HERMES-GIELIE/static
nesquena-hermes e61a405add
fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194)
Batch release v0.50.231 — 3 fixes.

## PRs included

| PR | Author | Fix |
|---|---|---|
| #1186 | @nesquena (Claude Code) | macOS `/etc` symlink bypass in workspace blocked-roots |
| #1187 | @nesquena-hermes | Workspace panel stuck closed after empty-session reload |
| #1190 | @bergeouss | Fenced code content leaking into markdown passes (#1154) |

All three PRs were independently reviewed and approved by @nesquena.

## Test results

**2729 passed, 2 skipped** (2 macOS-only tests correctly skipped on Linux). Browser QA: **21/21**.

## Key fix notes

**#1186:** `_workspace_blocked_roots()` now returns both literal and `Path.resolve()` forms of each blocked root. macOS symlinks (`/etc → /private/etc`) previously let a resolved candidate slip past the literal check. New `_is_blocked_system_path()` helper with `/var/folders` and `/var/tmp` carve-outs for pytest temp dirs.

**#1187:** Regression from #1182 — `syncWorkspacePanelState()` force-closed on any no-session state. Now only closes in `'preview'` mode. Both boot paths restore localStorage panel pref before sync.

**#1190:** Fenced code blocks are now stashed as `\x00P<n>\x00` tokens through ALL markdown passes (list/heading/table regexes), restored at the very end. Previously, diff hunks and markdown headings inside code blocks triggered those regexes, injecting `<ul>/<li>/<h>` tags that broke `</pre>` closure.
2026-04-27 17:43:36 -07:00
..
vendor chore: vendor streaming-markdown@0.2.15, remove CDN dependency 2026-04-24 01:05:20 +00:00
boot.js fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194) 2026-04-27 17:43:36 -07:00
commands.js fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00
favicon-32.png fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
favicon.ico fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
favicon.svg fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613) 2026-04-16 20:11:02 -07:00
i18n.js fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00
icons.js refactor(ui): three-column layout with left rail + main-view migration (#899) 2026-04-24 09:05:25 -07:00
index.html fix: batch triage — 12 contributor PRs (v0.50.227) (#1168) 2026-04-27 13:34:59 -07:00
login.js v0.50.210: gpt-5.5, cron titles, agent cache, bfcache fix, onboarding fix, mermaid CSP, PWA auth (#1056) 2026-04-25 15:47:44 -07:00
manifest.json feat: add PWA support (manifest, service worker, install prompt) (#920) 2026-04-23 15:14:21 -07:00
messages.js fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00
onboarding.js v0.50.210: gpt-5.5, cron titles, agent cache, bfcache fix, onboarding fix, mermaid CSP, PWA auth (#1056) 2026-04-25 15:47:44 -07:00
panels.js fix: batch triage — 12 contributor PRs (v0.50.227) (#1168) 2026-04-27 13:34:59 -07:00
sessions.js fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00
style.css fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00
sw.js feat: add PWA support (manifest, service worker, install prompt) (#920) 2026-04-23 15:14:21 -07:00
ui.js fix: batch v0.50.231 — macOS symlink bypass, workspace panel, fenced code leak (#1194) 2026-04-27 17:43:36 -07:00
workspace.js fix: batch v0.50.229 — session perf, ephemeral sessions, iOS zoom (#1183) 2026-04-27 16:27:03 -07:00