The UI was uneven: the home page looked finished, but app pages used three
different display typefaces, the anonymize flow changed frame between steps,
and the dashboard, explorer and admin screens each had their own controls,
status colours and edge-case handling.
Make every screen follow one system: shared page header, grid, buttons,
filters and status colours; a repository picker and step trail on anonymize;
a "What reviewers will see" preview of the actual reviewer page; consistent
file headers and viewers for every file type; truthful admin charts and
tables. Fold the accumulated override blocks back into style.css (22%
smaller, no visual change).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Anonymize preview renders redactions as the viewer's numbered slots
- Code-block slots keep the width of XXXX-n and sit on the text line
- README no longer overflows on phones (grid forced two columns)
- Status bar always hides under the file header: no second Files button
or breadcrumb on repos with a website or for owners; Open website and
Edit anonymization move to the file menu
- Loading state no longer repeats the path visually
- Phone usage popover opens inside the screen
- Home closing band: no double divider, tighter gap above the footer
- File drawer closes after opening a file on phones
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Phone viewer: Contents menu for README headings, theme toggle in the header,
GitHub icon on sign-in, 12px Ace font
- File ⋯ menu: file details line, Find for HTML, View raw, Download ZIP,
Copy file path
- Redaction slots inside highlighted code blocks; fix regex lastIndex reuse
in the redaction walker
- Landing and FAQ copy: plainer headings, trust items, closing CTA band
- Explorer ZIP button label, snapshot text cleanup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Backend, scripts, docs and their tests take main's newer code where both
sides changed the same lines (the shared blob cache, GitHubStream and
markdown fixes landed on main after the Go migration branch was cut).
The Dockerfile keeps the Go build from the migration, plus main's
owner-alert-protocol label; .gitignore keeps both sides' entries.
Frontend keeps the redesign and folds in main's features: Stripe billing
in the New anonymization submit bar, GitHub access repair, redaction
syntax help, the preview expand toggle, configurable redaction mask,
folder counts, reviewer-route header rules, link expiry (now in the
viewer's snapshot details) and the explorer error card. main's
narrow-only wrap logic is dropped because the redesign wraps on desktop
and scrolls sideways on phones.
Tests: 1534 passing with SESSION_SECRET set (as in CI). Three main tests
were updated for the agreed viewer design (no site header in the viewer,
no repository-wide file count).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One-row phone toolbar, errors page opens on server errors, one-row submit
bar, publish warning after a source loads, three-column FAQ with a help
card, queue range control in the Throughput card, shared admin table cards,
dark-mode contrast and a stronger phone code scroll cue.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Viewer: full-height app bar with a Help menu, search + ZIP sidebar, one
toolbar for README and code, reading mode with a scroll-tracking outline,
docked find for Markdown and code, and redaction slots (a blank stone slot
holding the term number) in prose, headings, code, the tree and the path.
Landing and FAQ: live redaction demo, serif display headings, teal accent.
Author screens: My work table with copy/open/edit actions, a usage meter,
a single-container New anonymization flow with a sticky submit bar, themed
form controls, and consistent GitHub connection cards.
Admin: underline tabs, severity-first errors chart and list, error tiles
that filter (older pages load until matches appear), queue and overview
health states, and shared toolbar heights and borders.
Fixes: guarded localStorage access, failed README images render a
placeholder, phone hover states no longer stick, and UI tests updated for
the new copy and markup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Explorer: redacted terms are highlighted in Markdown and code, the
sidebar shows when the link expires, "Download repository" is the one
primary action, and signed-out reviewers get a header without Sign in
or the source-code link.
- Status: a ready anonymization leads with a copyable share link; the
support links sit flat inside their section.
- One primary colour (accent) for actions and progress; mono is kept for
IDs, hashes and paths; settings are plain sections instead of cards.
- Font sizes snap to one scale (10-40px); rem values keep following the
reader's browser font size.
- Ko-fi button uses a dark surface in dark mode instead of a white pill.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- File-level errors keep the breadcrumb and repository actions; only
repository-level failures (no file list) hide the bar.
- Code wrapping follows the viewport when it crosses 992px.
- Settings and FAQ tables of contents stack at the same breakpoint as
their grids, so they no longer stay sticky over stacked content.
- The sign-in page keeps its 480px cap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Explorer: 13px code, page-coloured dark editor, padded Markdown with a
readable width, full repository ID on hover, sidebar footer kept clear
of the floating Ko-fi button.
- Explorer errors render as a card with links home and to the FAQ; the
empty action bar and Raw/Download buttons are hidden.
- Unknown error codes show the generic message instead of the raw
ERRORS.<code> key.
