4 Commits

Include renames

Author	SHA1	Message	Date
sneak	537374e4cc	Deploy main eacf1e7 to prod ... Replaces #559, which conflicted. Model: opus-5-5	2026-10-25 01:55:36 +00:00
clawbot	5fda446c71	Name a deleted target on its historical deliveries (closes #211)	2026-08-24 02:03:23 +02:00
clawbot	9ae19159a3	Mask the http target's destination URL in the UI (closes #115) ... The http target's destination URL can itself be a bearer credential, and the source detail page rendered it in full. Render it through the existing MaskURL instead, matching the rule already applied to slack targets. Independently reviewed: mutation-verified (reverting to the raw value fails the absence assertions, not merely the masked-form ones), MaskURL probed against userinfo, query, fragment, port, IPv6 literal and non-http schemes, and every sibling path that surfaces target data re-walked and found clean.	2026-08-17 22:50:26 +02:00
clawbot	15a61173fc	Mask target config on the source detail page (closes #113) ... The page rendered the stored target config verbatim, exposing the Slack incoming-webhook URL, which is a bearer credential: anyone holding it can post to the channel indefinitely, and it cannot be scoped or revoked per-holder. Target config now reaches the template only as a TargetView carrying labelled fields, so no code path can render the raw blob. maskURL keeps scheme and host and elides the path, and drops query, fragment and userinfo; every parse failure yields a neutral placeholder rather than falling back to the stored string. HTTP header values are never rendered, only a count. Rendering change only: the stored config format and the delivery path are unchanged.	2026-08-11 14:37:09 +02:00