Claude c0d785967b Resolve remaining Codacy findings in settings search ...

- Validate plugin ids against a strict allowlist (mirroring the server's
  _SAFE_PLUGIN_ID_RE) before they can appear in a fetch path, so the request
  URL is never built from unvalidated input (Codacy: user-controlled URL).
- Document that the fetched HTML is parsed into an inert document (scripts
  never run, never inserted into the live DOM) purely to read field text for
  the search index.
- Declare block-scoped locals with const instead of var where they were
  nested inside conditionals (Codacy: var not at function root).

No behavior change; re-verified with ESLint and the headless-Chromium test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gZxznuxw8L92FUMBN3Nqz

2026-07-08 15:40:22 +00:00

..

js

Resolve remaining Codacy findings in settings search

2026-07-08 15:40:22 +00:00

app.css

Add settings tooltips and search to the web UI

2026-07-08 15:01:19 +00:00

app.js

fix(web-ui): support multiple browser tabs via SSE broadcaster (#349)

2026-05-25 14:37:03 -04:00

plugins_manager.js

feat(ui): add reusable json-file-manager widget (#352)

2026-05-26 15:46:38 -04:00