routine 2026-10-05 (2): README rendering can't stall the server, copy buttons that speak and fail loudly, client-bundle audit, header hardening, 404s that say who asked

[physics515]

Nightly routine, 2026-10-05 (2), started 21:10 CDT. This is the second run today; the morning run is #14.

Rebased onto main at aa0220c, which includes two commits another session pushed during this run: splimes, and its own source-map-js override (see "Concurrent work" below).

Increments

1. marked 18.1.0: link destinations no longer backtrack cubically (53e9fa7)

Files: package.json, package-lock.json, test/markdown-backtracking.test.ts (new).

Problem: READMEs are fetched at request time and rendered on the server's one thread. marked 18.0.14 backtracked cubically on []( followed by a run of unicode whitespace (markedjs/marked#4106). Through the site's own renderMarkdown, 4 KB of U+00A0 took 10.3 s. One README edit could have stalled every page.

Fix: marked 18.1.0, published today. The same input now takes 0.1 ms.

Evidence:

• All 87 documents the site renders (7 READMEs, the 76 live posts backed up from the container, 4 fixtures) are byte-identical on both versions.
• The new test renders 8 KB of three different unicode spaces. On 18.0.14 it does not finish inside 60 s.
• Every route answered as expected.
• check, a11y and a11y:browser clean over 95 pages, including the live posts.
• Screenshots: built-in browser pane at desktop and mobile, plus headless 1280/390.

2. axe-core 4.14, with its new default rule judged in the browser (fd89785)

Files: package.json, package-lock.json, scripts/check-a11y{,-browser}.mjs, README.

Problem: axe 4.14 turns on label-content-name-mismatch (WCAG 2.5.3) by default. jsdom cannot tell what text is visible, so the rule only ever came back "incomplete" on the copy buttons. Nothing was actually judging it.

Fix: the rule moves to the real-browser pass.

Evidence:

• Today's pages pass.
• With a mismatched aria-label planted in CodeBlock, the browser pass fails with 12 violations (one per project page, per width).

3. The README patterns run in linear time (31d878e)

Files: shared/markdown/readme.ts, shared/markdown/slug.ts, test/markdown-backtracking.test.ts, ROADMAP.

Problem: eight of the site's own regexes over fetched README text were quadratic on input that opens something and never closes it. At 100 KB:

Input	Before	After
absolutize, a run of [	5.2 s	0.5 ms
slugify, a run of <	5.0 s	0.9 ms
a 100 KB heading	2.5 s	34 ms
stripLeadingLogo	1.0 s	0.2 ms
lazyImages	1.0 s	0.2 ms
<img runs	0.4 s	0.2 ms

The eighth pattern is the <a href> rule the splimes commit added tonight, which had the same shape (100 KB of <a : 711 ms). I made it linear while resolving the rebase.

Fix: a link label stops at the next [, a tag stops at the next <, and a URL may end at the end of the input. The logo test now runs in a callback instead of the pattern.

Evidence:

• All 8 READMEs (prepared markdown and HTML, splimes included, compared against main's readme.ts) and the 76 posts are byte-identical before and after.
• 12 timing cases, all failing on the old code.
• Three tests pin the edges that move: a URL ending the input, ![a [b](x), and a stray < before a tag.

4. A copy button announces that it copied (9acb737)

Files: app/components/CodeLine.vue, app/components/CodeBlock.vue, ROADMAP.

Problem: the button's text changes to [copied], but its name is pinned by aria-label, so a screen reader heard nothing (WCAG 4.1.3).

Fix: each component now has an empty role="status" region, rendered on the server.

Evidence: checked over CDP with clipboard access granted.

• The polite region reads "Copied to clipboard" in the accessibility tree.
• The clipboard holds the command.
• Both reset after 1.6 s.
• CodeBlock's region sits outside its figcaption, so it doesn't change the figure's name.

5. No x-powered-by, and a Cross-Origin-Opener-Policy (3b5eaff)

Files: server/plugins/powered-by.ts (new), nuxt.config.ts, scripts/check-site.mjs, ROADMAP.

