YxinMiracle ce50a28dfd

fix(auth): enforce write permission for Live Browser WebSockets (#5621) ...

* fix(auth): enforce write permission for Live Browser WebSockets

Resolve route permissions before accepting browser streams and require threads:write, matching the existing HTTP navigation endpoint.

Preserve shared authorization failure semantics and reject unexpected setup errors before acquiring a browser session.

Add authorization, frame delivery, input dispatch, cancellation, and ownership regressions. Document the admission-only permission check.

* fix(auth): improve browser authorization diagnostics

---------

Co-authored-by: YxinMiracle <“939157765@qq.com”>

2026-09-22 10:43:49 +08:00

..

__init__.py

feat(subagents): add unified capacity and durable batch execution (#4998)

2026-08-25 07:49:38 +08:00

agents.py

feat(agents): persist default knowledge scopes for custom agents (#5579)

2026-09-20 16:31:35 +08:00

artifacts.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

assistants_compat.py

fix(backend): validate assistant search pagination (#5506)

2026-09-17 22:13:53 +08:00

auth.py

feat(authz): surface effective route permissions on GET /auth/me (Phase 4, #4063) (#5228)

2026-09-08 16:33:05 +08:00

browser.py

fix(auth): enforce write permission for Live Browser WebSockets (#5621)

2026-09-22 10:43:49 +08:00

capabilities.py

feat(capabilities): unify catalog, plugin configuration and agent selection (#5497)

2026-09-19 12:14:24 +08:00

channel_connections.py

feat(channels): support WeChat QR login from the web UI (#5582)

2026-09-20 17:21:49 +08:00

channels.py

fix(channels): harden runtime credential management APIs (#3581)

2026-06-18 10:45:33 +08:00

console.py

fix(console): disable cost reporting when model pricing mixes currencies (#4564)

2026-07-29 22:24:04 +08:00

features.py

feat(knowledge): add per-message RAGFlow retrieval scope (#5238)

2026-09-18 16:59:31 +08:00

feedback.py

fix(gateway):unify thread id validation (#4589)

2026-08-01 19:42:44 +08:00

github_webhooks.py

fix(gateway): stop implying 200 webhook deliveries are unrecoverable (#4307)

2026-07-23 14:32:49 +08:00

input_polish.py

feat: add composer input polishing (#3986)

2026-07-08 17:10:27 +08:00

integrations.py

feat(integrations): support switching Lark app credentials (#4703)

2026-08-10 07:19:19 +08:00

knowledge.py

feat(knowledge): add per-message RAGFlow retrieval scope (#5238)

2026-09-18 16:59:31 +08:00

managed_models.py

feat(models): manage shared models from Settings (#5596)

2026-09-20 16:13:58 +08:00

mcp_tasks.py

fix(gateway): reject MCP task cancellation when the worker is stopped (#4963)

2026-08-24 06:57:55 +08:00

mcp.py

feat(capabilities): unify catalog, plugin configuration and agent selection (#5497)

2026-09-19 12:14:24 +08:00

memory.py

feat(memory): add hybrid fact eviction policy (#4789)

2026-08-17 08:20:42 +08:00

models.py

feat(authz): enforce model authorization at Gateway routes and runtime (#4063 Phase 3) (#4540)

2026-08-01 22:34:11 +08:00

project_documents.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

project_thread_files.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

projects.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

runs.py

fix(tools): run tool assembly off-loop at async entry points (#5224)

2026-09-12 07:41:24 +08:00

scheduled_tasks.py

feat(scheduled-tasks): filter run history by occurrence status (#5384)

2026-09-14 14:09:27 +08:00

skills.py

feat(authz): filter per-caller skill visibility on the skill listing surfaces (#4063 Phase 4) (#5489)

2026-09-18 08:02:52 +08:00

subagent_batches.py

feat(subagents): add unified capacity and durable batch execution (#4998)

2026-08-25 07:49:38 +08:00

subagents.py

feat: add managed subagents and delegation scopes (#4887)

2026-08-24 11:04:23 +08:00

suggestions.py

fix(gateway):unify thread id validation (#4589)

2026-08-01 19:42:44 +08:00

thread_runs.py

fix(gateway): preserve clarification answers on regenerate (#5544)

2026-09-19 10:18:13 +08:00

threads.py

fix(security): prevent external system-role message injection (#5651)

2026-09-22 10:38:16 +08:00

trash.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

uploads.py

feat(projects): Projects MVP Phase 2 — instructions, document shelf, promotion, trash (#5443)

2026-09-16 18:46:18 +08:00

user_preferences.py

feat(settings): persist account preferences across browsers (#5397)

2026-09-14 07:25:41 +08:00