8 Commits

Include renames

Author	SHA1	Message	Date
Alex	66786c2760	fix: remove code exec as default and sec improvements	2026-07-08 18:50:10 +01:00
Alex	94a845aa82	fix: more artefact hardening	2026-07-04 11:42:27 +02:00
Alex	47cc0314af	feat: more executor guards	2026-07-03 23:53:51 +02:00
Alex	a0f10925af	fix: artefact fixes	2026-07-03 20:16:31 +02:00
Alex	bd88dd6807	feat: scope artefacts on api	2026-07-01 20:34:27 +02:00
Alex	75e07af78f	fix: minor issue fixes	2026-06-30 18:36:06 +02:00
Alex	b144265094	fix: workflow security pass	2026-06-29 19:21:35 +02:00
Alex	922ed53a70	Add artifact REST endpoints (list, get, download, restore) ... Serve artifact metadata and bytes over HTTP with parent-derived authorization: conversation-parented artifacts inherit conversation access (owner, shared_with, or a public share token whose conversation matches the parent), workflow-run artifacts check run ownership, and access fails closed when the parent is missing or deleted. Adds list/get/versions/download/restore routes, an authenticated storage-agnostic download (sanitized Content-Disposition, 302 to a short-lived private S3 presigned URL when that strategy is configured), a generate_presigned_url primitive on the storage base and S3 backend, and generalizes the tools artifact endpoint for documents/files. Shared authorization helpers live in a dedicated module used by both surfaces.	2026-06-24 10:53:41 +01:00