From c2c1f8153027fd946fc345c6a1b6dda1cfa1218c Mon Sep 17 00:00:00 2001
From: mertcano <35747700+mertcano@users.noreply.github.com>
Date: Fri, 9 Oct 2026 00:01:15 +0300
Subject: [PATCH 1/3] Fix script tag breakout in generated HTML maps

### Summary of Changes
Resolves **F19 (High)** and **F20 (High)** from the Uphold Workspace Security Audit:

- **HTML Breakout / Stored XSS Prevention (F19 & F20):**
  - Updated `build_perf_map.mjs` and `build_lcp_map.mjs` to escape `</script>` closing tags before injecting JSON payloads into template script elements.
  - Neutralizes DOM-based script execution vectors originating from untrusted target repository filenames and traced Chrome resource URLs.
  - Aligns HTML map generation with the defensive escaping already present in `build_run_report.mjs`.

### Verification
- `npm test` passes cleanly (6/6 self-tests, 6/6 invariant validations).
- End-to-end artifact generation confirms inputs containing `</script>` are serialized as `<\/script>` within HTML `<script>` tags.
---
 skills/browsergnome/scripts/build_lcp_map.mjs | 405 +++++++++---------
 .../browsergnome/scripts/build_perf_map.mjs   | 201 ++++-----
 2 files changed, 308 insertions(+), 298 deletions(-)
 mode change 100644 => 100755 skills/browsergnome/scripts/build_perf_map.mjs

