only-cli d56ddb30a0 fix: never let a '<' survive title flattening ...

CodeQL flagged the tag strip in plainTitle: requiring a closing '>' means
a title whose markup never closes keeps its '<script' fragment. The '>'
is optional now, so every '<' starts a strip and none reaches the results
page, and the output is trimmed. Both call sites already HTML-escape the
result; this hardens the flattening itself. Covered by a new test.

2026-08-24 10:18:05 -04:00

..

pages

fix: hand over code an agent can actually run

2026-08-23 09:12:25 -04:00

act.test.js

fix: hand over code an agent can actually run

2026-08-23 09:12:25 -04:00

distill.test.js

fix: fail loud when a page distills to no readable content

2026-08-23 20:49:14 -04:00

fetch.test.js

fix: address proxy review — SSRF guard, no_proxy wiring, NO_PROXY parsing

2026-08-24 10:23:29 +08:00

sites.test.js

prototype a Sphinx search backend for the Python docs

2026-08-24 09:59:34 -04:00

sphinx.test.js

fix: never let a '<' survive title flattening

2026-08-24 10:18:05 -04:00