Mikael Hugo 66ff949c11 cherry-pick(security): harden project-controlled surfaces (PR #4755 partial) ... Cherry-pick of gsd-build/gsd-2 65ca5aa2e — applies the security hardening hunks that conflicted minimally: - mcp-server/env-writer: validate writes against a strict allowlist - web/api/files: enforce path containment via web/lib/secure-path - vscode-extension: read binaryPath/autoStart only from trusted global/default scopes (resolveTrustedSfStartupConfig), avoiding workspace-controlled override (renamed Gsd → Sf for sf naming) - New regression tests: mcp-client-security, vscode-startup-security, web-files-symlink Skipped hunks (drifted): mcp-server/server.ts, mcp-client/index.ts, mcp-server/README.md. Co-Authored-By: Jeremy <jeremy@fluxlabs.net> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-28 05:37:07 +02:00
..
boot	chore: sync workspace state after rebrand	2026-04-15 14:54:20 +02:00
bridge-terminal	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
browse-directories	refactor: update log prefixes and string values from gsd- to sf- namespace	2026-04-15 15:37:12 +02:00
captures	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
cleanup	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
dev-mode	refactor: update log prefixes and string values from gsd- to sf- namespace	2026-04-15 15:37:12 +02:00
doctor	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
experimental	refactor: update log prefixes and string values from gsd- to sf- namespace	2026-04-15 15:37:12 +02:00
export-data	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
files	cherry-pick(security): harden project-controlled surfaces (PR #4755 partial)	2026-04-28 05:37:07 +02:00
forensics	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
git	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
history	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
hooks	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
inspect	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
knowledge	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
live-state	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
notifications	feat(gsd): persistent notification panel with TUI overlay, widget, and web API	2026-04-05 22:13:28 -05:00
onboarding	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
preferences	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
projects	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
recovery	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
remote-questions	refactor: update log prefixes and string values from gsd- to sf- namespace	2026-04-15 15:37:12 +02:00
session	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
settings-data	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
shutdown	fix(security): activate auth middleware and harden shutdown/update routes (#4023)	2026-04-13 07:52:43 -04:00
skill-health	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
steer	refactor: update log prefixes and string values from gsd- to sf- namespace	2026-04-15 15:37:12 +02:00
switch-root	feat(web): add "Change project root" button to web UI (#2355)	2026-03-24 07:18:05 -06:00
terminal	refactor: rebrand gsd_ tool names and references to sf_ namespace	2026-04-15 15:51:38 +02:00
undo	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00
update	fix(security): activate auth middleware and harden shutdown/update routes (#4023)	2026-04-13 07:52:43 -04:00
visualizer	feat(web): browser-based web interface (#1717)	2026-03-21 12:16:54 -06:00