David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#5307): gate the 3rd/final import_cli_session write path (archive fallback)

Browse source 
Codex round 4 found POST /api/session/archive's missing-sidecar fallback also
calls import_cli_session(). grep confirms exactly 3 import_cli_session() call
sites in routes.py; all 3 now refuse source='subagent' children:
  - 4792 _get_or_materialize_session (chat-start) -> PermissionError
  - 22382 import_cli endpoint -> read-only view payload
  - 13885 archive fallback -> 400 'Subagent sessions cannot be archived'
So no path can materialize a delegated child as a writable WebUI sidecar.
Fixes #5307
This commit is contained in:
nesquena-hermes 2026-07-01 07:48:34 +00:00
parent c989acc991
commit 161fdeba7a
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
api/routes.py
View file

@ -13856,6 +13856,13 @@ def handle_post(handler, parsed) -> bool:
return bad(handler, "Session not found", 404)
if cli_meta.get("read_only"):
return bad(handler, "Read-only imported sessions cannot be archived from WebUI", 400)
# Delegated subagent children (#5307) are view-only and owned by the
# delegate runner — never materialize one into a writable WebUI
# sidecar via the archive fallback (the 3rd of the shared
# import_cli_session write paths).
_arch_source_tag = (cli_meta.get("source_tag") or cli_meta.get("raw_source") or "").strip().lower()
if _arch_source_tag == "subagent" or _is_subagent_child_session_id(sid):
return bad(handler, "Subagent sessions cannot be archived from WebUI", 400)
if _is_messaging_session_record(cli_meta):
s = Session(
session_id=sid,