diff --git a/skills/browsergnome/scripts/build_lcp_map.mjs b/skills/browsergnome/scripts/build_lcp_map.mjs
index 184248e..e963f75 100644
--- a/skills/browsergnome/scripts/build_lcp_map.mjs
+++ b/skills/browsergnome/scripts/build_lcp_map.mjs
@@ -1,200 +1,205 @@
-#!/usr/bin/env node
-/**
- * build_lcp_map.mjs — merge lcp_attribution.mjs's JSON output into the HTML
- * template to produce a standalone lcp-map.html. Mirrors build_perf_map.mjs's
- * marker-based split/join. lcp_attribution.mjs emits raw {class, label, ms,
- * confidence, ...} nodes with no render hints, so this script adds val/color
- * (same job perf_scan.mjs does for build_perf_map.mjs).
- *
- * Also resolves the target's production URL and, if found, fetches real-user
- * CrUX field data (crux.mjs) as the map's third readout tier, alongside the
- * lab (unthrottled) and throttled-reference numbers. This is the one network
- * call in the whole toolchain — everything else is offline trace parsing —
- * and it never blocks the build: any failure (no URL, offline, no field data
- * for a low-traffic origin) just omits the tier.
- *
- * Usage:
- *   node lcp_attribution.mjs <trace.json[.gz]> [bundle-stats.json[.gz]] > attribution.json
- *   node build_lcp_map.mjs attribution.json [--out lcp-map.html] [--open] [--prod-url <url>]
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import process from 'node:process';
-import readline from 'node:readline/promises';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { execFile } from 'node:child_process';
-import { getFieldData } from './crux.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ASSETS = path.resolve(__dirname, '..', 'assets');
-const TEMPLATE = path.join(ASSETS, 'lcp-map.template.html');
-const LIB = path.join(ASSETS, '3d-force-graph.min.js');
-
-const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
-const DATA_MARKER = '/*__LCP_DATA__*/';
-
-// class -> hue. Kept off the page's single brand accent (violet, used for
-// chrome/"measured" only) so the categorical palette and the accent don't
-// collide. Confidence (measured vs apportioned) is alpha, not hue.
-const CLASS_COLOR = { network: '#fbbf24', chunk: '#38bdf8', module: '#2dd4bf' };
-
-function hexToRgba(hex, alpha) {
-  const n = parseInt(hex.slice(1), 16);
-  return `rgba(${(n >> 16) & 255},${(n >> 8) & 255},${n & 255},${alpha})`;
-}
-
-function toRenderNode(n, i) {
-  const alpha = n.confidence === 'measured' ? 1 : 0.4;
-  return {
-    id: `${n.class}:${i}:${n.label}`,
-    label: n.label,
-    class: n.class,
-    ms: n.ms,
-    bytes: n.bytes ?? null,
-    confidence: n.confidence,
-    resourceType: n.resourceType ?? null,
-    failed: n.failed ?? false,
-    compileMs: n.compileMs ?? null,
-    evaluateMs: n.evaluateMs ?? null,
-    color: hexToRgba(CLASS_COLOR[n.class] || '#94a3b8', alpha),
-    val: Math.max(0.5, Math.sqrt(Math.max(n.ms, 0))),
-  };
-}
-
-function readJsonSafe(p) {
-  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
-}
-
-/**
- * Production URL, cheapest-first: explicit flag, then `.bgn/config.json`'s
- * `prodUrl` (set by Doctor's light repo find, or by hand), then the one
- * cross-repo npm convention (`package.json`'s `homepage`). No repo scanning
- * happens here — that's Doctor's job, once, at setup time; this is just the
- * read.
- */
-export function resolveProdUrl({ flagUrl, config, packageJson }) {
-  return flagUrl || config?.prodUrl || packageJson?.homepage || null;
-}
-
-/**
- * Interactive last resort: only when nothing above resolved a URL and stdout
- * is an actual terminal (never in CI/non-interactive builds). Persists the
- * answer to `.bgn/config.json` so it's asked once, not every build.
- */
-async function promptForProdUrl(configPath, config) {
-  if (!process.stdin.isTTY) return null;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question('Production URL for CrUX field data (blank to skip): ')).trim();
-  rl.close();
-  if (!answer) return null;
-  fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, JSON.stringify({ ...(config || {}), prodUrl: answer }, null, 2) + '\n');
-  return answer;
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  const open = args.includes('--open');
-  const outIdx = args.indexOf('--out');
-  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'lcp-map.html';
-  const prodUrlIdx = args.indexOf('--prod-url');
-  const skip = new Set([outIdx >= 0 ? outIdx + 1 : -1, prodUrlIdx >= 0 ? prodUrlIdx + 1 : -1]);
-  const inFile = args.find((a, i) => !a.startsWith('--') && !skip.has(i));
-
-  if (!inFile) {
-    console.error('usage: node build_lcp_map.mjs <attribution.json> [--out lcp-map.html] [--open] [--prod-url <url>]');
-    process.exit(1);
-  }
-  for (const [p, what] of [[inFile, 'attribution data'], [TEMPLATE, 'template'], [LIB, 'vendored lib']]) {
-    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
-  }
-
-  const attribution = JSON.parse(fs.readFileSync(inFile, 'utf8'));
-  if (attribution.error) {
-    console.error(`attribution data has an error, nothing to render: ${attribution.error}`);
-    process.exit(1);
-  }
-
-  const configPath = path.join(process.cwd(), '.bgn', 'config.json');
-  const config = readJsonSafe(configPath);
-  const packageJson = readJsonSafe(path.join(process.cwd(), 'package.json'));
-  const prodUrl = resolveProdUrl({ flagUrl: prodUrlIdx >= 0 ? args[prodUrlIdx + 1] : null, config, packageJson })
-    || await promptForProdUrl(configPath, config);
-  const crux = prodUrl ? await getFieldData(prodUrl, { apiKey: config?.cruxApiKey }) : null;
-
-  const nodes = (attribution.nodes || []).map(toRenderNode);
-  const payload = {
-    meta: {
-      url: attribution.url,
-      lcpMs: attribution.lcpMs,
-      tbtMs: attribution.tbtMs ?? null,
-      phases: attribution.phases ?? null,
-      transport: attribution.transport ?? null,
-      throttled: attribution.throttled ?? null,
-      crux,
-      degraded: attribution.degraded,
-      counts: {
-        network: nodes.filter((n) => n.class === 'network').length,
-        chunk: nodes.filter((n) => n.class === 'chunk').length,
-        module: nodes.filter((n) => n.class === 'module').length,
-      },
-    },
-    nodes,
-  };
-  const dataJson = JSON.stringify(payload);
-
-  const template = fs.readFileSync(TEMPLATE, 'utf8');
-  const lib = fs.readFileSync(LIB, 'utf8');
-
-  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
-    console.error('template is missing an injection marker — did the template change?');
-    process.exit(1);
-  }
-
-  const html = template
-    .split(LIB_MARKER).join(lib)
-    .split(DATA_MARKER).join(dataJson);
-
-  fs.writeFileSync(outFile, html);
-  const outAbs = path.resolve(outFile);
-  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
-
-  console.log(`\nbrowsergnome lcp-map`);
-  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
-  console.log(`  ${payload.meta.url || '(no url)'} · LCP ${payload.meta.lcpMs != null ? Math.round(payload.meta.lcpMs) + 'ms' : '?'}`);
-  console.log(`  ${payload.meta.counts.network} network · ${payload.meta.counts.chunk} chunk · ${payload.meta.counts.module} module` +
-    (payload.meta.degraded ? '  (degraded: no bundle stats, chunk-only)' : ''));
-  if (payload.meta.transport?.legacyHttp) {
-    const t = payload.meta.transport;
-    console.log(`  ⚠ transport: HTTP/1.1 (${t.http1Count}/${t.firstPartyTotal} first-party requests) — results may not represent production (HTTP/2 CDN). See banner.`);
-  }
-  if (payload.meta.throttled) {
-    const t = payload.meta.throttled;
-    console.log(`  throttled reference (${t.label}): FCP ${t.fcpMs != null ? Math.round(t.fcpMs) + 'ms' : '?'} ·` +
-      ` LCP ${t.lcpMs != null ? Math.round(t.lcpMs) + 'ms' : '?'} · TBT ${t.tbtMs != null ? Math.round(t.tbtMs) + 'ms' : '?'}`);
-  }
-  if (payload.meta.crux) {
-    const m = payload.meta.crux.metrics;
-    const src = payload.meta.crux.source === 'psi' ? 'via PageSpeed Insights, keyless' : 'CrUX API';
-    console.log(`  field data (${src}, real users, origin): LCP ${m.lcp.p75 != null ? Math.round(m.lcp.p75) + 'ms' : '?'} ·` +
-      ` CLS ${m.cls.p75 != null ? m.cls.p75.toFixed(2) : '?'} · INP ${m.inp.p75 != null ? Math.round(m.inp.p75) + 'ms' : '?'}`);
-  } else if (prodUrl) {
-    console.log(`  no CrUX field data for ${prodUrl} (low-traffic origin, or offline) — field-data tier omitted`);
-  }
-  console.log(`  open with:  open ${outAbs}\n`);
-
-  if (open) {
-    const opener = process.platform === 'darwin' ? 'open'
-      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
-    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
-  }
-}
-
-// Guarded like lcp_attribution.mjs/trace_metrics.mjs's identical checks — lets
-// resolveProdUrl/getFieldData be imported by another script (e.g. a test)
-// without also triggering a CLI run as a side effect.
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  main().catch((err) => { console.error(err); process.exit(1); });
-}
