Codeman maintainer 524a096e14 Merge feat/docker-session-mode into master (docker deep-review fixes) ...

Brings the docker session-mode deep-review work (intended for the skipped
1.4.2) onto the 1.5.x line: deterministic-conversation-id resume across
container stop/recreate, config-drift detection + POST /api/docker-cases/:name/recreate,
docker model-picker support, import-manifest hardening, remote-daemon (context/
daemonHost) correctness, comma-in-path rejection, and the zh-CN README re-translation.

Conflicts resolved to preserve BOTH the multi-user security scoping already on
master (ownership checks, workingDir confinement, permission downgrade) AND the
docker features. Version kept at master's 1.5.0 (the 1.4.2 bump is superseded;
a fresh changeset bumps to 1.5.1). tsc, eslint, and test:ci all green (3548 tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-20 13:45:37 +02:00

..

fonts

feat(ui): theme skins — OG Codeman, Daylight Green, Daylight Blue

2026-06-13 23:21:47 +02:00

gesture

feat(gesture): hand-drag subagent & ultracode windows in the gesture beta

2026-06-19 16:01:04 +02:00

vendor

Replace markdown denylist sanitizer with vendored DOMPurify (mXSS hardening)

2026-06-14 12:33:48 -04:00

admin-ui.js

feat(multiuser): phase 5b, frontend (identity boot + admin panel)

2026-07-20 04:31:30 +02:00

api-client.js

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

app.js

chore: version packages

2026-07-20 02:36:02 +02:00

constants.js

Merge feat/docker-session-mode into master (docker deep-review fixes)

2026-07-20 13:45:37 +02:00

cron-ui.js

fix(review): harden cron security, session lifecycle, skip policy (PR #141)

2026-07-12 19:25:42 +02:00

icon-192.png

local: add PWA support for Android home screen install

2026-04-04 22:15:24 -04:00

icon-512.png

local: add PWA support for Android home screen install

2026-04-04 22:15:24 -04:00

image-input.js

feat(mobile): large + multi-image uploads from the camera-roll picker

2026-06-23 23:12:41 +02:00

index.html

Merge feat/docker-session-mode into master (docker deep-review fixes)

2026-07-20 13:45:37 +02:00

input-cjk.js

fix(review): content-free IME traces, guarded onData self-heal, Android-only retap recovery (PR #143)

2026-07-12 12:42:14 +02:00

keyboard-accessory.js

fix(mobile): keep /compact in extended accessory bar, only drop it from simple

2026-06-18 10:29:49 +02:00

manifest.json

local: add PWA support for Android home screen install

2026-04-04 22:15:24 -04:00

mobile-handlers.js

fix(iPad): accessory bar styling, positioning, and paste dialog

2026-06-17 23:40:04 +08:00

mobile.css

chore: version packages

2026-07-20 02:36:02 +02:00

notification-manager.js

fix(security): harden remaining inline onclick handlers against XSS double-context

2026-06-19 15:26:42 +02:00

orchestrator-panel.js

fix(security): harden remaining inline onclick handlers against XSS double-context

2026-06-19 15:26:42 +02:00

panels-ui.js

feat(docker): harden session mode + File Viewer button (v1.4.1)

2026-07-20 01:36:21 +02:00

ralph-panel.js

fix(api): close contract gaps found by post-merge adversarial audit

2026-06-10 03:41:04 +02:00

ralph-wizard.js

fix(terminal): linear-time link-provider regex; always allow blob workers in CSP

2026-06-10 18:06:45 +02:00

respawn-ui.js

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

sanitize-html.js

fix(sanitizer): enforce the curated allowlist + make the test run order-independently

2026-06-14 22:21:13 +02:00

session-ui.js

chore: version packages

2026-07-20 02:36:02 +02:00

settings-ui.js

feat(docker): harden session mode + File Viewer button (v1.4.1)

2026-07-20 01:36:21 +02:00

styles.css

fix(multiuser): wrap modal tabs so the injected Users tab is clickable

2026-07-20 08:38:06 +02:00

subagent-windows.js

fix(security): harden remaining inline onclick handlers against XSS double-context

2026-06-19 15:26:42 +02:00

sw.js

feat(push): plumb hostname-aware prefix into Web Push notifications

2026-05-12 10:03:59 +02:00

terminal-ui.js

fix(terminal): restore Claude scroll-back on macOS trackpads (#154)

2026-07-16 09:33:39 +02:00

ultracode-panel.js

Harden ultracode inline onclick handlers against XSS

2026-06-19 08:55:24 -04:00

ultracode-windows.js

Harden ultracode inline onclick handlers against XSS

2026-06-19 08:55:24 -04:00

upload.html

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

voice-input.js

refactor: extract app.js into 6 domain modules with deferred init

2026-03-14 21:24:22 +01:00