mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-14 02:29:33 +01:00
Codeman maintainer
59d4bbca2d
The four review items of #797, applied at merge. The editor's name rule lowercases, the data dir's .env pattern did not: .codeman/.ENV passed both, and on a case-insensitive filesystem (the macOS default) that is ~/.codeman/.env, the login file codeman attach reads. A session whose workspace is the home folder could open and save it. The pattern is case-insensitive now, pinned in the blocklist table and on the three editor routes. A save writes a new file and renames it over the old one, so the file took the server's own group: a 0640 .env owned you:www-data came back you:you and the web server lost read access. The save now puts the old user and group back where the account may (best effort), and the wiki says mode and group instead of permissions. Tests: an .env in an outside worktree is refused on edit=1 and PUT too, now that the editor's own gate lets dotenv through; the comment on why .env.example is blocked for downloads and attachments is back. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>