Ernest Hysa 3738df3b93 fix(tasks): validate then_task_id belongs to same owner on create/update (#2764) ...

then_task_id was stored without checking the target task's owner. A user
could chain their task to execute any other user's task on success via the
scheduler's _run_chained path. Now verifies the target task exists and
belongs to the requesting user before storing.

2026-06-05 15:12:47 +02:00

..

__init__.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

admin_wipe_routes.py

Admin: wipe gallery albums with images

2026-06-02 20:35:57 +09:00

api_token_routes.py

Codex Agent integration: HTTP surface + plugin bundle + Settings UI

2026-06-03 22:49:09 +09:00

assistant_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

auth_routes.py

feat: round-limit handling — Continue affordance at the cap + configurable cap (#1999)

2026-06-04 22:36:05 +02:00

backup_routes.py

fix: backup import drops a user's memory when its text matches another user's (#1743)

2026-06-03 13:29:14 +09:00

calendar_routes.py

Fix calendar routing and user-local time context (#408)

2026-06-04 13:20:04 +01:00

chat_helpers.py

fix: normalize Gemma 4 thought-channel output (#2224)

2026-06-04 19:26:58 +02:00

chat_routes.py

feat: Add workspace: confine agent tools to a folder (#1103)

2026-06-05 00:06:37 +02:00

cleanup_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

codex_routes.py

cookbook agent debug loop: persistent log files, auto-adopt orphan tmux, Codex/Claude skill parity

2026-06-04 23:27:18 +09:00

compare_routes.py

fix(compare): stop blind mode leaking model identities via session names (#1318)

2026-06-04 04:39:01 +01:00

contacts_routes.py

fix(contacts): parse Apple/iCloud item-grouped vCard EMAIL/TEL properties (#1438)

2026-06-03 14:24:04 +09:00

cookbook_helpers.py

cookbook agent debug loop: persistent log files, auto-adopt orphan tmux, Codex/Claude skill parity

2026-06-04 23:27:18 +09:00

cookbook_routes.py

Cookbook scheduler + serve: schedule via Tasks, Stop verifies kill, Ollama auto port-pick

2026-06-05 14:41:43 +09:00

copilot_routes.py

feat(provider): add GitHub Copilot provider with device-flow auth (#1480)

2026-06-04 21:13:14 +02:00

diagnostics_routes.py

Fix email-thread HTML injection, attachment path traversal, and missing authz (#475)

2026-06-01 22:20:17 +09:00

document_helpers.py

fix: _resolve_user_upload_path crashes on a non-dict resolve_upload result (#1715)

2026-06-03 13:34:33 +09:00

document_routes.py

fix(document): add 404 guard to version list/get endpoints (#2762)

2026-06-05 15:12:40 +02:00

editor_draft_routes.py

Ignore invalid editor draft payloads (#1533)

2026-06-03 14:07:03 +09:00

email_helpers.py

fix(email): scope AI caches by owner (#2695)

2026-06-05 02:21:50 +02:00

email_pollers.py

fix(email): scope AI caches by owner (#2695)

2026-06-05 02:21:50 +02:00

email_routes.py

fix(email): scope AI caches by owner (#2695)

2026-06-05 02:21:50 +02:00

embedding_routes.py

Ignore non-object embedding endpoint config (#1260)

2026-06-03 14:12:41 +09:00

emoji_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

font_routes.py

Keep compact font family names together (#1263)

2026-06-03 14:24:30 +09:00

gallery_helpers.py

fix: gallery records raw instead of display dimensions for EXIF-rotated photos (#1667)

2026-06-03 14:23:04 +09:00

gallery_routes.py

fix(gallery): add auth check to /api/image/sharpen endpoint (#2761)

2026-06-05 15:12:33 +02:00

history_routes.py

fix(history): block compact during active runs (#2635)

2026-06-04 21:50:16 +02:00

hwfit_routes.py

Merge remote-tracking branch 'origin/main' into visual-pr-playground

2026-06-03 16:49:10 +09:00

mcp_routes.py

feat(mcp): add Streamable HTTP transport with OAuth 2.0 (#1033)

2026-06-05 02:40:52 +02:00

memory_routes.py

fix(uploads): bound direct upload reads

2026-06-04 00:32:50 +01:00

model_routes.py

fix: bool('false') is True coerces endpoint toggles incorrectly (#2361)

2026-06-04 19:43:38 +02:00

note_routes.py

fix: fire-reminder endpoint crashes with NameError on _gcu (#1250)

2026-06-03 01:02:25 +09:00

personal_routes.py

fix: personal-docs path confinement used abspath, allowing symlink escape (#1728)

2026-06-03 13:29:57 +09:00

prefs_routes.py

Persist user prefs atomically (#1840)

2026-06-04 03:55:22 +01:00

preset_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

research_routes.py

fix(research): owner-scope endpoint resolution

2026-06-03 23:19:28 +01:00

search_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

session_routes.py

fix(history): block compact during active runs (#2635)

2026-06-04 21:50:16 +02:00

shell_routes.py

Add a 'Rebuild llama.cpp' Cookbook action to force a fresh GPU build (#1787)

2026-06-03 13:28:19 +09:00

signature_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

skills_routes.py

fix: skill test-task / precision helpers crash on a non-dict skill (#1638)

2026-06-03 08:59:24 +09:00

stt_routes.py

fix(uploads): bound direct upload reads

2026-06-04 00:32:50 +01:00

task_routes.py

fix(tasks): validate then_task_id belongs to same owner on create/update (#2764)

2026-06-05 15:12:47 +02:00

tts_routes.py

Odysseus v1.0

2026-05-31 23:58:26 +09:00

upload_routes.py

fix: use safe .get for id lookup in uploads.json to prevent KeyError (#1465)

2026-06-03 14:12:00 +09:00

vault_routes.py

Keep Bitwarden unlock password off argv (#1311)

2026-06-03 02:13:51 +09:00

webhook_routes.py

Reapply "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus"

2026-06-03 22:47:00 +09:00

workspace_routes.py

feat: Add workspace: confine agent tools to a folder (#1103)

2026-06-05 00:06:37 +02:00