pastilhasandClaude Opus 5 b077671f19 make the notify identity rule testable, and fix what the test found ...

Extracting resolveNotifyUser into its own module immediately caught a hole
in the fix from the previous commit: a header that was present but
unparseable fell through to the body, so a browser could send junk in the
header, name any user in the body and win.

PRESENCE of X-Officer-User is the signal, not its validity — a malformed
header means a proxied request went wrong, and falling through hands the
decision back to the caller we just declined to trust.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-08 10:00:02 +00:00

docs

retire the single-user claim from the docs it outlived

2026-08-07 21:58:44 +00:00

public

desktop: load noVNC as one bundle instead of 42 modules

2026-08-01 20:52:50 +00:00

scripts

scripts: give every user a root under DATA_PATH

2026-08-04 14:00:33 +00:00

seed/templates

move tasks to marketplace, sync native tasks on bootstrap

2026-03-10 13:57:40 +00:00

src

make the notify identity rule testable, and fix what the test found

2026-08-08 10:00:02 +00:00

.env.example

move the wallet's chain source out of env and into the ui

2026-08-03 22:59:00 +00:00

.gitignore

drop a scratch file committed by mistake, and ignore the pattern

2026-08-04 00:24:54 +00:00

.prettierignore

vendor hls.js and play transcodes over hls

2026-08-04 18:52:15 +00:00

.prettierrc

first

2026-02-16 19:34:35 +00:00

AGENTS.md

retire the single-user claim from the docs it outlived

2026-08-07 21:58:44 +00:00

bun-env.d.ts

restore the code editor screen, drop the dead theme picker, unshadow AppRegistry

2026-07-25 23:30:20 +01:00

bun.lock

add photos, an immich-backed library behind its own sidecar

2026-08-03 00:18:33 +00:00

bunfig.toml

freeze installs: bun resolves from the lockfile or fails

2026-08-04 17:58:07 +00:00

CLAUDE.md

retire the single-user claim from the docs it outlived

2026-08-07 21:58:44 +00:00

components.json

first

2026-02-16 19:34:35 +00:00

CONVENTIONS.md

docs: the convention docs were describing a different codebase

2026-07-31 16:42:47 +00:00

ecosystem.config.cjs

gitea: the app — repos, code, issues, pulls, notifications

2026-08-06 17:10:36 +00:00

ecosystem.light.config.cjs

jellyfin sidecar: server registry, video façade and byte pass-through

2026-08-04 17:59:50 +00:00

ecosystem.mac.light.config.cjs

run the gitea sidecar in the mac light profile

2026-08-08 00:39:18 +01:00

ecosystem.profile.cjs

mac: name the laptop build a profile, and derive it like the others

2026-08-04 12:47:27 +00:00

events_not_in_statistics.txt

first

2026-02-16 19:34:35 +00:00

example.csv

App Preview

2026-02-22 03:35:26 +00:00

launcher_config.json

first

2026-02-16 19:34:35 +00:00

MUSIC_API.md

docs: bring the live docs back in line with the code

2026-07-31 16:11:29 +00:00

opencode.json

drop inherited architecture docs that no longer match the code

2026-07-22 20:25:44 +01:00

package.json

add photos, an immich-backed library behind its own sidecar

2026-08-03 00:18:33 +00:00

playwright.config.ts

first

2026-02-16 19:34:35 +00:00

SYSTEM_MONITOR_API.md

retire the single-user claim from the docs it outlived

2026-08-07 21:58:44 +00:00

test-setup.ts

test useDashboardState, and fix the revert it proved was inverted

2026-08-07 14:22:26 +00:00

TODO.md

retire the single-user claim from the docs it outlived

2026-08-07 21:58:44 +00:00

tsconfig.json

tool registry, claude tool awareness, and model selector fix

2026-03-07 11:55:38 +00:00

S

Description

No description provided

51 MiB

Languages

TypeScript 84.6%

CSS 6.7%

Shell 5%

JavaScript 3.7%