Good First Issues in TypeScript

Finding pkg/sanitize implements two security-critical sanitizers, PromptString (LLM prompt-injection) and LogString (CWE-117 log-injection). The existing test file covers many specific inputs (role markers, ANSI, U+2028/U+2029, null bytes, control chars, mixed UTF-8) but does not lock the universal post-conditions the sanitizers are supposed to guarantee for arbitrary input. A subtle regex regression (e.g., swapping \\x1c-\\x1f for \\x1c-\\x1e, or reordering the html.EscapeString / role-marker stages) can pass every named case while still leaking a control byte or structure marker on some other input. Three properties in particular are unprotected: Idempotence of LogString — running the sanitizer on an already-sanitized value must be a no-op. Pass-through log middleware relies on this. Output-shape guarantees over an adversarial corpus — LogString output must contain no C0 controls (except tab), no DEL, no ESC, no CR/LF, no U+2028/U+2029; PromptString output must contain no raw \n

🟢 Good First Issue: Add Color Theme: Ramen Steam — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner 🎨 Add New Color Theme: "Ramen Steam" Category: Community Contribution - Theme Difficulty: Easy (good first issue!) Estimated Time: <1 min 🎯 Your Task Add this beautiful new theme to KanaDojo! Theme Details Property Value ID ramen-steam Background oklch(21.0% 0.038 50.0 / 1) Main Color oklch(82.0% 0.135 85.0 / 1) Secondary oklch(65.0% 0.165 40.0 / 1) 💡 Vibe: Hot broth rising from the bowl 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/community-themes.json in your browser (click the link!) Scroll to the bottom of the fil

🟢 Good First Issue: Add Community Note Line #1 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add Tiny Community Note Line Category: Community Contribution - Community Note Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add one exact markdown line to a low-priority community notes file. The Community Note Edit File: docs/community-notes/contribution-notes-1.md Position: bottom - Community note: this file is used for lightweight contribution practice. 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open docs/community-notes/contribution-notes-1.md in your browser Add the following line to the bottom of the file Save the file and commit the ch

🟢 Good First Issue: Add Learner Mistake #53 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add Common Japanese Learner Mistake Category: Community Contribution - Common Mistake Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add this common learner mistake pair to help others avoid frequent Japanese errors! The Common Mistake Wrong: これは私のです本。 Correct: これは私の本です。 Why: Place の correctly in noun phrase. (Pattern set 3) 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/japanese-common-mistakes.json in your browser (click the link!) Scroll to the bottom of the file and paste the following

🟢 Good First Issue: Add Example Sentence #104 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add Japanese Example Sentence Category: Community Contribution - Example Sentence Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add this Japanese example sentence to improve real-world reading and comprehension! The Example Sentence Japanese Romaji English JLPT この漢字の読み方を教えてください。 Kono kanji no yomikata o oshiete kudasai. Please tell me how to read this kanji. N5 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/japanese-example-sentences.json in your browser (click the link!) Scroll to

🟢 Good First Issue: Add False Friend Pair #28 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add Japanese False Friend Category: Community Contribution - False Friend Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add this confusion pair to help learners avoid common Japanese mixups! The False Friend Pair Term A: リベンジ (ribenji) Term B: revenge (English) Explanation: Often used as 'try again after failing'. (Set 2) Example: 去年落ちた試験に今年リベンジする。 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/japanese-false-friends.json in your browser (click the link!) Scroll to the bottom of the

🟢 Good First Issue: Add Dialect Entry #94 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add New Regional Dialect Entry Category: Community Contribution - Regional Dialect Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add this regional dialect phrase so learners can understand real-world Japanese variation! The Dialect Entry Dialect Standard Japanese English Region ぶち とても very Yamaguchi/Hiroshima Note: Regional intensifier. (Set 5) 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/japanese-regional-dialects.json in your browser (click the link!) Scroll to the bottom of the file and paste the follow

