Jenny Ferries 0612442158 daily-focus-board: reject inherited-property-name task ids (prototype safety) ...

Resolves the Copilot review on board-core.mjs: task ids like `toString` /
`constructor` passed validId and, used as object keys, could resolve to
Object.prototype members. Now validId also rejects any inherited name (`s in {}`),
and the progress maps (counters, t) are null-prototype so a task id can never
resolve to an inherited member. (`__proto__` was already blocked by the id grammar.)

Headless test 43/43 (adds inherited-name rejection, drop-on-normalize, and an
Object.prototype-intact check).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cb356aa8-0af2-48f3-b3c6-8086c69d5308

2026-07-29 08:59:31 -07:00

..

.github/plugin

ember: add daily-focus-board canvas extension

2026-07-28 11:39:21 -07:00

assets

daily-focus-board: harden canvas (DNS-rebind, XSS, destructive write) + skill a11y

2026-07-28 20:50:59 -07:00

board-core.mjs

daily-focus-board: reject inherited-property-name task ids (prototype safety)

2026-07-29 08:59:31 -07:00

extension.mjs

daily-focus-board: explicit op results + date-scoped default state file

2026-07-29 08:16:58 -07:00

package.json

ember: add daily-focus-board canvas extension

2026-07-28 11:39:21 -07:00