2 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Sonnet 5.5	da860e2dae	sitesmith cleaner: drop images.pexels.com from the AI image host allow-list ... Stock photos are imported into the site's assets, never hotlinked, so the only external image host model output may use is placehold.co. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXgk6UunFCKyXqLe2Cq	2026-11-02 10:15:04 -08:00
shadowdaoandClaude Opus 5.5	465cf17bb0	Sitesmith: self-review render via review_render_upload; one-line-per-node summaries; real-browser check of cleaned output ... - The render is uploaded with the new review_render_upload action (backend kind review_render, the only image a review job accepts); mocks follow. - summarizeCanvas() never lets a newline or a quote into a node line (the server validates review summaries line by line); test. - test:browser:sitesmith-cleaned (Firefox + Chromium): a page published from a cleaned ordinary Sitesmith response requests nothing outside the allow-listed hosts (own assets, fonts, Font Awesome CDN, images.pexels.com, placehold.co) and has no inline handlers or javascript:/data: URL attributes; the same response uncleaned is the control (requests example.com). All requests are answered or aborted locally. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 11:47:04 -08:00