Small, self-contained cleanup in src/app/features/focus-mode/. Good first issue for someone who wants to get familiar with the focus mode code. No behaviour change of any kind is intended. Since 31b702c (feat(focusMode): improve focus rocket, 2025-10-31) deleted the standalone focus-mode-duration-selection and focus-mode-preparation components, a piece of the screen-routing API they used has been left behind and is now unreachable. What is dead 1. FocusModeStrategy.getNextScreenAfterTaskSelection() Declared on the interface in focus-mode.model.ts and implemented by all three strategies (PomodoroStrategy, FlowtimeStrategy, CountdownStrategy in focus-mode-strategies.ts), but never called anywhere outside those files and their specs: grep -rn "getNextScreenAfterTaskSelection" --include="*.ts" src \ | grep -v "focus-mode-strategies\|focus-mode.model" # no results Screen transitions are decided entirely by the reducer now. selectFocusTask unconditionally sets currentScreen: FocusScreen.M

Summary On 0.21.0 the MCP server picks its workspace identity by taking the first entry from /api/workspace/directory instead of the activeWorkspaceId that the very same response returns. When a user belongs to more than one workspace and the active one is not first in the list, every MCP read of that user's own local projects fails with: 403 WORKSPACE_PROJECT_PERMISSION_DENIED {"error":{"code":"WORKSPACE_PROJECT_PERMISSION_DENIED","message":"workspace project read is not allowed"}} get_active_context still works (it uses a different endpoint), so the agent can see the project's name and id but cannot read anything inside it — which makes the failure look like a permissions setting the user is supposed to flip somewhere. There is no such setting. Environment Open Design 0.21.0 (launcher-managed install, macOS 15) MCP client: Claude Code, stdio (daemon-cli.mjs mcp --daemon-url …) Account profile prod, session authenticated User is owner of two workspaces, both reported as workspac

🟢 Good First Issue: Add Video Game Quote #59 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner Add Famous Japanese Video Game Quote Category: Community Contribution - Video Game Quote Difficulty: Easy (good first issue!) Estimated Time: <1 min Your Task Add this iconic Japanese game quote so learners can enjoy game culture while studying! The Video Game Quote Japanese Romaji English 俺たちの物語は、ここからだ Oretachi no monogatari wa, koko kara da Our story starts here. Game: Tales series Character: Various endings 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/japanese-videogame-quotes.json in your browser (click the l

🟢 Good First Issue: Add Anime Quote #35 — Beginner-Friendly Open Source Contribution 🟢 No prerequisites needed! You don't need to clone the repo, install anything, or write code. This entire contribution can be done from your browser in under 60 seconds. Labels: good first issue, help wanted, hacktoberfest Language: JSON (no coding required) Time: < 1 minute Skill Level: Absolute beginner 🎬 Add Famous Anime Quote Category: Community Contribution - Anime Quote Difficulty: Easy (good first issue!) Estimated Time: <1 min 🎯 Your Task Add this iconic anime quote so learners can enjoy Japanese pop culture! The Quote Japanese Romaji English 痛みを伴わない教訓には意味がない Itami o tomonawanai kyoukun ni wa imi ga nai A lesson without pain is meaningless. Anime: Fullmetal Alchemist: Brotherhood Character: Edward Elric 📝 Instructions Star our repo ⭐ Fork our repo 🍴 Open community/content/anime-quotes.json in your browser (click the link!)