+#!/usr/bin/env node
+/**
+ * build_lcp_map.mjs — merge lcp_attribution.mjs's JSON output into the HTML
+ * template to produce a standalone lcp-map.html. Mirrors build_perf_map.mjs's
+ * marker-based split/join. lcp_attribution.mjs emits raw {class, label, ms,
+ * confidence, ...} nodes with no render hints, so this script adds val/color
+ * (same job perf_scan.mjs does for build_perf_map.mjs).
+ *
+ * Also resolves the target's production URL and, if found, fetches real-user
+ * CrUX field data (crux.mjs) as the map's third readout tier, alongside the
+ * lab (unthrottled) and throttled-reference numbers. This is the one network
+ * call in the whole toolchain — everything else is offline trace parsing —
+ * and it never blocks the build: any failure (no URL, offline, no field data
+ * for a low-traffic origin) just omits the tier.
+ *
+ * Usage:
+ *   node lcp_attribution.mjs <trace.json[.gz]> [bundle-stats.json[.gz]] > attribution.json
+ *   node build_lcp_map.mjs attribution.json [--out lcp-map.html] [--open] [--prod-url <url>]
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import readline from 'node:readline/promises';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { execFile } from 'node:child_process';
+import { getFieldData } from './crux.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ASSETS = path.resolve(__dirname, '..', 'assets');
+const TEMPLATE = path.join(ASSETS, 'lcp-map.template.html');
+const LIB = path.join(ASSETS, '3d-force-graph.min.js');
+
+const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
+const DATA_MARKER = '/*__LCP_DATA__*/';
+
+// class -> hue. Kept off the page's single brand accent (violet, used for
+// chrome/"measured" only) so the categorical palette and the accent don't
+// collide. Confidence (measured vs apportioned) is alpha, not hue.
+const CLASS_COLOR = { network: '#fbbf24', chunk: '#38bdf8', module: '#2dd4bf' };
+
+function hexToRgba(hex, alpha) {
+  const n = parseInt(hex.slice(1), 16);
+  return `rgba(${(n >> 16) & 255},${(n >> 8) & 255},${n & 255},${alpha})`;
+}
+
+function toRenderNode(n, i) {
+  const alpha = n.confidence === 'measured' ? 1 : 0.4;
+  return {
+    id: `${n.class}:${i}:${n.label}`,
+    label: n.label,
+    class: n.class,
+    ms: n.ms,
+    bytes: n.bytes ?? null,
+    confidence: n.confidence,
+    resourceType: n.resourceType ?? null,
+    failed: n.failed ?? false,
+    compileMs: n.compileMs ?? null,
+    evaluateMs: n.evaluateMs ?? null,
+    color: hexToRgba(CLASS_COLOR[n.class] || '#94a3b8', alpha),
+    val: Math.max(0.5, Math.sqrt(Math.max(n.ms, 0))),
+  };
+}
+
+function readJsonSafe(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+/**
+ * Production URL, cheapest-first: explicit flag, then `.bgn/config.json`'s
+ * `prodUrl` (set by Doctor's light repo find, or by hand), then the one
+ * cross-repo npm convention (`package.json`'s `homepage`). No repo scanning
+ * happens here — that's Doctor's job, once, at setup time; this is just the
+ * read.
+ */
+export function resolveProdUrl({ flagUrl, config, packageJson }) {
+  return flagUrl || config?.prodUrl || packageJson?.homepage || null;
+}
+
+/**
+ * Interactive last resort: only when nothing above resolved a URL and stdout
+ * is an actual terminal (never in CI/non-interactive builds). Persists the
+ * answer to `.bgn/config.json` so it's asked once, not every build.
+ */
+async function promptForProdUrl(configPath, config) {
+  if (!process.stdin.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question('Production URL for CrUX field data (blank to skip): ')).trim();
+  rl.close();
+  if (!answer) return null;
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify({ ...(config || {}), prodUrl: answer }, null, 2) + '\n');
+  return answer;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const open = args.includes('--open');
+  const outIdx = args.indexOf('--out');
+  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'lcp-map.html';
+  const prodUrlIdx = args.indexOf('--prod-url');
+  const skip = new Set([outIdx >= 0 ? outIdx + 1 : -1, prodUrlIdx >= 0 ? prodUrlIdx + 1 : -1]);
+  const inFile = args.find((a, i) => !a.startsWith('--') && !skip.has(i));
+
+  if (!inFile) {
+    console.error('usage: node build_lcp_map.mjs <attribution.json> [--out lcp-map.html] [--open] [--prod-url <url>]');
+    process.exit(1);
+  }
+  for (const [p, what] of [[inFile, 'attribution data'], [TEMPLATE, 'template'], [LIB, 'vendored lib']]) {
+    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
+  }
+
+  const attribution = JSON.parse(fs.readFileSync(inFile, 'utf8'));
+  if (attribution.error) {
+    console.error(`attribution data has an error, nothing to render: ${attribution.error}`);
+    process.exit(1);
+  }
+
+  const configPath = path.join(process.cwd(), '.bgn', 'config.json');
+  const config = readJsonSafe(configPath);
+  const packageJson = readJsonSafe(path.join(process.cwd(), 'package.json'));
+  const prodUrl = resolveProdUrl({ flagUrl: prodUrlIdx >= 0 ? args[prodUrlIdx + 1] : null, config, packageJson })
+    || await promptForProdUrl(configPath, config);
+  const crux = prodUrl ? await getFieldData(prodUrl, { apiKey: config?.cruxApiKey }) : null;
+
+  const nodes = (attribution.nodes || []).map(toRenderNode);
+  const payload = {
+    meta: {
+      url: attribution.url,
+      lcpMs: attribution.lcpMs,
+      tbtMs: attribution.tbtMs ?? null,
+      phases: attribution.phases ?? null,
+      transport: attribution.transport ?? null,
+      throttled: attribution.throttled ?? null,
+      crux,
+      degraded: attribution.degraded,
+      counts: {
+        network: nodes.filter((n) => n.class === 'network').length,
+        chunk: nodes.filter((n) => n.class === 'chunk').length,
+        module: nodes.filter((n) => n.class === 'module').length,
+      },
+    },
+    nodes,
+  };
+  const dataJson = JSON.stringify(payload);
+
+  const template = fs.readFileSync(TEMPLATE, 'utf8');
+  const lib = fs.readFileSync(LIB, 'utf8');
+
+  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
+    console.error('template is missing an injection marker — did the template change?');
+    process.exit(1);
+  }
+
+  // The payload is embedded inside a <script> block, and JSON.stringify does not escape "/".
+  // Node labels are remote resource URLs taken straight from the Chrome trace (and `meta.url` is
+  // the traced navigation URL), so measuring a site whose URL contains `</script>` would otherwise
+  // close the script element and execute attacker-chosen script when the report is opened. This
+  // report is published to GitHub Pages, so escape before injecting.
+  const html = template
+    .split(LIB_MARKER).join(lib)
+    .split(DATA_MARKER).join(dataJson.replace(/<\/(script)/gi, '<\\/$1'));
+
+  fs.writeFileSync(outFile, html);
+  const outAbs = path.resolve(outFile);
+  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
+
+  console.log(`\nbrowsergnome lcp-map`);
+  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
+  console.log(`  ${payload.meta.url || '(no url)'} · LCP ${payload.meta.lcpMs != null ? Math.round(payload.meta.lcpMs) + 'ms' : '?'}`);
+  console.log(`  ${payload.meta.counts.network} network · ${payload.meta.counts.chunk} chunk · ${payload.meta.counts.module} module` +
+    (payload.meta.degraded ? '  (degraded: no bundle stats, chunk-only)' : ''));
+  if (payload.meta.transport?.legacyHttp) {
+    const t = payload.meta.transport;
+    console.log(`  ⚠ transport: HTTP/1.1 (${t.http1Count}/${t.firstPartyTotal} first-party requests) — results may not represent production (HTTP/2 CDN). See banner.`);
+  }
+  if (payload.meta.throttled) {
+    const t = payload.meta.throttled;
+    console.log(`  throttled reference (${t.label}): FCP ${t.fcpMs != null ? Math.round(t.fcpMs) + 'ms' : '?'} ·` +
+      ` LCP ${t.lcpMs != null ? Math.round(t.lcpMs) + 'ms' : '?'} · TBT ${t.tbtMs != null ? Math.round(t.tbtMs) + 'ms' : '?'}`);
+  }
+  if (payload.meta.crux) {
+    const m = payload.meta.crux.metrics;
+    const src = payload.meta.crux.source === 'psi' ? 'via PageSpeed Insights, keyless' : 'CrUX API';
+    console.log(`  field data (${src}, real users, origin): LCP ${m.lcp.p75 != null ? Math.round(m.lcp.p75) + 'ms' : '?'} ·` +
+      ` CLS ${m.cls.p75 != null ? m.cls.p75.toFixed(2) : '?'} · INP ${m.inp.p75 != null ? Math.round(m.inp.p75) + 'ms' : '?'}`);
+  } else if (prodUrl) {
+    console.log(`  no CrUX field data for ${prodUrl} (low-traffic origin, or offline) — field-data tier omitted`);
+  }
+  console.log(`  open with:  open ${outAbs}\n`);
+
+  if (open) {
+    const opener = process.platform === 'darwin' ? 'open'
+      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
+    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
+  }
+}
+
+// Guarded like lcp_attribution.mjs/trace_metrics.mjs's identical checks — lets
+// resolveProdUrl/getFieldData be imported by another script (e.g. a test)
