3 Commits

Include renames

Author	SHA1	Message	Date
Tenggan ZhangandTeigen	ec38fd11bf	feat(web): mobile image upload to active session via paste dialog (#101) ... - Extend the keyboard accessory paste dialog with an image picker (camera / photo library) plus best-effort image paste, routing selected files through the existing _uploadAndInsertImages pipeline - Re-encode images to standard JPEG/PNG in the browser before upload, so mislabeled gallery images (e.g. MIUI WebP claiming image/jpeg) pass the server magic-byte check; PNG keeps transparency, GIF passes through untouched, decode failures fall back to the original file - Log the real byte header on the paste-image magic-mismatch branch to pin down any remaining format mismatches without a guessing loop - Ignore the runtime .claude-images/ upload directory Co-authored-by: Teigen <teigen@TeigendeMac-mini.local>	2026-06-01 19:38:48 +02:00
aakhter	101cee0cec	security(paste-image): harden against 7 findings from PR #84 review (#90) ... Hardens `/api/sessions/:id/paste-image` against the seven findings flagged in the dismissed security review on #84. Each commit addresses one finding. - LOW: Collision-free filenames (`paste-${ts}-${rand4}${ext}`) - MED: Symlink check on image dir (`lstat` + non-recursive mkdir + `O_EXCL|O_NOFOLLOW`) - MED: Magic-byte validation (PNG/JPEG/GIF/WebP/BMP) - HIGH: CSRF protection (Origin/Referer match req.host; non-browser clients send `X-Codeman-CSRF`) - MED: Swap hand-rolled multipart parser to @fastify/multipart with `limits: { fileSize: 10MB, files: 1, fields: 4 }` - MED: Rate limit (30/min per IP+session) + hourly GC of `paste-*` files older than 7d - LOW: Use `terminal.paste(text)` instead of `sendInput(text)` so bracketed-paste markers survive Co-authored-by: Aamer Akhter <aakhter@gmail.com>	2026-05-19 10:36:05 +02:00
3 people	94bcf524a2	feat: image paste (Ctrl+V) and drag-and-drop into terminal (#84) ... * feat: add image paste and drag-and-drop support Clipboard paste (Ctrl+V) and drag-and-drop of image files into the terminal. Images are saved to {workdir}/.claude-images/ and the absolute path is inserted into the terminal input for Claude to read. - POST /api/sessions/:id/paste-image endpoint (hand-parsed multipart) - image-input.js mixin with paste trap technique (works on HTTP) - Ctrl+V intercepted at xterm keyboard level, routes through hidden contenteditable div to capture both image and text clipboard data - Drag-and-drop on terminal container with visual overlay - Session cleanup deletes .claude-images/ on destroy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * security: remove SVG from paste-image allowlist Drops .svg / image/svg+xml from the paste-image endpoint. SVGs are served as image/svg+xml via /api/sessions/:id/file-raw, same-origin, under a CSP that permits inline scripts — which would execute on view. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: arkon <arkon.85@hotmail.com>	2026-05-17 05:57:07 +02:00