mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-27 00:02:21 +01:00
88772b3278
POST /api/tasks and the scheduler both refuse action tasks whose action is in ADMIN_ONLY_TASK_ACTIONS (run_local, run_script, ssh_command, cookbook_serve) for owners without admin task privileges: those actions reach subprocess.run(shell=True) or SSH with no sandbox. The model-facing manage_tasks tool applied neither check, so an agent could create or edit such a task, resume it, or trigger it, and only the scheduler's execution-time guard stood in the way (pausing the task after the fact). Route the tool through the same src.task_action_policy helpers the HTTP route uses: create checks the requested type/action, edit checks the task as it would be after the edit (so an llm task cannot be flipped into a shell action), and resume/run check the stored task. Admins, non- privileged actions and llm/research tasks are unaffected; pause still works for everyone since it only narrows. Fixes #6021 Claude-Session: https://claude.ai/code/session_01UAB5sz5srMKR7rbeDFtdMH Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com>