kepr / e660eac9e17a

never serve .kohignore/.agent via steal, load, or manifest viewer (v1.55.34) The web UI already filtered ignored paths through manifest.parse, but the snapshot/steal endpoint served the raw on-disk manifest verbatim — and koh stores .kohignore inline (<512B) — so koh load/steal handed it back, leaking private ignore rules. New manifest.filterRawManifest strips .kohignore/.agent from a stored manifest's files[] and re-serializes via std.json.Value; returns null when nothing is dropped so clean manifests stay byte-exact (koh checksum intact). Safe because koh trusts manifest.id on load (no checksum re-verify), so it also cleans existing repos with no re-offer. Wired into read.handleSnapshot + collectObjects (now via manifest.parse), ops saveManifest viewer, and diff_render prior-manifest parse. Adds a filterRawManifest round-trip test.

dev · 13 weeks ago · 2026-06-11 · 13.9 MB

session: kohignore privacy in snapshots · agent: claude-opus-4-8

parent: 2ed25e2977ec