Grzegorz afecd44ddf fix(approvals): let "approve once" run ungranted bash/python, close skill-test streams (#6635) (#6683) ... ToolApprovalStore.create() sealed a process identity only from the request authority's launch scopes, which exist only for granted bash/python. For an ungranted call the sealing failed silently, so the approval was created without a process identity and the executor always refused it ("Approved action has no sealed process/job identity"). When the authority is not inherited and has no launch scope for the backend, seal one in the request's single workspace root at approval time, as filesystem approvals already do. Inherited authorities still cannot widen. The skill test run and audit arm left their `async for` over stream_agent_loop early when an approval was needed, without closing the generator. asyncio closed it later from another task, so its ContextVar resets raised "Token ... was created in a different Context". Close the stream with aclosing, like the scheduler and teacher escalation do. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-13 20:16:02 +01:00
..
admin_wipe	refactor(routes): move admin_wipe domain into routes/admin_wipe/ subpackage (#5659)	2026-07-21 12:39:27 +02:00
cleanup	refactor(routes): move cleanup domain into routes/cleanup/ subpackage (#5658)	2026-07-21 12:38:32 +02:00
compare	refactor(routes): move compare domain into routes/compare/ subpackage (#5660)	2026-07-21 12:40:09 +02:00
contacts	Squash Odysseus development history	2026-09-11 06:04:19 +00:00
document	fix(runtime): enforce workspace confinement in one place	2026-10-01 19:45:59 +02:00
email	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
gallery	fix(runtime): enforce workspace confinement in one place	2026-10-01 19:45:59 +02:00
history	Merge commit 'refs/phase3/pre-ajax/publication-tip' into integration/pre-ajax-release	2026-10-05 15:59:59 +01:00
mcp	fix(mcp): reject malformed Args on Add MCP Server instead of defaulting to []	2026-09-30 12:54:09 +02:00
memory	fix(memory): don't let an unreadable store get overwritten with an empty one (#5831)	2026-08-06 02:33:50 -06:00
note	Squash Odysseus development history	2026-09-11 06:04:19 +00:00
research	Squash Odysseus development history	2026-09-11 06:04:19 +00:00
search	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
task	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
vault	feat(runtime): bind remote and owned resources to authority	2026-10-02 03:00:46 +01:00
webhook	refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781)	2026-08-03 20:44:31 +02:00
__init__.py	Odysseus v1.0	2026-05-31 23:58:26 +09:00
_validators.py	fix(hwfit): validate remote SSH detection targets (#3718)	2026-06-11 00:43:49 +02:00
admin_wipe_routes.py	refactor(routes): move admin_wipe domain into routes/admin_wipe/ subpackage (#5659)	2026-07-21 12:39:27 +02:00
api_token_routes.py	fix(api): normalize non-object JSON bodies to empty dict in token PATCH (#3976)	2026-06-15 18:05:15 +01:00
assistant_routes.py	fix(security): enforce registered endpoint authority	2026-10-05 22:24:15 +01:00
auth_routes.py	Preserve preview harness, editor, email and task improvements	2026-10-01 01:34:26 +00:00
backup_routes.py	fix(memory): don't let an unreadable store get overwritten with an empty one (#5831)	2026-08-06 02:33:50 -06:00
calendar_routes.py	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
chat_helpers.py	feat(notes): attach selected Notes/Todos as Agent context (#6495)	2026-10-13 18:57:19 +01:00
chat_routes.py	feat(notes): attach selected Notes/Todos as Agent context (#6495)	2026-10-13 18:57:19 +01:00
chatgpt_subscription_routes.py	feat(provider): support multiple ChatGPT subscriptions with usage	2026-09-22 13:12:19 +01:00
cleanup_routes.py	refactor(routes): move cleanup domain into routes/cleanup/ subpackage (#5658)	2026-07-21 12:38:32 +02:00
codex_routes.py	fix(runtime): enforce local control across Cookbook wrappers	2026-10-02 23:39:13 +01:00
compare_routes.py	refactor(routes): move compare domain into routes/compare/ subpackage (#5660)	2026-07-21 12:40:09 +02:00
contacts_routes.py	Merge remote-tracking branch 'origin/dev'	2026-07-07 00:51:34 +00:00
