pastilhasandClaude Opus 5 1dc0eddde0 put the open plan in the url, and stop /api/plans reading outside its folder ...

/plans/:name, no redirect guard: the bare route is 'no plan open', which is a
real state, so the auto-select-first effect is deleted rather than turned into
a Navigate. The picker stays a native select — chrome for one document, not a
master list — but it navigates instead of setting state.

Reading the server route for this turned up a path traversal: hono
percent-decodes params, so GET /api/plans/..%2F..%2Fsecret reached
join(plansDir, '../../secret.md'). basename() the param.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-07 12:41:55 +00:00

..

agent-coordination.md

measure what a handoff actually survives

2026-08-07 10:32:18 +00:00

api-method-changes-2026-08-06.md

api: five reads that were declared as writes are now GET

2026-08-06 13:38:49 +00:00

chat-ui-walkthrough.md

walkthrough: the tab-name clone check was a guess

2026-08-07 02:27:12 +00:00

claude-sidecar-isolation.md

delete the claude-done hook and its unauthenticated endpoint

2026-08-04 01:36:35 +00:00

design-language-interface.md

add the interface half of the duck suite design language

2026-08-06 21:16:42 +00:00

file-sync.md

docs: phone photo backup contract, and the file-sync decision

2026-08-04 03:27:01 +00:00

jobs-unification.md

docs: bring the live docs back in line with the code

2026-07-31 16:11:29 +00:00

mobile-dav-provisioning-feedback.md

commit the mobile dav correspondence

2026-08-04 14:30:25 +00:00

mobile-dav-provisioning-reply.md

commit the mobile dav correspondence

2026-08-04 14:30:25 +00:00

mobile-dav-provisioning.md

one-tap ios dav provisioning

2026-08-04 14:20:52 +00:00

mobile-photo-sync-api.md

docs: phone photo backup contract, and the file-sync decision

2026-08-04 03:27:01 +00:00

navigation-audit.md

put the open plan in the url, and stop /api/plans reading outside its folder

2026-08-07 12:41:55 +00:00

nextcloud-replacement.md

caldav/carddav: officer-caldav sidecar and the /dav door

2026-08-04 03:16:17 +00:00

push-notifications.md

push notifications: design, and the device registry

2026-07-31 21:27:07 +00:00

sidecar-audit-2026-07.md

docs: fold the workspace-root docs into the repo, with honest status

2026-07-31 16:45:26 +00:00

sidecar-topology.md

docs: fold the workspace-root docs into the repo, with honest status

2026-07-31 16:45:26 +00:00

wallet-key-custody.md

document the wallet key custody model

2026-07-31 07:09:03 +00:00

working-on-officer.md

docs: bring the live docs back in line with the code

2026-07-31 16:11:29 +00:00

workspace-panel-todo.md

put the music library location in the url

2026-08-07 12:08:04 +00:00

workspace-panels.md

give the soulseek workspace a url

2026-08-07 11:45:33 +00:00