cynarAI/evOo-local
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
28 Commits 95 Branches 0 Tags
Commit Graph

3 Commits

Author SHA1 Message Date
Cursor Agent
c8b06ec7a8 fix(api): gate memory/providerConfig read behind Space owner authz 
Non-owner Space members could read provider settings (mode, baseUrl,
endpoint metadata) while connect/disconnect/setDefaultScope already
required owner role. Align the read path with write authz.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
 2026-09-22 06:20:54 +00:00
Cursor Agent
8ae36763a7 fix(api): scope Team Computer bot homes per member in shared Spaces 
Team mode shares one disk per Space. RPC and executor paths under
bots/<otherBotId>/ were reachable with any member-owned entry bot,
leaking another member's workspace files while same-user cross-bot
access stays intentional.

Add path guards, filter bot listings, regression tests.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
 2026-09-22 06:20:49 +00:00
cynarAI
6c7eed7580 Initial clean evOo-local from f00577b 
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline
(Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/*
packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
 2026-09-20 17:15:16 +02:00