mirror of
https://github.com/saphid/frame-control.git
synced 2026-10-25 17:01:38 +01:00
saphidandClaude Opus 5.5
2d63dacdf9
- Storage downloads no longer go through a "any host name" redirect policy. _web.public_apk resolves each hop, refuses loopback, private, link-local, shared, reserved and multicast addresses (odd IPv4 spellings and IPv4 mapped into IPv6 included), connects to the checked address, and checks again on every redirect. No credentials are sent there. _web.ANY and the extra open_url/apk parameters are gone; _web.apk's streaming is shared as save_apk. - api.itch.io redirects are no longer followed with the key: the download step reads a 30x Location, a JSON body's url, or takes the file itself, since the live response is unverified. - Error text loses the key, and any start of it from 8 characters, before joining and truncating. - Saving and deleting the key are serialised; a connect whose /profile check finishes after a disconnect (or another connect) does not save. The key file is written through a unique mkstemp file. - 401/403 from api.itch.io deletes the key only once /profile confirms the key itself is refused, including at download time with cached metadata. Storage-host 403s are download errors, not rate limits. - Docs list which parts are verified against the public reference and which are assumed or unknown without a live account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>