arkon and Claude Opus 4.6
b4a808adcf
fix: security hardening and cleanup from community PR cherry-picks
...
- Add HTML sanitizer for markdown rendering (XSS prevention)
- Switch service worker to network-first caching (deploys take effect immediately)
- Sanitize Content-Disposition filenames (header injection prevention)
- Expose session.muxName getter, replace unsafe `as any` cast
- Static import for execFile, update CLAUDE.md keyboard shortcuts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-11 07:20:09 +02:00
arkon and Claude Opus 4.6
f3cbe9bca6
feat: cherry-pick keyboard UX and file download from community PRs
...
Cherry-picked from PR #60 (keyboard UX) and PR #61 (file download):
- Alt+1-9 session switching
- Disable Ctrl+K (too easy to trigger accidentally)
- Session rename with prefix preservation (w1-case: description)
- Shift+Enter / Ctrl+Enter multiline input via tmux send-keys -H
- Android virtual keyboard fix for non-composition input
- File download button in browser file explorer (?download=true)
Dropped from PR #60 : stale package-lock.json, upload popup (missing upload.html)
Dropped from PR #61 : standalone /api/download endpoint (arbitrary fs access)
Fixed from PR #60 : execFileSync replaced with async execFile
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-11 06:59:50 +02:00
arkon and Claude Opus 4.6
a448983be3
refactor: pass 2 — extract shared helpers and simplify patterns
...
app.js:
- Add _clearTimer() helper replacing 11 inline clearTimeout patterns
- Add _isStaleSelect() helper for generation check + cleanup
- Replace 11 keyboard shortcut if-blocks with data-driven lookup table
- Extract _cleanupPreviousSession() from selectSession() (~75 lines)
- Extract _resetAllAppState() from handleInit() (~75 lines)
tmux-manager:
- Extract buildEnvExports() eliminating duplication in createSession/respawnPane
- Extract buildPathExport() for CLI path resolution
- Extract _configureOpenCode() for OpenCode setup
routes:
- Add readJsonConfig() to route-helpers, replacing 5 inline JSON-read patterns
- Add validateSessionFilePath() to route-helpers, replacing 2 identical path
traversal validation blocks in file-routes
session-auto-ops:
- Convert executeWhenIdle() from 8 positional params to options object
- Extract validateThreshold() for shared compact/clear validation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-25 23:32:28 +01:00
arkon and Claude Opus 4.6
e05d507254
refactor: extract server.ts routes into domain modules (phase 3)
...
Split 6,710-line server.ts into focused route modules using port
interfaces for dependency injection. 107/109 routes extracted into
12 domain files with auth middleware, 5 port interfaces, and shared
helpers. Server.ts retains orchestration (SSE, lifecycle, state).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-28 19:12:45 +01:00
