:48 -07:00
SKILL.md	v1.62.0.0 feat: plan-mode auto-select at the review scope gate (#2533)	2026-08-12 11:12:28 -07:00
SKILL.md.tmpl	v1.58.0.0 feat: diagram + multi-format document engine (mermaid, excalidraw, single-file HTML, DOCX) (#1990)	2026-06-12 15:38:53 -07:00