pastilhasandClaude Opus 5 1dc0eddde0 put the open plan in the url, and stop /api/plans reading outside its folder ...

/plans/:name, no redirect guard: the bare route is 'no plan open', which is a
real state, so the auto-select-first effect is deleted rather than turned into
a Navigate. The picker stays a native select — chrome for one document, not a
master list — but it navigates instead of setting state.

Reading the server route for this turned up a path traversal: hono
percent-decodes params, so GET /api/plans/..%2F..%2Fsecret reached
join(plansDir, '../../secret.md'). basename() the param.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-07 12:41:55 +00:00

docs

put the open plan in the url, and stop /api/plans reading outside its folder

2026-08-07 12:41:55 +00:00

public

desktop: load noVNC as one bundle instead of 42 modules

2026-08-01 20:52:50 +00:00

scripts

scripts: give every user a root under DATA_PATH

2026-08-04 14:00:33 +00:00

seed/templates

move tasks to marketplace, sync native tasks on bootstrap

2026-03-10 13:57:40 +00:00

src

put the open plan in the url, and stop /api/plans reading outside its folder

2026-08-07 12:41:55 +00:00

.env.example

move the wallet's chain source out of env and into the ui

2026-08-03 22:59:00 +00:00

.gitignore

drop a scratch file committed by mistake, and ignore the pattern

2026-08-04 00:24:54 +00:00

.prettierignore

vendor hls.js and play transcodes over hls

2026-08-04 18:52:15 +00:00

.prettierrc

first

2026-02-16 19:34:35 +00:00

AGENTS.md

docs: bring the live docs back in line with the code

2026-07-31 16:11:29 +00:00

bun-env.d.ts

restore the code editor screen, drop the dead theme picker, unshadow AppRegistry

2026-07-25 23:30:20 +01:00

bun.lock

add photos, an immich-backed library behind its own sidecar

2026-08-03 00:18:33 +00:00

bunfig.toml

freeze installs: bun resolves from the lockfile or fails

2026-08-04 17:58:07 +00:00

CLAUDE.md

sweep the dead code in section 8

2026-08-07 11:26:33 +00:00

components.json

first

2026-02-16 19:34:35 +00:00

CONVENTIONS.md

docs: the convention docs were describing a different codebase

2026-07-31 16:42:47 +00:00

ecosystem.config.cjs

gitea: the app — repos, code, issues, pulls, notifications

2026-08-06 17:10:36 +00:00

ecosystem.light.config.cjs

jellyfin sidecar: server registry, video façade and byte pass-through

2026-08-04 17:59:50 +00:00

ecosystem.mac.light.config.cjs

jellyfin sidecar: server registry, video façade and byte pass-through

2026-08-04 17:59:50 +00:00

ecosystem.profile.cjs

mac: name the laptop build a profile, and derive it like the others

2026-08-04 12:47:27 +00:00

events_not_in_statistics.txt

first

2026-02-16 19:34:35 +00:00

example.csv

App Preview

2026-02-22 03:35:26 +00:00

launcher_config.json

first

2026-02-16 19:34:35 +00:00

MUSIC_API.md

docs: bring the live docs back in line with the code

2026-07-31 16:11:29 +00:00

opencode.json

drop inherited architecture docs that no longer match the code

2026-07-22 20:25:44 +01:00

package.json

add photos, an immich-backed library behind its own sidecar

2026-08-03 00:18:33 +00:00

playwright.config.ts

first

2026-02-16 19:34:35 +00:00

SYSTEM_MONITOR_API.md

docs: SYSTEM_MONITOR_API.md contract for the app + drop dead Pm2Logs.tsx

2026-07-27 11:03:10 +00:00

test-setup.ts

one way to mint a panel id, and a registry that cannot silently lose an app

2026-08-07 10:38:52 +00:00

TODO.md

add a living todo for the workspace/panel framework

2026-08-07 02:58:16 +00:00

tsconfig.json

tool registry, claude tool awareness, and model selector fix

2026-03-07 11:55:38 +00:00

S

Description

No description provided

42 MiB

Languages

TypeScript 90.9%

Shell 4.7%

JavaScript 4.1%

CSS 0.2%

HTML 0.1%