4 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	b2ecda9896	fix(security): safe links and security headers (FLAW-28, FLAW-29) ... safeHref lets only http, https and mailto become links (Markdown viewer, outliner, legal links); javascript: and friends show as text. A middleware sets a Content-Security-Policy (scripts only from MindSift, no framing, connections only to this server), X-Frame-Options, nosniff, Referrer-Policy and a Permissions-Policy. The two inline scripts of index.html moved to files so script-src stays 'self'. The second inline script also deleted every cache on each page load, which undermined the offline start; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 19:02:13 +01:00
sandrodachandClaude Sonnet 5.5	c7e05b385c	feat(workspace): merge bullet on Backspace, render hashtags inline ... - Backspace at the start of a non-empty bullet appends its text to the previous visible bullet (skipped for blocks with children and for code/divider/table/progress blocks). - Hashtags are rendered inline as clickable chips instead of a badge row below the text, so lines no longer grow taller. - Targeted/highlighted bullets use a neutral background instead of accent. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-28 08:31:25 +01:00
sandrodach	554029a099	fix(workspace): group text and code blocks cleanly under headings on paste	2026-10-27 21:40:51 +01:00
sandrodach	d39d1d1122	feat: complete workspace, triage, outliner and sharing overhaul (tasks 1-26)	2026-10-27 19:46:46 +01:00