fix(security): constrain API token chat authority

2026-10-25 07:12:20 +01:00 · 2026-08-28 13:25:13 +00:00
parent c9dd68d890
commit aeff329c05
9 changed files with 235 additions and 18 deletions
@@ -59,6 +59,7 @@ def _history_grants_chat_session_approval(
            if (
                ask_user.get("kind") == "tool_approval"
                and ask_user.get("resolved") == CHAT_SESSION_APPROVAL_DECISION
+                and ask_user.get("approved_by_interactive_session") is True
                and str(ask_user.get("session_id") or "") == expected_session
            ):
                return True