Codeman maintainer 5c1ec46b6f fix: keep a root=live listing inside the session folder (release review) ...

The lookup judges liveWorktree.path lexically and only when the pane moves,
while the route's probe and readdir both follow symlinks. A symlink put at
that path, or at a parent of it, without moving the pane re-rooted the listing
outside workingDir. Names and sizes leaked, while file-content and file-raw
still refused the paths.

The route now resolves both folders on every request and walks the worktree
only when it lies strictly inside the resolved workingDir, otherwise it walks
workingDir. Only the check uses the resolved paths: the walk keeps the session's
spelling, so a workspace reached through a symlink still gets paths relative
to workingDir.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-06 02:25:14 +01:00

..

_route-test-utils.ts

fix(test): a real home is never "the test HOME" to the deletion guards

2026-10-17 05:07:38 +08:00

agent-case-marker-routes.test.ts

feat(cli): add codeman agent — session-to-session verbs for every CLI mode

2026-10-09 12:59:56 +02:00

agent-session-routes.test.ts

fix(agent): verify staged text on a live codex pane and refuse popups

2026-10-25 09:22:35 -04:00

approval-routes.test.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

case-clone-credential-helpers.test.ts

fix(docker): gate gh/az seeding on its switch; no shared git sign-in for non-admin clones

2026-09-23 14:44:26 +08:00

case-clone-custom-folder.test.ts

fix: apply the review items for #744 at merge

2026-11-04 16:50:44 +01:00

case-clone-routes.test.ts

fix(cases): tell an unreachable path from an absent one, scope the stall cap

2026-10-04 20:30:40 -04:00

case-custom-path-routes.test.ts

Merge pull request #660: fix(test): make a bare vitest invocation use the isolated CI config

2026-10-22 19:53:43 +02:00

case-default-group-routes.test.ts

feat(tabs): start a session beside any tab from an opt-in + in its actions

2026-10-24 20:29:00 -04:00

case-rename-routes.test.ts

fix: apply the review items for #719 at merge

2026-10-27 01:24:15 +01:00

case-routes.test.ts

fix(cases): show the real reason when Link Existing rejects a case

2026-10-10 13:50:04 +08:00

cli-registry-routes.test.ts

fix(cli-install): address review: drop every npm_config_prefix spelling, probe async

2026-10-09 19:42:06 +08:00

config-backup-one-walk.test.ts

fix(config-backup): read the backup folder once per pass

2026-10-22 19:17:36 +02:00

config-backup-routes.test.ts

fix(discord): address review on #741

2026-10-29 23:03:26 +08:00

config-backup-unreachable.test.ts

test(config-backup): pin Back up now against a custom folder that does not answer

2026-10-22 19:14:27 +02:00

custom-model-routes.test.ts

feat(custom-model): discover context length from /v1/models and add a default context length

2026-11-01 21:08:52 +08:00

discord-last-message-per-cli.test.ts

feat(discord): post a finished turn as the CLI's whole last message, stale thread cleanup, types moved to src/types

2026-10-30 18:26:35 +08:00

discord-routes.test.ts

fix: keep credential files out of the file routes and Discord uploads (release review)

2026-11-04 17:28:52 +01:00

doctor-routes.test.ts

fix(doctor): resolve CLIs via searchDirs, single-flight runs, admin-gate the group (#536 review)

2026-10-05 09:11:10 +08:00

edit-history-routes.test.ts

fix(edit-history): colons in file:// paths, yield on forward reads, no store for unsupported

2026-11-03 09:50:21 +01:00

external-cli-bypass-clamp.test.ts

feat(cli-registry): GitHub Copilot CLI as a run mode

2026-10-18 00:47:46 +08:00

file-routes-attachment-path-guard.test.ts

feat(preview): render XLSX spreadsheets in the file-preview overlay

2026-09-26 23:13:21 -04:00

file-routes-live-worktree.test.ts

fix: keep a root=live listing inside the session folder (release review)

2026-11-06 02:25:14 +01:00

file-routes-preview-thumbnail.test.ts

fix(attachments): harden document preview/thumbnail path (review of #120)

