封堵鉴权旁路与导出 IDOR,DocGov 改服务端身份;对话层 PendingAction 接真实 docgov/taskrun;修复流式租约假死与会话级任务流;加固配置/doc_id/NULL;补齐 slog 与测试;前端 ErrorBoundary 与受控文档重试。 Co-authored-by: Cursor <cursoragent@cursor.com>
Extend taskrun executors to return full TaskRunResult, finalize assistant placeholder content with artifact metadata, and map quality_failed terminal state instead of metadata-only updates. Co-authored-by: Cursor <cursoragent@cursor.com>
Add POST/GET/POST cancel task run APIs, background worker with event replay, workspace reconcile, runner child cancel, and chat message metadata updates. Co-authored-by: Cursor <cursoragent@cursor.com>