4grayandClaude Fable 5 b16ede9fbe refactor(pwa): make stalker cmd append visibly query-only for CodeQL ...

Rebuild the /stalker request URL through the URL object and concatenate
the encoded cmd strictly behind a literal '?', so static analysis can
see the tainted value never reaches host or path (js/request-forgery
alert on the previous separator ternary). Behavior unchanged; the
fragment/bare-'?' regression tests still pin the wire format.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-01 23:34:53 +02:00

..

electron-backend

fix(stalker): send cmd in the reference MAG wire format

2026-08-01 22:33:47 +02:00

electron-backend-e2e

fix(stalker): send cmd in the reference MAG wire format

2026-08-01 22:33:47 +02:00

remote-control-web

test(perf): add production renderer benchmark build

2026-07-26 22:37:52 +02:00

stalker-mock-server

fix(stalker): send cmd in the reference MAG wire format

2026-08-01 22:33:47 +02:00

web

fix(ui): make the workspace usable on phone-sized screens (#1326)

2026-08-01 19:23:20 +02:00

web-backend

refactor(pwa): make stalker cmd append visibly query-only for CodeQL

2026-08-01 23:34:53 +02:00

web-e2e

test(e2e): pin the phone-layout invariants from #1326 (#1333)

2026-08-01 22:02:08 +02:00

website

feat(website): use full app screenshot for hero, drop mock window chrome

2026-07-05 23:13:06 +02:00

xtream-mock-server

test(stalker): enforce portal auth in the mock and cover the full-portal flow (#1324)

2026-08-01 21:52:09 +02:00