cookbook_helpers.py	Squash Odysseus development history	2026-09-11 06:04:19 +00:00
cookbook_output.py	fix(cookbook): report dead finished downloads as completed instead of stopped (#4025)	2026-06-15 15:26:55 +09:00
cookbook_routes.py	fix(runtime): enforce local control across Cookbook wrappers	2026-10-02 23:39:13 +01:00
copilot_routes.py	feat: add ChatGPT Subscription provider (#2876)	2026-06-08 10:19:18 +02:00
device_flow.py	feat: add ChatGPT Subscription provider (#2876)	2026-06-08 10:19:18 +02:00
diagnostics_routes.py	feat(ui): add real-time diagnostic logs console (#974)	2026-06-15 10:32:51 +02:00
document_helpers.py	refactor(routes): move document domain into routes/document/ subpackage (#5885)	2026-08-04 03:54:55 -06:00
document_routes.py	refactor(routes): move document domain into routes/document/ subpackage (#5885)	2026-08-04 03:54:55 -06:00
editor_draft_routes.py	fix(review): harden scholarly redirects, editor draft limits, and threat model	2026-09-23 12:53:06 +01:00
email_helpers.py	Preserve preview harness, editor, email and task improvements	2026-10-01 01:34:26 +00:00
email_pollers.py	refactor(routes): move the email modules into routes/email/	2026-09-29 18:21:18 +02:00
email_routes.py	Preserve preview harness, editor, email and task improvements	2026-10-01 01:34:26 +00:00
embedding_routes.py	feat(paths): abstract runtime path logic for frozen distribution packages (#969)	2026-06-15 17:44:10 +01:00
emoji_routes.py	refactor(constants): single source of truth for data dir (#3368)	2026-06-08 09:58:52 +02:00
font_routes.py	Keep compact font family names together (#1263)	2026-06-03 14:24:30 +09:00
gallery_helpers.py	Merge dev into main for testing	2026-06-28 14:07:23 +00:00
gallery_routes.py	Merge dev into main for testing	2026-06-28 14:07:23 +00:00
history_routes.py	refactor(routes): move history domain into routes/history/ subpackage (#5090)	2026-07-04 13:36:35 +02:00
hwfit_routes.py	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
mcp_routes.py	refactor(routes): move mcp domain into routes/mcp/ subpackage (#5899)	2026-08-11 02:24:55 -06:00
memory_routes.py	refactor(routes): move memory domain into routes/memory/ subpackage (#5007)	2026-06-30 17:52:14 +02:00
model_routes.py	Preserve preview harness, editor, email and task improvements	2026-10-01 01:34:26 +00:00
note_routes.py	refactor(routes): move note domain into routes/note/ subpackage (#5236)	2026-07-20 13:52:30 +02:00
personal_routes.py	fix(runtime): enforce workspace confinement in one place	2026-10-01 19:45:59 +02:00
prefs_routes.py	refactor(model-routing): centralize explicit foreground fallback policy (#6020)	2026-08-14 08:10:30 +01:00
preset_routes.py	Squash Odysseus development history	2026-09-11 06:04:19 +00:00
research_routes.py	refactor(routes): move research domain into routes/research/ subpackage	2026-06-28 14:34:11 +01:00
search_routes.py	refactor(routes): move search domain into routes/search/ subpackage (#5779)	2026-07-28 22:26:29 +02:00
session_routes.py	fix(security): harden Python service boundaries	2026-10-06 03:16:54 +01:00
shell_routes.py	fix(runtime): restore authorized local control paths	2026-10-02 23:15:51 +01:00
signature_routes.py	Constrain signature uploads to PNG data (#2844)	2026-06-05 13:17:43 +02:00
skills_routes.py	fix(approvals): let "approve once" run ungranted bash/python, close skill-test streams (#6635) (#6683)	2026-10-13 20:16:02 +01:00
stt_routes.py	refactor(uploads): centralize upload byte-limits in upload_limits.py (#3364) (#3518)	2026-06-09 01:24:30 +02:00
task_routes.py	refactor(routes): move task domain into routes/task/ subpackage	2026-08-17 10:07:17 +08:00
tts_routes.py	Odysseus v1.0	2026-05-31 23:58:26 +09:00
upload_routes.py	fix(runtime): enforce workspace confinement in one place	2026-10-01 19:45:59 +02:00
vault_routes.py	refactor(routes): move vault domain into routes/vault/ subpackage (#5780)	2026-08-03 20:44:00 +02:00
webhook_routes.py	refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781)	2026-08-03 20:44:31 +02:00
workspace_routes.py	Squash Odysseus development history	2026-09-11 06:04:19 +00:00