nesquena-hermes e4152c0398 fix(extensions): render skin picker label via textContent, not innerHTML (XSS hardening) ...

Codex flagged that _buildSkinPicker injected the extension-controlled skin
label/name via btn.innerHTML, so a malicious registerHermesSkin descriptor
(label='<img src=x onerror=...>') could execute when Settings -> Appearance
builds the picker. Rebuild the button with DOM nodes + textContent for the
label and set swatch backgrounds via element.style.background. Adds regression
tests asserting the innerHTML sink is gone.

2026-06-28 05:22:26 +00:00

..

vendor

fix: protect pipes inside backtick code spans in renderMd tables

2026-06-25 08:25:58 +00:00

apple-touch-icon.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

assistant_turn_anchors.js

Add assistant turn anchor renderer snapshot adapter

2026-06-14 02:03:45 +08:00

boot.js

fix(extensions): render skin picker label via textContent, not innerHTML (XSS hardening)

2026-06-28 05:22:26 +00:00

commands.js

fix(steer): rename typo, catch retry rejection, update JSDoc (#4749)

2026-06-25 03:23:36 +00:00

favicon-32.png

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

favicon-192.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon-512.png

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon-512.svg

feature: add manifest and icons to enable app install on android

2026-05-02 19:06:39 +02:00

favicon.ico

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

favicon.svg

fix: add favicon (SVG + PNG + ICO), fix static MIME types (#613)

2026-04-16 20:11:02 -07:00

i18n.js

Merge current master into extension gallery source permissions

2026-06-28 13:05:12 +08:00

icons.js

stage #4581 onto master (v0.51.556) — surface escape-target symlinks as display-only workspace rows

2026-06-21 09:15:22 +00:00

index.html

theme-registration: preserve pending ext skin across reload + expand accent token allowlist

2026-06-28 05:22:26 +00:00

login.js

feat: add passkey sign-in

2026-05-25 00:14:38 +00:00

manifest.json

Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20

2026-05-24 18:28:52 +00:00

messages.js

feat(moa): route /moa through WebUI via server-resolved MoA config (#5070, #5057)

2026-06-28 00:23:51 +00:00

onboarding.js

fix(onboarding): rehydrate plain-select fallback so saved model isn't reset to option[0]

2026-06-27 04:33:02 +00:00

outline.js

fix(outline): keep outline valid on the todos sidebar panel (Opus follow-up)

2026-06-10 23:55:05 +00:00

panels.js

Merge current master into extension gallery source permissions

2026-06-28 13:05:12 +08:00

pwa-startup.js

Stage 405: PR #2842 — feat: polish installed PWA startup by @AJV20

2026-05-24 18:28:52 +00:00

sessions.js

fix(boot): preserve typed composer input during saved-session boot restore (#5069)

2026-06-27 20:51:46 +00:00

style.css

Improve extension gallery source and permissions display

2026-06-28 12:44:57 +08:00

sw.js

fix: focus the existing chat tab when a notification is clicked instead of opening a new tab

2026-06-13 14:42:41 -07:00

terminal.js

fix(#4313): guard EventSource.close() calls to suppress ERR_ABORTED noise

2026-06-18 17:25:18 +00:00

ui.js

feat(settings): sync a Hermes Dashboard chip with Appearance dropdown (#4936)

2026-06-27 20:33:51 +00:00

workspace.js

docs(workspace): clarify redirect401 401 contract (#5001)

2026-06-26 22:09:09 +00:00