HERMES-GIELIE/api
nesquena-hermes e6e7454c7a fix(#5307): gate ALL remaining session-mutation routes + stale-webui-row coercion (Codex round 9)
Enumerated every /api/session/<mutation> route and applied _session_is_subagent_view_only:
duplicate, branch, retry, undo, toolsets, compress, archive (existing-sidecar path)
now 400 for subagent children; delete/clear/truncate/pin already gated; rename/move/update
route through the gated _get_or_materialize_session (403). This closes the data-loss
paths (delete_cli_session, retry/undo truncate, branch/duplicate fork).

Also: /api/sessions list coercion now also honors state.db source='subagent' for rows
whose stale index says webui/fork, so they can't surface as writable/CLI sidebar rows.
Fixes #5307
2026-07-01 08:38:47 +00:00
..
__init__.py
agent_health.py fix(agent_health): read cross-container gateway runtime status from gateway_state.json (#5065) 2026-06-27 19:54:50 +00:00
agent_sessions.py fix(#5307): root-fix subagent classification + GET serialization (Codex round 7) 2026-07-01 08:10:24 +00:00
auth.py fix(auth): keep OIDC startup warnings off the optional crypto path (#3825) 2026-06-29 22:31:45 -04:00
auth_oidc.py fix(#3825): harden oidc endpoint and claim validation 2026-06-30 20:59:19 -04:00
background.py
background_process.py fix(webui): render a server-initiated turn that finished during an SSE gap on a visible tab 2026-06-30 17:13:45 +00:00
clarify.py
commands.py feat(moa): route /moa through WebUI via server-resolved MoA config (#5070, #5057) 2026-06-28 00:23:51 +00:00
compression_anchor.py Address compaction marker and redaction review 2026-06-26 00:12:09 +00:00
config.py Fix composer control reorder rebase collision 2026-06-30 21:11:54 -05:00
dashboard_probe.py
extensions.py fix(extensions): keep settings-only installs canonical (#5094) 2026-06-28 18:25:47 -04:00
gateway_chat.py fix(#5092): continue WebUI goals after gateway turns 2026-06-30 05:04:32 +00:00
gateway_restart.py fix(health): preserve restart failure contract and proofs (#5156) 2026-06-29 03:44:06 +00:00
gateway_watcher.py
goals.py
helpers.py fix(redaction): memoize deterministic API response redactor 2026-06-29 18:22:18 +00:00
kanban_bridge.py rebase(#2814): resolve i18n onto current master + add kanban_view_* keys to all 13 locales 2026-06-23 23:40:45 +00:00
metering.py
models.py Merge #4988 (enihcam prune orphan zero-msg sessions) into stage 2026-07-01 00:19:56 +00:00
oauth.py
onboarding.py fix: harden None providers config across onboarding/providers/routes (salvage of #3967) 2026-06-28 08:57:39 +00:00
passkeys.py
paths.py
plugin_providers.py
plugins.py
profiles.py fix(#4783): prune dependency trees in mtime probe to match compute path (gate finding 4) 2026-06-24 21:27:22 +00:00
providers.py Merge #5120 (rodboev budget limit) into stage 2026-06-30 21:28:51 +00:00
request_diagnostics.py fix(#4973): replace per-request diagnostics Timer with a process-global watchdog thread 2026-06-26 07:58:13 +00:00
rollback.py
route_approvals.py fix(#5000): relay mirrored gateway approvals after stream loss 2026-06-27 06:03:24 +00:00
route_session_list_cache.py feat: add Webhooks sidebar filter parity 2026-06-30 17:06:31 +00:00
routes.py fix(#5307): gate ALL remaining session-mutation routes + stale-webui-row coercion (Codex round 9) 2026-07-01 08:38:47 +00:00
run_journal.py
runner_client.py
runtime_adapter.py
session_discoverability.py
session_events.py
session_lifecycle.py
session_ops.py fix(session): preserve kept tool rows on ambiguous truncate (#5134) 2026-06-30 01:40:07 +00:00
session_recovery.py fix(anchor): preserve settled mixed content order (#4958) 2026-06-27 22:54:29 +00:00
skill_usage.py
sse_chunked.py
startup.py
state_sync.py
streaming.py stage #5024 2026-07-01 06:49:44 +00:00
system_health.py fix: keep psutil optional for system health 2026-06-26 20:49:13 +00:00
terminal.py
todo_state.py
turn_journal.py
updates.py fix(updates): resolve git under macOS launchd (#5175) 2026-06-29 04:22:51 +00:00
upload.py fix(auth): enforce active-profile session IDs 2026-06-30 04:28:15 +00:00
usage.py
webui_session_db.py fix(#4767): review fixes - more edge cases 2026-06-24 18:08:50 +00:00
workspace.py fix(profiles): use profile-scoped resolver for /api/profile/active default_workspace (Codex gate #5169) 2026-06-29 01:45:17 +00:00
workspace_git.py
worktrees.py