stefaan van hoofandClaude Opus 5.5 91bdaee724 fix(html-view): address review — scope, source view, tests, docs ...

- Refuse to mint for an HTML file in a hidden directory or directly in a
  broad root (/, home, tmpdir, cases and user-space roots): the capability
  serves the directory tree recursively to the page's own scripts.
- Keep HTML's source view and editor: a Page pill (per-device htmlRendered,
  like MD) toggles to the file-content text path, and a refused mint (remote
  case, broad root, hidden dir) falls through to it automatically.
- Tests: html-view auth exemption edges, revocation on logout / admin logout /
  user deletion, out-of-workspace mint (blocked tree, confinement), hidden
  and broad roots.
- Docs: Working-With-Files, architecture-invariants, security-architecture,
  the file-routes comment and CLAUDE.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-08 09:21:55 +02:00

..

_route-test-utils.ts

fix(security): scope the filesystem path picker per user in multi-user mode

2026-07-28 10:49:49 +02:00

agent-case-marker-routes.test.ts

feat(agent-cases): tag agent-spawned case dirs and sweep their leftovers

2026-09-07 19:09:24 +02:00

approval-routes.test.ts

feat(approvals): let a watching session keep quiet, and fix the tui gate

2026-09-22 08:10:05 +02:00

case-clone-credential-helpers.test.ts

fix(docker): gate gh/az seeding on its switch; no shared git sign-in for non-admin clones

2026-09-23 14:44:26 +08:00

case-clone-routes.test.ts

fix(cases): tell an unreachable path from an absent one, scope the stall cap

2026-10-04 20:30:40 -04:00

case-custom-path-routes.test.ts

fix(cases): custom-folder create landing fixes (#535)

2026-10-05 19:51:59 +02:00

case-routes.test.ts

fix(cases): keep deleted workspaces deleted, cap pastCap, scope stalls to network mounts

2026-10-05 09:51:27 -04:00

cli-registry-routes.test.ts

fix(docker): persist CLIs installed from Settings across container updates

2026-09-25 08:56:20 +08:00

custom-model-routes.test.ts

fix(custom-model): address fourth pre-merge review + merge upstream master (Ark0N)

2026-09-19 18:05:51 +08:00

doctor-routes.test.ts

fix(doctor): resolve CLIs via searchDirs, single-flight runs, admin-gate the group (#536 review)

2026-10-05 09:11:10 +08:00

external-cli-bypass-clamp.test.ts

test(codex): pin reasoning effort through quick-start and the multi-user clamp

2026-10-01 17:16:18 +02:00

file-routes-attachment-path-guard.test.ts

feat(files): preview text files from outside the workspace, and stop routing them at a viewer that cannot read them

2026-08-16 18:12:00 +02:00

file-routes-preview-thumbnail.test.ts

fix(attachments): harden document preview/thumbnail path (review of #120)

2026-06-14 08:43:57 +02:00

file-routes-range.test.ts

feat(files): raise the download cap to 2GB and stream /api/download

2026-09-10 02:57:07 +02:00

file-routes-remote.test.ts

fix(files): fail closed on remote symlinks, guard PUT for remote cases, bound ssh fan-out

2026-09-14 23:42:06 +02:00

file-routes.test.ts

feat(files): render markdown in the File Viewer, with Lines/Wrap toggles

2026-09-28 01:49:37 -04:00

file-search-mode.test.ts

feat(files): search the Files panel by name or path

2026-08-19 09:17:20 -04:00

file-write-routes.test.ts

feat(file-viewer): edit mode for text files (edit + save in the viewer)

2026-08-05 08:44:47 +02:00

git-status-routes.test.ts

fix(git-status): landing fixes (#537)

2026-10-05 19:51:59 +02:00

hook-event-routes.test.ts

fix(session): learn the live Claude conversation from the CLI's own hook

2026-09-01 12:33:24 +08:00

html-view-routes.test.ts

fix(html-view): address review — scope, source view, tests, docs

2026-10-08 09:21:55 +02:00

mcp-sync-routes.test.ts

fix(mcp): no file text in sync errors, follow relocated config dirs, docs and Settings polish (#521 review)

2026-10-04 23:52:41 +02:00

mux-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

orchestrator-routes.test.ts

test: repair route harness error rendering + stop AI-checker spawning real processes in tests (#97)

2026-05-25 23:55:57 +02:00

plan-routes.test.ts

fix(api): close contract gaps found by post-merge adversarial audit

2026-06-10 03:41:04 +02:00

push-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

quick-start-custom-model.test.ts

feat(custom-model): warn before launching Claude on a model too small for its own overhead

