64ca1f8686
Gate findings (Codex 2-CORE / Opus SHIP-WITH-FIXES), both fixed: 1. cross-profile leak — _pre_compression_continuation_session_id scanned all profiles' sessions, matched only by parent_session_id; now filters children by _profiles_match(child, snapshot) + validates returned sid with is_safe_session_id. +cross-profile regression test. 2. restore-state poison — frontend wrote continuationSid to localStorage/URL BEFORE the inner loadSession proved it loadable; removed the speculative write (success path at the loaded id handles it). Updated the source-grep test to assert the safe form. Bounded BFS (range(20)+seen) + recursion guard confirmed safe by both gates. |
||
|---|---|---|
| .. | ||
| vendor | ||
| apple-touch-icon.png | ||
| assistant_turn_anchors.js | ||
| boot.js | ||
| commands.js | ||
| favicon-32.png | ||
| favicon-192.png | ||
| favicon-512.png | ||
| favicon-512.svg | ||
| favicon.ico | ||
| favicon.svg | ||
| i18n.js | ||
| icons.js | ||
| index.html | ||
| login.js | ||
| manifest.json | ||
| messages.js | ||
| onboarding.js | ||
| outline.js | ||
| panels.js | ||
| pwa-startup.js | ||
| sessions.js | ||
| style.css | ||
| sw.js | ||
| terminal.js | ||
| ui.js | ||
| workspace.js | ||
