nesquena-hermes 64ca1f8686 harden(#2980): profile-scope continuation lookup + safe-sid + no speculative restore write ...

Gate findings (Codex 2-CORE / Opus SHIP-WITH-FIXES), both fixed:
1. cross-profile leak — _pre_compression_continuation_session_id scanned all profiles' sessions,
   matched only by parent_session_id; now filters children by _profiles_match(child, snapshot)
   + validates returned sid with is_safe_session_id. +cross-profile regression test.
2. restore-state poison — frontend wrote continuationSid to localStorage/URL BEFORE the inner
   loadSession proved it loadable; removed the speculative write (success path at the loaded id
   handles it). Updated the source-grep test to assert the safe form.
Bounded BFS (range(20)+seen) + recursion guard confirmed safe by both gates.

2026-06-21 08:17:32 +00:00

..

vendor

fix: vendor math and yaml assets for CSP

2026-05-26 23:49:02 +02:00

apple-touch-icon.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

assistant_turn_anchors.js

Add assistant turn anchor renderer snapshot adapter

2026-06-14 02:03:45 +08:00

boot.js

rebase #3933 + stamp v0.51.544 — opt-in render markdown in user messages

2026-06-21 00:03:02 +00:00

commands.js

frontend: subpath-safe fetch() in /model command

2026-06-18 21:44:43 +00:00

favicon-32.png

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

favicon-192.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon-512.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon-512.svg

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon.ico

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

favicon.svg

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

i18n.js

stage #4588 — extensions settings diagnostics panel

2026-06-21 07:10:05 +00:00

icons.js

feat(#4226): display symlinks in workspace file tree (#4228)

2026-06-16 23:24:15 +00:00

index.html

stage #4588 — extensions settings diagnostics panel

2026-06-21 07:10:05 +00:00

login.js

feat: add passkey sign-in

2026-05-25 00:14:38 +00:00

manifest.json

Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20

2026-05-24 18:28:52 +00:00

messages.js

harden(#4587): align scene-builder final-answer filters to the renderer's >=0.9 ratio

2026-06-21 06:03:44 +00:00

onboarding.js

docs: clarify Anthropic auth choices in onboarding

2026-05-06 06:26:43 +00:00

outline.js

fix(outline): keep outline valid on the todos sidebar panel (Opus follow-up)

2026-06-10 23:55:05 +00:00

panels.js

stage #4588 — extensions settings diagnostics panel

2026-06-21 07:10:05 +00:00

pwa-startup.js

Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20

2026-05-24 18:28:52 +00:00

sessions.js

harden(#2980): profile-scope continuation lookup + safe-sid + no speculative restore write

2026-06-21 08:17:32 +00:00

style.css

stage #4588 — extensions settings diagnostics panel

2026-06-21 07:10:05 +00:00

sw.js

fix: focus the existing chat tab when a notification is clicked instead of opening a new tab

2026-06-13 14:42:41 -07:00

terminal.js

fix(#4313): guard EventSource.close() calls to suppress ERR_ABORTED noise

2026-06-18 17:25:18 +00:00

ui.js

stage #4578 onto master (v0.51.553) — preserve mid-stream scroll anchor + honor manual unpin (#4295)

2026-06-21 07:25:11 +00:00

workspace.js

feat(#2941): add read-only LLM Wiki browser in the Insights panel

2026-06-17 19:47:45 +00:00