Return existing task run 202 for the same turn before scope/preflight so
SSE disconnect retries do not hit DOC_BUSY or duplicate chat. Extend
task-run events write deadlines with heartbeats without dropping global
HTTP WriteTimeout. Reconnect subscribeTaskRunEvents on EOF via after_seq.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unrestricted stage access on projects without a live workflow must not
let arbitrary authenticated users join by project_id. Enforce member or
creator (admin per existing policy) before stage ABAC, and reject chat
streams with JSON 403 before SSE headers/flush.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add goose v19 task_runs/task_run_events tables with PG store for restart
replay, orphan interruption on startup, strict /ready checks, and strip
client work_dir from chat/SSE paths per P0 path sandbox requirements.
Co-authored-by: Cursor <cursoragent@cursor.com>
Tag messages with stage_key metadata, block sends for unauthorized roles, and filter history/search/case results by allowed stages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
Stream SSE path now forwards Materials to ExecuteTask/ExecuteStage, and
TestTaskStream_MaterialsInjection targets the real /tasks/run/stream endpoint.
Co-authored-by: Cursor <cursoragent@cursor.com>
