YxinMiracle ce50a28dfd

fix(auth): enforce write permission for Live Browser WebSockets (#5621) ...

* fix(auth): enforce write permission for Live Browser WebSockets

Resolve route permissions before accepting browser streams and require threads:write, matching the existing HTTP navigation endpoint.

Preserve shared authorization failure semantics and reject unexpected setup errors before acquiring a browser session.

Add authorization, frame delivery, input dispatch, cancellation, and ownership regressions. Document the admission-only permission check.

* fix(auth): improve browser authorization diagnostics

---------

Co-authored-by: YxinMiracle <“939157765@qq.com”>

2026-09-22 10:43:49 +08:00

..

auth

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

github

fix(agent): align unattended prompt with tool policy (#4919)

2026-09-20 18:57:49 +08:00

routers

fix(auth): enforce write permission for Live Browser WebSockets (#5621)

2026-09-22 10:43:49 +08:00

__init__.py

feat(observability): add trace-id correlation and enhanced logging (#3902)

2026-07-03 08:01:46 +08:00

AGENTS.md

fix(auth): enforce write permission for Live Browser WebSockets (#5621)

2026-09-22 10:43:49 +08:00

app.py

feat(models): manage shared models from Settings (#5596)

2026-09-20 16:13:58 +08:00

artifact_archive.py

feat(artifacts): download run files as zip (#5117)

2026-09-01 22:01:21 +08:00

auth_disabled.py

feat(auth): add personal access tokens for programmatic API access (#5041)

2026-08-29 23:50:45 +08:00

auth_middleware.py

feat(auth): add personal access tokens for programmatic API access (#5041)

2026-08-29 23:50:45 +08:00

authz.py

feat(authz): filter per-caller skill visibility on the skill listing surfaces (#4063 Phase 4) (#5489)

2026-09-18 08:02:52 +08:00

browser_capability.py

feat(browser): add agentic browser control (#4187)

2026-07-21 11:46:33 +08:00

capabilities.py

refactor(capabilities): simplify labels and connection validation (#5580)

2026-09-20 15:02:02 +08:00

checkpoint_lineage.py

fix(gateway): replay edit and rerun from a settled checkpoint (#4534)

2026-07-28 22:12:27 +08:00

checkpoint_retention.py

feat(gateway): checkpoint retention service on the #4189 deletion contract (#5308)

2026-09-18 16:46:19 +08:00

config.py

fix(nginx): defer CORS to gateway allowlist (#2861)

2026-05-11 17:38:37 +08:00

context_usage.py

fix(gateway): preserve owner isolation when thread metadata is missing (#5484)

2026-09-18 09:39:14 +08:00

conversation_access.py

feat(gateway): accept conversation references in run context and report the capability (#5463)

2026-09-16 15:37:57 +08:00

conversation_reader.py

feat(conversation): continue reading a cut message by offset (#5434)

2026-09-15 08:25:08 +08:00

csrf_middleware.py

feature(gateway): issue request trace ids unconditionally (#5119)

2026-09-01 16:49:39 +08:00

deps.py

fix(extensions): drain service shutdown across cancellation (#5549)

2026-09-19 11:23:12 +08:00

health.py

feat(gateway): add /health/ready readiness probe backed by the database (#5166)

2026-09-04 23:26:53 +08:00

internal_auth.py

feat(skills): per-user custom skill isolation with sandbox mounting (#3889)

2026-07-04 13:54:04 +08:00

knowledge_scope_admission.py

feat(agents): persist default knowledge scopes for custom agents (#5579)

2026-09-20 16:31:35 +08:00

langgraph_auth.py

fix: restore standalone LangGraph Studio compatibility (#4760)

2026-08-15 21:20:34 +08:00

langgraph_studio.py

fix: support Studio file-based app loading (#4838)

2026-08-16 23:54:06 +08:00

pagination.py

fix: load paginated run history messages (#3305)

2026-06-01 15:50:39 +08:00

path_utils.py

fix(gateway): confine artifact PUT to /mnt/user-data/outputs after path resolution (#5321)

2026-09-10 15:01:56 +08:00

request_path.py

feat(extensions): add gateway contribution points and packaged extension management (#4780)

2026-08-13 23:55:30 +08:00

run_models.py

feat(gateway): accept conversation references in run context and report the capability (#5463)

2026-09-16 15:37:57 +08:00

services.py

fix(security): prevent external system-role message injection (#5651)

2026-09-22 10:38:16 +08:00

skill_export.py

feat(skills): export custom skill packages with revision-bound preview (#5332)

2026-09-11 16:21:23 +08:00

trace_middleware.py

feature(gateway): issue request trace ids unconditionally (#5119)

2026-09-01 16:49:39 +08:00

upload_ingestion.py

fix(uploads): convert the bytes we wrote, not the name they landed under (#5611)

2026-09-21 07:34:09 +08:00

utils.py

feat(persistence): add unified persistence layer with event store, token tracking, and feedback (#1930)

2026-04-26 11:05:47 +08:00