feat: Claude CLI 2.1.50–2.1.53 audit #171

Merged
naomi merged 12 commits from feat/audit into main 2026-02-25 22:55:47 -08:00

12 Commits

Author SHA1 Message Date
hikari 8a7dbb16bd chore: bump supported CLI version to 2.1.53
Security Scan and Upload / Security & DefectDojo Upload (pull_request) Successful in 1m8s
CI / Lint & Test (pull_request) Successful in 19m5s
CI / Build Linux (pull_request) Successful in 24m15s
CI / Build Windows (cross-compile) (pull_request) Successful in 33m55s
2026-02-25 21:59:46 -08:00
hikari 11c0b0f2df chore: update dependencies and suppress build warnings
Security Scan and Upload / Security & DefectDojo Upload (pull_request) Successful in 58s
CI / Lint & Test (pull_request) Successful in 18m13s
CI / Build Linux (pull_request) Successful in 22m37s
CI / Build Windows (cross-compile) (pull_request) Successful in 35m57s
2026-02-25 21:56:29 -08:00
hikari 85520bdea6 chore: clean up build warnings in frontend components
- Remove unused .animate-spin CSS from PluginManagementPanel and McpManagementPanel
- Replace deprecated <svelte:component> with Svelte 5 dynamic component syntax
- Add for/id associations to MCP add-server form labels
- Change display-only <label> elements in MCP details panel to <p>
- Add missing a11y_click_events_have_key_events suppression to overlay divs
- Add onwarn filter to svelte.config.js for intentional patterns
2026-02-25 20:55:29 -08:00
hikari dfe98be117 chore: verify stream-json handles 50K tool result threshold (#162)
Add explicit tests documenting that the parser gracefully handles both
large inline tool results (>50K chars) and null content from persisted
results introduced in Claude CLI v2.1.51.
2026-02-25 20:32:26 -08:00
hikari 2b371bf9af fix: initialise unread counts on mount to prevent false unread dots (#164) 2026-02-25 20:24:18 -08:00
hikari dbf5234a42 fix: watchdog for hung wsl bridge process (#166)
Adds a 60-second watchdog that silently kills the Claude Code process if
system:init never arrives, preventing the UI from being stuck in a
"Connected" state indefinitely. Refactors process handle to
Arc<Mutex<Option<Child>>> for cross-thread access, and removes the
unused CommandExt import.
2026-02-25 20:06:18 -08:00
hikari dfc3d71c42 fix: suppress terminal window flash on Windows for all subprocesses (#165) 2026-02-25 19:02:39 -08:00
hikari 5fb3f1a44b fix: escape raw HTML in markdown renderer (#169)
Prevents HTML tags from being rendered as live DOM elements in terminal
output. Overrides the marked codespan and html renderers to escape < and >
before inserting into the output HTML.
2026-02-25 18:29:59 -08:00
hikari d3ee1c644f feat: draggable tab reordering (#168)
Adds HTML5 drag-and-drop support to conversation tabs, allowing users to
reorder tabs by dragging. Visual feedback via opacity and border highlight.
Keyboard navigation (Ctrl+Tab) respects custom tab order.
2026-02-25 17:46:18 -08:00
hikari f57397a6c0 feat: custom background image with opacity control 2026-02-25 15:49:42 -08:00
hikari e8cbe9f647 feat: expose org UUID from claude auth status 2026-02-25 14:49:49 -08:00
hikari 9890b83313 feat: workspace trust gate with persistent trust decisions
Adds a pre-connection trust check that detects hooks, MCP servers, and
custom slash commands in a workspace's .claude/ config before launching
Claude Code. Shows a trust modal (permission sprite) listing all concerns
by category. Trusted workspaces are persisted to config so the user is
only prompted once per workspace path.

Closes #163
2026-02-25 13:39:34 -08:00