- Browser can record entries (e.g. meter readings) into session.md/jsonl;
broadcast to other open clients. Log feed renders as text, not HTML.
- Page loads state.json on open instead of only localStorage, so a new
device (or one that missed the WS push) shows current content.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The LAN-bound HTTP server joined the raw URL path onto the project dir,
so /../../.ssh/id_ed25519 (and %2e%2e variants) served any file the
user could read. Resolve and require the path stay inside the project.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Mortdecai