Claude 48ff7d3094 fix(security): harden web admin static serving and API responses ...

- Mask bridge token in /api/v1/status (return token_set bool instead
  of the raw secret to avoid credential leakage)
- Add path traversal guard in withStaticFallback to ensure resolved
  file paths stay within the webDistDir boundary
- Stop stripping zero-value TOML lines in formatTOML — values like
  `quiet = false` or `port = 0` may be intentionally set by the user

2026-03-30 13:56:01 +08:00

..

config_test.go

feat(web): add work_dir/agent_type to project creation and expand settings

2026-03-27 10:43:07 +08:00

config.go

fix(security): harden web admin static serving and API responses

2026-03-30 13:56:01 +08:00