Mohamed Boudra
3585c80266
Allow previews to open readable files ( #1214 )
...
* Allow previews to open readable files
* Fix Windows file preview path test
* Address file preview review comments
2026-05-29 11:35:38 +08:00
Mohamed Boudra
c40e1f03db
docs: deep audit pass — fix drift across every doc, rebase coding-standards on /unslop
...
Each doc verified against current code; stale claims fixed in place.
- architecture: handshake/binary-frame/route/module-table corrections
- data-model: atomic-write claim narrowed, missing daemon files/fields added
- development: db:query removed (SQLite/Drizzle gone), tmux→concurrently+portless, PASEO_HOME split
- unistyles: withUnistyles(Icon) is the dominant pattern; new Animated.View+dynamic-styles iOS gotcha
- SECURITY: bearer-token auth, DNS-rebinding allowlist semantics, ephemeral phone keypair, wire format
- glossary: Project-checkout rename has shipped
- providers: claude-acp not built-in, Pi/mock, async isCommandAvailable, interface drift
- coding-standards: rewritten as compressed /unslop adaptation
- product/release/testing/custom-providers/android/mobile-testing/ad-hoc-daemon-testing/file-icons/design: smaller corrections
2026-05-09 11:35:26 +07:00
Mohamed Boudra
7a8f65805d
refactor: rename allowedHosts to hostnames ( #413 )
...
* refactor: rename allowedHosts to hostnames for DNS rebinding config
The old name confused users who thought it was related to CORS.
"hostnames" communicates that you're declaring the daemon's own
hostnames, not granting access to external parties.
Backward compatible: old config files (daemon.allowedHosts), env var
(PASEO_ALLOWED_HOSTS), CLI flag (--allowed-hosts), and Nix option
(allowedHosts) all still work as deprecated aliases.
* fix(nix): update npmDepsHash to match current package-lock.json
2026-04-15 12:47:49 +08:00
Mohamed Boudra
8a585e60f2
fix(security): shell injection, symlink escape, remove /pairing endpoint, harden defaults
...
- Replace all execAsync shell-interpolated git calls with execFileAsync + array args in session.ts
- Add symlink resolution in file-explorer resolveScopedPath to prevent workspace escape
- Remove /pairing HTTP endpoint from server; desktop now uses `paseo daemon pair --json` via CLI
- Disable MCP HTTP endpoint by default (opt-in via config)
- Correct SECURITY.md: fix cipher name (XSalsa20-Poly1305), accurate replay resistance claims, add local daemon trust boundary docs
2026-04-02 23:58:38 +07:00
Mohamed Boudra
765a11c7ab
fix(metadata): update project contact email
2026-03-25 23:36:55 +07:00
Mohamed Boudra
5ac6c4a82c
docs: add SECURITY.md
2026-02-05 15:08:41 +07:00
Mohamed Boudra
41403df485
docs: add SECURITY.md
2026-02-05 15:04:32 +07:00
Mohamed Boudra
ef899717c8
docs: add SECURITY.md
2026-02-05 15:02:55 +07:00
