The installer pulls each pack JSON from /manifest/<file>.json, but the server was blocking every /manifest/ path. Add a strict whitelist route that only serves /manifest/<a-zA-Z0-9_-name>.json files (no directory listing, no path traversal, no other extensions); keep the catch-all 404 for anything else under /manifest/. Also strip the manifest URL input and "목록 새로고침" button from installer step 1 — packs auto-load on page render, only the selectable list remains. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
21 KiB
21 KiB