Summary Every od automation create and od automation update invocation fails with a temporal dead zone ReferenceError on 0.21.1. The headless automation surface the CLI help advertises for external agents is unusable as a result. ReferenceError: Cannot access 'splitAutomationIds' before initialization at automationContextFromFlags (.../apps/daemon/dist/cli.js:11346:22) at Object.runAutomation (.../apps/daemon/dist/cli.js:11905:29) at async .../apps/daemon/dist/cli.js:851:5 Reproduce Source install, daemon running: export OD_DAEMON_URL=http://127.0.0.1:<daemon-port> node apps/daemon/bin/od.mjs automation create \ --name "example" --prompt "example" --schedule "daily:03:00" automation update <id> --name ... fails identically. automation list, get and run are unaffected, because they do not go through automationContextFromFlags. Cause Not environment specific and not a race. In the bundled apps/daemon/dist/cli.js: 851: await SUBCOMMAND_MAP[first](rest);

Finding pkg/safego/safego_test.go proves that a panicking goroutine launched via Go/GoWith does not crash the process. It does not prove: The recover path actually emits a slog error entry. A future refactor that drops the slog.Error("goroutine panicked", ...) call (e.g., "the recover alone is enough") would leave every existing test green while silently swallowing every panic in production. Post-mortem debuggability disappears with no compile error, no test failure. GoWith funnels label through sanitize.LogString before logging. The label is a caller-supplied string that reaches slog.Error("label", label, ...). Today the wrapper is sanitize.LogString(label), which strips ANSI escapes and neutralizes CR/LF/NUL. If a mechanical refactor drops the sanitize wrapper ("redundant, slog already handles it"), the raw label lands in the log stream and any caller-controlled label with \n produces classic log injection (CWE-117) — a forged log line the SIEM can't tell from a legitimate entr

First: the pi runtime adapter works beautifully end-to-end — we verified a full run today (spawn via pi --mode rpc, model passthrough deepseek/deepseek-v4-flash, 4 tool_use/tool_result pairs mapped, clean exit 0, 17s total, 99% prompt-cache hit, session-file discovery for native resume engaged). The --list-models TSV parse surfaced 23 models. Great adapter. Two observability suggestions from dogfooding: 1. Record agent_cli_version in execution diagnostics executionDiagnostics.environment.agentCliVersion came back not_collected / agent_cli_version_not_recorded, even though the daemon clearly probes pi --version during runtime detection (the agent list shows the resolved version). Recording the resolved CLI version per run would make version-specific regressions debuggable — e.g. we just hit a pi-ai 0.84.3 packaging defect (#7608) that doesn't exist in 0.80.x, and correlating "which agent CLI version executed this run" would have halved the triage time. The detection probe result cou

Summary Do two things so window.confirm cannot come back. Live calls are already gone. Before: deletes use Dialog, but noAlert is "off" and a stale comment still names window.confirm. After: that comment is gone, and bun x ultracite check fails if anyone adds window.confirm, alert, or prompt. About 15 minutes. Why it matters window.confirm does not run while a Radix Dialog is open (see SkillAssignPicker). It also ignores the app theme. The Dialog pattern already exists — do not add a shared ConfirmDialog. Do this Delete the comment at apps/web/src/pages/profiles/use-profiles-page.ts:802. In biome.jsonc, set linter.rules.suspicious.noAlert from "off" to "error". If that flags a real alert / confirm / prompt, replace it with the Dialog in apps/web/src/pages/files/files-delete-dialog.tsx. Run bun x ultracite check. Acceptance criteria git grep -n window.confirm is empty biome.jsonc no longer sets noAlert to "off" bun x ultracite check passes

[Bug]: Qwen Code is never detected on Windows — node-launched agents need a script-path entry Summary On Windows, Orca never recognizes Qwen Code as a running agent, even though it is listed as a supported agent and launches fine. Every orchestration path that requires agent identity fails: orca orchestration worker-start --task <t> --worktree <w> --agent qwen-code → state: failed · stage: agent_readiness · lastError: timeout orca orchestration dispatch --task <t> --to <handle> --inject → runtime_error: "Cannot dispatch --inject to terminal <handle>: no recognized agent detected." The error message lists the detectable agents and qwen is in that list, so this is not a missing-agent problem — it is a detection problem specific to Windows. Environment Orca 1.4.192 (desktop, Windows) Agent runtime host (not WSL) OS Windows 11 Pro for Workstations 22631 Qwen Code 0.22.3 (official Windows installer) Node 24.14.0 The same setup works on Linux, which i

