Nan Gao 0966131b31 fix(channels): require bound identity for user-owned IM messages (#3578) ...

* fix(channels): require bound identity for user-owned IM messages

* make format

* docs: document bound identity channel config

* refactor: reuse channel connection config

* refactor _requires_bound_identity()

* refactor from_app_config()

* make format

* fix: reject unbound channel chats before semaphore

* security enhancement

* make format

* fix: enforce bound-identity admission at command entry point

The bound-identity gate only ran for non-command messages in
_handle_message() and as a fallback inside _handle_chat(). Commands had
no equivalent boundary, so an unbound platform user could send /new and
reach _create_thread() directly, creating an unowned Gateway thread and
empty checkpoint. Info commands (/status, /models, /memory) likewise
leaked Gateway state to unbound users.

Add the same _requires_bound_identity() check at the top of
_handle_command(), rejecting via _reject_unbound_channel_message() before
any thread creation or Gateway query. The gate is a no-op in legacy
open-bot mode (require_bound_identity=False) and auth-disabled mode.
Provider-level binding flows (/connect, /start) are consumed by the
provider adapter before reaching the manager, so they are unaffected.

Tests:
- unbound auth-enabled /new is rejected before threads.create
- bound auth-enabled /new still creates the thread

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(channels): carry workspace fallback decision on inbound messages

* fix(channels): recheck bound identity by normalized workspace

* fix(channels): avoid duplicate bound identity checks

* fix(channels): preserve verified routing for bound identity rejects

* fix(channels): clarify bound identity upgrade failures

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-06-16 23:04:39 +08:00

..

__init__.py

feat(loop-detection): make loop detection configurable with per-tool frequency overrides (#2711)

2026-05-07 16:15:15 +08:00

acp_config.py

feat(acp): add env field to ACPAgentConfig for subprocess env injection (#1447)

2026-03-27 20:03:30 +08:00

agents_api_config.py

fix: disable custom-agent management API by default (#2161)

2026-04-14 00:03:38 +08:00

agents_config.py

fix(agents): require config.yaml in resolve_agent_dir to skip memory-only directories (#3390) (#3481)

2026-06-10 23:57:17 +08:00

app_config.py

make ai follow-up suggestions optional (#3591)

2026-06-15 17:59:25 +08:00

channel_connections_config.py

fix(channels): require bound identity for user-owned IM messages (#3578)

2026-06-16 23:04:39 +08:00

checkpointer_config.py

fix(runtime): protect sync singleton init and reset (#3413)

2026-06-08 08:38:36 +08:00

database_config.py

feat(persistence):Unified persistence layer with event store, feedback, and rebase cleanup (#2134)

2026-04-26 11:09:55 +08:00

extensions_config.py

fix(mcp): accept transport field as alias for type (#3238) (#3243)

2026-06-03 18:11:38 +08:00

guardrails_config.py

feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

2026-03-23 18:07:33 +08:00

loop_detection_config.py

feat(loop-detection): make loop detection configurable with per-tool frequency overrides (#2711)

2026-05-07 16:15:15 +08:00

memory_config.py

feat(memory): add memory.token_counting config to avoid tiktoken network dependency (#3429) (#3465)

2026-06-10 23:26:15 +08:00

model_config.py

fix(#3189): prevent write_file streaming timeout on long reports (#3195)

2026-06-07 17:47:11 +08:00

paths.py

feat(im): Add user-owned IM channel connections (#3487)

2026-06-12 15:24:58 +08:00

reload_boundary.py

feat(im): Add user-owned IM channel connections (#3487)

2026-06-12 15:24:58 +08:00

run_events_config.py

feat(persistence): add unified persistence layer with event store, token tracking, and feedback (#1930)

2026-04-26 11:05:47 +08:00

runtime_paths.py

fix(harness): resolve runtime paths from project root (#2642)

2026-05-01 22:19:50 +08:00

safety_finish_reason_config.py

fix(runtime): suppress tool execution when provider safety-terminates with tool_calls (#3035)

2026-05-22 21:20:28 +08:00

sandbox_config.py

fix(sandbox): make missing sandbox.mounts host_path a loud ERROR (#3244) (#3250)

2026-06-09 23:16:14 +08:00

skill_evolution_config.py

Implement skill self-evolution and skill_manage flow (#1874)

2026-04-06 22:07:11 +08:00

skills_config.py

fix(harness): restore legacy skills path fallback (#2694) (#2696)

2026-05-03 23:40:59 +08:00

stream_bridge_config.py

fix(config): reset config-backed singletons on hot reload (#2588)

2026-05-06 10:17:55 +08:00

subagents_config.py

fix(subagents): raise general-purpose max_turns to 150 and default timeout to 30min (#3610)

2026-06-16 19:55:04 +08:00

suggestions_config.py

make ai follow-up suggestions optional (#3591)

2026-06-15 17:59:25 +08:00

summarization_config.py

fix(middleware): avoid rescuing non-skill tool outputs during summarization (#2458)

2026-04-24 21:19:46 +08:00

title_config.py

fix(tracing): propagate session_id and user_id into Langfuse traces (#2944)

2026-05-21 16:49:31 +08:00

token_usage_config.py

enable token usage by default (#2841)

2026-05-10 22:00:57 +08:00

tool_config.py

refactor: split backend into harness (deerflow.*) and app (app.*) (#1131)

2026-03-14 22:55:52 +08:00

tool_output_config.py

feat(agent): add ToolOutputBudgetMiddleware for oversized tool output protection (#3303)

2026-05-29 22:59:26 +08:00

tool_search_config.py

feat(tools): add tool_search for deferred MCP tool loading (#1176)

2026-03-17 20:43:55 +08:00

tracing_config.py

fix(tracing): propagate session_id and user_id into Langfuse traces (#2944)

2026-05-21 16:49:31 +08:00