weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,733 Commits 10 Branches 15 Tags
4a97cfcf766bc136fef66629117dbddbc4e2ff42
Commit Graph
4 Commits
Author SHA1 Message Date
weichenandCursor d2903a1662 fix(server): enforce principal identity and docgov project access (H1-H3) 
- H1: log legacy test-principal fallback (path/method/remote_addr) via
  slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
  principal and server-side doc duty resolution (resolveDocGovRole),
  never from request body; GetDocument/ListComments/ListAuditLogs now
  require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
  and handleGetUserContext reject cross-user user_id (403) and stop
  defaulting to user id=1

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-19 05:33:38 +00:00
weichenandCursor f6813cc272 feat(api): add additive HTTP/SSE error envelopes 
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-15 14:40:56 +00:00
weichenandCursor 3f42149457 feat(bizdev): snapshot collaborators onto Runtime and Server ports 
Composition roots copy Parts once so HTTP/CLI handlers stop calling locator getters on every request.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-15 13:00:33 +00:00
WeiCHENandCursor a1cb4aade0 feat(api): gate chat stream on chat_turns with session serial execution 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00