Danny Avila 1ca246b3bd 🧪 test: Assert denial for permanent agent uploads without permission ... This case asserted that an upload naming an agent but no tool_resource skipped the permission check, which is the behavior the unified path made exploitable. It also described itself as a message attachment while sending none; the adjacent case already covers real message attachments. It now asserts denial.		2026-08-31 11:06:12 -04:00
..
controllers	🧳 feat: Register Principal-Owned Code Environments (#15365)	2026-08-30 19:33:19 -04:00
middleware	🪢 feat: show Langfuse session link in shared chats (#15273)	2026-08-27 14:29:57 -04:00
routes	🧪 test: Assert denial for permanent agent uploads without permission	2026-08-31 11:06:12 -04:00
services	🐛 fix: Provision for file-editing tools and keep failed entries queued	2026-08-31 10:58:28 -04:00
utils	🎟️ refactor: Require Credentials for Local Image Access by Default (#15252)	2026-08-27 09:55:27 -04:00
cleanup.js
csp.spec.js	🔣 fix: Escape SPA Language Attribute (#15248)	2026-08-26 07:37:36 -04:00
experimental.js	🧳 feat: Register Principal-Owned Code Environments (#15365)	2026-08-30 19:33:19 -04:00
experimental.spec.js	🧾 feat: Store Durable Event Actor Receipts (#15265)	2026-08-27 06:00:43 -04:00
index.js	🔧 feat: Unified file upload — per-mime-type routing with lazy provisioning	2026-08-30 20:12:09 -04:00
index.metrics.spec.js
index.spec.js	🦺 feat: Configurable Baseline HTTP Security Headers (#14445)	2026-08-25 08:21:39 -04:00
socialLogins.js
socialLogins.spec.js
telemetry.js
telemetry.spec.js