Root cause: handleTeammatePermissionRequest was called from 3 paths
(early inbox scan, Category 4 relay scan, stdout/native) but only
the early scan checked processedPermissionRequestIds, causing
duplicate ToolApprovalRequests and extra permission_responses.
Fix:
- Move processedPermissionRequestIds check INTO handleTeammatePermissionRequest
so ALL callers are protected by the same dedup gate
- Remove duplicate Category 4 scan that re-processed inbox messages
(early scan already covers all messages including read=true)
- Category 4 now only builds a filter Set to exclude permission_request
from relay to lead
- markdownPlugins.ts: use dot notation for abbr attribute access
- useResizablePanel.ts: wrap ref.current assignments in useEffect
to comply with react-hooks/refs rule
The previous Object.fromEntries spread would silently overwrite the
custom abbr attribute list if rehype-sanitize adds abbr to its default
schema in a future version. Simplify to a direct merge.
Add rehype-sanitize to the markdown plugin chain to prevent XSS via
malicious HTML in rendered content. The rehype-raw plugin was passing
inline HTML through without sanitization, allowing script injection
through tags like <img onerror=...> or <script>.
The sanitization schema extends GitHub's default allowlist with additional
tags Claude commonly uses (mark, abbr, u, figure, figcaption) while
stripping all event handlers, scripts, and dangerous attributes.
Plugin order: rehype-raw → rehype-sanitize → rehype-highlight ensures
raw HTML is parsed, then cleaned, then syntax highlighting is applied.
- Updated notification configuration to separate settings for lead and user inbox messages, improving user control over notifications.
- Enhanced the handling of inbox message notifications to respect individual inbox settings.
- Introduced new IPC methods for managing watched directories, allowing for more granular file monitoring.
- Improved task management by implementing work intervals for task status transitions, ensuring accurate tracking of task progress.
- Added validation for task creation and configuration, ensuring proper input handling for project paths and task properties.
- Replaced local IPC channel constants in `index.ts` with imports from `@preload/constants/ipcChannels` for better consistency.
- Simplified the `leadRelayCapture` assignment in `TeamProvisioningService`.
- Updated markdown plugin imports across multiple components to use the new `REHYPE_PLUGINS` constant.
- Enhanced task status display logic in `TaskRow` for improved clarity.
- Adjusted CSS for better syntax highlighting in the editor.
