4fa051ea14
1. routes.py: hoist a single case-folded path helper (_norm/_within_ci/_equal_ci) used for ALL deny + carve-out comparisons (consistent macOS/Windows safety). 2. routes.py: split the deny into (a) dir-based denies that ALWAYS fire (even inside the active workspace — so a workspace overlapping a state dir cannot expose sessions/memories), and (b) filename denies relaxed only by the carve-out. Fix the over-block: a workspace that is a proper DESCENDANT of a Hermes root (e.g. STATE_DIR/workspace) is a legit project workspace and keeps the carve-out; only a root-itself / ancestor / $HOME / profiles / state-subdir workspace disables it. 3. ui.js: move the bare file:// media-stash pass after the raw-<pre> stash too, so file:// inside a raw <pre> block stays literal (not just fenced/inline code). |
||
|---|---|---|
| .. | ||
| vendor | ||
| apple-touch-icon.png | ||
| boot.js | ||
| commands.js | ||
| favicon-32.png | ||
| favicon-192.png | ||
| favicon-512.png | ||
| favicon-512.svg | ||
| favicon.ico | ||
| favicon.svg | ||
| i18n.js | ||
| icons.js | ||
| index.html | ||
| login.js | ||
| manifest.json | ||
| messages.js | ||
| onboarding.js | ||
| panels.js | ||
| pwa-startup.js | ||
| sessions.js | ||
| style.css | ||
| sw.js | ||
| terminal.js | ||
| ui.js | ||
| workspace.js | ||
