From ae93a902de266d77df1b92d8395ccc280fc574f3 Mon Sep 17 00:00:00 2001
From: Jobin Kurian <jobink.dev@gmail.com>
Date: Tue, 31 Mar 2026 11:04:30 +0530
Subject: [PATCH] fix(wiki): escape embedded JSON in HTML viewer and handle LLM
 token param
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Unicode-escape <, >, & in serialised JSON to prevent the HTML parser
  from misinterpreting tag-like sequences inside <script> blocks.
  Add a Content-Security-Policy meta tag to restrict resource origins.
- Auto-switch max_tokens → max_completion_tokens when the LLM API
  rejects the former with a 400, retrying transparently.
---
 gitnexus/src/core/wiki/html-viewer.ts | 13 ++++++++++---
 gitnexus/src/core/wiki/llm-client.ts  | 12 ++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/gitnexus/src/core/wiki/html-viewer.ts b/gitnexus/src/core/wiki/html-viewer.ts
index 1e4ecabc9..8e5cb2786 100644
--- a/gitnexus/src/core/wiki/html-viewer.ts
+++ b/gitnexus/src/core/wiki/html-viewer.ts
@@ -68,9 +68,15 @@ function buildHTML(
   meta: Record<string, unknown> | null,
 ): string {
   // Embed data as JSON inside the HTML
-  const pagesJSON = JSON.stringify(pages);
-  const treeJSON = JSON.stringify(moduleTree);
-  const metaJSON = JSON.stringify(meta);
+  // Unicode-escape HTML-significant chars so the HTML parser can't misinterpret them
+  const safeJSON = (v: unknown) =>
+    JSON.stringify(v)
+      .replace(/</g, '\\u003c')
+      .replace(/>/g, '\\u003e')
+      .replace(/&/g, '\\u0026');
+  const pagesJSON = safeJSON(pages);
+  const treeJSON = safeJSON(moduleTree);
+  const metaJSON = safeJSON(meta);
 
   const parts: string[] = [];
 
@@ -80,6 +86,7 @@ function buildHTML(
   parts.push('<head>');
   parts.push('<meta charset="UTF-8">');
   parts.push('<meta name="viewport" content="width=device-width, initial-scale=1.0">');
+  parts.push('<meta http-equiv="Content-Security-Policy" content="default-src \'none\'; script-src \'unsafe-inline\' https://cdn.jsdelivr.net; style-src \'unsafe-inline\'; img-src data: https:;">');
   parts.push('<title>' + esc(projectName) + ' — Wiki</title>');
   parts.push('<script src="https://cdn.jsdelivr.net/npm/marked@11.0.0/marked.min.js"><\/script>');
   parts.push(
diff --git a/gitnexus/src/core/wiki/llm-client.ts b/gitnexus/src/core/wiki/llm-client.ts
index 98e845696..35cbe54fb 100644
--- a/gitnexus/src/core/wiki/llm-client.ts
+++ b/gitnexus/src/core/wiki/llm-client.ts
@@ -210,6 +210,18 @@ export async function callLLM(
           continue;
         }
 
+        // Auto-switch max_tokens → max_completion_tokens when the model rejects max_tokens
+        if (
+          response.status === 400 &&
+          errorText.includes('max_completion_tokens') &&
+          body.max_tokens !== undefined
+        ) {
+          body.max_completion_tokens = body.max_tokens;
+          delete body.max_tokens;
+          // Retry immediately with the corrected parameter
+          continue;
+        }
+
         throw new Error(`LLM API error (${response.status}): ${errorText.slice(0, 500)}`);
       }