Haileyesus bacca8d62b fix(security): centralize safe frontmatter parsing ...

Move frontmatter parsing into server/shared/frontmatter.ts so every backend caller
uses the same gray-matter configuration instead of importing gray-matter directly.

The goal is to keep executable JS and JSON frontmatter engines disabled for
all markdown discovered from the filesystem, not only command routes.

Provider skills and shared skill metadata now go through parseFrontMatter too.
That closes the gap where plugin or provider markdown could regain default
gray-matter behavior simply because it lived outside the original command path.

Classify the new parser in backend boundaries so modules can depend on the
safe shared API without reaching into legacy utility paths.

2026-05-12 20:05:52 +03:00

..

claude-auth.provider.ts

Fix New session issues and websocket issues (#738)

2026-05-04 13:54:07 +03:00

claude-mcp.provider.ts

Refactor provider runtimes for sessions, auth, and MCP management (#666)

2026-04-21 14:38:51 +02:00

claude-session-synchronizer.provider.ts

Fix/websocket streaming issues (#748)

2026-05-08 22:51:03 +03:00

claude-sessions.provider.ts

Fix/websocket streaming issues (#748)

2026-05-08 22:51:03 +03:00

claude-skills.provider.ts

fix(security): centralize safe frontmatter parsing

2026-05-12 20:05:52 +03:00

claude.provider.ts

feat(providers): surface skills in slash command menu

2026-05-11 18:05:24 +03:00