Skip to content

Consolidate Classic into Ledger and protect drafts and local APIs - #262

Merged
Coding-Dev-Tools merged 202 commits into
codex/dashboard-local-audit-20261011from
ui/ledger-only
Oct 17, 2026
Merged

Coding-Dev-Tools merged 202 commits into
codex/dashboard-local-audit-20261011from
ui/ledger-only

Conversation

@Coding-Dev-Tools

@Coding-Dev-Tools Coding-Dev-Tools commented Oct 12, 2026 •

Copy link
Copy Markdown
Owner

Consolidates Classic capabilities into Ledger, redirects /classic, protects hidden drafts across refreshes and workspace changes, and enforces complete browser origins for token-free local APIs. Timeline filtering precedes limits and follows world/system time. This PR follows #261 and includes the verified #260/#261 fixes.

Community legend names and colors now remain stable when filtering changes their visible rank. Relation pagination focuses the first newly revealed row, including the final partial page. Existing draft, scope, temporal, CSP and origin review safeguards remain covered.

Validation: 95 focused graph, polling, spec API, evidence, MCP and skill tests; 13 documentation/distribution tests; the new relation-pagination Chromium regression; Ruff. Fresh immutable evidence, SVG/PNG provenance and README source links match this branch. Remote CI validates the complete matrix at the pushed head.

dependabot Bot and others added 6 commits October 9, 2026 19:29
---
updated-dependencies:
- dependency-name: openai-codex
  dependency-version: 0.160.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases)
- [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md)
- [Commits](xberg-io/tree-sitter-language-pack@v1.20.0...v1.21.0)

---
updated-dependencies:
- dependency-name: tree-sitter-language-pack
  dependency-version: 1.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.2 to 0.24.3.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@3ad7283...66cbf4b)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.24.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
The dashboard now has one interface. Each capability Classic had was rebuilt
into the Ledger view where people look for it, then Classic was removed:

- Library: Markdown rendering (DOM-only renderer, never parses HTML) with a
  Write/Preview editor, unsaved-changes guard and Ctrl/Cmd+S; word-level
  history diffs; per-memory audit trail; drag and Alt+Arrow ordering; one
  Import menu (Quick import of files, folders or a server path, document
  import, code indexing and PostgreSQL schema import).
- Ask: per-result retrieval scores. Home: memory health and the selected
  project's last-session handoff (GET /api/proactive gains `repo`).
- Explore: colour by cluster, type or connections, palettes, editable type
  colours, a legend, an entity and relation explorer, keyboard navigation.
- Activity: bi-temporal Timeline cards with a superseded-only filter
  (replacing the Supersessions tab), receipt-chain status, packed-context
  accounting.
- Settings: workspace Describe, Copy, Merge, Export and Delete; plan status
  and plan-aware hosted messages; automation run status and proposals.
- Everywhere: connection and semantic-search banners, an accessible in-page
  dialog instead of native confirm/prompt, Solarized and Sepia themes.

Removed: engraphis/classic_assets, the duplicate engraphis/static tree, the
dashboard switcher, the graph compat adapter, and the Marked and DOMPurify
copies. /classic redirects to /. Shipped dashboard assets drop from 3.51 MB
in three trees to 1.85 MB in one.

Hardening found on the way: the zero-config API refuses requests a browser
marks as cross-site unless they passed a CORS preflight; the Markdown
renderer is linear on adversarial input; dialogs drop bidi controls; secure
erase sends its required confirmation; a stalled graph download no longer
blocks Reload; the CSP release gate covers Ledger and every first-party
script. Tests, docs, packaging and the public offline evidence artifact are
updated to match (fixture results unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRXYjdLRbDr9oEUU4qdZ2m
Without ENGRAPHIS_API_TOKEN the dashboard trusts loopback peers. A website
that points its own name at 127.0.0.1 (DNS rebinding) becomes same-origin
with that name, so its requests came from a loopback peer, passed every
Origin check and could read or write the whole /api surface.

- The zero-config gate now also checks Host: it accepts exactly
  `localhost`, IP literals (an address cannot be rebound), the bind host,
  the ENGRAPHIS_DASHBOARD_URL host and the new ENGRAPHIS_ALLOWED_HOSTS
  names. `localhost.` and `*.localhost` are refused because some resolvers
  send them to DNS. Token mode is unchanged.
- The check covers the `/dashboard/review` routes as well as `/api`; `/mcp`
  keeps the SDK's own Host allow-list.
- The read-only graph server (engraphis-graph-server) applies the same
  check when it runs without a token.
- The cross-site guard no longer lets a header vouch for another site's
  page: with ENGRAPHIS_CORS_ORIGINS=* any page could pass the preflight
  and send the dashboard's header.
- Ledger shows the server's reason when a request is refused instead of
  reporting the server as unreachable.

The helpers live in engraphis/netutil.py and are unit-tested; the public
offline evidence artifact is re-exported for the new sources (fixture
results unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRXYjdLRbDr9oEUU4qdZ2m
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-17T14:29:16.398783Z fa692a5 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Coding-Dev-Tools
Coding-Dev-Tools changed the base branch from main to codex/dashboard-local-audit-20261011 October 12, 2026 13:59

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 679dcbb1f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/ledger.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 22ce45e0da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/ledger.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1af2b2224

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/ledger.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f1f85a4925

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/ledger.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de8c168b95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/index.html Outdated
Comment thread engraphis/dashboard_assets/ledger.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 606d3e579b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_assets/engraphis-graph.js Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95999cb42e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/dashboard_app.py Outdated
Comment thread engraphis/routes/v2_api.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f07db1ff95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/core/store.py Outdated
Coding-Dev-Tools and others added 28 commits October 16, 2026 22:32
# Conflicts:
#	package.json
* fix(deps-dev): bump openai-codex from 0.159.0 to 0.160.1

