4 Commits

Include renames

Author	SHA1	Message	Date
weichenandCursor	fad7fac044	fix(authz): close preference, session project, and recategorize IDOR gaps ... Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-20 10:42:58 +00:00
weichenandCursor	3f42149457	feat(bizdev): snapshot collaborators onto Runtime and Server ports ... Composition roots copy Parts once so HTTP/CLI handlers stop calling locator getters on every request. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-15 13:00:33 +00:00
weichen	3145550a59	feat(security): complete P0 release blocking remediation ... Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.	2026-09-13 02:50:22 +00:00
WeiCHEN	e8002b2243	feat(category): implement recategorize backfill engine and fallback mapping (Spec §3.4-3.5 A4-A5)	2026-09-13 02:50:20 +00:00