Age	Commit message (Collapse)	Author	Lines
13 hours	Keep every control byte out of a header value	Bryce Kwon	-0/+4
	A quoted header value escaped only the quote, the backslash, CR and LF. A web server refuses a response whose header holds any other control byte, so a file named with one could not be downloaded at all.
17 hours	Cut text between characters, never inside one	Bryce Kwon	-0/+6
	The index description was cut at a byte count, which could split a multibyte character and leave an invalid sequence on the page. Commit subjects already backed up to the start of the character, so html_ntxt now does that for every caller.
17 hours	Encode repository urls and the feed branch	Bryce Kwon	-0/+12
	Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
32 hours	Read and write slot keys and pages in full	Bryce Kwon	-1/+5
	xread and xwrite may move fewer bytes than asked. A short write of the key left a slot that could never match, a short read of it reported a collision, and a page write that moved nothing looped for ever.
32 hours	Keep the error of a request that dies mid capture	Bryce Kwon	-0/+1
	The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
2026-10-01	End a request quietly when the client has gone	Bryce Kwon	-2/+18
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-10-01	Keep the query string across the about redirects	Bryce Kwon	-0/+22
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-09-21	Harden the request path, scan and error recovery	Bryce Kwon	-4/+28
2026-09-21	Read every query parameter	Bryce Kwon	-1/+3
	A parameter without a value swallowed the parameter after it.
2026-09-06	Clean up the whole tree	Bryce Kwon	-10/+5
2026-09-06	Trim the comments and dead code across the tree	Bryce Kwon	-12/+10
2026-08-23	Log scan lock failures that are not contention	Bryce Kwon	-2/+2
2026-08-14	Drop the XHTML slashes and boolean spellings	Bryce Kwon	-4/+4
2026-08-14	Fix ampersand handling in generated urls	Bryce Kwon	-24/+26
2026-08-12	Restyle the sources and fix the audit's findings	Bryce Kwon	-141/+136
2026-08-08	Render each diff body while its file is open	Bryce Kwon	-0/+27
2026-08-08	Gather page output into one buffer	Bryce Kwon	-2/+45
2026-08-06	Settle the names, types and layout of the sources	Bryce Kwon	-3/+3
2026-07-16	Point the fork's links and credits at itself	Bryce Kwon	-1/+1
	AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
2026-07-15	Reorganize into source, assets and libraries	Bryce Kwon	-0/+344
	The C sources move to source/, the served files to assets/, the bundled Git submodule to libraries/git and the filter scripts to extensions/. Everything the build generates now lands in build/, so a clean is a single remove and the tree stays clean.