From b2c832b47a4d4850cf85b317248329901fdc7254 Mon Sep 17 00:00:00 2001
From: dev <info@activething.com>
Date: Sat, 16 May 2026 23:33:30 +0200
Subject: [PATCH] Reject unsafe Eidos CSS config values

---
 continue.md                               |  6 ++++--
 src/uix/eidos/active-eidos-config.test.ts | 17 +++++++++++++++++
 src/uix/eidos/lib/config.ts               | 14 ++++++++++++--
 3 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/continue.md b/continue.md
index 0e011a1b4..79db8bf29 100644
--- a/continue.md
+++ b/continue.md
@@ -40,10 +40,12 @@ Actualizacion Eidos ecosystem 2026-05-16:
   de theme.
 - Overrides de `semantics.color.roles.*.slots` quedan validados: solo slots
   canonicos y pasos `1..12`.
+- Valores CSS del `EidosConfig` comparten la misma defensa que los overrides
+  runtime: no pueden contener `;`, `{` ni `}`.
 - Validado:
-  - `npx vitest run src/uix/eidos/active-eidos-config.test.ts` -> 33 tests OK.
+  - `npx vitest run src/uix/eidos/active-eidos-config.test.ts` -> 34 tests OK.
   - `npx vitest run src/uix/eidos/active-eidos.test.ts` -> 19 tests OK.
-  - `npx vitest run src/uix/eidos` -> 7 archivos, 73 tests OK.
+  - `npx vitest run src/uix/eidos` -> 7 archivos, 74 tests OK.
   - `npm run check` -> 0 errores, 0 warnings.
 
 Actualizacion permutation runner 2026-05-16:
diff --git a/src/uix/eidos/active-eidos-config.test.ts b/src/uix/eidos/active-eidos-config.test.ts
index fd5e5d07f..93d6d1e35 100644
--- a/src/uix/eidos/active-eidos-config.test.ts
+++ b/src/uix/eidos/active-eidos-config.test.ts
@@ -558,6 +558,23 @@ describe('ActiveEidos config', () => {
 		expect(report.issues.some((issue) => issue.path === 'recipes.tooltip.empty-token')).toBe(true)
 	})
 
+	it('rejects config CSS values that contain declaration delimiters', () => {
+		const cfg = structuredClone(THEME_BASE_OPTIONS)
+
+		;(cfg.recipes!.tooltip as Record<string, string>)['content-bg'] =
+			'red; color: transparent'
+		;(cfg.themes!['base-light'].color!.surface as unknown as Record<string, string>).default =
+			'Canvas { color: red }'
+
+		const report = createEidos(cfg).validate()
+
+		expect(report.ok).toBe(false)
+		expect(report.issues.some((issue) => issue.path === 'recipes.tooltip.content-bg')).toBe(true)
+		expect(
+			report.issues.some((issue) => issue.path === 'themes.base-light.color.surface.default')
+		).toBe(true)
+	})
+
 	it('validates role mappings against every configured theme', () => {
 		const cfg: EidosConfig = {
 			...THEME_BASE_OPTIONS,
diff --git a/src/uix/eidos/lib/config.ts b/src/uix/eidos/lib/config.ts
index 759445f08..d50f34bbd 100644
--- a/src/uix/eidos/lib/config.ts
+++ b/src/uix/eidos/lib/config.ts
@@ -413,7 +413,9 @@ function validateColorSemanticGroup(
 				path: `${path}.${key}`,
 				message: 'color semantic CSS value cannot be empty'
 			})
+			continue
 		}
+		validateNonEmptyCssValue(`${path}.${key}`, value, issues)
 	}
 
 	for (const key of Object.keys(group)) {
@@ -987,10 +989,18 @@ function validateNonEmptyCssValue(
 	value: string,
 	issues: EidosValidationIssue[]
 ): void {
-	if (value.trim() !== '') return
+	if (value.trim() === '') {
+		issues.push({
+			path,
+			message: 'CSS value cannot be empty'
+		})
+		return
+	}
+
+	if (!/[;{}]/.test(value)) return
 	issues.push({
 		path,
-		message: 'CSS value cannot be empty'
+		message: 'CSS value cannot contain declaration or block delimiters'
 	})
 }