Problem: Nuxt's renderer sets x-powered-by: Nuxt on every page after route rules apply, so a route rule cannot remove it.

Fix:

• The header is removed in Nitro's beforeResponse.
• COOP same-origin is added to the /** route rule.
• npm run check now fails on either one being wrong.

Evidence:

• Against the previous build, the new check failed all 94 pages, once for each header.
• After the fix, x-powered-by is gone from pages, the 404 page, the API, the XML routes, static files and HEAD responses.
• Client navigation in the pane (home → onyums → its blog) logs no console errors.

6. A refused clipboard selects the text and says so (f551840)

Files: app/composables/useCopy.ts (new), both copy components, ROADMAP.

Problem: found while testing #4, when the browser pane's own clipboard refused the write. On a refused write, the button did nothing, so the visitor would paste whatever their clipboard already held.

Fix: useCopy is now the one copy of the logic both components carried. On refusal it selects the text, shows [selected] and announces how to finish the copy.

Evidence: checked over CDP with the permission denied (NotAllowedError).

• The selection is exactly the command, without the $.
• Both buttons reset after 4 s.
• No overflow at 390 px; screenshot taken.

7. A failed request's log line says who asked (893eee5)

Files: server/plugins/request-log.ts, README, ROADMAP.

Problem: the error-hook line covers every 404 and 500. It promised the same shape as the success line but stopped at via. In 15 h of live log, 627 lines (almost all scanners) had no ip, ua or ref.

Fix: both lines now share one requester() function.

Evidence: on a built server, with a forwarded address, user agent and referer:

• 200, page 404, API 404 and HEAD 404 lines all carry the three fields.
• An onion-marked request keeps ip: null.
• There is still exactly one line per request.

8. audit:runtime covers the client bundle (962f2a5, README f1735aa)

Files: scripts/lib/client-packages.ts (new), nuxt.config.ts, scripts/audit-runtime.mjs, README, ROADMAP.

Problem: the roadmap said it outright: the client bundle had no sourcemaps, so the audit had nothing to read its packages from.

Fix:

• A client-only Vite plugin records every package with rendered code, at its exact version.
• It writes the list to .output/server/client-packages.json. That file is inside the image but never under public/, and the server answers 404 for it.
• The audit now asks about those packages too.

Evidence:

• 32 client packages, 14 of which the server audit never saw. Clean.
• It fails on a planted marked@4.0.9, on a missing inventory and on an empty one.
• It also showed that tiptap's marked@17 never reaches a browser.

Dropped in the rebase: a source-map-js 1.2.2 lockfile bump

audit:runtime went red tonight on GHSA-68fv-2mgg-jv7q. I fixed it with a lockfile bump, then the other session landed the same fix as an override on main. The rebase dropped my commit as already upstream, and the audit is clean on the rebased tree.

Also: fallback snapshot refreshed (665c58f)

npm run sync (8 projects): issue counts and one push date moved. Snapshot test passes.

Final verification (rebased tree, combined)

Checks:

• npm ci on the merged lockfile.
• Typecheck clean, 231 tests, build green.
• audit:runtime: 79 packages (server and client), clean.
• cargo audit --deny yanked --deny unsound (onion): only the two known unmaintained warnings.
• check: 96 pages, 153 URLs, no problems.
• a11y: 97 pages, clean.
• a11y:browser: 97 pages at 1280 and 390 px, no violations and no console errors.

Real status codes:

• /healthz, /, /projects, /news, /status, /sitemap.xml, /robots.txt, /releases.xml, /news.xml, /api/projects and /api/projects/splimes: 200.
• Every /projects/<slug> (8): 301. Their /about and /blog: 200.
• /projects/no-such-project, /no-such-page, /api/projects/nope, /api/admin/posts and onion-marked /admin: 404.
• /onion-frame: 503, expected locally because there is no gateway.
• HEAD /healthz: 200.

