Files
Codeman/test
Codeman maintainer ea4b940cef review fixes: block Codeman's own credential-bearing JSON, make the inside-anchor test bite
Widening the servable extensions to EDITABLE_EXTENSIONS made ~/.codeman
JSON previewable for the first time, and the blocklist named only
state.json. But settings.json holds a credential BY SCHEMA
(voiceSettings.apiKey), push-keys.json holds the VAPID PRIVATE key, and
intents.json is written 0600 precisely because captured prompts can carry
secrets — all three were one authenticated click away once an agent
printed the path. Blocked alongside state.json, whose rule now also
catches state-* siblings.

The never-re-cuts-inside-an-anchor test used an unmatchable URL tail, so
it passed with the guard deleted; the fixture now carries a matchable
/tmp path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-16 19:21:43 +02:00
..
2026-07-20 17:35:40 +02:00
2026-06-19 17:58:06 -04:00
2026-06-19 17:58:06 -04:00
2026-07-20 02:36:02 +02:00
2026-07-20 02:36:02 +02:00
2026-06-19 13:10:17 -04:00
2026-08-09 01:18:03 +02:00
2026-08-09 01:18:03 +02:00