---
updated-dependencies:
- dependency-name: openai-codex
  dependency-version: 0.160.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: address verified release audit findings

Validated local candidate: f9dabd9d69d779210ce83e919b410b1770505e43

- f9dabd9d69d779210ce83e919b410b1770505e43 fix(packaging): align MCP install paths with the patched SDK floor
- 24afc26e882c0f3fa5eab4b6e2b5294fe73bd4c6 fix(deps): require the patched MCP 1.30 transport

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…258)

* fix(deps-dev): bump tree-sitter-language-pack from 1.20.0 to 1.21.0

Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases)
- [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md)
- [Commits](xberg-io/tree-sitter-language-pack@v1.20.0...v1.21.0)

---
updated-dependencies:
- dependency-name: tree-sitter-language-pack
  dependency-version: 1.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Keep new benchmark campaigns on the updated tree-sitter grammars

* fix: address verified release audit findings

Validated local candidate: e142e3158e06c92c00253266120496d33d111a92

- e142e3158e06c92c00253266120496d33d111a92 fix(packaging): align MCP install paths with the patched SDK floor
- e5631206443c0d069d3e9114bccb87111b89d602 fix(deps): require the patched MCP 1.30 transport

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
* fix(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3

Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.2 to 0.24.3.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@3ad7283...66cbf4b)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.24.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* test(release): validate immutable SBOM action pins across upgrades

* fix: address verified release audit findings

Validated local candidate: 0e9f6f2599167a5f235b298d39c87182356156f5

- 0e9f6f2599167a5f235b298d39c87182356156f5 fix(packaging): align MCP install paths with the patched SDK floor
- 3207cfa5af1c7309407b8d63f9ca304113dfcd66 fix(deps): require the patched MCP 1.30 transport

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Coding-Dev-Tools <algorithmictradingsolutions@gmail.com>
….22,<0.18 (#264)

* fix(deps-dev): update ruff requirement

Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.22...0.17.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

* test(release): align ruff version bound assertion with <0.18

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.63.0 to 1.64.0.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [impeccable](https://github.com/pbakaus/impeccable) from 4.1.0 to 4.5.2.
- [Release notes](https://github.com/pbakaus/impeccable/releases)
- [Changelog](https://github.com/pbakaus/impeccable/blob/main/docs/RELEASE-4.4.0.md)
- [Commits](pbakaus/impeccable@cli-v4.1.0...cli-v4.5.2)

---
updated-dependencies:
- dependency-name: impeccable
  dependency-version: 4.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
@Coding-Dev-Tools
Coding-Dev-Tools merged commit fa692a5 into codex/dashboard-local-audit-20261011 Oct 17, 2026
57 checks passed

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa692a5a62

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread engraphis/factory.py
Comment on lines +166 to +169
if connect is None:
from engraphis.backends.encrypted_db import connector_from_env

connect = connector_from_env()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Close factory-created encryption connectors

When ENGRAPHIS_DB_KEY or ENGRAPHIS_DB_KEY_FILE is set and a caller uses the public engine factory directly, this branch creates an _EncryptedConnector, but the engine later adopts only the store and backend resources. Store.close() deliberately does not close injected connectors, so engine.close() leaves the connector's key-bearing _pragma resident as long as the closed engine/store is referenced; construction failures after opening the store leak it similarly. Track whether the factory created the connector and close it after the store, without taking ownership of caller-supplied connectors.

Useful? React with 👍 / 👎.

@@ -1893,7 +1898,9 @@ def timeline(q: str = Query(..., min_length=1, max_length=10_000),
raise _invalid_request() from None
logger.error("dashboard timeline failed (%s)", type(exc).__name__)
raise HTTPException(status_code=500, detail={"error": "internal server error"})
mems = _keyword_search(ws, q, limit)
mems = _keyword_search(ws, q, limit, include_invalid=True, closed_only=closed_only)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject unmatchable short timeline queries

When semantic retrieval falls back because of an embedder mismatch, a request such as closed_only=true&q=AI reaches _keyword_search(), whose predicate ignores every term of two characters or fewer. With no usable terms it applies no keyword condition at all, so this new closed-history path returns arbitrary superseded memories from the workspace as though they matched the topic. Match short terms safely or return no results when the query produces no lexical terms.

AGENTS.md reference: AGENTS.md:L175-L177

Useful? React with 👍 / 👎.

}
}
state.graphTypeColors = { ...state.graphTypeColors, [type]: color.toLowerCase() };
if (state.graphEngine) state.graphEngine.setTypeColor(type, color.toLowerCase());

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use the Every-renderer API for entity colors

In Every node mode, changing an entity-type color calls setTypeColor(), but that renderer exposes only the plural setTypeColors() API. The event handler therefore throws a TypeError; the selected color is not applied and the subsequent legend refresh and preference persistence are skipped. Use the shared bulk API here or add the singular method to the Every renderer.

Useful? React with 👍 / 👎.


function picked(input) {
const items = [...(input.files || [])].map(file => ({
file, name: file.webkitRelativePath || file.name,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Handle long relative paths per file during folder imports

When a selected folder contains one file whose ordinary relative path exceeds 200 characters, passing the full webkitRelativePath causes MemoryService.import_files() to reject that name before entering its per-file error handling. The resulting ValidationError aborts the entire Quick import instead of importing the remaining valid files and reporting the long path as skipped. Validate and report this case client-side, use a path-sized server bound, or move the validation into the per-file failure path.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants