Permit Radar

repo: ~/Projects/permit-radar · 14 commits · 0 in last 24h, 0 in last 7d ·

Search the build

14 commits indexed

  1. f6cdd9b 2026-08-31 fail-open guardrail: warn at boot when admin auth is unconfigured (TK-10984 opt-A)
  2. 04e7eeb 2026-08-30 add creds-in-URL fetch guard to gated pages (TK-10984)
  3. c3b0ab2 2026-08-25 creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)
  4. d596a1b 2026-08-01 permit-radar: adopt href-to-deeper-data primitives (TK-10093)
  5. fdc840b 2026-07-16 shopify: refresh catalog — keep sample-only as 'by request'
  6. 12a1e8e 2026-07-16 cross-sell strip: use price_display + product_url, prefer buyable products
  7. ed3fea7 2026-07-16 shopify: refresh catalog — real roll prices, no $4.25 sample-only leak
  8. 994b444 2026-07-16 auto-save: 2026-07-16T08:12:03 (1 files) — data/shopify-catalog.json
  9. 633acd7 2026-07-16 security: bind server to 127.0.0.1 so the tunnel/proxy basic-auth gate can't be bypassed on the LAN
  10. b1dbc23 2026-07-16 auto-save: 2026-07-16T07:41:55 (1 files) — data/subscribers.json
  11. e1e9ff1 2026-07-16 feat: add DW cross-sell strip to index + permit detail pages (links only, no checkout)
  12. 591ba0d 2026-07-16 feat: copy shopify-catalog.json + add /api/shopify-crosssell read-only endpoint
  13. de185e8 2026-07-15 permit-radar: full permit directory + lead funnel + admin — working prototype
  14. f1fb193 2026-07-15 initial scaffold (permit-radar) via web-dev accelerator

Authors

Agents used

  • none detected

Skills used

  • /shopify-crosssell2
  • /shopify-catalog1
  • /proxy1
  • /subscribers1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

c3b0ab2 · 2026-08-25 · creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap) 
Fleet inoculation — opening this basic-auth app with credentials in the URL
poisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves
non-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
12a1e8e · 2026-07-16 · cross-sell strip: use price_display + product_url, prefer buyable products 
- /api/shopify-crosssell now returns price_display (pre-formatted string),
  sample_only, and product_url for each pick instead of raw numeric price
- Pool is filtered to buyable products first (167 available >> 6 needed),
  so "Roll price on request" cards are suppressed in normal operation
- Frontend uses esc(p.price_display) — no manual \$+toFixed() formatting,
  eliminates any \$null/\$NaN risk

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

File tree

13 files tracked. Click any to browse the source at HEAD.

Other build journals

← Penrose Designs  ·  all 4 projects  ·  Petitionyour →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 1ms