4 Commits

Include renames

Author	SHA1	Message	Date
weichenandCursor	d5a9a29eec	feat(api): add workflow catalog routes and public auth config endpoint ... Expose governance APIs for workflow selection/termination and allow login pages to read registration policy without admin credentials. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-13 02:50:23 +00:00
weichenandCursor	aea391cdaf	feat(taskrun): persist runs/events and fix finalize-before-done ordering ... Add goose v19 task_runs/task_run_events tables with PG store for restart replay, orphan interruption on startup, strict /ready checks, and strip client work_dir from chat/SSE paths per P0 path sandbox requirements. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-13 02:50:23 +00:00
weichen	e96ade076a	fix(auth): restrict demo seed users to dev/test environments ... Main no longer creates fixed-password demo accounts and legacy anonymous fallback is limited to explicit dev/test in-memory fixtures.	2026-09-13 02:50:22 +00:00
weichen	3145550a59	feat(security): complete P0 release blocking remediation ... Unify auth middleware and remove X-User-ID trust, add project_members authorization, sandbox workspaces via resolver, and admin-only reconcile by run_id. Introduce goose migrations with startup schema gate, fail closed when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in app Dockerfile, and remove frontend pseudo-login fallback.	2026-09-13 02:50:22 +00:00