Yuval Dinodia 0a588fa795 fix(acp): /acp sessions exposes every gateway session to non-owner senders (#110745) ... * fix(acp): scope /acp sessions listing for non-owner senders /acp sessions listed every ACP session on the gateway for any sender allowlisted via commands.allowFrom, exposing other senders' session labels, agent ids, runtime state, and thread bindings. The handler now returns only the current bound or requester session for non-owner senders, while owner identity and operator.admin clients keep the full gateway-wide listing, matching the documented contract. Fixes #103055 * test(acp): cover empty and missing-session cases for /acp sessions scoping * fix(acp): avoid non-owner session scans * docs(acp): remove duplicated session scope text * test(acp): cover internal session visibility * fix(acp): require current ACP metadata * test(acp): reject sessions target tokens --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>		2026-07-18 18:38:48 -06:00
..
acp-agents-setup.md	fix(memory-lancedb): prevent cross-agent memory leakage (#103799)	2026-07-16 03:33:08 -07:00
acp-agents.md	fix(acp): /acp sessions exposes every gateway session to non-owner senders (#110745)	2026-07-18 18:38:48 -06:00
agent-send.md	fix(cli): bound --message-file reads for agent command (#101442)	2026-07-18 12:29:33 +01:00
apply-patch.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
ask-user.md	feat(apps,ui): question surface parity and composer takeover (#110681)	2026-07-18 21:42:15 +01:00
brave-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
browser-control.md	docs(browser): clarify JSON flag placement (#103155)	2026-07-12 06:58:40 +01:00
browser-linux-troubleshooting.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
browser-login.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
browser-wsl2-windows-remote-cdp-troubleshooting.md	fix(browser): diagnose empty WSL2 Chrome replies (#100590)	2026-07-06 07:42:02 +01:00
browser.md	docs(browser): clarify JSON flag placement (#103155)	2026-07-12 06:58:40 +01:00
btw.md	feat(ui): redesign /btw side chat into a floating multi-turn panel (#104749)	2026-07-11 16:22:58 -07:00
capability-cookbook.md
chrome-extension.md	feat(browser): add secure per-tab copilot panel (#109817)	2026-07-18 01:00:23 +01:00
clawhub.md
code-execution.md	fix(xai): require consent for cross-provider billed tools (#97629)	2026-07-10 05:30:23 +01:00
code-mode.md	feat: contract sessions-family tool outputs (#110424)	2026-07-18 06:43:12 +01:00
creating-skills.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
diffs.md	refactor(diffs): move ephemeral artifacts to SQLite (#109328)	2026-07-16 16:47:19 -07:00
duckduckgo-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
elevated.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
exa-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
exec-approvals-advanced.md	feat(apps): review durable approvals on mobile (#104913)	2026-07-11 19:59:07 -07:00
exec-approvals.md	fix(exec): stop isolated state dirs from moving live approvals (#108742)	2026-07-16 08:57:32 -07:00
exec.md	fix(exec): track background commands as tasks (#110468)	2026-07-18 08:51:23 +01:00
firecrawl.md	feat(firecrawl): add keyless Firecrawl Search (Free) provider + richer firecrawl_search options (#97078)	2026-07-12 21:04:43 -07:00
gemini-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
goal.md	feat(ui): redesign session goal into interactive composer pill with elapsed time and /goal edit (#100736)	2026-07-06 09:42:49 +01:00
grok-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
image-generation.md	fix(models): refresh bundled provider catalogs (#109410)	2026-07-16 16:47:25 -07:00
index.md	docs: align interactive client behavior (#111047)	2026-07-18 17:00:14 -07:00
kimi-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
llm-task.md	chore: migrate active GPT-5.5 references to GPT-5.6 (#104452)	2026-07-11 06:30:57 -07:00
lobster.md	docs(lobster): enumerate injected workflow env vars and clarify step-output access (#108622)	2026-07-16 05:05:21 -07:00
loop-detection.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
media-overview.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
minimax-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
multi-agent-sandbox-tools.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
music-generation.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
ollama-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
parallel-search.md	chore: migrate active GPT-5.5 references to GPT-5.6 (#104452)	2026-07-11 06:30:57 -07:00
pdf.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
permission-modes.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
perplexity-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
plugin.md	fix: gateway boots when a configured plugin payload is broken (#110239)	2026-07-18 03:50:50 +01:00
reactions.md	fix(channels): honor configured read target policies (#99905)	2026-07-10 22:29:37 -05:00
screen.md	docs: align interactive client behavior (#111047)	2026-07-18 17:00:14 -07:00
searxng-search.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
self-learning.md	fix: default skill workshop approvals to auto (#107690)	2026-07-14 18:31:51 +01:00
show-widget.md	feat(canvas): export widgets as PNG — copy or download from the card menu (#110992)	2026-07-19 00:39:59 +01:00
skill-workshop.md	fix: default skill workshop approvals to auto (#107690)	2026-07-14 18:31:51 +01:00
skills-config.md	fix: default skill workshop approvals to auto (#107690)	2026-07-14 18:31:51 +01:00
skills.md	feat: node-hosted plugins — dynamic tools, MCP servers, and skills (#90431)	2026-07-11 10:16:34 -07:00
slash-commands.md	feat(models): make per-agent allowlists explicit (#110888)	2026-07-18 21:42:05 +01:00
steer.md	docs: align interactive client behavior (#111047)	2026-07-18 17:00:14 -07:00
subagents.md	fix: CLI timeout warnings explain stopped work (#110369)	2026-07-18 06:18:11 +01:00
tavily.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
thinking.md	fix(models): refresh bundled provider catalogs (#109410)	2026-07-16 16:47:25 -07:00
tokenjuice.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
tool-search.md	improve: let Code Mode use declared tool result shapes (#109813)	2026-07-17 14:46:37 +01:00
trajectory.md	refactor: flip sessions and transcripts to sqlite storage (#98236)	2026-07-11 14:50:37 -07:00
tts.md	docs: align SecretRef degradation semantics (#111021)	2026-07-19 00:18:01 +01:00
video-generation.md	fix(models): refresh bundled provider catalogs (#109410)	2026-07-16 16:47:25 -07:00
web-fetch.md	improve(agents): exact web_fetch output contract with cleaned result shape (#110223)	2026-07-18 03:28:29 +01:00
web.md	improve(agents): normalized web_search output contract with boundary-owned wrapping (#110308)	2026-07-18 03:39:29 +01:00