* fix: expose apps:run in the token scope picker and let apps:write grant it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: confine path-scoped app run/write tokens to the app they name
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let apps:run read back its own app's S3 files, condense scope comments
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: let apps:write mint apps:run and extend run read-back to app S3 display routes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: drop stale embed-token wording from the app S3 helper summary
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: require pinned sha for inline raw_code in viewer app run mode
* fix: gate rd_string import behind parquet feature to fix oss build
* fix: also require pin for raw_code with app_script id in viewer run mode
* fix: enforce auth guards on app component preview execution
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: guard previewed runnable path and worker tag in app preview
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: validate app_script id ownership and keep root push isolation
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: scope app preview guards to operator check + referenced runnables
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: require jobs:run scope and tag check on app preview (apps:run escalation)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ruben Fiszel