WRG d237e1972f fix(scripts): sandbox HTML siblings, link-name MIME, portable fixtures ...

Review follow-ups: serve text/html sibling assets under the artifact sandbox CSP (direct navigation no longer bypasses it); resolve MIME from the request name first with target extension as fallback; make security fixtures cross-platform (no angle brackets in filenames, skip when symlink creation is denied). Residual check-then-read TOCTOU documented as accepted for the loopback-local threat model. Tests 33/33 GREEN, ESLint clean.

2026-09-26 02:39:42 +10:00

..

markdown.js

fix(plan-canvas): stop dropping list items when a block's first item is over-indented (#2501)

2026-07-17 17:10:58 -04:00

sdk.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

server.js

fix(scripts): sandbox HTML siblings, link-name MIME, portable fixtures

2026-09-26 02:39:42 +10:00

sessions.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

ui.js

fix(plan-canvas): guard localStorage so blocked site data can't disable canvas controls (#2703)

2026-08-12 00:34:15 -04:00