weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,524 Commits 10 Branches 15 Tags
dev
Commit Graph
4 Commits
Author SHA1 Message Date
weichenandCursor fad7fac044 fix(authz): close preference, session project, and recategorize IDOR gaps 
Bind preference writes and session-scoped project reads to the authenticated principal, and require an owned session_id for recategorize so empty ids cannot touch all messages.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-20 10:42:58 +00:00
weichenandCursor 3f42149457 feat(bizdev): snapshot collaborators onto Runtime and Server ports 
Composition roots copy Parts once so HTTP/CLI handlers stop calling locator getters on every request.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-15 13:00:33 +00:00
weichen 3145550a59 feat(security): complete P0 release blocking remediation 
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
 2026-09-13 02:50:22 +00:00
WeiCHEN be659cba11 feat(chat): wire multi-turn dialogue broken links (G1/G2/G3/G9) with session restore 2026-09-13 02:50:20 +00:00