Codeman maintainer 4276b53a8f fix: keep credential files out of the file routes and Discord uploads (release review) ...

The Discord bot token was readable through the attachment routes, because
discord.json was not on the sensitive list, and so were webhook.json,
custom-model-hosts.json and the generated custom-model configs. Config backups
were the wider gap: a dated copy of users.json or settings.json matched none of
the name-anchored patterns. All are blocked now.

`codeman notify --file` relied on folder confinement alone, which holds nothing
back when a tab's folder is the home directory, and it would also post a
workspace .env. It now applies the attachment blocklist to the real path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-04 17:28:52 +01:00

..

agent-teams

refactor: restructure repo for cleaner GitHub landing page

2026-04-03 16:23:54 +02:00

archive

docs: archive stale findings docs (work completed)

2026-05-25 23:31:50 +02:00

images

docs(readme): add two codeman skill GIFs (5 tiles, 8 tabs with lineage)

2026-10-15 18:17:34 +02:00

reports

docs: refresh README + document v0.9.5 security hardening

2026-06-09 04:35:29 +02:00

screenshots

docs(readme): merge touch-optimized content into the mobile section

2026-07-28 10:57:14 +02:00

wiki

fix: keep credential files out of the file routes and Discord uploads (release review)

2026-11-04 17:28:52 +01:00

agent-control-plan.md

feat(sessions): make pinning every tab name an opt-in setting

2026-10-18 13:58:09 +08:00

api-reference.md

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00

approvals-inbox-plan.md

docs: tighten the inbox, push and idle-detection wording

2026-10-17 18:28:03 +02:00

architecture-invariants.md

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00

browser-testing-guide.md

docs(tests): finish the ephemeral-port wording (#570)

2026-10-10 02:54:39 +02:00

claude-code-hooks-reference.md

fix(hooks): guard subagent stops and rewake from the parent transcript

2026-08-08 22:31:38 +03:00

claude-voice-plan.md

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

cli-enable-disable-plan.md

feat(cli-registry): CLI management write API + Settings UI (Phases 1-6) (#476)

2026-09-24 01:48:26 +02:00

cli-registry.md

fix(agent): verify staged text on a live codex pane and refuse popups

2026-10-25 09:22:35 -04:00

copilot-integration.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

cron-build-brief.md

refactor(cron): rename scheduler feature to cron

2026-06-29 11:35:56 +05:30

cron-discovery.md

feat(pi): add Pi (pi.dev) as a sixth CLI run mode (#206)

2026-08-13 13:54:47 +02:00

cron-guide.md

Merge pull request #670: fix(input): keep the line breaks of a multi-line mux prompt, pasted as one block

2026-10-22 19:23:17 +02:00

custom-model-endpoints-plan.md

fix(custom-model): create missing dsh home dirs before linking, rebuild restore bookkeeping, dedicated custom key var, schema guards for the real-home recipe

2026-11-02 14:06:56 +08:00

custom-model-endpoints.md

fix: apply the review items for #755 at merge

2026-11-04 16:55:44 +01:00

deepseek-integration-plan.md

fix(deepseek): run the web UI server in the background, not in a shell tab

2026-08-25 03:08:15 +02:00

deepseek-integration.md

fix: apply the review items for #710 at merge

2026-10-27 01:21:56 +01:00

discord-bridge.md

fix: keep credential files out of the file routes and Discord uploads (release review)

2026-11-04 17:28:52 +01:00

docker-cases-plan.md

docs(docker): record implementation status (phases 0-5 done, e2e verified)

2026-07-19 15:38:53 +02:00

docker-cases.md

fix(docker): address git identity review

2026-09-25 22:27:26 +08:00

docker-compose.md

fix(docker): merge-time fixes for #490

2026-09-28 16:28:29 +02:00

docker-self-update.md

fix(docker): merge-time fixes for Update-Codeman.sh (#465)

2026-09-23 11:40:03 +02:00

extending-codeman.md

docs: finish dropping the stripped-newline rule from the input docs

2026-10-21 04:11:28 +02:00

file-viewer-edit-plan.md

fix(files): read remote-case file previews and downloads over ssh

2026-09-14 14:54:41 +02:00

grok-integration-plan.md

feat(grok): add Grok Build (xAI) as a seventh CLI run mode

2026-08-23 08:39:03 +02:00

grok-integration.md

fix(#648): move Antigravity into the screen-checked group in five more docs

2026-10-18 08:14:39 +02:00

installer-v2-plan.md

fix(install): fold in both reviews of #460

2026-09-21 03:03:31 +02:00

local-echo-overlay-plan.md

chore: version packages

2026-05-09 03:23:34 +02:00

media-assets.md

docs(wiki): add a Codeman Skill page with the skill GIFs

2026-10-15 19:10:38 +02:00

mobile-testing-report.md

test(mobile): read PHONE_MAX as an exclusive bound everywhere, drop the stale 430px baselines