- All app pages share one content column; New anonymization starts at
the top instead of floating mid-screen.
- Status page: spaced action buttons, aligned status pill, no second
Ko-fi embed under the support cards.
- Claim placeholders; consistent notebook option on new conferences.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: anonymize Windows batch scripts (#735)
mime-types maps .bat to application/x-msdownload, the same MIME type as
.exe/.dll, so batch scripts were classified as binary and streamed
through without any anonymization. Special-case .bat/.cmd as text before
the MIME lookup, keeping .exe/.dll binary.
* fix: recover files missing from truncated tree listings (#738)
GitHub truncates tree listings of very large repositories. Folders whose
listing was truncated are recorded in truncatedFolders, but files that
fell outside the listing never reached the database, so requesting them
returned 404 file_not_found even though they exist on GitHub — and a
force refresh could not help.
When a file lookup misses and its directory is under a truncated folder,
fetch the file metadata directly from GitHub's contents API (object
media type, so it works past the 1MB inline limit), cache it in the
database, and serve it normally.
* feat: warn when a repository uses git submodules (#737)
GitHub archives and tree listings never include submodule contents, so
submodules end up as empty folders in the anonymized repository, which
surprises users. Detect a root .gitmodules file and show a warning
banner in the explorer explaining that submodule contents are not
included.
* feat: allow users to delete their account (#741)
Add DELETE /api/user: removes all anonymized repositories, gists, and
pull requests owned by the user, best-effort revokes the GitHub OAuth
grant, and scrubs personal data (username, emails, tokens, GitHub id,
photo) from the user record. The record itself is kept with a
placeholder username so removed repoIds stay reserved and owner
references remain resolvable.
The settings page gains an Account section with a confirmed delete
button.
* fix: add missing error translations for token_expired and job_is_active
The error-code coverage test failed because both backend codes had no
frontend translation.
* security: harden against XSS, ReDoS, path traversal, and injection
Defensive fixes across the server, storage, and viewer:
- XSS (CWE-79): sanitise rendered notebooks with DOMPurify, escape file
names interpolated into AngularJS expressions (escapeNgString), set
Mermaid securityLevel to 'strict', and stop urlRel2abs from returning
javascript:/vbscript:/data:text/html URLs.
- Path traversal / zip-slip (CWE-22/23/24): validate URL-derived path
components before they reach the storage layer (file/webview routes +
StorageBase.assertSafePath) and sanitise zip entry names on extract for
both the filesystem and S3 backends.
- ReDoS (CWE-1333): escape anonymization terms with catastrophic
backtracking shapes to literals instead of compiling them as regexes.
- Secret hardening (CWE-798): require SESSION_SECRET / OAuth creds / DB
password in production, random dev SESSION_SECRET fallback.
- Rate-limit spoofing (CWE-290): derive request.ip via trust-proxy hop
count instead of the client-settable cf-connecting-ip header.
- NoSQL injection (CWE-943): allow only plain field paths as admin sort keys.
- Reject malformed streamer requests missing required string fields.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(ui): make gists reachable/visible and clarify the ZIP button
- Gist & PR routes now accept a trailing slash (/gist/:id/:path*?), so the
dashboard links (which end in "/") resolve to the gist/PR page instead of
falling through to the 404 route (#725).
- Gist viewer picks the default tab after content loads, defaulting to
"files" when files exist; previously the ng-init ran before the async
load and a files-only gist rendered blank under the hidden comments tab.
- Explorer toolbar: relabel ZIP to "Full repo ZIP" with a tooltip, and add
tooltips to Raw/Download clarifying they apply to the current file (#721).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: report SAML-enforced orgs clearly instead of "token expired"
When a repo's organization enforces SAML SSO, GitHub returns a 403 whose
message differs from the OAuth-App-restriction case. That 403 fell through
to the generic handler and surfaced as "token_expired", pushing users to
re-login when the real fix is authorizing their token for the org. Detect
the "SAML enforcement" message and raise a dedicated, actionable error
instead (#379, #550).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* security: catch nested quantified groups in ReDoS guard and backslash path traversal
- hasCatastrophicBacktracking now scans across nested parens ([\s\S]*?)
so shapes like ((a+))+ are detected; comment reframed as a heuristic
backstop rather than a proof.
- file route path-traversal check now rejects backslash separators and a
leading backslash, covering Windows-style "..\" payloads (CWE-22/25).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore(dev): track dev-proxy script, ignore .DS_Store and .claude/
scripts/dev-proxy.js is referenced by the "dev:ui" npm script but was
never committed, breaking the command on a fresh clone. Add it and
ignore local-only macOS/Claude Code files.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
