From 2e48b2e69c12124a6d300503a80b40f649de1316 Mon Sep 17 00:00:00 2001
From: Serhii Shpak <sergak.shpak@gmail.com>
Date: Fri, 7 Aug 2026 14:55:17 +0300
Subject: [PATCH 1/2] fix: Variables Editor client script fails to parse,
 blanking the whole UI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

escapeJsAttr() lives inside the one giant template literal that
getVariablesEditorHtml() returns as the page's inline <script>. Its
backslash-escaping regexes were written for a standalone file, but the
outer template literal consumes one level of backslash-escaping when the
.ts source is parsed — so the browser received a syntactically broken
script (Invalid regular expression: /\/g, '\').replace(/: Unmatched ')').
The resulting SyntaxError aborted the entire inline script, so neither the
Schema nor the Values tab ever rendered, regardless of whether the schema
had any tags.

Doubles the escaping to compensate for the extra template-literal layer,
verified against the exact embedded-string pipeline. Adds a regression
test that extracts every <script> block from the rendered page and parses
it with `new Function()`, which fails on the old code and passes on the fix.
---
 src/lib/variables-editor.ts             |  2 +-
 tests/unit/lib/variables-editor.spec.ts | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/lib/variables-editor.ts b/src/lib/variables-editor.ts
index f07575b..3d8965a 100644
--- a/src/lib/variables-editor.ts
+++ b/src/lib/variables-editor.ts
@@ -526,7 +526,7 @@ function escapeHtml(s) {
 // (see DistService.saveTemplateVariablesFile). Backslash/quote-escape for the JS-string
 // context first, then HTML-escape the result so it can't break out of the attribute either.
 function escapeJsAttr(s) {
-  return escapeHtml(String(s).replace(/\\/g, '\\\\').replace(/'/g, "\\'"));
+  return escapeHtml(String(s).replace(/\\\\/g, '\\\\\\\\').replace(/'/g, "\\\\'"));
 }
 
 function showBanner(type, html) {
diff --git a/tests/unit/lib/variables-editor.spec.ts b/tests/unit/lib/variables-editor.spec.ts
index f520d83..ffda857 100644
--- a/tests/unit/lib/variables-editor.spec.ts
+++ b/tests/unit/lib/variables-editor.spec.ts
@@ -341,5 +341,26 @@ describe('registerVariablesEditorRoutes', () => {
       expect(res.body).not.toContain('id="tab-schema"');
       expect(res.body).not.toContain('id="save-btn"');
     });
+
+    // Every `<script>` block is built via string concatenation inside one giant template
+    // literal — a backslash-escaping mistake there (e.g. a regex like /\\/) is invisible to
+    // `tsc`/eslint (it's just characters inside a string) and only breaks at runtime when the
+    // browser parses it, which none of the tests above would ever catch. `new Function` parses
+    // without executing, so this fails fast on any embedded-script SyntaxError.
+    it('embeds syntactically valid client-side JavaScript in every <script> block', async () => {
+      const app = register({ miAPI: { isTemplateLess: false } as unknown as MiAPI });
+      const res = makeRes();
+
+      app.handlers.get(`GET ${VARIABLES_EDITOR_PATH}`)!({}, res);
+
+      const html = res.body as string;
+      const scripts = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+
+      expect(scripts.length).toBeGreaterThan(0);
+
+      for (const script of scripts) {
+        expect(() => new Function(script)).not.toThrow();
+      }
+    });
   });
 });

From e207d1ad57cabe92e3d4f52f88aded558ee72d0c Mon Sep 17 00:00:00 2001
From: semantic-release-bot <semantic-release-bot@martynus.net>
Date: Fri, 7 Aug 2026 12:05:41 +0000
Subject: [PATCH 2/2] chore(release): 1.2.0-beta.3 [skip ci]

# [1.2.0-beta.3](https://github.com/mi-examples/pp-dev/compare/v1.2.0-beta.2...v1.2.0-beta.3) (2026-08-07)

### Bug Fixes

* Variables Editor client script fails to parse, blanking the whole UI ([2e48b2e](https://github.com/mi-examples/pp-dev/commit/2e48b2e69c12124a6d300503a80b40f649de1316))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e49be71..51e739f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+# [1.2.0-beta.3](https://github.com/mi-examples/pp-dev/compare/v1.2.0-beta.2...v1.2.0-beta.3) (2026-08-07)
+
+
+### Bug Fixes
+
+* Variables Editor client script fails to parse, blanking the whole UI ([2e48b2e](https://github.com/mi-examples/pp-dev/commit/2e48b2e69c12124a6d300503a80b40f649de1316))
+
 # [1.2.0-beta.2](https://github.com/mi-examples/pp-dev/compare/v1.2.0-beta.1...v1.2.0-beta.2) (2026-08-07)
 
 
diff --git a/package-lock.json b/package-lock.json
index 4cf0060..0cf1812 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@metricinsights/pp-dev",
-  "version": "1.2.0-beta.2",
+  "version": "1.2.0-beta.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@metricinsights/pp-dev",
-      "version": "1.2.0-beta.2",
+      "version": "1.2.0-beta.3",
       "hasInstallScript": true,
       "license": "ISC",
       "dependencies": {
diff --git a/package.json b/package.json
index 46dc471..9c528f6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@metricinsights/pp-dev",
   "type": "module",
-  "version": "1.2.0-beta.2",
+  "version": "1.2.0-beta.3",
   "description": "Portal Page dev build tool",
   "bin": {
     "pp-dev": "bin/pp-dev.js"