+// without also triggering a CLI run as a side effect.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((err) => { console.error(err); process.exit(1); });
+}
diff --git a/skills/browsergnome/scripts/build_perf_map.mjs b/skills/browsergnome/scripts/build_perf_map.mjs
old mode 100644
new mode 100755
index 86204a8..2d21d42
--- a/skills/browsergnome/scripts/build_perf_map.mjs
+++ b/skills/browsergnome/scripts/build_perf_map.mjs
@@ -1,98 +1,103 @@
-#!/usr/bin/env node
-/**
- * build_perf_map.mjs — merge graph.json into the HTML template to produce a
- * single, fully standalone perf-map.html.
- *
- * "Standalone" is a hard requirement: the vendored 3d-force-graph build (which
- * bundles three.js) and the graph payload are both INLINED into the output, so
- * perf-map.html renders from file:// with the network disabled and no sibling
- * files. That's what makes it safe to hand to anyone / open on a plane.
- *
- * Usage:
- *   node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]
- *
- * --renders overlays a Page Tools render profile (`[{file, renders, selfMs}]`, written by the agent
- * from a react_* profiling pass — see references/page-tools.md) onto matching nodes before injection.
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import process from 'node:process';
-import { fileURLToPath } from 'node:url';
-import { execFile } from 'node:child_process';
-import { mergeRenders } from './page_tools.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ASSETS = path.resolve(__dirname, '..', 'assets');
-const TEMPLATE = path.join(ASSETS, 'perf-map.template.html');
-const LIB = path.join(ASSETS, '3d-force-graph.min.js');
-
-const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
-const DATA_MARKER = '/*__GRAPH_DATA__*/';
-
-function main() {
-  const args = process.argv.slice(2);
-  const open = args.includes('--open');
-  const outIdx = args.indexOf('--out');
-  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'perf-map.html';
-  const rendersIdx = args.indexOf('--renders');
-  const rendersFile = rendersIdx >= 0 ? args[rendersIdx + 1] : null;
-  const valueIdxs = [outIdx, rendersIdx].filter((i) => i >= 0).map((i) => i + 1); // flag values, not the graph arg
-  const graphFile = args.find((a, i) => !a.startsWith('--') && !valueIdxs.includes(i));
-
-  if (!graphFile) {
-    console.error('usage: node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]');
-    process.exit(1);
-  }
-  for (const [p, what] of [[graphFile, 'graph'], [TEMPLATE, 'template'], [LIB, 'vendored lib'], ...(rendersFile ? [[rendersFile, 'render profile']] : [])]) {
-    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
-  }
-
-  let graphRaw = fs.readFileSync(graphFile, 'utf8');
-  let graph = JSON.parse(graphRaw); // validate it parses before embedding
-  let unmatched = [];
-  if (rendersFile) {
-    ({ graph, unmatched } = mergeRenders(graph, JSON.parse(fs.readFileSync(rendersFile, 'utf8'))));
-    graphRaw = JSON.stringify(graph);
-  }
-  const template = fs.readFileSync(TEMPLATE, 'utf8');
-  const lib = fs.readFileSync(LIB, 'utf8');
-
-  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
-    console.error('template is missing an injection marker — did the template change?');
-    process.exit(1);
-  }
-
-  // Literal split/join (not regex) so the 1.3MB minified lib can't be
-  // misinterpreted as a replacement pattern.
-  const html = template
-    .split(LIB_MARKER).join(lib)
-    .split(DATA_MARKER).join(graphRaw.trim());
-
-  fs.writeFileSync(outFile, html);
-  const outAbs = path.resolve(outFile);
-  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
-
-  const s = graph.meta?.stats || {};
-  console.log(`\nbrowsergnome perf-map`);
-  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
-  console.log(`  ${s.nodes ?? '?'} modules · ${s.hotspots ?? '?'} hotspot(s) · ${s.findings ?? '?'} findings`);
-  if (rendersFile) {
-    const overlaid = graph.nodes.filter((n) => 'renders' in n).length;
-    console.log(`  render overlay: ${overlaid} module(s)${unmatched.length ? ` · ${unmatched.length} profiled file(s) not in the graph: ${unmatched.join(', ')}` : ''}`);
-  }
-  if (graph.top3?.length) {
-    console.log(`  Top-3:`);
-    for (const t of graph.top3) console.log(`    ${t.rank}. ${t.paste}  (debt ${t.debt})`);
-  }
-  console.log(`  open with:  open ${outAbs}\n`);
-
-  if (open) {
-    const opener = process.platform === 'darwin' ? 'open'
-      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
-    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
-  }
-}
-
-main();
+#!/usr/bin/env node
+/**
+ * build_perf_map.mjs — merge graph.json into the HTML template to produce a
+ * single, fully standalone perf-map.html.
+ *
+ * "Standalone" is a hard requirement: the vendored 3d-force-graph build (which
+ * bundles three.js) and the graph payload are both INLINED into the output, so
+ * perf-map.html renders from file:// with the network disabled and no sibling
+ * files. That's what makes it safe to hand to anyone / open on a plane.
+ *
+ * Usage:
+ *   node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]
+ *
+ * --renders overlays a Page Tools render profile (`[{file, renders, selfMs}]`, written by the agent
+ * from a react_* profiling pass — see references/page-tools.md) onto matching nodes before injection.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { execFile } from 'node:child_process';
+import { mergeRenders } from './page_tools.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ASSETS = path.resolve(__dirname, '..', 'assets');
+const TEMPLATE = path.join(ASSETS, 'perf-map.template.html');
+const LIB = path.join(ASSETS, '3d-force-graph.min.js');
+
+const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
+const DATA_MARKER = '/*__GRAPH_DATA__*/';
+
+function main() {
+  const args = process.argv.slice(2);
+  const open = args.includes('--open');
+  const outIdx = args.indexOf('--out');
+  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'perf-map.html';
+  const rendersIdx = args.indexOf('--renders');
+  const rendersFile = rendersIdx >= 0 ? args[rendersIdx + 1] : null;
+  const valueIdxs = [outIdx, rendersIdx].filter((i) => i >= 0).map((i) => i + 1); // flag values, not the graph arg
+  const graphFile = args.find((a, i) => !a.startsWith('--') && !valueIdxs.includes(i));
+
+  if (!graphFile) {
+    console.error('usage: node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]');
+    process.exit(1);
+  }
+  for (const [p, what] of [[graphFile, 'graph'], [TEMPLATE, 'template'], [LIB, 'vendored lib'], ...(rendersFile ? [[rendersFile, 'render profile']] : [])]) {
+    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
+  }
+
+  let graphRaw = fs.readFileSync(graphFile, 'utf8');
+  let graph = JSON.parse(graphRaw); // validate it parses before embedding
+  let unmatched = [];
+  if (rendersFile) {
+    ({ graph, unmatched } = mergeRenders(graph, JSON.parse(fs.readFileSync(rendersFile, 'utf8'))));
+    graphRaw = JSON.stringify(graph);
+  }
+  const template = fs.readFileSync(TEMPLATE, 'utf8');
+  const lib = fs.readFileSync(LIB, 'utf8');
+
+  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
+    console.error('template is missing an injection marker — did the template change?');
+    process.exit(1);
+  }
+
+  // Literal split/join (not regex) so the 1.3MB minified lib can't be
+  // misinterpreted as a replacement pattern.
+  //
+  // The graph payload is embedded inside a <script> block, and JSON.stringify does not escape
+  // "/". Node ids and labels are derived from the scanned target repository's file paths, so a
+  // file named `x</script><img src=x onerror=...>` would close the script element and execute in
+  // the output page. build_run_report.mjs already escapes this; do the same here.
+  const html = template
+    .split(LIB_MARKER).join(lib)
+    .split(DATA_MARKER).join(graphRaw.trim().replace(/<\/(script)/gi, '<\\/$1'));
+
+  fs.writeFileSync(outFile, html);
+  const outAbs = path.resolve(outFile);
+  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
+
+  const s = graph.meta?.stats || {};
+  console.log(`\nbrowsergnome perf-map`);
+  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
+  console.log(`  ${s.nodes ?? '?'} modules · ${s.hotspots ?? '?'} hotspot(s) · ${s.findings ?? '?'} findings`);
+  if (rendersFile) {
+    const overlaid = graph.nodes.filter((n) => 'renders' in n).length;
+    console.log(`  render overlay: ${overlaid} module(s)${unmatched.length ? ` · ${unmatched.length} profiled file(s) not in the graph: ${unmatched.join(', ')}` : ''}`);
+  }
+  if (graph.top3?.length) {
+    console.log(`  Top-3:`);
+    for (const t of graph.top3) console.log(`    ${t.rank}. ${t.paste}  (debt ${t.debt})`);
+  }
+  console.log(`  open with:  open ${outAbs}\n`);
+
+  if (open) {
+    const opener = process.platform === 'darwin' ? 'open'
+      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
+    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
+  }
+}
+
+main();

