fix(inputquality): decode quote/apostrophe/numeric entities in thin-issue count (BEFLOW-30) (#21)

visibleBodyLength measures human-visible text for the thin-issue gate but
decoded only &/</>/ , so ", ', ', and numeric
entities each counted as 5-7 chars instead of 1 — inflating the count and
letting a genuinely-thin, quote-heavy body escape the gate.

Add "/'/' to the named-entity pass and a numeric pass for
decimal (&#NN;) and hex (&#xNN;) entities, guarding NaN and codepoints
above U+10FFFF (left as-is on invalid input). The count now reflects
visible length.

Author: corrm

src/core/inputquality.ts

@@ -5,9 +5,12 @@ export const THIN_ISSUE_MESSAGE =
 
 const ENTITIES: Record<string, string> = {
     "&amp;": "&",
+    "&apos;": "'",
     "&gt;": ">",
     "&lt;": "<",
     "&nbsp;": " ",
+    "&quot;": '"',
+    "&#39;": "'",
 };
 
 /**
@@ -17,7 +20,17 @@ const ENTITIES: Record<string, string> = {
  */
 export function visibleBodyLength(body: string): number {
     const stripped = body.replace(/<[^>]*>/g, "");
-    const decoded = stripped.replace(/&nbsp;|&amp;|&lt;|&gt;/g, (m) => ENTITIES[m] ?? m);
+    const namedDecoded = stripped.replace(/&(?:amp|apos|gt|lt|nbsp|quot|#39);/g, (m) => ENTITIES[m] ?? m);
+    const decoded = namedDecoded.replace(
+        /&#(?:x([0-9a-fA-F]+)|(\d+));/g,
+        (_m: string, hex: string | undefined, dec: string | undefined) => {
+            const codepoint = hex !== undefined ? parseInt(hex, 16) : parseInt(dec ?? "", 10);
+            if (isNaN(codepoint) || codepoint > 0x10ffff) {
+                return _m;
+            }
+            return String.fromCodePoint(codepoint);
+        },
+    );
     return decoded.replace(/\s+/g, " ").trim().length;
 }
 

test/core-inputquality.test.ts

@@ -42,6 +42,38 @@ describe("visibleBodyLength", () => {
         expect(visibleBodyLength("&<>")).toBe(3);
     });
 
+    it("decodes ", ', and ' as single chars", () => {
+        // 10 " entities = 10 visible chars, not 60
+        expect(visibleBodyLength("""""""""""")).toBe(10);
+        expect(visibleBodyLength("it's")).toBe(4);
+        expect(visibleBodyLength("it's")).toBe(4);
+    });
+
+    it("decodes decimal numeric entities as single chars", () => {
+        // ’ is a right single quotation mark — counts as 1 char
+        expect(visibleBodyLength("’")).toBe(1);
+        // 10 of them = 10 visible chars
+        const ten = "’".repeat(10);
+        expect(visibleBodyLength(ten)).toBe(10);
+    });
+
+    it("decodes hex numeric entities as single chars", () => {
+        // ’ is the same right single quotation mark
+        expect(visibleBodyLength("’")).toBe(1);
+        expect(visibleBodyLength("&")).toBe(1);
+    });
+
+    it("does not throw on an invalid or out-of-range numeric entity", () => {
+        expect(() => visibleBodyLength("�")).not.toThrow();
+        expect(() => visibleBodyLength("�")).not.toThrow();
+    });
+
+    it("keeps thin body correctly flagged after entity decode", () => {
+        // body is 10 " chars = 10 visible chars; gate at 20 → thin
+        const body = """.repeat(10);
+        expect(isThinIssue(body, 20)).toBe(true);
+    });
+
     it("collapses whitespace runs and trims", () => {
         expect(visibleBodyLength("  a \n\t  b  ")).toBe(3);
     });