Codeman maintainer 076f62fa1b fix(preview): refuse a bare ~ folder in a Docker case too (#604 merge-time fix) ...

The Docker refusal on POST /api/sessions/:id/folders tested only `~/`, but
listFolder also expands a bare `~` to this host's home, so a Docker case
could list and serve the host home through it (the preview's "Show folder"
for a `~/x.png` link reached it with no typing). A bare `~` now gets the same
400.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-13 18:08:38 +02:00

..

middleware

fix(webview): recover a proxied dashboard that reloads on its landing page

2026-09-14 23:38:54 +02:00

ports

fix(reboot-restore): the merge-time items from the #442 review

2026-09-18 13:46:04 +02:00

public

Merge pull request #604: feat(preview): open ~/, relative and hard-wrapped paths; folder grid

2026-10-13 18:08:12 +02:00

routes

fix(preview): refuse a bare ~ folder in a Docker case too (#604 merge-time fix)

2026-10-13 18:08:38 +02:00

admin-audit.ts

feat(multiuser): phase 5a, admin user-management API

2026-07-20 04:26:44 +02:00

approval-inbox.ts

feat(approvals): let a watching session keep quiet, and fix the tui gate

2026-09-22 08:10:05 +02:00

away-digest.ts

COD-8 add away digest

2026-06-19 17:58:06 -04:00

case-path.ts

fix(cases): bounded path probe landing fixes (#516)

2026-10-05 20:00:30 +02:00

heic-jpeg-converter.ts

fix(review): worker-thread HEIC conversion with bomb guard, concurrency cap, and magic-byte routing (PR #151)

2026-07-12 18:06:59 +02:00

heic-jpeg-worker.ts

fix(review): worker-thread HEIC conversion with bomb guard, concurrency cap, and magic-byte routing (PR #151)

2026-07-12 18:06:59 +02:00

http-range.ts

fix(file-viewer): make previewed video seekable and stop it on close

2026-08-14 00:14:21 +02:00

launch-defaults.ts

fix(cli-registry): codex launch defaults as registry data, ultra footer, schema doc defaults

2026-10-09 09:35:56 +02:00

network-auth-policy.ts

feat(docker): allowlist container-to-host gateway aliases in host guard

2026-07-19 15:32:45 +02:00

paste-image-gc.ts

fix(uploads): list upload dirs bounded and async, and keep uploads inside the data dir collected

2026-10-09 20:05:21 -04:00

plan-usage-latest.ts

feat(web): show Codex plan usage in header

2026-08-26 18:43:52 +08:00

reboot-restore-registry.ts

fix(sessions): scope the launch model to claude and pin it with the advisor (#514, #515, #530 landing)

2026-10-04 23:52:41 +02:00

repo-status.ts

fix(repo-status): async git, single-flight TTL cache, credential redaction, local-upstream parse

2026-08-21 02:25:43 +02:00

respawn-event-wiring.ts

chore: version packages

2026-03-27 01:43:59 +01:00

response-viewer-transcript.ts

fix(web): show the whole last turn in the Claude response viewer's brief view

2026-09-10 12:45:16 +08:00

route-error-handler.ts

test: repair route harness error rendering + stop AI-checker spawning real processes in tests (#97)

2026-05-25 23:55:57 +02:00

route-helpers.ts

fix(preview): hold a folder file's resolved target to the attachment gate; accept long names

2026-10-12 12:04:34 +02:00

schemas.ts

feat(telemetry): read out Claude Code's prompt cache state per session

2026-10-10 13:09:32 -04:00

self-update.ts

fix(self-update): stalled status and hung shutdown on launchd-daemon installs (#478)

2026-09-24 01:35:27 +02:00

sensitive-path.ts

fix: file-link and session-sidebar review follow-ups from 1.19.0

2026-08-16 20:34:34 +02:00

server.ts

Merge pull request #604: feat(preview): open ~/, relative and hard-wrapped paths; folder grid

2026-10-13 18:08:12 +02:00

session-history-index.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-listener-wiring.ts

feat(sessions): publish the model each session runs (displayModel)

2026-10-07 13:31:59 +02:00

session-order-sse.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

session-wait-registry.ts

refactor(cli-registry): make CLI backends data instead of per-mode branching

2026-09-02 08:26:45 +08:00

sse-events.ts

feat(telemetry): read out Claude Code's prompt cache state per session

2026-10-10 13:09:32 -04:00

sse-stream-manager.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

tab-layout-sse.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

voice-stream.ts

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

webview-egress-policy.ts

fix(webview): refuse link-local and cloud-metadata targets on the resolved address

2026-09-04 15:21:12 +02:00

webview-egress.ts

fix(webview): refuse link-local and cloud-metadata targets on the resolved address

2026-09-04 15:21:12 +02:00

webview-proxy.ts

fix(webview): recover a proxied dashboard that reloads on its landing page

2026-09-14 23:38:54 +02:00

webview-sse.ts

fix(webview): route webview:changed only to its owner in multi-user mode

2026-09-26 22:45:35 -04:00

ws-connection-registry.ts

fix(review): WS state machine, per-tab supersede key, backoff, dot CSS (PR #149)

2026-07-12 18:42:36 +02:00