mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 22:16:26 +00:00
Maurice
ed67a5e9f8
An assistant rendering a temperature, a distance or a clock time was guessing: the session instructions named only the trip currency, and nothing could read what the user had picked. The write works off an allow-list rather than off the settings row, because that row also holds the webhook URL, the ntfy token and the Mapbox, Carto and LLM keys, and getUserSettings hands some of those back in cleartext. Everything outside the list is refused, including a key nobody has heard of yet. The guard test asserts against the service's own encrypted and masked sets rather than a copy of them, so a sixth key added there fails it.