From 774881c737eac3858b66c3b19934ed0d00cd30f2 Mon Sep 17 00:00:00 2001
From: mertcano <35747700+mertcano@users.noreply.github.com>
Date: Tue, 3 Nov 2026 17:39:19 +0300
Subject: [PATCH 2/3] Convert perf map builder line endings to LF

---
 .../browsergnome/scripts/build_perf_map.mjs   | 206 +++++++++---------
 1 file changed, 103 insertions(+), 103 deletions(-)
 mode change 100755 => 100644 skills/browsergnome/scripts/build_perf_map.mjs

diff --git a/skills/browsergnome/scripts/build_perf_map.mjs b/skills/browsergnome/scripts/build_perf_map.mjs
old mode 100755
new mode 100644
index 2d21d42..9954217
--- a/skills/browsergnome/scripts/build_perf_map.mjs
+++ b/skills/browsergnome/scripts/build_perf_map.mjs
@@ -1,103 +1,103 @@
-#!/usr/bin/env node
-/**
- * build_perf_map.mjs — merge graph.json into the HTML template to produce a
- * single, fully standalone perf-map.html.
- *
- * "Standalone" is a hard requirement: the vendored 3d-force-graph build (which
- * bundles three.js) and the graph payload are both INLINED into the output, so
- * perf-map.html renders from file:// with the network disabled and no sibling
- * files. That's what makes it safe to hand to anyone / open on a plane.
- *
- * Usage:
- *   node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]
- *
- * --renders overlays a Page Tools render profile (`[{file, renders, selfMs}]`, written by the agent
- * from a react_* profiling pass — see references/page-tools.md) onto matching nodes before injection.
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import process from 'node:process';
-import { fileURLToPath } from 'node:url';
-import { execFile } from 'node:child_process';
-import { mergeRenders } from './page_tools.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ASSETS = path.resolve(__dirname, '..', 'assets');
-const TEMPLATE = path.join(ASSETS, 'perf-map.template.html');
-const LIB = path.join(ASSETS, '3d-force-graph.min.js');
-
-const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
-const DATA_MARKER = '/*__GRAPH_DATA__*/';
-
-function main() {
-  const args = process.argv.slice(2);
-  const open = args.includes('--open');
-  const outIdx = args.indexOf('--out');
-  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'perf-map.html';
-  const rendersIdx = args.indexOf('--renders');
-  const rendersFile = rendersIdx >= 0 ? args[rendersIdx + 1] : null;
-  const valueIdxs = [outIdx, rendersIdx].filter((i) => i >= 0).map((i) => i + 1); // flag values, not the graph arg
-  const graphFile = args.find((a, i) => !a.startsWith('--') && !valueIdxs.includes(i));
-
-  if (!graphFile) {
-    console.error('usage: node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]');
-    process.exit(1);
-  }
-  for (const [p, what] of [[graphFile, 'graph'], [TEMPLATE, 'template'], [LIB, 'vendored lib'], ...(rendersFile ? [[rendersFile, 'render profile']] : [])]) {
-    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
-  }
-
-  let graphRaw = fs.readFileSync(graphFile, 'utf8');
-  let graph = JSON.parse(graphRaw); // validate it parses before embedding
-  let unmatched = [];
-  if (rendersFile) {
-    ({ graph, unmatched } = mergeRenders(graph, JSON.parse(fs.readFileSync(rendersFile, 'utf8'))));
-    graphRaw = JSON.stringify(graph);
-  }
-  const template = fs.readFileSync(TEMPLATE, 'utf8');
-  const lib = fs.readFileSync(LIB, 'utf8');
-
-  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
-    console.error('template is missing an injection marker — did the template change?');
-    process.exit(1);
-  }
-
-  // Literal split/join (not regex) so the 1.3MB minified lib can't be
-  // misinterpreted as a replacement pattern.
-  //
-  // The graph payload is embedded inside a <script> block, and JSON.stringify does not escape
-  // "/". Node ids and labels are derived from the scanned target repository's file paths, so a
-  // file named `x</script><img src=x onerror=...>` would close the script element and execute in
-  // the output page. build_run_report.mjs already escapes this; do the same here.
-  const html = template
-    .split(LIB_MARKER).join(lib)
-    .split(DATA_MARKER).join(graphRaw.trim().replace(/<\/(script)/gi, '<\\/$1'));
-
-  fs.writeFileSync(outFile, html);
-  const outAbs = path.resolve(outFile);
-  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
-
-  const s = graph.meta?.stats || {};
-  console.log(`\nbrowsergnome perf-map`);
-  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
-  console.log(`  ${s.nodes ?? '?'} modules · ${s.hotspots ?? '?'} hotspot(s) · ${s.findings ?? '?'} findings`);
-  if (rendersFile) {
-    const overlaid = graph.nodes.filter((n) => 'renders' in n).length;
-    console.log(`  render overlay: ${overlaid} module(s)${unmatched.length ? ` · ${unmatched.length} profiled file(s) not in the graph: ${unmatched.join(', ')}` : ''}`);
-  }
-  if (graph.top3?.length) {
-    console.log(`  Top-3:`);
-    for (const t of graph.top3) console.log(`    ${t.rank}. ${t.paste}  (debt ${t.debt})`);
-  }
-  console.log(`  open with:  open ${outAbs}\n`);
-
-  if (open) {
-    const opener = process.platform === 'darwin' ? 'open'
-      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
-    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
-  }
-}
-
-main();
+#!/usr/bin/env node
+/**
+ * build_perf_map.mjs — merge graph.json into the HTML template to produce a
+ * single, fully standalone perf-map.html.
+ *
+ * "Standalone" is a hard requirement: the vendored 3d-force-graph build (which
+ * bundles three.js) and the graph payload are both INLINED into the output, so
+ * perf-map.html renders from file:// with the network disabled and no sibling
+ * files. That's what makes it safe to hand to anyone / open on a plane.
+ *
+ * Usage:
+ *   node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]
+ *
+ * --renders overlays a Page Tools render profile (`[{file, renders, selfMs}]`, written by the agent
+ * from a react_* profiling pass — see references/page-tools.md) onto matching nodes before injection.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { execFile } from 'node:child_process';
+import { mergeRenders } from './page_tools.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ASSETS = path.resolve(__dirname, '..', 'assets');
+const TEMPLATE = path.join(ASSETS, 'perf-map.template.html');
+const LIB = path.join(ASSETS, '3d-force-graph.min.js');
+
+const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
+const DATA_MARKER = '/*__GRAPH_DATA__*/';
+
+function main() {
+  const args = process.argv.slice(2);
+  const open = args.includes('--open');
+  const outIdx = args.indexOf('--out');
+  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'perf-map.html';
+  const rendersIdx = args.indexOf('--renders');
+  const rendersFile = rendersIdx >= 0 ? args[rendersIdx + 1] : null;
+  const valueIdxs = [outIdx, rendersIdx].filter((i) => i >= 0).map((i) => i + 1); // flag values, not the graph arg
+  const graphFile = args.find((a, i) => !a.startsWith('--') && !valueIdxs.includes(i));
+
+  if (!graphFile) {
+    console.error('usage: node build_perf_map.mjs <graph.json> [--out perf-map.html] [--renders render-profile.json] [--open]');
+    process.exit(1);
+  }
+  for (const [p, what] of [[graphFile, 'graph'], [TEMPLATE, 'template'], [LIB, 'vendored lib'], ...(rendersFile ? [[rendersFile, 'render profile']] : [])]) {
+    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
+  }
+
+  let graphRaw = fs.readFileSync(graphFile, 'utf8');
+  let graph = JSON.parse(graphRaw); // validate it parses before embedding
+  let unmatched = [];
+  if (rendersFile) {
+    ({ graph, unmatched } = mergeRenders(graph, JSON.parse(fs.readFileSync(rendersFile, 'utf8'))));
+    graphRaw = JSON.stringify(graph);
+  }
+  const template = fs.readFileSync(TEMPLATE, 'utf8');
+  const lib = fs.readFileSync(LIB, 'utf8');
+
+  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
+    console.error('template is missing an injection marker — did the template change?');
+    process.exit(1);
+  }
+
+  // Literal split/join (not regex) so the 1.3MB minified lib can't be
+  // misinterpreted as a replacement pattern.
+  //
+  // The graph payload is embedded inside a <script> block, and JSON.stringify does not escape
+  // "/". Node ids and labels are derived from the scanned target repository's file paths, so a
+  // file named `x</script><img src=x onerror=...>` would close the script element and execute in
+  // the output page. build_run_report.mjs already escapes this; do the same here.
+  const html = template
+    .split(LIB_MARKER).join(lib)
+    .split(DATA_MARKER).join(graphRaw.trim().replace(/<\/(script)/gi, '<\\/$1'));
+
+  fs.writeFileSync(outFile, html);
+  const outAbs = path.resolve(outFile);
+  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
+
+  const s = graph.meta?.stats || {};
+  console.log(`\nbrowsergnome perf-map`);
+  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
+  console.log(`  ${s.nodes ?? '?'} modules · ${s.hotspots ?? '?'} hotspot(s) · ${s.findings ?? '?'} findings`);
+  if (rendersFile) {
+    const overlaid = graph.nodes.filter((n) => 'renders' in n).length;
+    console.log(`  render overlay: ${overlaid} module(s)${unmatched.length ? ` · ${unmatched.length} profiled file(s) not in the graph: ${unmatched.join(', ')}` : ''}`);
+  }
+  if (graph.top3?.length) {
+    console.log(`  Top-3:`);
+    for (const t of graph.top3) console.log(`    ${t.rank}. ${t.paste}  (debt ${t.debt})`);
+  }
+  console.log(`  open with:  open ${outAbs}\n`);
+
+  if (open) {
+    const opener = process.platform === 'darwin' ? 'open'
+      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
+    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
+  }
+}
+
+main();

From bc4faf717b17add02f1719846d7c89a788d9c338 Mon Sep 17 00:00:00 2001
From: Xavier Costa <xavier.costa@uphold.com>
Date: Tue, 3 Nov 2026 15:05:21 +0000
Subject: [PATCH 3/3] Harden script tag escaping in HTML builders

Escape every `<` as `<` in all three builders, which also covers
the `<!--<script` sequence and run_report's weaker `</script>` regex.
Convert build_lcp_map.mjs to LF, add a hostile payload check to
check_invariants.mjs and update the CLAUDE.md convention.
---
 CLAUDE.md                                     |   5 +-
 skills/browsergnome/scripts/build_lcp_map.mjs | 407 +++++++++---------
 .../browsergnome/scripts/build_perf_map.mjs   |   8 +-
 .../browsergnome/scripts/build_run_report.mjs |   5 +-
 .../browsergnome/scripts/check_invariants.mjs |  22 +
 5 files changed, 233 insertions(+), 214 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index c9fbe7c..3f2e03d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -95,8 +95,9 @@ Two conventions hold across the real file/stdout handoffs:
   HTML by `split().join()` on comment markers (`/*__GRAPH_DATA__*/`, `/*__LCP_DATA__*/`,
   `/*__RUN_DATA__*/`, `/*__FORCE_GRAPH_LIB__*/`) in `assets/*.template.html`, deliberately not regex
   (the 1.3 MB vendored `assets/3d-force-graph.min.js` could match one). Renaming a marker without
-  updating its builder fails loudly — keep it that way. Only `build_run_report.mjs` escapes
-  `</script>` in injected data; the other two inject raw JSON/text into a `<script>` block.
+  updating its builder fails loudly — keep it that way. All three replace every `<` in the
+  injected data with `\u003c` (blocks `</script` and `<!--<script` breakout); `check_invariants.mjs`
+  builds each one from a hostile payload to keep it that way.
 
