jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-29 17:22:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

merge(dev): reconcile photo editor security and upstream changes

Browse Source 
- Reconcile conflict resolution in routes/editor_agent_routes.py and src/editor_agent_model.py
- Enforce strict server-authorized endpoint resolution and reject client URL overrides
- Enforce bearer-token privilege separation: delegated API tokens are capped at non-admin scope per src/tool_security.py and cannot inspect private base URLs or probe metadata
- Preserve chat-scope authorization, missing-session 401 rejection, and owner-scoped browser bridge/SSE queues
- Preserve administrator-disabled-tool denylist enforcement introduced by PR #6357
- Fix mobile toolbar flyout hit-testing and stacking context trapping on viewports <= 700px via scoped elevation and mask suppression
- Stabilize project recovery test fixture by awaiting document draft quiescence prior to baseline capture
This commit is contained in:
Alexandre Teixeira
2026-10-28 19:30:08 +00:00
parent c237a1cb9c 57a1859f08
commit 2e1c2a343a
94 changed files with 12199 additions and 477 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/js/chat.js
+9 -1
View File
@@ -6149,7 +6149,15 @@ import { invalidateSettings } from './appConfig.js';
cache: 'no-store',
});
if (!_getForegroundStreamState() || _backgroundStreams.has(sid)) return;
if (res.status !== 404) return;
// The server now reports "no active stream" as 200 {status:"idle"} (an
// older server used 404); a body with status "streaming" means it is NOT
// stale. Accept both so the watchdog keeps working across deploys.
if (res.status !== 404 && !res.ok) return;
let _probe = null;
try { _probe = await res.json(); } catch (_) { _probe = null; }
const _noActiveStream = res.status === 404 || (res.ok && _probe &&
typeof _probe.status === 'string' && _probe.status !== 'streaming');
if (!_noActiveStream) return;
console.warn('[stream-watchdog] Local stream was stale and server has no active stream. Unlocking composer.');
if (active.abortCtrl && !active.abortCtrl.signal.aborted) {
static/js/editor/build/toolbar.js
+4
View File
@@ -109,6 +109,8 @@ export function buildToolbar({ currentTool, onSelectTool, onClearSelection }) {
const closeAllFlyouts = () => {
toolbar.querySelectorAll('.ge-tool-slot.open').forEach(s => s.classList.remove('open'));
toolbar.classList.remove('ge-flyout-open');
toolbar.closest('.ge-toolbar-wrap')?.classList.remove('ge-flyout-open');
};
const openFlyout = (slotEl, face) => {
@@ -116,6 +118,8 @@ export function buildToolbar({ currentTool, onSelectTool, onClearSelection }) {
closeAllFlyouts();
if (isOpen) return;
slotEl.classList.add('open');
toolbar.classList.add('ge-flyout-open');
toolbar.closest('.ge-toolbar-wrap')?.classList.add('ge-flyout-open');
const flyout = slotEl.querySelector('.ge-tool-flyout');
if (!flyout) return;
const r = face.getBoundingClientRect();