Round-6 review fixes: untrusted-diagram attack surface, multi-tab data loss, animation bounds

[zntznt]

Fixes all fourteen findings from the sixth multi-agent review, plus the formula code-execution sink I confirmed before launching it.

Each fix has a test that I verified fails against the unpatched code first. 258 unit tests, smoke green.

Security: a diagram is untrusted input

The product invites exactly this. It advertises "Copy share link" (a base64 diagram in the #d= hash), File > Open of .json and .econ, library components, and node cli.js someones-economy.econ. Five ways a diagram could act on the reader:

Sink	Baseline	Fixed
evalFormula fell through to new Function(expr)	opening a share link executed the author's JavaScript with no click; the CLI ran it with the invoking user's privileges	payload evaluates to 0, validateFormula reports it invalid
Parameter names interpolated into the sweep table with innerHTML	3 injected <img> elements, script running in the app's origin with read access to sim_library and sim_autosave	rendered as text
meta.name interpolated into the generated module's banner comment	a name containing the comment terminator ran code on require()	contained
meta.font pasted into a fonts.googleapis.com URL	opening a shared diagram phoned home with a sender-chosen string, leaking the reader's IP	off-list families ignored, 0 requests
Share link adopted into autosave with no prompt	the reader's saved diagram silently replaced, nothing to undo	asks first, restores theirs on decline

Removing the formula fallback needed evidence it was safe. All 110 distinct expressions across the 12 demos and 11 templates compile under math.js. The JS-flavoured spellings a saved diagram might use still work: a seeded Math object is exposed in scope, and an expression math.js refuses is retried with the operators rewritten (&&→and, ||→or, !→not, **→^, ===→==). One deliberate semantic change: a && b used to return b's value under JS truthiness and now returns 1 or 0, which is the answer math.js gives everywhere else in these numeric fields.

The meta.font leak also contradicted the no-Google-Fonts-at-runtime claim in CLAUDE.md and README.md.

Data loss

• Library Delete, Duplicate and Rename wrote back the array the list was rendered from. Measured through the real Delete menu item: a library holding one entry from each of two tabs ended up empty. Now they re-read storage and locate the target by a stable per-entry id.
• sim_autosave is one slot shared by every tab. Nothing can merge two diagrams, but the superseded tab is now told once, while its work is still on screen and exportable.
• The +/- steppers changed the canvas, undo and autosave but not the reset baseline, so Reset or a reload silently reverted them. The autosave recorded the contradiction directly: resources: 13 next to initialResources: 10.

Determinism and animation

• Repainting consumed the seeded RNG. A gate's weight label mirrors the engine and evaluates the formula, and the canvas repaints on hover, pan, zoom, selection and every step, so the same diagram under the same seed gave different results depending on mouse movement. Measured: a single render() moved the stream position.
• The animation layer had no ceiling and no idea when it was off screen. Cleanup runs from requestAnimationFrame, which browsers suspend in a hidden tab while the setInterval driving steps keeps firing. Measured: 838 live dots in the foreground on a heavy model at top speed, growing to 2431 while hidden. Now capped at 240, skipped entirely while document.hidden, and dropped on visibilitychange.

Panels that lied

• Hiding the overflow menu in embeds last round left a narrow embed with no way to reset a run at all. Reset comes back at those widths.
• Loading a template left the Simulation panel showing the empty canvas it was drawn against: blank Name, 0 nodes, beside a canvas full of them.
• The (node deleted) placeholder added last round was selectable, and picking it restored the exact misleading state it exists to prevent. It is disabled now.

Food Web: description corrected, mechanics untouched

The template claimed "Ten species lock into coupled, bounded oscillations", but Foxes crash to 1 and stay there with foxBirths at 0. This is not a mistuned constant: at three times the birth rate and a quarter of the death rate they still peak at 167 and collapse to 1, because their break-even prey population sits near the rabbit peak and they eat the base out from under themselves.

Retuning the predator-prey coupling is a design decision about the demo rather than a defect fix, and the surrounding web is sensitive to it: pushing fox efficiency collapsed the rabbit oscillation from a span of 93 to 17. So the mechanics are unchanged and the description now says what the model does.

Testing

• node test/run.js — 258 passed (was 255 on main)
• npm run smoke — passed, no console or page errors
• Every new test baselined against the unpatched code: each fails without its fix
• New standing check: every bundled template runs 120 steps with every value finite. Smoke previously only asserted that they load.

Two caveats

• The document.hidden guard is not provable in this harness. Headless Chromium reports a backgrounded page as visible, so the test covers what is verifiable: the 240 cap, and the visibility handler driven through a real visibilitychange event.
• The share-link prompt is a design call. Two review lanes reached opposite verdicts on it, one arguing the behaviour is a deliberate documented boundary. I dropped the part of the complaint about Ctrl+Z, since no page load can offer undo for pre-load state, but kept the prompt: destroying a reader's saved work without asking is a bad outcome even when it was a considered decision. Straightforward to revert.

---

Generated by Claude Code