What happened? When a generated deck uses a real, self-navigating presentation library (reveal.js is the concrete case we hit) instead of OpenDesign's own .slide.active convention, the deck thumbnail rail shows the same slide (always the first one) for every single slide, even though the main preview pane navigates correctly and each slide's own markup is genuinely different. Observed directly in the product with a real 9-slide deck (screenshot on file, but it contains confidential business content so it isn't attached here - the minimal repro below reproduces the same underlying DOM signature with placeholder content instead). Steps to reproduce Save the attached index.html (bottom of this issue) as an OpenDesign project's deck file, or just open it directly in a browser first to inspect the underlying DOM state described in "Evidence" below (no OpenDesign build needed for that part). Open it as a deck in OpenDesign. Look at the thumbnail rail on the left. All 3 thumbnails render "Sl

Summary Hunk currently calls its single-column diff presentation the stack or stacked layout. That terminology is incorrect: the implemented presentation is a unified diff. Rename this layout to unified throughout the product, public APIs, implementation, tests, documentation, examples, and maintained media. This is a terminology change only. Rendering, navigation, responsive behavior, wrapping, copying, notes, and scrolling should behave exactly as they do today. Look at the implementation plan before starting. It contains the investigated file map, compatibility policy, rename guidance, test coverage, media audit, and validation checklist. Desired vocabulary Current Replacement Stack layout Unified layout Stacked view Unified view Canonical stack value Canonical unified value Internal Stack* / stack* names Unified* / unified* Apply these replacements only where “stack” describes the diff layout. Do not rename unrelated uses such as call stacks, stack traces, parse

Summary PR #7267 fixed a defect in apps/desktop/src/main/updater/store.ts where isOsManagedRootArtifact() matched .DS_Store/Thumbs.db/desktop.ini/.localized by name only, with no lstat check confirming the entry is actually a plain file. That let a directory or symlink squatting on one of those names be silently treated as harmless OS litter — bypassing the empty-root claim check and staying permanently excluded from unexpected-entry corruption validation. packages/download/src/store.ts's ensureManagedBase() has the identical unpatched pattern. It was already flagged once as a follow-up (#7266 → merged via #7268), but that merge duplicated the same name-only check rather than the type-verified version: // packages/download/src/store.ts:27-34 (current upstream/main) const OS_MANAGED_ROOT_ARTIFACTS = new Set([".DS_Store", "Thumbs.db", "desktop.ini", ".localized"]); function isOsManagedRootArtifact(name: string): boolean { return OS_MANAGED_ROOT_ARTIFACTS.has(name); } // line 107, i

Problem Statement On the task list, when a note has been added to a task, a note icon is shown on the right hand side of the entry. Tapping this icon seems to do exactly the same thing as tapping the main content on the row, which opens the context menu for the task. If I want to view the note contents, I have to expand the note section, and it if it a long note, I have to press the full screen button to have a reasonable viewing experience. Possible Solution Logically when I tap the note icon, I would expect that it would go directly to the note, instead of just going to the context menu, as if I tapped anywhere else on the row. Ideally tapping the icon should open the note directly in full screen mode, as the intent is clear that the user's main intention would be to view (or edit) the note content. Implementing this would save 2 additional taps and some scrolling to reach that state Describe alternatives you've considered No response Additional context No response

