Abdul WahabandCursor a85017cd33 Fix: require session key and origin/host checks on serve-question POSTs (#555) ...

Unauthenticated POST /answer copied steer into the agent ANSWER line. The handler now requires the detached session key and rejects foreign Origin and Host.

Written with AI assistance under maintainer direction.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-28 05:35:47 +05:00

..

lib

Share doctor boot finding policy

2026-08-22 11:58:26 -07:00

live

Centralize framework detection probes

2026-08-20 11:38:20 -07:00

command-metadata.json

Refine product and visual work lifecycle

2026-07-17 16:10:13 -07:00

concept-seed.mjs

Build path becomes a config key existing projects can actually reach

2026-08-13 21:52:17 -04:00

context-signals.mjs

Reject empty critique metrics

2026-08-11 13:00:31 -04:00

context.mjs

Fix: drain context stdout before process.exit (#573)

2026-08-25 07:51:47 +05:00

critique-storage.mjs

Centralize critique snapshot reading (#511)

2026-08-05 15:27:02 -07:00

detect-csp.mjs

Refactor: cleaner top-level directory structure (#138)

2026-05-04 16:38:03 -07:00

detect.mjs

Improve critique skill reliability

2026-05-18 15:15:14 -07:00

doctor.mjs

Share doctor boot finding policy

2026-08-22 11:58:26 -07:00

embed-prompt.mjs

Fix: keep raster provenance through the finish-review fix loop (#588)

2026-08-14 13:51:03 -04:00

generate-image.mjs

Surface rounds deal three structures, draw wireframes, and anchor comps on a reference screenshot

2026-08-12 16:28:15 -04:00

hook-admin.mjs

Remove stale Claude MultiEdit matcher

2026-08-19 09:28:28 -07:00

hook-before-edit.mjs

Denoise the design hook and let agents self-serve confident ignores (#508)

2026-08-11 13:42:39 -04:00

hook-lib.mjs

Merge origin/main into fix/603-codex-stop-payload

2026-08-24 07:25:47 +05:00

hook.mjs

Merge origin/main into fix/603-codex-stop-payload

2026-08-24 07:25:47 +05:00

live-accept.mjs

Simplify Svelte accept orchestration

2026-08-12 14:15:14 -04:00

live-browser-dom.js

Extract live browser DOM helpers (#239)

2026-06-09 23:10:10 +02:00

live-browser-session.js

Refactor: cleaner top-level directory structure (#138)

2026-05-04 16:38:03 -07:00

live-browser.js

Fix stalled Tune state without params

2026-08-20 09:18:33 -07:00

live-commit-manual-edits.mjs

Simplify manual Apply rollback flow

2026-08-18 11:33:07 -07:00

live-complete.mjs

Live v2: root manifest, mount-ack protocol, AST scaffolder, mechanical accept

2026-07-27 15:09:40 -07:00

live-copy-edit-agent.mjs

Bound copy-edit prompt context (#528)

2026-08-09 16:56:49 -07:00

live-discard-manual-edits.mjs

Organize skill script support modules

2026-06-08 16:58:55 -07:00

live-inject.mjs

fix: stop cross-project live session leakage and stale-adapter 401s

2026-07-28 17:38:46 -07:00

live-insert.mjs

Live v2: root manifest, mount-ack protocol, AST scaffolder, mechanical accept

2026-07-27 15:09:40 -07:00

live-manual-edit-evidence.mjs

Fix Live accept for Elixir templates in lib/ (#374)

2026-07-20 10:49:36 -07:00

live-poll.mjs

Fix: strip page-controlled poller fields before they reach the agent (#488)

2026-08-22 05:31:05 +05:00

live-resume.mjs

fix: fifth review round (durable mount failures, {#key} hydration slots)

2026-07-27 16:33:34 -07:00

live-server.mjs

Merge pull request #631 from pbakaus/fix/488-strip-reserved-poll-fields

2026-08-24 04:32:49 +05:00

live-status.mjs

Live v2: root manifest, mount-ack protocol, AST scaffolder, mechanical accept

2026-07-27 15:09:40 -07:00

live-target.mjs

Add monorepo context support (#213)

2026-06-20 19:49:37 +09:00

live-wrap.mjs

fix: preview-truth CSS supersession + cascade ordering on Svelte accept

2026-07-27 18:45:07 -07:00

live.mjs

Fix #476: stop using JSON.stringify/double quotes as shell quoting in four exec sites (#533)

2026-08-08 18:43:17 -07:00

modern-screenshot.umd.js

Refactor: cleaner top-level directory structure (#138)

2026-05-04 16:38:03 -07:00

palette.mjs

a19: form dictates viewport geometry at life scale; cinematic/divergent/drenched in bounds; native motion once — probe-validated (batch7); delete seed-094 (Paul)

2026-07-14 07:57:58 -07:00

pin.mjs

Add Hermes Agent as a supported provider

2026-08-06 00:03:12 -07:00

serve-question.mjs

Fix: require session key and origin/host checks on serve-question POSTs (#555)

2026-08-28 05:35:47 +05:00

surface-brief.mjs

Refine product and visual work lifecycle

2026-07-17 16:10:13 -07:00