3 Commits

Include renames

Author	SHA1	Message	Date
weichenandCursor	5cd22c7327	fix(authz): harden permissions, chat gate, and project create idempotency ... Add project:manage_members, CSP frame-src, task-run member view, CreateUser tx error handling, ERR_NO_PROJECT chat gate, and creator-scoped project name/client_key uniqueness to stop duplicate creates and auth gaps. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-20 07:04:57 +00:00
weichenandCursor	4c34e8a503	fix(server): close security headers, lease clamp, replay digest, double start ... Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-19 09:12:17 +00:00
weichen	171959710d	fix(security): add CORS allowlist and enforce principal on chat handlers ... Replace wildcard CORS with configured origins and bind chat/task user identity to the authenticated principal instead of request body fields.	2026-09-13 02:50:22 +00:00