Eric WagonerandClaude Fable 5 e83d70116f Room ids pass a strict alphabet before touching the filesystem ...

The lazy room wake handed caller-supplied ids to fileFor; an 8-char
traversal like '../../aa' fit through the length trim. Only [A-Z0-9]
codes reach disk now — reads refuse quietly, server-minted writes
fail loud.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RCWSTnb1KYTPyL4GmhGnF

2026-08-30 13:48:34 -04:00

..

engine

The ward's bite gets its name, and shrink slips past the giant

2026-08-29 23:36:13 -04:00

server

Room ids pass a strict alphabet before touching the filesystem

2026-08-30 13:48:34 -04:00

web

The left-hand hand deals into two columns and the map takes the height

2026-08-29 23:36:13 -04:00