james.maesandClaude Fable 5.1 ffedcbb2ff core+cli: never write a server-named download outside --out-dir or over a file ...

DOWNLOAD_FORM names come from the server. safeDownloadName keeps the last path
segment only (either separator), strips control characters and refuses empty,
. and ..; qqq process run writes with flag wx and takes name-1.ext, name-2.ext
when the name is taken. Tested with traversal names.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-10-31 17:50:20 -05:00

..

src

core+cli: never write a server-named download outside --out-dir or over a file

2026-10-31 17:50:20 -05:00

package.json

cli: noun-verb grammar on the kernel, output formats, JMESPath, CRUD, api escape hatch

2026-10-31 17:03:18 -05:00

tsconfig.json

feat: reference CLI, generated UI API client, conformance suite and dev IdP

2026-10-15 11:47:12 -05:00