l0ng-ai 757412cb73 fix(security): reach content roots in plugin quick fixes and keep diagrams local ...

- A plugin quick fix may change or open files in the project's content
  roots (a project window group's members, extra Project Structure
  folders), still never git's own files; before, it was disabled for
  every file outside the primary root.
- `git init` (New Project › Create Git repository) uses the configured
  git executable again.
- Mermaid output is cleaned before it is shown: remote image sources,
  external `url()`, `@import` and address strings in its CSS are
  removed, so `style`/`classDef` values and HTML labels fetch nothing.
- The reply image e2e test loads a web image only after its button is
  clicked; the post-checkout hook test runs in a trusted scope.
- Capability docs list `project.write` as high risk.

2026-11-11 22:18:48 +08:00

..

en

fix(security): reach content roots in plugin quick fixes and keep diagrams local

2026-11-11 22:18:48 +08:00

logo

docs: add the Mintlify documentation site (#2528)

2026-11-10 21:06:30 +08:00

zh

fix(security): reach content roots in plugin quick fixes and keep diagrams local

2026-11-11 22:18:48 +08:00

docs.json

docs: add the Mintlify documentation site (#2528)

2026-11-10 21:06:30 +08:00

favicon.svg

docs: add the Mintlify documentation site (#2528)

2026-11-10 21:06:30 +08:00