Final review wave: filter-bound page token, host-spoof tests, length bound
Bind the continuation token: next_page_token is now base64url JSON
{ c: cursor, q?, s? } carrying the query/status the page was actually
fetched with. On continuation the token is length-bounded (<=1024),
decoded (failures -> the fixed friendly error before any fetch), its
status re-validated, and the decoded filters used - model-supplied
query/status are ignored under page_token, so a model dropping optional
args on a follow-up can never silently fetch the unfiltered matter list.
Schema/prompt now say "pass page_token alone; filters are remembered".
Removed the uncited "next URL = original params + page_token" comment
claim. Added the two named 2026-07-28 host-spoof regression shapes
(suffix-domain, userinfo) to the matterPageTokenFromNext tests.
627/627 tests (23 new vs baseline), tsc + prettier clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| Repository | Sloth-ninja/JessicaOSS |
|---|---|
| Author | sloth-ninja <ezanahaddis@gmail.com> |
| Authored | |
| Parents | 11373e51 |
| Stats | 3 files changed , +238 , -51 |
| Part of | Clio connector: per-user OAuth, chat tools, and matter search |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-ea89d17e.md
from inside the repo you want the change in.