2026-09-14 15:53:22 +02:00

multi-user-plan.md

fix: address the release-prep review of #684

2026-10-24 14:32:36 +02:00

omp-integration.md

fix(omp): read omp's status bar so an omp turn can end

2026-10-09 02:43:22 +02:00

opencode-integration.md

fix(opencode): read opencode's composer bar and footer spinner so a turn can end

2026-10-09 02:40:04 +02:00

orchestrator-loop-architecture.md

fix(tmux): type a single-character submit so a dialog answer selects

2026-10-14 21:23:58 +02:00

orchestrator-loop-plan.md

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

orchestrator-loop-research.md

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

pi-integration-plan.md

feat(pi): add Pi (pi.dev) as a sixth CLI run mode (#206)

2026-08-13 13:54:47 +02:00

pi-integration.md

fix(pi): read pi's composer rule so a pi turn can end

2026-10-09 01:49:19 +02:00

predictive-echo-plan.md

fix(predictive-echo): anchor hold after unpredicted wire edits (review findings)

2026-08-09 05:29:45 +02:00

qr-auth-plan.md

feat: implement QR code authentication for tunnel access

2026-03-01 06:05:26 +01:00

ralph-wiggum-guide.md

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

readmymind-plan.md

fix(readmymind): style the modal footer, point the empty-result copy at the steer note

2026-08-10 11:15:47 +02:00

readmymind.md

docs: add pi to the mode lists the sixth-backend sweep missed

2026-08-13 19:40:54 +02:00

releasing.md

fix: retire the OpenCode Console breach notice

2026-11-04 16:51:56 +01:00

reliable-input-delivery.md

fix(input): keep the line breaks of a multi-line mux prompt, pasted as one block

2026-10-21 03:51:31 +02:00

remote-sessions.md

fix: keep a remote session's fix plan authoritative (release review, #722)

2026-10-28 09:25:50 +01:00

respawn-state-machine.md

chore: bump version to 0.1538

2026-02-18 12:51:35 +01:00

scrollback-fix-plan.md

fix(terminal): strip opencode's mouse DECSETs so a drag selects text again

2026-10-08 14:55:02 +02:00

scrollback-issues-analysis.md

docs: record the scrollback analysis and its measurements for #205

2026-08-07 04:33:15 +02:00

security-architecture.md

fix: keep credential files out of the file routes and Discord uploads (release review)

2026-11-04 17:28:52 +01:00

session-lineage-lines-plan.md

fix(ui): draw session lineage lines in blue for contrast

2026-08-14 10:03:10 +02:00

SPEEDRUN.md

docs: move SECURITY.md to .github/ and SPEEDRUN.md to docs/

2026-07-27 14:00:26 +02:00

split-pane-sessions-plan.md

fix(tiles): wire the Android soft-keyboard controller into every tile (#541 parity)

2026-10-09 08:20:02 +02:00

tailscale-installer-plan.md

fix(tunnel): give the unauthenticated tunnel its own acknowledgement

2026-10-26 03:13:25 -04:00

terminal-anti-flicker.md

fix(terminal): drain deferred output without a wake event

2026-08-08 23:00:36 +03:00

terminal-copy-shortcut-plan.md

fix(terminal): strip opencode's mouse DECSETs so a drag selects text again

2026-10-08 14:55:02 +02:00

tile-grid-plan.md

docs(tiles): a reload brings the grid back only when it was open

2026-10-10 06:33:00 +02:00

tui-plan.md

docs: document codeman tui

2026-08-22 14:13:58 +02:00

tui.md

fix: address the release-prep review of #688

2026-10-24 14:45:34 +02:00

ultracode-agent-viz-plan.md

feat(ultracode): master-detail tab for Workflow/ultracode run visualization

2026-06-15 08:40:05 +02:00

usage-limits-display-plan.md

fix(telemetry): stamp a compaction on entering the null window

2026-10-11 12:36:59 -04:00

versioning-policy.md

docs: list both unauthenticated-exposure acknowledgements as stable

2026-10-27 09:36:15 +01:00

vm-cases-plan.md

docs(vm): VM cases plan + Apple virtualization stack reference

2026-08-06 01:28:17 +02:00

vm-subsystem-apple-stack.md

docs(vm): VM cases plan + Apple virtualization stack reference

2026-08-06 01:28:17 +02:00

web-tabs-fixes-plan.md

chore: version packages

2026-08-04 15:02:46 +02:00

web-tabs.md

docs(webview): record the lost-frame page as the third unauthenticated 200, and the inline-style limit

2026-09-14 23:38:54 +02:00

worker-warm-pool-plan.md

feat: skill fast-path hardening, lineage retune + colors, per-tab pop-out, reliable tab alerts

2026-08-15 06:38:26 +02:00