Codeman maintainer ddcdd5d974 fix(agent-skill): refuse a symlinked reference folder inside the skill copy ...

Install and uninstall checked only the copy and its parent for symlinks, so a
`reference` folder that is a link carried every write and unlink of
`reference/<name>.md` to wherever it pointed. Measured: install overwrote a
`history.md` outside the workspace and uninstall deleted it. A cloned
repository can commit that link, and a Docker case's container can plant it
in the bind-mounted workspace the host injects into. With the skill on by
default, both now ran without the user asking.

Both paths now return 'symlink' for a linked folder inside the copy, before
the first write or unlink, and the refusal messages say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-08 08:33:02 +01:00

..

admin-routes.ts

feat: per-case default session group

2026-10-22 03:42:42 -04:00

agent-session-routes.ts

fix(agent): verify staged text on a live codex pane and refuse popups

2026-10-25 09:22:35 -04:00

approval-routes.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

case-routes.ts

Merge #774 head 51264ec0 into the release branch

2026-11-06 08:48:19 +01:00

cli-registry-routes.ts

fix(cli-install): address review: drop every npm_config_prefix spelling, probe async

2026-10-09 19:42:06 +08:00

clipboard-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

config-backup-routes.ts

fix(discord): address review on #741

2026-10-29 23:03:26 +08:00

cron-routes.ts

refactor(cli-registry): make CLI backends data instead of per-mode branching

2026-09-02 08:26:45 +08:00

custom-model-routes.ts

chore: one changeset for the release, and no new em-dashes

2026-11-04 17:31:48 +01:00

discord-routes.ts

fix(adopt): an adopted session has no workspace of ours

2026-11-06 03:13:52 +01:00

doctor-routes.ts

fix(doctor): resolve CLIs via searchDirs, single-flight runs, admin-gate the group (#536 review)

2026-10-05 09:11:10 +08:00

edit-history-routes.ts

Merge #510 feat(adopt): adopt tmux sessions a human started, in all three locations

2026-11-06 05:36:20 +01:00

file-routes.ts

fix: flag a Files panel folder that did not answer the probe (release review)

2026-11-06 08:41:15 +01:00

git-status-routes.ts

fix(adopt): an adopted session has no workspace of ours

2026-11-06 03:13:52 +01:00

hook-event-routes.ts

fix(hooks): keep a keep-alive turn's hooks out of the run summary

2026-10-22 19:10:48 +02:00

html-view-routes.ts

fix(html-view): a ~/ HTML link renders as a page too (#547/#604 integration)

2026-10-13 18:56:58 +02:00

inbox-routes.ts

fix(agent-inbox): review round 1

2026-10-23 12:45:48 +02:00

index.ts

Merge pull request #693: feat: edit history panel for local claude sessions (files edited, diffs, generated images)

2026-11-04 17:04:46 +01:00

mcp-sync-routes.ts

fix(cli-registry): address review on GitHub Copilot run mode

2026-10-18 00:47:47 +08:00

me-routes.ts

feat(multiuser): phase 5b, frontend (identity boot + admin panel)

2026-07-20 04:31:30 +02:00

mux-routes.ts

fix: remove the em-dashes this release added (release review)

2026-11-06 08:20:39 +01:00

orchestrator-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

plan-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

push-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

ralph-routes.ts

fix: remove the em-dashes this release added (release review)

2026-11-06 08:20:39 +01:00

readmymind-routes.ts

docs(adopt): document the routes and the overlay, correct stale comments

2026-11-06 03:29:35 +01:00

reboot-restore-routes.ts

feat(sessions): keep an idle session's prompt cache warm with a guarded keep-alive turn

2026-10-18 15:19:08 -04:00

respawn-routes.ts

fix: remove the em-dashes this release added (release review)

2026-11-06 08:20:39 +01:00

scheduled-routes.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

search-routes.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

session-routes.ts

fix(agent-skill): refuse a symlinked reference folder inside the skill copy

2026-11-08 08:33:02 +01:00

status-telemetry-routes.ts

feat(sessions): keep an idle session's prompt cache warm with a guarded keep-alive turn

2026-10-18 15:19:08 -04:00

system-routes.ts

fix(adopt): an adopted session has no workspace of ours

2026-11-06 03:13:52 +01:00

tab-layout-routes.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

team-routes.ts

refactor: extract server.ts routes into domain modules (phase 3)

2026-02-28 19:12:45 +01:00

voice-routes.ts

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

webhook-routes.ts

fix(notifications): main Save keeps webhook edits, glue test, docs and nits (#523 review)

2026-10-04 23:52:41 +02:00

webview-routes.ts

fix(webview): relay the request Content-Length so length-only dashboards get the body

2026-10-21 08:34:14 +02:00

worktree-routes.ts

fix(#625): never remove a worktree that is, or holds, a Docker case workspace

2026-10-16 01:36:45 +02:00

ws-routes.ts

fix(agent): hold input during a guarded submit instead of refusing it

2026-10-26 09:19:05 -04:00