2026-09-17 07:36:57 +08:00

ralph-routes.test.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

readmymind-routes.test.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

reboot-restore-rebuild-failure.test.ts

docs(sessions): correct what a failed rebuild is actually likely to be

2026-09-17 08:26:29 +02:00

reboot-restore-routes.test.ts

fix(reboot-restore): the merge-time items from the #442 review

2026-09-18 13:46:04 +02:00

remote-discover-routes.test.ts

COD-105 discover + attach existing remote tmux sessions (detach-not-kill)

2026-07-17 15:49:24 -04:00

respawn-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

scheduled-routes.test.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

search-routes.test.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-create-unreachable-path.test.ts

fix(cases): tell an unreachable path from an absent one, scope the stall cap

2026-10-04 20:30:40 -04:00

session-custom-model.test.ts

fix(release): the seven findings from the pre-release review of the whole tree

2026-09-19 12:58:33 +02:00

session-input-delivery.test.ts

fix(input): deliver API prompts through tmux so their Enter is not lost

2026-09-28 16:44:59 +02:00

session-input-wait.test.ts

chore: version packages

2026-08-09 01:18:03 +02:00

session-name-routes.test.ts

fix(sessions): stop pinning the w1-myapp placeholder as Claude's /resume title (#457)

2026-09-24 01:48:33 +02:00

session-order-routes.test.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

session-pin-routes.test.ts

Merge master into PR #157 (session manager polish)

2026-07-20 14:31:44 +02:00

session-remote-wake.test.ts

fix(remote): authorize the attach wake first; tell the caller what happened to its bytes

2026-09-19 11:39:50 +02:00

session-routes-agent-skill.test.ts

test: cover the skill CLI, the injection call site, and endpoints.md drift

2026-08-09 12:09:51 +02:00

session-routes-claude-last-response.test.ts

fix(web): show the whole last turn in the Claude response viewer's brief view

2026-09-10 12:45:16 +08:00

session-routes-claude-model.test.ts

fix(sessions): scope the launch model to claude and pin it with the advisor (#514, #515, #530 landing)

2026-10-04 23:52:41 +02:00

session-routes-codex-last-response.test.ts

fix(web): pin the Claude response viewer to the pane's own conversation

2026-08-03 14:53:42 +08:00

session-routes-external-cli-last-response.test.ts

fix(response-viewer): role on full-context blocks, divider ReDoS, pi mode (#326 follow-up)

2026-08-21 02:25:43 +02:00

session-routes-parent-lineage.test.ts

chore: version packages

2026-08-12 02:30:08 +02:00

session-routes-workspace-hooks.test.ts

fix(statusline): sticky telemetry collection, footer print-through, EOF fix

2026-09-07 20:37:29 -05:00

session-routes.test.ts

fix(terminal): address review: Key tester isolates shortcuts, Codex stays on line feed

2026-10-03 11:19:42 +08:00

session-wait-output-routes.test.ts

chore: version packages

2026-08-09 01:18:03 +02:00

session-wait-routes.test.ts

chore: version packages

2026-08-09 01:18:03 +02:00

status-telemetry-routes.test.ts

fix(statusline): print nothing instead of the bare word codeman

2026-09-14 15:59:00 +02:00

system-routes-settings-get-plan-usage-default.test.ts

fix(statusline): GET /api/settings never writes, and a save sends the collection switch only on a flip

2026-09-14 15:59:00 +02:00

system-routes-settings-partial-put.test.ts

fix(statusline): sticky telemetry collection, footer print-through, EOF fix

2026-09-07 20:37:29 -05:00

system-routes-tunnel-guard.test.ts

feat(tunnel,ui): purple tunnel button + opt-in unauthenticated tunnel with warning (v1.1.9)

2026-06-16 18:44:03 +02:00

system-routes.test.ts

fix(statusline): GET /api/settings never writes, and a save sends the collection switch only on a flip

2026-09-14 15:59:00 +02:00

system-span-displays.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

tab-layout-routes.test.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

team-routes.test.ts

chore: version packages

2026-03-01 17:34:09 +01:00

unified-sessions-routes.test.ts

fix(review): dedupe resumed-session rows + newest-wins lifecycle name/mode (PR #139)

2026-07-12 12:41:48 +02:00

voice-routes.test.ts

docs(test): name the real reason the suite could reach ~/.codeman

2026-09-04 13:50:22 +02:00

webhook-routes.test.ts

feat(notifications): ntfy/Slack/Discord/generic webhook for the push events

2026-10-02 22:06:29 +08:00

webview-routes.test.ts

fix(webview): refuse link-local and cloud-metadata targets on the resolved address

2026-09-04 15:21:12 +02:00

workflow-routes.test.ts

feat(ultracode): master-detail tab for Workflow/ultracode run visualization

2026-06-15 08:40:05 +02:00

ws-routes.test.ts

fix(input): an oversized paste no longer poisons the durable input queue (#484)

2026-09-24 18:17:06 +02:00