#009: html_fragment's content-shape check is substring-based, so it can false-positive on inert text inside <script>/<pre> (e.g. a JS string literal that happens to contain "<html>"). Documented as a known limitation in docs/api.md rather than implementing real HTML parsing - a proper fix is a much bigger change than the narrow trigger justifies, and substring matching is the same approach the client helper already uses. #011: added a curated CDN Snippets section to SKILL.md for html_full (Tailwind, Chart.js, with an offline/air-gapped caveat), scoped explicitly to that kind only. Fixed daybook_post.py's --theme help text, which named a non-existent "bootstrap" theme (written ahead of a vendored-Bootstrap feature that was planned but never built, not a typo). Also updated SKILL.md's kind cheat sheet, which never mentioned the json/csv kinds and still pointed at the old --as-markdown workaround for them - and filed issue #012 for a real gap that surfaced doing so: the posting script itself doesn't support --kind json/csv yet, only the raw API does. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 001-csrf-behind-reverse-proxy.md | ||
| 002-env-example-not-actually-loaded.md | ||
| 003-model-max-length-silently-unenforced.md | ||
| 004-html-fragment-content-not-validated-server-side.md | ||
| 005-patch-silently-mishandles-invalid-input.md | ||
| 006-failed-post-still-evicts-artifacts.md | ||
| 007-handover-to-llm-test-2026-09-02.md | ||
| 008-source-fields-untyped-and-mangled.md | ||
| 009-content-shape-check-false-positive-in-script-strings.md | ||
| 010-concurrent-posts-race-past-quota.md | ||
| 011-vetted-cdn-snippets-for-html-full.md | ||
| 012-posting-script-missing-json-csv-support.md | ||
| README.md | ||
Issues
One file per issue: NNN-short-slug.md, numbered sequentially. Each file
has a title, status (Open / Fixed / By design), description, and resolution
once closed.