2026-06-14 08:43:57 +02:00

file-routes-range.test.ts

feat(files): raise the download cap to 2GB and stream /api/download

2026-09-10 02:57:07 +02:00

file-routes-remote.test.ts

fix(files): fail closed on remote symlinks, guard PUT for remote cases, bound ssh fan-out

2026-09-14 23:42:06 +02:00

file-routes.test.ts

fix(preview): folder grid review — multi-user scope, bounded probing, smaller items

2026-10-11 14:03:20 +02:00

file-search-mode.test.ts

feat(files): search the Files panel by name or path

2026-08-19 09:17:20 -04:00

file-write-routes.test.ts

feat(file-viewer): edit mode for text files (edit + save in the viewer)

2026-08-05 08:44:47 +02:00

filesystem-mkdir-routes.test.ts

fix(picker): do not offer New folder inside a cases directory

2026-10-31 21:12:46 +08:00

filesystem-mkdir-unreachable.test.ts

fix: probe bounded before a realpath in clone and New folder (release review, #516)

2026-11-04 17:29:08 +01:00

folder-grid-routes.test.ts

fix(preview): refuse a bare ~ folder in a Docker case too (#604 merge-time fix)

2026-10-13 18:08:38 +02:00

git-status-routes.test.ts

chore: replace the em-dashes this release added with plain punctuation

2026-10-27 09:11:19 +01:00

hook-event-routes.test.ts

fix(hooks): keep a keep-alive turn's hooks out of the run summary

2026-10-22 19:10:48 +02:00

html-view-routes.test.ts

fix(html-view): a ~/ HTML link renders as a page too (#547/#604 integration)

2026-10-13 18:56:58 +02:00

inbox-routes.test.ts

fix(agent-inbox): review round 1

2026-10-23 12:45:48 +02:00

mcp-sync-routes.test.ts

fix(mcp-sync): route tests never follow COPILOT_HOME, and docs name Copilot (#581)

2026-10-10 03:41:38 +02:00

mux-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

orchestrator-routes.test.ts

test: repair route harness error rendering + stop AI-checker spawning real processes in tests (#97)

2026-05-25 23:55:57 +02:00

plan-routes.test.ts

fix(api): close contract gaps found by post-merge adversarial audit

2026-06-10 03:41:04 +02:00

push-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

quick-start-custom-model.test.ts

fix: refuse an unlaunchable model id before quick-start asks to evict a model (#752)

2026-11-04 17:29:08 +01:00

ralph-routes-remote.test.ts

fix: read a remote session's @fix_plan.md on its host, refuse remote Ralph writes

2026-10-27 09:29:18 -05:00

ralph-routes.test.ts

test(ralph): pin the case name a Ralph loop start registers with

2026-10-22 19:29:50 +02:00

readmymind-routes.test.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

reboot-restore-rebuild-failure.test.ts

feat(uploads): write prompt uploads to a hidden, self-ignoring .codeman-uploads/ folder

2026-10-09 14:10:54 -04:00

reboot-restore-routes.test.ts

fix(reboot-restore): the merge-time items from the #442 review

2026-09-18 13:46:04 +02:00

remote-discover-routes.test.ts

COD-105 discover + attach existing remote tmux sessions (detach-not-kill)

2026-07-17 15:49:24 -04:00

respawn-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

scheduled-routes.test.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

search-routes.test.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-create-unreachable-path.test.ts

fix(uploads): bound the paste-image workspace probe (#516)

2026-10-10 15:03:32 -04:00

session-custom-model.test.ts

chore: one changeset for the release, and no new em-dashes

2026-11-04 17:31:48 +01:00

session-input-delivery.test.ts

fix(input): deliver API prompts through tmux so their Enter is not lost

2026-09-28 16:44:59 +02:00

session-input-wait.test.ts

fix(wait): a retried send-and-wait finds a screen-read dialog

2026-10-14 05:53:58 +02:00

session-name-routes.test.ts

fix(sessions): stop pinning the w1-myapp placeholder as Claude's /resume title (#457)

2026-09-24 01:48:33 +02:00

session-order-routes.test.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

session-pin-routes.test.ts

Merge master into PR #157 (session manager polish)

2026-07-20 14:31:44 +02:00

session-remote-wake.test.ts

fix(remote): authorize the attach wake first; tell the caller what happened to its bytes

