nesquena-hermes 4ee9368464 Opus pre-release follow-ups for PR #1445 ... REQUIRED: - _fully_unquote_path range(3) -> range(10) — defense-in-depth so quadruple- encoded .. is rejected by validator instead of slipping through (not exploitable but contract violation) - docs/EXTENSIONS.md trust-model callout moved to top of file with explicit 'don't enable in untrusted env / don't point at user-writable dir' guidance NICE-TO-HAVE (taken since Nathan asked for all fixes big and small): - URL list cap at _MAX_URL_LIST=32 to avoid pathological rendering - One-shot WARNING log for rejected URLs (silent drop now visible to admin) - One-shot WARNING log for URL list truncation - MIME map: ttf (font/ttf), otf (font/otf), wasm (application/wasm) 5 regression tests in tests/test_pr1445_opus_followups.py pin all invariants.		2026-05-02 03:49:40 +00:00
..
images	docs: HERMES.md deep-dive, Why Hermes in README, screenshot layout	2026-04-03 22:03:19 -07:00
pr-assets	fix(ui): restore rail-era app titlebar state (v0.50.226) (#1163)	2026-04-27 11:43:32 -07:00
ui-ux	feat: remove bubble_layout setting end-to-end (#777)	2026-04-20 22:34:45 +00:00
docker.md	v0.50.260: Docker reliability batch - PR #1428 + broader UX/docs improvements + Opus advisor fixes	2026-05-01 23:10:52 +00:00
EXTENSIONS.md	Opus pre-release follow-ups for PR #1445	2026-05-02 03:49:40 +00:00
ISSUES.md	fix(#1195): route sessions to profile dir even when dir doesn't exist yet (#1373)	2026-04-30 23:24:31 +00:00