3 people 35a79caf87 fix(web): assign unique thread_id to manual routine triggers (#500) ...

* fix(web): assign unique thread_id to manual routine triggers

Manual routine triggers via the web API created an IncomingMessage
without a thread_id, causing session_manager.resolve_thread() to
route the output to whatever thread was last associated with the
(user, "gateway", None) key. This sets a unique thread_id of the
form "routine-{id}-{timestamp}" so each manual trigger gets its own
dedicated thread.

Closes #484

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: add ownership check to routine trigger handler (IDOR)

Address review feedback: verify routine.user_id matches the
authenticated user before allowing the trigger, preventing
unauthorized cross-user routine execution.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* style: cargo fmt

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

2026-03-04 00:41:41 +00:00

..

chat.rs

feat(web): persist tool calls, restore approvals on thread switch, and UI fixes (#382)

2026-02-27 17:46:37 +04:00

extensions.rs

feat: add OAuth support for WASM tools in web gateway (#489)

2026-03-04 01:08:40 +08:00

jobs.rs

feat(web): fix jobs UI parity for non-sandbox mode (#491)

2026-03-03 22:23:30 +08:00

memory.rs

fix(workspace): thread document path through search results (#503)

2026-03-03 23:31:30 +00:00

mod.rs

Fix skills system: enable by default, fix registry and install (#300)

2026-02-23 10:04:02 -08:00

routines.rs

fix(web): assign unique thread_id to manual routine triggers (#500)

2026-03-04 00:41:41 +00:00

settings.rs

refactor: architecture improvements for contributor velocity (#198)

2026-02-18 23:05:47 +00:00

skills.rs

fix(skills): use slug for skill download URL from ClawHub (#502)

2026-03-03 23:53:16 +00:00

static_files.rs

feat: add IRONCLAW_BASE_DIR env var with LazyLock caching (#397)

2026-02-27 17:43:43 +04:00