|
|
20c2fcd496
|
Harden auth with revocable sessions, cookies, and single-login default.
Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
2026-08-06 14:13:37 +08:00 |
|
|
|
9314f11ce7
|
Fix WebCRT sessions killed by StrictMode ws_ticket reuse.
Allow short-lived tickets multiple uses, stop deleting PTY on transient websocket errors, and avoid marking connect complete after a dropped wait loop.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
2026-08-02 18:49:29 +08:00 |
|
|
|
d56020d84c
|
Harden runtime budgets: DB pool, CLI concurrency, timeouts, and metrics.
Add shared CLI budget/timeout with force-close, parallel port-traffic dispatch, unified shutdown, bounded audit queue, output/log caps, and /metrics probes.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
2026-08-02 18:02:43 +08:00 |
|
|
|
96b76294b4
|
Split UME sync and WebCRT session into focused modules.
Keep public facades stable, re-export symbols tests patch, and fix missing threading import plus reaper fixture state.
Co-authored-by: Cursor <cursoragent@cursor.com>
|
2026-08-02 17:12:55 +08:00 |
|
