mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-10-20 09:09:35 +02:00
Codeman maintainer
ba5649bcd4
Owner decision 2026-10-13 (#547): a rendered .html page behaves like a file opened from disk in a browser. It may load scripts, styles, fonts, images and media from any host and make fetch, XHR, WebSocket, beacon and form requests to any host. The /html-view Content-Security-Policy is therefore the `sandbox` directive alone (HTML_VIEW_CSP, now exported and documented): the same sandbox flags as before, never `allow-same-origin`, and no fetch directive. It replaces Codeman's own `default-src 'self'` policy on these responses. Everything that confines a page stays: the opaque origin (no Codeman cookies or document, API writes with `Origin: null` refused, API reads not readable cross-origin), and the capability serving only the page's own folder under every path, symlink, dot, extension and confinement rule. A new test builds the route behind registerSecurityHeaders, as in production, and pins the exact header: one `sandbox` directive with the current flags, no `allow-same-origin`, no `-src` directive. The security architecture, architecture invariants, API reference, CLAUDE.md and the Working With Files wiki page now say what a page can do (reach the network, read its own folder) and cannot do (Codeman's origin, cookies, API, other folders), and that this is the owner's decision. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>