weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,524 Commits 10 Branches 15 Tags
dev
Commit Graph
6 Commits
Author SHA1 Message Date
weichenandCursor 5cd22c7327 fix(authz): harden permissions, chat gate, and project create idempotency 
Add project:manage_members, CSP frame-src, task-run member view, CreateUser
tx error handling, ERR_NO_PROJECT chat gate, and creator-scoped project
name/client_key uniqueness to stop duplicate creates and auth gaps.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-20 07:04:57 +00:00
weichenandCursor 4c34e8a503 fix(server): close security headers, lease clamp, replay digest, double start 
Add nosniff, frame denial, referrer policy, and a self-origin CSP. Clamp human and squad lease TTLs and require author edit rights before a human lease. Include DryRun in replay digests so a dry-run approval cannot authorize apply. Stop Server.Start from swallowing a second Runtime.Start.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-19 09:12:17 +00:00
weichenandCursor 7fdbee6c0c test(server): adapt fixtures to IAM dual-gate fail-closed 
Boot memory IAM only via explicit test env opt-in; strict auth cases
disable AllowInMemory after startup.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 09:42:07 +00:00
weichen 8cdc839650 test(docs): Phase 1 IAM authz tests and test report 
Extend P0 and auth/me handler tests for members endpoint and capabilities; archive Phase 1 test report under .doc/test-reports/.
 2026-09-13 02:50:22 +00:00
weichen d4988d04e8 test(docs): extend Phase 0 security gates and archive test report 
Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0
security止血 acceptance report with PASS results.
 2026-09-13 02:50:22 +00:00
weichen 3145550a59 feat(security): complete P0 release blocking remediation 
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
 2026-09-13 02:50:22 +00:00