- I2: .wd-row now wraps and .wd-output takes the full row width, so streamed
output no longer gets crushed beside the button on the filename's line.
- I3: split .webinar-dash into token scope + a new .wd-bar toolbar above a
.wd-grid two-pane layout. Extracted renderAll (called from onload) which
renders a global "Sync coverage" button, generalised runIngest's subprocess
handling into a shared runClaude keyed by run id, and added spawnGate to
preflight-disable both the sync and per-file ingest buttons when claude
can't be spawned (no desktop Obsidian / no child_process). A successful
ingest or sync now re-renders the dashboard instead of requiring reopen.
- I6: the right pane now shows the tracked script path and last-synced date
from the coverage file's metadata, and flags when cfg.script disagrees
with it.
- Minors: documented the unescaped-pipe split regex, added role="img" to the
coverage meter alongside its aria-label.
spawn(..., { shell: true }) made Node concatenate argv without quoting;
cmd.exe re-tokenized it and the ingest prompt arrived as a bare "ingest"
with the filename silently discarded, while the run still reported
success. claude.exe is a real executable here, so no shell is needed:
drop shell: true and pass argv directly. isSafeFilename is unchanged
(still correct defence in depth) but its comment now reflects that the
spawn path carries no injection surface today.
Caret and control characters added to the filename guard, file-keyed in-flight
registry replacing the row-scoped one, try/catch around spawn, single finish()
exit path, UTF-8 chunk decoding, bounded output buffer.
index.md groups integration-dead-ends and leave-less-room-for-imagination
under Machine side, and both are absent from the script. The claim that every
absent concept is human-side or strategy-side was wrong: it is 8 of 10.
Corrections made during execution as reviews surfaced defects in the plan
itself: duplicate raw-path claim handling and its one-pass orphaned filter,
unescaped-pipe table split, RAW_EXTENSIONS widening, dark accent tracking the
installed theme, the bare node --test command, and test counts.
- readPipeline no longer filters raw/sources to .md only; CLAUDE.md
documents txt and pdf as valid raw source types, and hiding them from
the queue silently was the same invisibility bug the dashboard exists
to remove.
- Dark-mode accent now tracks the installed tesanti theme (same signal
red, no base-color lift) instead of contradicting it; status colors
(ok/warn/danger) keep their lifted dark values for AA contrast on
small text, per design-system separation of status tokens from the
brand accent.