Version Used 18.21.1L Current Behavior I just updated from 18.14 to 18.21 and noticed that the tray icon does not work like before on my linux mint 22.3 with the cinnamon 6.6.7 desktop. Expected Behavior the tray icon should work like before Steps to Reproduce Install and open the app. Can you reproduce this reliably? Yes, I can reproduce it reliably. Console Output sam@linux-addict:~$ pkill -f superprod* sam@linux-addict:~$ superproductivity Start app... 23:33:48.609 › Initializing plugin node executor 23:33:48.612 › { enabled: null, showDevTools: false, mode: 'bottom' } (node:108006) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead. (Use `superproductivity-bin --trace-deprecation ...` to show where the warning was created) Saving backups to /home/sam/.config/superProductivity/backups 23:33:48.705 › Saving backups to /home/sam/.config/superProductivity/backups 23:33

Before you submit I searched existing issues and confirmed this is not a duplicate. I replaced the example text with the real behavior, reproduction steps, expected result, and version from the app's About menu or od --version. What happened? whenever I try to design something with an openweight model from openrouter (like DeepSeek oder GLM), it never manages to actually create a design, like it never finishes its work. and Im not using weak models either, Im using DeepSeek V4 Flash and GLM 5.3 Flash, the AI is working for 30min+ and in the end I get no output Steps to reproduce just chatting Expected behavior to get a design OpenDesign version 1.9.0 Platform macOS (Apple Silicon) Logs (optional) Screenshots (optional) No response Additional context No response

Problem The shared key-chord parser removes empty segments after splitting a chord on +. As a result, malformed bindings are silently interpreted as different valid shortcuts: s+ → s +s → s ctrl++s → ctrl+s ctrl+s+ → ctrl+s For example, parseKeyChord("s+") currently returns the same parsed chord as parseKeyChord("s"), and the malformed chord matches a real s key event. The behavior comes from filtering empty tokens before the parser validates the modifier and base-key structure in src/extension-api/keys.ts. Why this matters This grammar is shared by user [keybindings], extension registerCommand bindings, Hunk's own command table, and the public matchesKey helper. A typo can therefore claim and execute a real shortcut instead of being rejected and surfaced as an unusable chord. This is also inconsistent with the parser's existing behavior for other malformed chords such as ctlr+s, f13, and ctrl+, which are rejected rather than normalized. Expected behavior Key cho

Summary Fal.ai is configured, but an image project created without a saved imageModel defaults to vela/gpt-image-2. On Linux/WSL, where Vela is not bundled, generation fails instead of using an available Fal model. Steps to reproduce Configure Fal.ai under Media providers. Create an Image project without an explicit model selection. Request an image. Actual result The agent invokes: od media generate --model vela/gpt-image-2 The task fails with: vela binary not found; install vela or configure VELA_BIN The UI reports the generic MEDIA_DISPATCH_FAILED error. Expected result Fal models should be available in the image-model selector and the selected model should be saved in project metadata. If no model is selected, OpenDesign should prefer a configured provider or request a selection instead of defaulting to an unavailable provider. Environment OpenDesign tag: open-design-v0.21.0 Commit: dbbd3b4 Linux/WSL2 Related: #5117

Summary Importing a truncated pre-v14 backup — one that carries a legacy marker (taskArchive, improvement or obstruction) but is missing a core slice such as task or project — fails with an opaque TypeError instead of the intended "repair not possible" message. No data is lost. The import aborts before anything is written: runDestructiveStateReplacement is not called and nothing is dispatched. This is a diagnostics defect only. What happens BackupService.importCompleteBackup() is meant to refuse unrepairable payloads via isDataRepairPossible(), which reports a clear Data validation failed and repair not possible. A legacy-marked backup never reaches that check: isLegacyBackupData() routes it into migrateLegacyBackup() first, and one of the migration steps dereferences the missing slice and throws. Observed message: Cannot read properties of undefined (reading 'entities') The user sees a JS error with no indication that their backup file is incomplete or what to do about it. Reprod

