aduoge 26bf78f2b9

fix(github): apply allow_authors to the webhook sender (#7868) ...

_author_login returned the issue/PR creator for issues and pull_request
events. On edited/labeled/reopened actions the actor is sender, so an
allow_authors user editing someone else's issue was gated on mention,
while anyone editing an allow_authors user's issue bypassed it. Prefer
sender.login and keep the object author as a fallback.

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-11-04 21:35:55 +08:00

..

auth

fix(auth): allow demoting disabled administrators (#7769)

2026-11-02 09:26:00 +08:00

github

fix(github): apply allow_authors to the webhook sender (#7868)

2026-11-04 21:35:55 +08:00

routers

fix(runtime): persistently fence stale run event producers (#7619)

2026-11-02 15:26:42 +08:00

__init__.py

feat(observability): add trace-id correlation and enhanced logging (#3902)

2026-07-03 08:01:46 +08:00

AGENTS.md

docs: restore agent guidance size budgets (#7810)

2026-11-02 15:20:54 +08:00

app.py

fix(sandbox): leave SIGTERM/SIGINT teardown to the Gateway lifespan (#7560)

2026-10-26 20:38:32 +08:00

artifact_archive.py

feat(artifacts): download run files as zip (#5117)

2026-09-01 22:01:21 +08:00

auth_disabled.py

feat(auth): add personal access tokens for programmatic API access (#5041)

2026-08-29 23:50:45 +08:00

auth_middleware.py

feat(knowledge): add optional ingestion and status center (#7518)

2026-11-02 10:42:21 +08:00

authz.py

fix(gateway): read the route authorization config off the event loop (#7557)

2026-10-26 18:44:09 +08:00

browser_capability.py

feat(browser): add agentic browser control (#4187)

2026-07-21 11:46:33 +08:00

capabilities.py

fix(mcp): isolate personal connections from deployment configuration (#5966)

2026-09-28 16:02:34 +08:00

checkpoint_lineage.py

fix(gateway): classify duration-only checkpoints without the Postgres-dropped marker (#5988)

2026-10-09 20:30:19 +08:00

checkpoint_retention.py

fix(checkpoints): run conservative retention after completion (#6051)

2026-10-20 22:23:47 +08:00

config.py

fix(gateway): treat a blank GATEWAY_HOST/GATEWAY_PORT as unset (#5801)

2026-09-24 15:56:38 +08:00

context_usage.py

fix(gateway): read the live config off the loop for thread token usage (#7727)

2026-10-31 08:28:01 +08:00

conversation_access.py

fix(conversation): tolerate malformed event metadata (#7721)

2026-10-31 18:25:31 +08:00

conversation_reader.py

fix(conversation): tolerate malformed event metadata (#7721)

2026-10-31 18:25:31 +08:00

csrf_middleware.py

fix(gateway): reject non-ASCII tokens instead of raising in constant-time compares (#6076)

2026-09-30 17:41:11 +08:00

deps.py

fix(runtime): persistently fence stale run event producers (#7619)

2026-11-02 15:26:42 +08:00

extension_agent_runs.py

feat(runtime): support Queue and Steer during active Web runs (#7729)

2026-10-31 11:35:36 +08:00

extension_artifacts.py

feat(workflows): add Phase 2 approvals, immutable artifacts and configuration evidence (#6920)

2026-10-17 09:41:15 +08:00

health.py

fix(runtime): strip the SQLAlchemy driver suffix from sync and store DSNs (#6917)

2026-10-15 23:45:09 +08:00

history_seed.py

fix(runtime): persistently fence stale run event producers (#7619)

2026-11-02 15:26:42 +08:00

internal_auth.py

fix(gateway): reject non-ASCII tokens instead of raising in constant-time compares (#6076)

2026-09-30 17:41:11 +08:00

knowledge_scope_admission.py

feat(knowledge): decouple scope and read-only catalogs (phase 2) (#6904)

2026-10-15 15:10:39 +08:00

langgraph_auth.py

feat(knowledge): decouple scope and read-only catalogs (phase 2) (#6904)

2026-10-15 15:10:39 +08:00

langgraph_studio.py

fix: support Studio file-based app loading (#4838)

2026-08-16 23:54:06 +08:00

mcp_oauth_tokens.py

fix(mcp): keep rotating OAuth refresh tokens across restarts and Gateway instances (#7207)

2026-10-21 18:17:29 +08:00

pagination.py

fix: load paginated run history messages (#3305)

2026-06-01 15:50:39 +08:00

path_utils.py

fix(gateway): confine artifact PUT to /mnt/user-data/outputs after path resolution (#5321)

2026-09-10 15:01:56 +08:00

persistent_writes.py

refactor(gateway): hoist the persistent-write drain into one shared helper (#6151)

2026-10-01 20:13:57 +08:00

personal_mcp_access.py

fix(mcp): isolate personal connections from deployment configuration (#5966)

2026-09-28 16:02:34 +08:00

request_path.py

feat(extensions): add gateway contribution points and packaged extension management (#4780)

2026-08-13 23:55:30 +08:00

run_inputs.py

fix(gateway): continue dispatching queued inputs after cancellation (#7746)

2026-11-04 10:39:20 +08:00

run_models.py

fix(gateway): answer malformed run bodies with 4xx instead of 500 (#7362)

2026-10-24 10:12:05 +08:00

run_origin.py

feat(scheduled-tasks): signals, honest notices and fair queueing for server-started runs (RFC #6340, 2/2) (#6393)

2026-10-07 10:22:15 +08:00

scheduled_task_access.py

feat(scheduled-tasks): finish the user-facing side of conversation schedules (RFC #6340, 1/2) (#6378)

2026-10-07 07:47:32 +08:00

scheduled_task_errors.py

feat: add Feishu group notifications and fix mention caret placement (#6762)

2026-10-13 07:17:56 +08:00

scheduled_task_validation.py

fix(scheduler): reject nonexistent local times at admission (#7281)

2026-10-23 09:13:37 +08:00

secret_masking.py

fix(memory): mask backend secrets in the memory config responses (#7665)

2026-10-30 14:53:33 +08:00

services.py

fix(runtime): persistently fence stale run event producers (#7619)

2026-11-02 15:26:42 +08:00

skill_export.py

feat(skills): export custom skill packages with revision-bound preview (#5332)

2026-09-11 16:21:23 +08:00

sse_headers.py

feat(scheduled-tasks): signals, honest notices and fair queueing for server-started runs (RFC #6340, 2/2) (#6393)

2026-10-07 10:22:15 +08:00

trace_middleware.py

feature(gateway): issue request trace ids unconditionally (#5119)

2026-09-01 16:49:39 +08:00

upload_ingestion.py

fix(uploads): retain filesystem ownership across request cancellation (#7170)

2026-10-20 23:17:00 +08:00

utils.py

fix(gateway): reject non-ASCII tokens instead of raising in constant-time compares (#6076)

2026-09-30 17:41:11 +08:00