2fa67ad699
* Release PL (v0.51.451): show named-profile external sessions in the all-profiles list (#4067, #4065) All-profiles session enumeration now scans across profiles only when the request explicitly asks (all-profiles view); cross-profile import resolves to the active profile's state.db for unqualified requests (foreign id -> 404), mirroring the #3982/#3991 detail/export profile-scoping gate. Co-authored-by: rodboev * gate fix (Codex CORE + Opus): close cross-profile leak on the import_cli refresh/existing-session branch The already-imported branch of _handle_session_import_cli forced allow_all_profiles=True whenever the globally-stored session carried a profile, with no active-profile visibility gate — so an unqualified request from profile A could read/refresh a session imported under profile B's live state.db (both advisors reproduced the foreign-transcript leak). Now gated exactly like the /api/session detail + export endpoints: unqualified requests require _session_visible_to_active_profile; explicit all_profiles requires a matching profile. + 3 regression tests. * gate fix (Codex SILENT, re-gate): thread source_filter into the all-profiles CLI scan (models.py:4113) The all-profiles branch keys its cache on source_filter but called _load_cli_sessions_uncached without it, so /api/sessions?all_profiles=1 with a source filter returned every-source sessions under a filtered key. + regression test. --------- Co-authored-by: nesquena-hermes <agent@nesquena-hermes> |
||
|---|---|---|
| .. | ||
| vendor | ||
| apple-touch-icon.png | ||
| assistant_turn_anchors.js | ||
| boot.js | ||
| commands.js | ||
| favicon-32.png | ||
| favicon-192.png | ||
| favicon-512.png | ||
| favicon-512.svg | ||
| favicon.ico | ||
| favicon.svg | ||
| i18n.js | ||
| icons.js | ||
| index.html | ||
| login.js | ||
| manifest.json | ||
| messages.js | ||
| onboarding.js | ||
| outline.js | ||
| panels.js | ||
| pwa-startup.js | ||
| sessions.js | ||
| style.css | ||
| sw.js | ||
| terminal.js | ||
| ui.js | ||
| workspace.js | ||