2026-09-19 11:39:50 +02:00

session-routes-agent-skill.test.ts

feat(agent-skill): give the codeman skill to every agent CLI, not just Claude

2026-10-13 12:33:47 +02:00

session-routes-claude-last-response.test.ts

fix(web): show the whole last turn in the Claude response viewer's brief view

2026-09-10 12:45:16 +08:00

session-routes-claude-model.test.ts

fix(sessions): scope the launch model to claude and pin it with the advisor (#514, #515, #530 landing)

2026-10-04 23:52:41 +02:00

session-routes-codex-defaults.test.ts

fix(cli-registry): codex launch defaults as registry data, ultra footer, schema doc defaults

2026-10-09 09:35:56 +02:00

session-routes-codex-last-response.test.ts

fix(web): pin the Claude response viewer to the pane's own conversation

2026-08-03 14:53:42 +08:00

session-routes-external-cli-last-response.test.ts

fix(#592): pin the screen-capture branch of last-response for copilot

2026-10-18 08:08:24 +02:00

session-routes-git-fetch-settings.test.ts

chore: replace the em-dashes this release added with plain punctuation

2026-10-27 09:11:19 +01:00

session-routes-keep-warm.test.ts

feat(sessions): keep an idle session's prompt cache warm with a guarded keep-alive turn

2026-10-18 15:19:08 -04:00

session-routes-parent-lineage.test.ts

chore: version packages

2026-08-12 02:30:08 +02:00

session-routes-tab-group.test.ts

feat: per-case default session group

2026-10-22 03:42:42 -04:00

session-routes-workspace-hooks.test.ts

fix(statusline): sticky telemetry collection, footer print-through, EOF fix

2026-09-07 20:37:29 -05:00

session-routes.test.ts

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00

session-wait-output-routes.test.ts

chore: version packages

2026-08-09 01:18:03 +02:00

session-wait-routes.test.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

status-telemetry-routes.test.ts

fix(telemetry): keep the first 20 miss causes instead of refusing the post

2026-10-13 20:45:13 -04:00

system-routes-settings-admin-only.test.ts

fix(settings): serialize settings.json writes so a quick-start cannot tear the file

2026-10-26 03:08:09 -04:00

system-routes-settings-get-plan-usage-default.test.ts

fix(settings): serialize settings.json writes so a quick-start cannot tear the file

2026-10-26 03:08:09 -04:00

system-routes-settings-partial-put.test.ts

fix(settings): serialize settings.json writes so a quick-start cannot tear the file

2026-10-26 03:08:09 -04:00

system-routes-system-ops-admin-only.test.ts

fix(multi-user): make the server-wide system operations admin-only

2026-10-16 13:11:41 +02:00

system-routes-tunnel-guard.test.ts

fix: make the tunnel-guard test fail on a settings.json write that skips the temp file and rename (release review)

2026-10-27 02:54:19 +01:00

system-routes.test.ts

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00

system-span-displays.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

tab-layout-routes.test.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

team-routes.test.ts

chore: version packages

2026-03-01 17:34:09 +01:00

unified-sessions-routes.test.ts

fix(review): dedupe resumed-session rows + newest-wins lifecycle name/mode (PR #139)

2026-07-12 12:41:48 +02:00

voice-routes.test.ts

test: bind the port-sharing test servers to ephemeral ports; guard new fixed ports

2026-10-08 14:56:42 +02:00

webhook-routes.test.ts

feat(notifications): ntfy/Slack/Discord/generic webhook for the push events

2026-10-02 22:06:29 +08:00

webview-routes.test.ts

fix(webview): refuse link-local and cloud-metadata targets on the resolved address

2026-09-04 15:21:12 +02:00

workflow-routes.test.ts

feat(ultracode): master-detail tab for Workflow/ultracode run visualization

2026-06-15 08:40:05 +02:00

worktree-routes.test.ts

fix(#625): never remove a worktree that is, or holds, a Docker case workspace

2026-10-16 01:36:45 +02:00

ws-routes.test.ts

test: bind the port-sharing test servers to ephemeral ports; guard new fixed ports

2026-10-08 14:56:42 +02:00