 ## Cross-file invariants
 
diff --git a/skills/browsergnome/scripts/build_lcp_map.mjs b/skills/browsergnome/scripts/build_lcp_map.mjs
index e963f75..60c0ba2 100644
--- a/skills/browsergnome/scripts/build_lcp_map.mjs
+++ b/skills/browsergnome/scripts/build_lcp_map.mjs
@@ -1,205 +1,202 @@
-#!/usr/bin/env node
-/**
- * build_lcp_map.mjs — merge lcp_attribution.mjs's JSON output into the HTML
- * template to produce a standalone lcp-map.html. Mirrors build_perf_map.mjs's
- * marker-based split/join. lcp_attribution.mjs emits raw {class, label, ms,
- * confidence, ...} nodes with no render hints, so this script adds val/color
- * (same job perf_scan.mjs does for build_perf_map.mjs).
- *
- * Also resolves the target's production URL and, if found, fetches real-user
- * CrUX field data (crux.mjs) as the map's third readout tier, alongside the
- * lab (unthrottled) and throttled-reference numbers. This is the one network
- * call in the whole toolchain — everything else is offline trace parsing —
- * and it never blocks the build: any failure (no URL, offline, no field data
- * for a low-traffic origin) just omits the tier.
- *
- * Usage:
- *   node lcp_attribution.mjs <trace.json[.gz]> [bundle-stats.json[.gz]] > attribution.json
- *   node build_lcp_map.mjs attribution.json [--out lcp-map.html] [--open] [--prod-url <url>]
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import process from 'node:process';
-import readline from 'node:readline/promises';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { execFile } from 'node:child_process';
-import { getFieldData } from './crux.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ASSETS = path.resolve(__dirname, '..', 'assets');
-const TEMPLATE = path.join(ASSETS, 'lcp-map.template.html');
-const LIB = path.join(ASSETS, '3d-force-graph.min.js');
-
-const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
-const DATA_MARKER = '/*__LCP_DATA__*/';
-
-// class -> hue. Kept off the page's single brand accent (violet, used for
-// chrome/"measured" only) so the categorical palette and the accent don't
-// collide. Confidence (measured vs apportioned) is alpha, not hue.
-const CLASS_COLOR = { network: '#fbbf24', chunk: '#38bdf8', module: '#2dd4bf' };
-
-function hexToRgba(hex, alpha) {
-  const n = parseInt(hex.slice(1), 16);
-  return `rgba(${(n >> 16) & 255},${(n >> 8) & 255},${n & 255},${alpha})`;
-}
-
-function toRenderNode(n, i) {
-  const alpha = n.confidence === 'measured' ? 1 : 0.4;
-  return {
-    id: `${n.class}:${i}:${n.label}`,
-    label: n.label,
-    class: n.class,
-    ms: n.ms,
-    bytes: n.bytes ?? null,
-    confidence: n.confidence,
-    resourceType: n.resourceType ?? null,
-    failed: n.failed ?? false,
-    compileMs: n.compileMs ?? null,
-    evaluateMs: n.evaluateMs ?? null,
-    color: hexToRgba(CLASS_COLOR[n.class] || '#94a3b8', alpha),
-    val: Math.max(0.5, Math.sqrt(Math.max(n.ms, 0))),
-  };
-}
-
-function readJsonSafe(p) {
-  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
-}
-
-/**
- * Production URL, cheapest-first: explicit flag, then `.bgn/config.json`'s
- * `prodUrl` (set by Doctor's light repo find, or by hand), then the one
- * cross-repo npm convention (`package.json`'s `homepage`). No repo scanning
- * happens here — that's Doctor's job, once, at setup time; this is just the
- * read.
- */
-export function resolveProdUrl({ flagUrl, config, packageJson }) {
-  return flagUrl || config?.prodUrl || packageJson?.homepage || null;
-}
-
-/**
- * Interactive last resort: only when nothing above resolved a URL and stdout
- * is an actual terminal (never in CI/non-interactive builds). Persists the
- * answer to `.bgn/config.json` so it's asked once, not every build.
- */
-async function promptForProdUrl(configPath, config) {
-  if (!process.stdin.isTTY) return null;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question('Production URL for CrUX field data (blank to skip): ')).trim();
-  rl.close();
-  if (!answer) return null;
-  fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, JSON.stringify({ ...(config || {}), prodUrl: answer }, null, 2) + '\n');
-  return answer;
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  const open = args.includes('--open');
-  const outIdx = args.indexOf('--out');
-  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'lcp-map.html';
-  const prodUrlIdx = args.indexOf('--prod-url');
-  const skip = new Set([outIdx >= 0 ? outIdx + 1 : -1, prodUrlIdx >= 0 ? prodUrlIdx + 1 : -1]);
-  const inFile = args.find((a, i) => !a.startsWith('--') && !skip.has(i));
-
-  if (!inFile) {
-    console.error('usage: node build_lcp_map.mjs <attribution.json> [--out lcp-map.html] [--open] [--prod-url <url>]');
-    process.exit(1);
-  }
-  for (const [p, what] of [[inFile, 'attribution data'], [TEMPLATE, 'template'], [LIB, 'vendored lib']]) {
-    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
-  }
-
-  const attribution = JSON.parse(fs.readFileSync(inFile, 'utf8'));
-  if (attribution.error) {
-    console.error(`attribution data has an error, nothing to render: ${attribution.error}`);
-    process.exit(1);
-  }
-
-  const configPath = path.join(process.cwd(), '.bgn', 'config.json');
-  const config = readJsonSafe(configPath);
-  const packageJson = readJsonSafe(path.join(process.cwd(), 'package.json'));
-  const prodUrl = resolveProdUrl({ flagUrl: prodUrlIdx >= 0 ? args[prodUrlIdx + 1] : null, config, packageJson })
-    || await promptForProdUrl(configPath, config);
-  const crux = prodUrl ? await getFieldData(prodUrl, { apiKey: config?.cruxApiKey }) : null;
-
-  const nodes = (attribution.nodes || []).map(toRenderNode);
-  const payload = {
-    meta: {
-      url: attribution.url,
-      lcpMs: attribution.lcpMs,
-      tbtMs: attribution.tbtMs ?? null,
-      phases: attribution.phases ?? null,
-      transport: attribution.transport ?? null,
-      throttled: attribution.throttled ?? null,
-      crux,
-      degraded: attribution.degraded,
-      counts: {
-        network: nodes.filter((n) => n.class === 'network').length,
-        chunk: nodes.filter((n) => n.class === 'chunk').length,
-        module: nodes.filter((n) => n.class === 'module').length,
-      },
-    },
-    nodes,
-  };
-  const dataJson = JSON.stringify(payload);
-
-  const template = fs.readFileSync(TEMPLATE, 'utf8');
-  const lib = fs.readFileSync(LIB, 'utf8');
-
-  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
-    console.error('template is missing an injection marker — did the template change?');
-    process.exit(1);
-  }
-
-  // The payload is embedded inside a <script> block, and JSON.stringify does not escape "/".
-  // Node labels are remote resource URLs taken straight from the Chrome trace (and `meta.url` is
-  // the traced navigation URL), so measuring a site whose URL contains `</script>` would otherwise
-  // close the script element and execute attacker-chosen script when the report is opened. This
-  // report is published to GitHub Pages, so escape before injecting.
-  const html = template
-    .split(LIB_MARKER).join(lib)
-    .split(DATA_MARKER).join(dataJson.replace(/<\/(script)/gi, '<\\/$1'));
-
-  fs.writeFileSync(outFile, html);
-  const outAbs = path.resolve(outFile);
-  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
-
-  console.log(`\nbrowsergnome lcp-map`);
-  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
-  console.log(`  ${payload.meta.url || '(no url)'} · LCP ${payload.meta.lcpMs != null ? Math.round(payload.meta.lcpMs) + 'ms' : '?'}`);
-  console.log(`  ${payload.meta.counts.network} network · ${payload.meta.counts.chunk} chunk · ${payload.meta.counts.module} module` +
-    (payload.meta.degraded ? '  (degraded: no bundle stats, chunk-only)' : ''));
-  if (payload.meta.transport?.legacyHttp) {
-    const t = payload.meta.transport;
-    console.log(`  ⚠ transport: HTTP/1.1 (${t.http1Count}/${t.firstPartyTotal} first-party requests) — results may not represent production (HTTP/2 CDN). See banner.`);
-  }
-  if (payload.meta.throttled) {
-    const t = payload.meta.throttled;
-    console.log(`  throttled reference (${t.label}): FCP ${t.fcpMs != null ? Math.round(t.fcpMs) + 'ms' : '?'} ·` +
-      ` LCP ${t.lcpMs != null ? Math.round(t.lcpMs) + 'ms' : '?'} · TBT ${t.tbtMs != null ? Math.round(t.tbtMs) + 'ms' : '?'}`);
-  }
-  if (payload.meta.crux) {
-    const m = payload.meta.crux.metrics;
-    const src = payload.meta.crux.source === 'psi' ? 'via PageSpeed Insights, keyless' : 'CrUX API';
-    console.log(`  field data (${src}, real users, origin): LCP ${m.lcp.p75 != null ? Math.round(m.lcp.p75) + 'ms' : '?'} ·` +
-      ` CLS ${m.cls.p75 != null ? m.cls.p75.toFixed(2) : '?'} · INP ${m.inp.p75 != null ? Math.round(m.inp.p75) + 'ms' : '?'}`);
-  } else if (prodUrl) {
-    console.log(`  no CrUX field data for ${prodUrl} (low-traffic origin, or offline) — field-data tier omitted`);
-  }
-  console.log(`  open with:  open ${outAbs}\n`);
-
-  if (open) {
-    const opener = process.platform === 'darwin' ? 'open'
-      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
-    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
-  }
-}
-
-// Guarded like lcp_attribution.mjs/trace_metrics.mjs's identical checks — lets
-// resolveProdUrl/getFieldData be imported by another script (e.g. a test)
-// without also triggering a CLI run as a side effect.
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  main().catch((err) => { console.error(err); process.exit(1); });
-}
+#!/usr/bin/env node
+/**
+ * build_lcp_map.mjs — merge lcp_attribution.mjs's JSON output into the HTML
+ * template to produce a standalone lcp-map.html. Mirrors build_perf_map.mjs's
+ * marker-based split/join. lcp_attribution.mjs emits raw {class, label, ms,
+ * confidence, ...} nodes with no render hints, so this script adds val/color