Screenshots: home, Skidbladnir, Nisaba and splimes at desktop and mobile, headless, in the run's scratch dir. I also looked at the splimes page and home in the built-in browser pane: no overflow, and no relative links left in the splimes README.

Concurrent work

Another Claude session worked in this same checkout during the run. It pushed 4278d22 (splimes) and aa0220c (source-map-js override) straight to main, and redeployed the live container at 22:37.

It also killed my local verification servers twice, on two different ports, partway through a11y:browser. I worked around it by serving a copy of the build from a distinct path. Those kills were external, not a site fault: the same pages served fine in isolation, and the full pass is clean.

The live container runs as uid 100 and was unaffected.

Research

• Nuxt 4.6.0 came out an hour into the run: 420 commits, a CLI major, and security fixes (the error route reachable from outside, error data passed to the error page).
  • I trialled it in a scratch worktree. Every gate above was clean, the routes and error-route probes matched 4.5.2, page bytes were identical, and nothing visible changed (one CSS line height rounds to 16 px instead of 15.98).
  • Added as a [ ] to land after a soak, not in an unattended deploy of an hour-old release.
  • https://github.com/nuxt/nuxt/releases/tag/v4.6.0
• marked 18.1.0 (acted on, routine: 16 increments — Phase 2 complete, release strips, social cards, operations, and the onion gateway's first slice #1): fix: avoid cubic backtracking on unicode whitespace in a link destination markedjs/marked#4106 · https://github.com/markedjs/marked/releases/tag/v18.1.0
• axe-core 4.14.0 (acted on, routine: 16 increments — CSP nonces, real-browser axe and console gate, measured Web Vitals, the rate limit fixed again, plus last night's unshipped 15 #2): https://github.com/dequelabs/axe-core/releases/tag/v4.14.0
• simple-git, via @nuxt/devtools: npm audit reports critical advisories, patched only in simple-git 4. Devtools pins ^3.36.0, and Nuxt 4.6 resolves the same version. Not reachable here (devtools: { enabled: false }, nothing of it ships). Added as an upstream [ ].
  • GHSA-858h-whjf-mvg5
• Copy-button status, read for routine 2026-09-28 (1/2): close the editor over Tor, BlogPosting JSON-LD #4: https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html
• COOP, read for Skidbladnir's screenshot refresh, and the test that had not caught up #5: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
• TypeScript: 7.1 has only nightlies (7.1.0-dev). vue-tsc 3.3.12 is current. Tailwind is still 4.3.3, Nitro 3 is still beta. GitHub REST: nothing affecting the site; the 2026 rate_limit change removed a field it never reads (https://github.blog/changelog/2026-05-19-removal-of-code_scanning_upload-field-from-rate_limit-api-endpoint/). No new signal from these.

Done vs open

Eight increments landed, plus the snapshot refresh.

New [ ]:

• Nuxt 4.6, after a soak.
• The devtools/simple-git upstream item.

Unchanged and still owner-gated or upstream:

• Owner decisions: the GitHub App token, distroless (blocked on the compose healthcheck), Onion-Location, HSTS, basic-automation.github.io, and contrast together with axe color-contrast.
• Screenshots for Nisaba and Enlil.
• Upstream: the x265 and onyums README links, and the TypeScript 7.1 API.

STOP REASON: no workable next item, at ~2 h 20 min, short of the 4 h bar. After eight increments, sweeps of the live logs, response headers, regex surfaces, the npm and cargo advisories, the client bundle and the external links turned up nothing more. The one new item, Nuxt 4.6, was deliberately held back. I didn't make up work to fill the clock.

Recommended next step

1. Land Nuxt 4.6 in a run once it has had a few days, or once 4.6.1 is out. The trial lockfile is in the run's scratch dir.
2. Make the one-line upstream fixes to the Skidbladnir README (x265 link) and the onyums README (anchor).
3. Agree a rule for concurrent sessions in this checkout. Tonight one pushed to main and killed node .output/server/index.mjs processes mid-run.

🤖 Generated with Claude Code