yoni
6ffe98312d
Session-gate the /api/runs history list
2026-07-21 02:24:06 +00:00
devin-ai-integration[bot] and yoni
000a243861
Close two follow-up viewer authz gaps (session-gate history reads, fail-closed expiry) ( #819 )
...
* Session-gate historical run reads; fail closed on missing expiry
* Accept epoch-seconds relay expiry so valid verification is not misread
* Reject OTP verify responses lacking a usable expiry
---------
Co-authored-by: yoni <yoni@usestrix.com >
2026-07-21 00:22:19 +00:00
devin-ai-integration[bot] and yoni
7b412ac3b1
Harden local viewer authorization (session capability, history gating, expiry) ( #818 )
...
* Harden viewer authz: session capability, history gating, expiry
* Set session cookie whenever index.html is served
* Gate session capability behind bootstrap token; sync auth status with expiry
---------
Co-authored-by: yoni <yoni@usestrix.com >
2026-07-20 23:45:11 +00:00
Jonathan Singer
de1c36d7e6
Update viewer event test for the cta surface and funnel events
2026-07-20 15:15:47 -04:00
Jonathan Singer
46e4b16167
Add a local web viewer for runs
...
`strix view` opens a run in the browser, served locally from the run files
(nothing is uploaded). There's also a quick link to it from the TUI and the
end-of-run summary.
2026-07-20 09:51:56 -04:00
yoni