+ * (same job perf_scan.mjs does for build_perf_map.mjs).
+ *
+ * Also resolves the target's production URL and, if found, fetches real-user
+ * CrUX field data (crux.mjs) as the map's third readout tier, alongside the
+ * lab (unthrottled) and throttled-reference numbers. This is the one network
+ * call in the whole toolchain — everything else is offline trace parsing —
+ * and it never blocks the build: any failure (no URL, offline, no field data
+ * for a low-traffic origin) just omits the tier.
+ *
+ * Usage:
+ *   node lcp_attribution.mjs <trace.json[.gz]> [bundle-stats.json[.gz]] > attribution.json
+ *   node build_lcp_map.mjs attribution.json [--out lcp-map.html] [--open] [--prod-url <url>]
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import readline from 'node:readline/promises';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { execFile } from 'node:child_process';
+import { getFieldData } from './crux.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ASSETS = path.resolve(__dirname, '..', 'assets');
+const TEMPLATE = path.join(ASSETS, 'lcp-map.template.html');
+const LIB = path.join(ASSETS, '3d-force-graph.min.js');
+
+const LIB_MARKER = '/*__FORCE_GRAPH_LIB__*/';
+const DATA_MARKER = '/*__LCP_DATA__*/';
+
+// class -> hue. Kept off the page's single brand accent (violet, used for
+// chrome/"measured" only) so the categorical palette and the accent don't
+// collide. Confidence (measured vs apportioned) is alpha, not hue.
+const CLASS_COLOR = { network: '#fbbf24', chunk: '#38bdf8', module: '#2dd4bf' };
+
+function hexToRgba(hex, alpha) {
+  const n = parseInt(hex.slice(1), 16);
+  return `rgba(${(n >> 16) & 255},${(n >> 8) & 255},${n & 255},${alpha})`;
+}
+
+function toRenderNode(n, i) {
+  const alpha = n.confidence === 'measured' ? 1 : 0.4;
+  return {
+    id: `${n.class}:${i}:${n.label}`,
+    label: n.label,
+    class: n.class,
+    ms: n.ms,
+    bytes: n.bytes ?? null,
+    confidence: n.confidence,
+    resourceType: n.resourceType ?? null,
+    failed: n.failed ?? false,
+    compileMs: n.compileMs ?? null,
+    evaluateMs: n.evaluateMs ?? null,
+    color: hexToRgba(CLASS_COLOR[n.class] || '#94a3b8', alpha),
+    val: Math.max(0.5, Math.sqrt(Math.max(n.ms, 0))),
+  };
+}
+
+function readJsonSafe(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+/**
+ * Production URL, cheapest-first: explicit flag, then `.bgn/config.json`'s
+ * `prodUrl` (set by Doctor's light repo find, or by hand), then the one
+ * cross-repo npm convention (`package.json`'s `homepage`). No repo scanning
+ * happens here — that's Doctor's job, once, at setup time; this is just the
+ * read.
+ */
+export function resolveProdUrl({ flagUrl, config, packageJson }) {
+  return flagUrl || config?.prodUrl || packageJson?.homepage || null;
+}
+
+/**
+ * Interactive last resort: only when nothing above resolved a URL and stdout
+ * is an actual terminal (never in CI/non-interactive builds). Persists the
+ * answer to `.bgn/config.json` so it's asked once, not every build.
+ */
+async function promptForProdUrl(configPath, config) {
+  if (!process.stdin.isTTY) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question('Production URL for CrUX field data (blank to skip): ')).trim();
+  rl.close();
+  if (!answer) return null;
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, JSON.stringify({ ...(config || {}), prodUrl: answer }, null, 2) + '\n');
+  return answer;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const open = args.includes('--open');
+  const outIdx = args.indexOf('--out');
+  const outFile = outIdx >= 0 ? args[outIdx + 1] : 'lcp-map.html';
+  const prodUrlIdx = args.indexOf('--prod-url');
+  const skip = new Set([outIdx >= 0 ? outIdx + 1 : -1, prodUrlIdx >= 0 ? prodUrlIdx + 1 : -1]);
+  const inFile = args.find((a, i) => !a.startsWith('--') && !skip.has(i));
+
+  if (!inFile) {
+    console.error('usage: node build_lcp_map.mjs <attribution.json> [--out lcp-map.html] [--open] [--prod-url <url>]');
+    process.exit(1);
+  }
+  for (const [p, what] of [[inFile, 'attribution data'], [TEMPLATE, 'template'], [LIB, 'vendored lib']]) {
+    if (!fs.existsSync(p)) { console.error(`missing ${what}: ${p}`); process.exit(1); }
+  }
+
+  const attribution = JSON.parse(fs.readFileSync(inFile, 'utf8'));
+  if (attribution.error) {
+    console.error(`attribution data has an error, nothing to render: ${attribution.error}`);
+    process.exit(1);
+  }
+
+  const configPath = path.join(process.cwd(), '.bgn', 'config.json');
+  const config = readJsonSafe(configPath);
+  const packageJson = readJsonSafe(path.join(process.cwd(), 'package.json'));
+  const prodUrl = resolveProdUrl({ flagUrl: prodUrlIdx >= 0 ? args[prodUrlIdx + 1] : null, config, packageJson })
+    || await promptForProdUrl(configPath, config);
+  const crux = prodUrl ? await getFieldData(prodUrl, { apiKey: config?.cruxApiKey }) : null;
+
+  const nodes = (attribution.nodes || []).map(toRenderNode);
+  const payload = {
+    meta: {
+      url: attribution.url,
+      lcpMs: attribution.lcpMs,
+      tbtMs: attribution.tbtMs ?? null,
+      phases: attribution.phases ?? null,
+      transport: attribution.transport ?? null,
+      throttled: attribution.throttled ?? null,
+      crux,
+      degraded: attribution.degraded,
+      counts: {
+        network: nodes.filter((n) => n.class === 'network').length,
+        chunk: nodes.filter((n) => n.class === 'chunk').length,
+        module: nodes.filter((n) => n.class === 'module').length,
+      },
+    },
+    nodes,
+  };
+  const dataJson = JSON.stringify(payload);
+
+  const template = fs.readFileSync(TEMPLATE, 'utf8');
+  const lib = fs.readFileSync(LIB, 'utf8');
+
+  if (!template.includes(LIB_MARKER) || !template.includes(DATA_MARKER)) {
+    console.error('template is missing an injection marker — did the template change?');
+    process.exit(1);
+  }
+
+  // Data lands inside a <script> block: a raw `<` in any value (bundle module/chunk names, URLs) can form `</script`
+  // or `<!--<script` and end or derail it. `\u003c` parses back to the same character.
+  const html = template
+    .split(LIB_MARKER).join(lib)
+    .split(DATA_MARKER).join(dataJson.replace(/</g, '\\u003c'));
+
+  fs.writeFileSync(outFile, html);
+  const outAbs = path.resolve(outFile);
+  const kb = (fs.statSync(outAbs).size / 1024).toFixed(0);
+
+  console.log(`\nbrowsergnome lcp-map`);
+  console.log(`  wrote ${outAbs} (${kb} KB, standalone)`);
+  console.log(`  ${payload.meta.url || '(no url)'} · LCP ${payload.meta.lcpMs != null ? Math.round(payload.meta.lcpMs) + 'ms' : '?'}`);
+  console.log(`  ${payload.meta.counts.network} network · ${payload.meta.counts.chunk} chunk · ${payload.meta.counts.module} module` +
+    (payload.meta.degraded ? '  (degraded: no bundle stats, chunk-only)' : ''));
+  if (payload.meta.transport?.legacyHttp) {
+    const t = payload.meta.transport;
+    console.log(`  ⚠ transport: HTTP/1.1 (${t.http1Count}/${t.firstPartyTotal} first-party requests) — results may not represent production (HTTP/2 CDN). See banner.`);
+  }
+  if (payload.meta.throttled) {
+    const t = payload.meta.throttled;
+    console.log(`  throttled reference (${t.label}): FCP ${t.fcpMs != null ? Math.round(t.fcpMs) + 'ms' : '?'} ·` +
+      ` LCP ${t.lcpMs != null ? Math.round(t.lcpMs) + 'ms' : '?'} · TBT ${t.tbtMs != null ? Math.round(t.tbtMs) + 'ms' : '?'}`);
+  }
+  if (payload.meta.crux) {
+    const m = payload.meta.crux.metrics;
+    const src = payload.meta.crux.source === 'psi' ? 'via PageSpeed Insights, keyless' : 'CrUX API';
+    console.log(`  field data (${src}, real users, origin): LCP ${m.lcp.p75 != null ? Math.round(m.lcp.p75) + 'ms' : '?'} ·` +
+      ` CLS ${m.cls.p75 != null ? m.cls.p75.toFixed(2) : '?'} · INP ${m.inp.p75 != null ? Math.round(m.inp.p75) + 'ms' : '?'}`);
+  } else if (prodUrl) {
+    console.log(`  no CrUX field data for ${prodUrl} (low-traffic origin, or offline) — field-data tier omitted`);
+  }
+  console.log(`  open with:  open ${outAbs}\n`);
+
+  if (open) {
+    const opener = process.platform === 'darwin' ? 'open'
+      : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const oArgs = process.platform === 'win32' ? ['/c', 'start', '', outAbs] : [outAbs];
+    execFile(opener, oArgs, (err) => { if (err) console.error('could not auto-open:', err.message); });
+  }
+}
+
+// Guarded like lcp_attribution.mjs/trace_metrics.mjs's identical checks — lets
+// resolveProdUrl/getFieldData be imported by another script (e.g. a test)
+// without also triggering a CLI run as a side effect.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((err) => { console.error(err); process.exit(1); });
+}
diff --git a/skills/browsergnome/scripts/build_perf_map.mjs b/skills/browsergnome/scripts/build_perf_map.mjs
index 9954217..0b3b31d 100644
--- a/skills/browsergnome/scripts/build_perf_map.mjs
+++ b/skills/browsergnome/scripts/build_perf_map.mjs
@@ -66,13 +66,11 @@ function main() {
   // Literal split/join (not regex) so the 1.3MB minified lib can't be
   // misinterpreted as a replacement pattern.
   //
-  // The graph payload is embedded inside a <script> block, and JSON.stringify does not escape
-  // "/". Node ids and labels are derived from the scanned target repository's file paths, so a
-  // file named `x</script><img src=x onerror=...>` would close the script element and execute in
-  // the output page. build_run_report.mjs already escapes this; do the same here.
+  // Data lands inside a <script> block: a raw `<` in any value (scanned file paths) can form `</script`
+  // or `<!--<script` and end or derail it. `\u003c` parses back to the same character.
   const html = template
     .split(LIB_MARKER).join(lib)
-    .split(DATA_MARKER).join(graphRaw.trim().replace(/<\/(script)/gi, '<\\/$1'));
+    .split(DATA_MARKER).join(graphRaw.trim().replace(/</g, '\\u003c'));
 
