2 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	f3119e3dc2	fix(security): validate avatar-decoration slugs from remote profiles ... The MSC4133 io.lotus.avatar_decoration value was interpolated into the CDN URL verbatim, letting a room member steer the path/query of a request every viewer's browser makes. Accept only slugs present in the catalog; anything else is treated as no decoration. Unit-tested. Fixes #64 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 14:48:35 -04:00
jaredandClaude Opus 4.8	6e59395fb8	test: lotus decorations, call caps, crypto, featureCheck, typing, markdown (+34) ... Subagent batch (no bugs found) + markdown: - lotus/avatarDecorations (8): decorationUrl, CDN shape, ALL_DECORATIONS flattening, data invariants (unique category ids + slugs, slug charset). - plugins/call/utils (7): getCallCapabilities — static caps + room/user/device scoped state-keys. - utils/matrix-crypto (3): verifiedDevice via a stubbed CryptoApi. - utils/featureCheck (3): checkIndexedDBSupport success/error/throw paths. - state/typingMembers (8): add/dedup-by-latest-ts/per-room-scope/delete reducer via a jotai store (enableMapSet, mirroring app startup). - plugins/markdown/utils (5): inline + block escape/unescape round-trips. Full suite now 231 tests, all passing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 14:32:53 -04:00