WRG 742395bca7 fix(scripts): confine plan-canvas artifact assets and escape 404 paths ...

Serve artifact pages with a sandbox-only CSP mirroring the viewer iframe, fail-closed realpath confinement for sibling assets, and escape the artifact path in the missing-artifact 404. TDD: 4 RED failures (CSP header, 404 escaping, symlink escape) before the fix, 31/31 GREEN after; markdown/sessions/hook suites and ESLint clean.

2026-09-26 02:14:24 +10:00

..

markdown.js

fix(plan-canvas): stop dropping list items when a block's first item is over-indented (#2501)

2026-07-17 17:10:58 -04:00

sdk.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

server.js

fix(scripts): confine plan-canvas artifact assets and escape 404 paths

2026-09-26 02:14:24 +10:00

sessions.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

ui.js

fix(plan-canvas): guard localStorage so blocked site data can't disable canvas controls (#2703)

2026-08-12 00:34:15 -04:00