   fs.writeFileSync(outFile, html);
   const outAbs = path.resolve(outFile);
diff --git a/skills/browsergnome/scripts/build_run_report.mjs b/skills/browsergnome/scripts/build_run_report.mjs
index 7dc8586..e8fcc3f 100644
--- a/skills/browsergnome/scripts/build_run_report.mjs
+++ b/skills/browsergnome/scripts/build_run_report.mjs
@@ -51,8 +51,9 @@ function main() {
     process.exit(1);
   }
 
-  // Escape </script> so it can't close the script block if it appears in data values
-  const safeData = rawData.replace(/<\/script>/gi, '<\\/script>');
+  // Data lands inside a <script> block: a raw `<` in any value (agent-written run state) can form `</script`
+  // or `<!--<script` and end or derail it. `\u003c` parses back to the same character.
+  const safeData = rawData.replace(/</g, '\\u003c');
   const [before, after] = template.split(DATA_MARKER);
   const out = before + safeData + after;
 
diff --git a/skills/browsergnome/scripts/check_invariants.mjs b/skills/browsergnome/scripts/check_invariants.mjs
index 8e3fe29..a900405 100644
--- a/skills/browsergnome/scripts/check_invariants.mjs
+++ b/skills/browsergnome/scripts/check_invariants.mjs
@@ -21,9 +21,11 @@
  */
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
 import { checkVersionPin, checkProviderPin, checkThirdPartyFlag } from './doctor.mjs';
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
@@ -166,6 +168,26 @@ function main() {
   report('Perf Map calibration SHA (pages.yml <-> perf-map.md)', calibration.ok,
     calibration.ok ? calibration.workflowSha.slice(0, 8) : `workflow=${calibration.workflowSha ?? '?'} docs=${calibration.docsSha ?? '?'}`);
 
+  // 5. HTML builders escape every `<` in the data they inject into a <script> block
+  const HOSTILE = '</script><!--<script>';
+  const ESCAPED = HOSTILE.replace(/</g, '\\u003c');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'bgn-escape-'));
+  const builders = [
+    ['build_perf_map.mjs', { nodes: [{ id: HOSTILE, label: HOSTILE }], links: [] }],
+    ['build_lcp_map.mjs', { url: HOSTILE, nodes: [{ class: 'module', label: HOSTILE, ms: 1, confidence: 'measured' }] }],
+    ['build_run_report.mjs', { target: HOSTILE, iterations: [] }],
+  ];
+  for (const [script, data] of builders) {
+    const inFile = path.join(tmp, 'in.json');
+    const outFile = path.join(tmp, 'out.html');
+    fs.writeFileSync(inFile, JSON.stringify(data));
+    // cwd = tmp: no package.json/.bgn there, so build_lcp_map resolves no prod URL and stays offline
+    const run = spawnSync(process.execPath, [path.join(repoRoot, 'skills/browsergnome/scripts', script), inFile, '--out', outFile], { cwd: tmp, encoding: 'utf8' });
+    const ok = run.status === 0 && fs.readFileSync(outFile, 'utf8').includes(ESCAPED);
+    report(`${script} escapes \`<\` in injected data`, ok, ok ? undefined : run.stderr.trim() || 'hostile payload not escaped');
+  }
+  fs.rmSync(tmp, { recursive: true, force: true });
+
   console.log(`\n  ${pass} passed, ${fail} failed`);
   process.exit(fail ? 1 : 0);
 }