Eric WagonerandClaude Fable 5 e83d70116f Room ids pass a strict alphabet before touching the filesystem ...

The lazy room wake handed caller-supplied ids to fileFor; an 8-char
traversal like '../../aa' fit through the length trim. Only [A-Z0-9]
codes reach disk now — reads refuse quietly, server-minted writes
fail loud.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RCWSTnb1KYTPyL4GmhGnF

2026-08-30 13:48:34 -04:00

..

src

Room ids pass a strict alphabet before touching the filesystem

2026-08-30 13:48:34 -04:00

package.json

Credibility pass: one voice, no scars

2026-08-16 11:56:55 -04:00

tsconfig.json

Scaffold monorepo: engine, server, and web packages

2026-08-15 18:20:16 -04:00