shadowdaoandClaude Opus 5.5
4a34781ab6
Review findings on clean-ai-response.ts: 1. update_props is now cleaned with the TARGET node's component (resolved on the live canvas by apply()); an unresolvable target gets the strictest rules (no code, url/src only assets/). code is kept only on an HtmlBlock. 2. cssValueAllowed() is a positive grammar: numbers/lengths/hex/keywords, an allow-list of functions (gradients, colour functions, calc/clamp, var(--*), transforms, filters), url() only of assets/<file>, quoted strings only plain font names; image-set(, src(, cross-fade(, element(, paint(, attr(, env(, ':' or '//' outside url(assets/..), backslashes and control chars rejected. Regression: every style/colour value in the templates, section families and palettes passes (clean-ai-response.ordinary.test.ts). Also: tricky link forms (//host, backslashes, whitespace/control chars, mixed-case schemes, > 2048) rejected; comments state the server-side mirror is not implemented (deferred). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