Description When trying to determine if an error mentioned in the chat has been "resolved", the message compression logic searches the entire conversation content for words like fixed|resolved|success|working. Because it checks the whole content rather than just the text after the error occurred, unrelated text (e.g. "I fixed a typo earlier") will falsely flag the new error as resolved. Environment OS: Any Node version: Node 18+ Nanocoder version: 1.30.0 Steps to Reproduce Have a conversation where you mention the word "success". Trigger an unrelated terminal error later in the same message block. The compression utility will falsely label the new error as "resolved". Expected Behavior Resolution detection should only look at text after the error match index. Actual Behavior It runs /fixed|resolved|success|working/i.test(content), scanning the whole string. Additional Context I have searched existing issues to ensure this is not a duplicate I can reproduce this issue consistentl

Description When pasting text into the CLI, the paste detector attempts to swap out the raw text for a placeholder so that the terminal isn't overwhelmed. However, because it uses standard String.prototype.replace(), it only swaps the very first occurrence. If the same block of text is pasted twice, or exists elsewhere in the input, the second block ships raw to the model. Environment OS: Any Node version: Node 18+ Nanocoder version: 1.30.0 Steps to Reproduce Paste a block of code into the CLI input. Paste the exact same block of code again. The first paste gets replaced by a placeholder, the second paste remains raw. Expected Behavior All occurrences of the exact pasted string should be replaced with the placeholder ID. Actual Behavior Only the first match is replaced due to the non-global .replace(). Additional Context I have searched existing issues to ensure this is not a duplicate I can reproduce this issue consistently This issue occurs with the latest version of nanocode

Description If a custom command in commands/ doesn't define any parameters in its frontmatter, the {{args}} template variable is never populated. Users trying to pass raw unparsed text to a simple command will find their arguments silently swallowed. Environment OS: Any Node version: Node 18+ Nanocoder version: 1.30.0 Steps to Reproduce Create a custom command without a parameters array in the YAML frontmatter. Use {{args}} in the body of the command. Run the command with arguments (e.g., /mycmd test args). Observe that {{args}} evaluates to an empty string. Expected Behavior The {{args}} variable should contain all passed arguments joined by a space, regardless of whether explicit parameters were defined. Actual Behavior The variable assignment variables['args'] = args.join(' ') is scoped inside if (command.metadata.parameters && command.metadata.parameters.length > 0), so it never runs for parameter-less commands. Additional Context I have searched existing issues to ensure thi

Description The dropdown caret icon is missing from the Assigned Environment selector in the Environments section of Workspaces. The selector should have a caret icon on the right side, similar to the other dropdown selectors in the UI. Currently, the caret icon is not visible. Steps to Reproduce Go to playground.meshery.io/management/workspaces Open a workspace. Navigate to the Environments section. Check the Assigned Environment selector. Current Behavior The dropdown caret icon is missing from the Assigned Environment selector. Expected Behavior The Assigned Environment selector should display the dropdown caret icon on the right side, consistent with other dropdown selectors. Screenshots Environment Host OS: Mac Linux Windows Platform: Docker or Kubernetes Meshery Server Version: stable-v Meshery Client Version: stable-v Contributor Guides and Handbook 🛠 Meshery Build & Release Strategy 📚 Instructions for contributing to documentation Meshery documentation site and s

Follow-up from #43. The default theme bootstrap uses a readable source file, a generator, and a committed output checked in CI: packages/themes/src/core/script-bootstrap.ts packages/themes/scripts/generate-script-source.ts packages/themes/src/core/script-source.ts (--check in tests) The opt-in extended bootstrap in packages/themes/src/core/extended-script.ts still builds its inline script with extendedThemeScript.toString() and a snapshot in extended-script.test.ts. That works for the opt-in path, but it is easier for bootstrap and runtime to drift when extended props or bootstrap semantics change. Proposal Extend the existing generator (or add a sibling) for extended config, including systemThemeMap, so both paths stay reviewable and CI-enforced the same way. Scope Keep @wrksz/themes/next/extended and @wrksz/themes/client/extended-provider behavior unchanged Replace or supplement Function#toString() output with generated, committed source Keep or update snapshot coverage so bootstr