agent-exec-transportandCursor 954e744d6d Require the caller's conversation when creating a surface ...

POST /api/surfaces with an empty surfaceId now requires a conversationId
that belongs to the caller: empty returns 400, missing or another owner's
conversation returns 404. Revisions keep the previous behavior. Without
this check a direct API caller could create a project-less surface and
skip the project lifecycle gate on actions.

Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit backend-surface-submit-conversation-required (pi, attempt 1 after authorized rerun, terminal=success); go test ./internal/server/... ./internal/surfacesvc/... .
Impact: HTTP create-surface validation only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-21 15:02:15 +00:00

..

app

Merge the lifecycle role and project-state work into Backend main

2026-10-21 03:47:35 +00:00

authz

agent-exec transport db62fd9b2ada67370988679837bbb3d1/b712680caa58

2026-10-20 12:39:28 +00:00

blobstore

Fall back to local artifacts when the blob store is a typed nil

2026-10-13 01:22:57 +00:00

bus

Recover interrupted runs and commit terminal state once

2026-10-03 14:37:49 +00:00

cardsvc

agent-exec transport 2f80ef82aa46c436ab31ad04be4314d5/5a44c92c20c8

2026-10-19 09:24:56 +00:00

cmdbus

Bind formal commands to exact project sources

2026-10-15 07:00:18 +00:00

config

agent-exec transport 64fcfc65eef6a9c12fe5ef9d4427a2bb/47019d8fae2f

2026-10-19 09:39:18 +00:00

ctxasm

Send current-turn images and keep vision fallbacks capable

2026-10-14 17:51:17 +00:00

docgen

Bump the renderer to 3f25999 and bind documents to published profile versions

2026-10-18 06:24:36 +00:00

evalgold

Add the public extension surface and platform services

2026-10-01 10:35:02 +00:00

execenv

Write the pip dry-run report to a file

2026-10-15 14:38:26 +00:00

genui

Close the account lifecycle leftovers: atomicity, bootstrap lock, redeem guard, credential delivery

2026-10-13 06:05:45 +00:00

hostapi

Close the EXT-8 remaining blocks: vector sharing, hostapi face, citation consistency

2026-10-08 17:16:10 +00:00

ingest

Route workspace Word delivery through the shared renderer

2026-10-15 19:41:14 +00:00

instanceguard

agent-exec transport d2c63b4a83821a5716997a28174233b1/d6e403e1e778

2026-10-18 09:20:03 +00:00

intentgate

Wire the intent slow lane behind settings flags (I2 WP3)

2026-10-07 11:20:41 +00:00

intentsem

Wire the intent slow lane behind settings flags (I2 WP3)

2026-10-07 11:20:41 +00:00

pgbus

Catch up event streams by cursor with real reconnect and periodic rescue (U6 slice 1)

2026-10-11 09:30:29 +00:00

plugins

Fence U3 account writes and stabilize directory cursors

2026-10-14 07:33:54 +00:00

profiles

Merge backend main into the vision branch

2026-10-15 05:49:30 +00:00

projectcontext

Recheck project workflow sources without storing prompts

2026-10-14 05:38:11 +00:00

projectscope

Add project lifecycle delegation and private member work

2026-10-13 08:43:02 +00:00

prompts

agent-exec transport ed457bf5f823c43a1d72b50b1f3cfeef/8e408ea19f4b

2026-10-19 09:24:43 +00:00

quality

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

rag

Fence U3 account writes and stabilize directory cursors

2026-10-14 07:33:54 +00:00

ratelimit

Close request atomicity: locked message append, card versions, atomic rate limit, recovery holds (U3 slice 1)

2026-10-11 04:37:50 +00:00

route

Keep only hard facts in the blocking gate and add fact-consistency checks

2026-10-10 00:04:57 +00:00

runmgr

agent-exec transport d7af319ad1e36046a46be5ad16007582/d3f2d0786d5b

2026-10-21 07:10:20 +00:00

runtime

agent-exec transport bf732506478b02c63a7b4fe251f0ef0f/ba449849829e

2026-10-21 06:08:09 +00:00

server

Require the caller's conversation when creating a surface

2026-10-21 15:02:15 +00:00

settings

agent-exec transport 8eed31d0d96c50c2dfb6a834d78cb5e9/d97e9636ff2e

2026-10-20 06:29:12 +00:00

skills

Pin published company default renderer and drop candidate wording

2026-10-16 05:07:19 +00:00

squadadapter

Bind formal commands to exact project sources

2026-10-15 07:00:18 +00:00

store

agent-exec transport d7af319ad1e36046a46be5ad16007582/d3f2d0786d5b

2026-10-21 07:10:20 +00:00

surfacesvc

Fence U3 account writes and stabilize directory cursors

2026-10-14 07:33:54 +00:00

tools

Merge Backend main into tavily KB fallback

2026-10-19 09:37:45 +00:00

vision

Send current-turn images and keep vision fallbacks capable

2026-10-14 17:51:17 +00:00

wfcompile

Recheck project workflow sources without storing prompts

2026-10-14 05:38:11 +00:00

workflow

Run workflow scripts through a capped callback host

2026-10-01 16:18:59 +00:00