🐛 fix(ui): fill a blank named __proto__ in the preview like the CLI does

changelog.d/fixed-ui-proto-blank.md

@@ -0,0 +1 @@
+- Builder UI: the preview now fills a blank named `{{__proto__}}` the same way the CLI does instead of showing it as unfilled while the generated command passes it. (#327)

dist/ui.html

@@ -835,7 +835,7 @@
     }
 
     const arrayVars = [];
-    const scalarValues = {};
+    const scalarValues = Object.create(null);
 
     for (const row of rows) {
       const vals = splitValues(row.values, row.source);
@@ -858,7 +858,7 @@
     const results = [];
     try {
       for (const combo of combos) {
-        const vals = { ...scalarValues };
+        const vals = Object.assign(Object.create(null), scalarValues);
         arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
         results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
       }

src/ui-builder.test.ts

@@ -277,6 +277,16 @@ test('update ignores rows without a name', () => {
   assert.equal(h.cli(), 'promptargs "Hello {{name}}" --name=World');
 });
 
+test('update fills a variable named __proto__ in the preview like the CLI does', () => {
+  const h = makeHarness();
+  h.tmpl.value = 'Hello {{__proto__}}';
+  h.rows.push({ name: '__proto__', values: 'world' });
+  h.update();
+  assert.deepEqual(expandedTexts(h), ['Hello world']);
+  assert.ok(!h.previewBody.innerHTML.includes('class="unfilled"'), '__proto__ should not be unfilled');
+  assert.equal(h.cli(), 'promptargs "Hello {{__proto__}}" --__proto__=world');
+});
+
 // --- PRESETS -----------------------------------------------------------------
 
 interface Preset {

src/ui.html

@@ -835,7 +835,7 @@
     }
 
     const arrayVars = [];
-    const scalarValues = {};
+    const scalarValues = Object.create(null);
 
     for (const row of rows) {
       const vals = splitValues(row.values, row.source);
@@ -858,7 +858,7 @@
     const results = [];
     try {
       for (const combo of combos) {
-        const vals = { ...scalarValues };
+        const vals = Object.assign(Object.create(null), scalarValues);
         arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
         results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
       }