Ruben FiszelandClaude Opus 5 b4a4cd8fdd fix: close three holes in the operator builder boundary ...

Found by the local Codex and Claude review passes. Each one let an operator with
builder rights reach code the composition check was supposed to keep out.

- Version-pinned flow steps. A step carrying a `hash` is dispatched by that hash
  alone: `script_to_payload` ignores the path beside it, reads the row with root
  permissions, and takes that script's tag and `on_behalf_of` identity. A builder
  could pin the hash of a script it cannot read under a path it can, and run that
  instead, possibly as the identity that script runs as. The walk now reports
  every `(path, hash)` pair and `validate_operator_composed_flow` verifies each
  against the caller's own permissions.

- Raw-script triggerables in a builder-authored app policy. `execute_component`'s
  run mode authorizes caller-supplied `raw_code` by the policy's
  `rawscript/<sha>` key alone; its operator guard only covers preview mode. A
  builder could deploy a clean value whose policy pinned an arbitrary sha, then
  execute matching code on a worker. Both triggerables maps are now refused such
  a key, which also closes the policy-supplied worker tag that rode with it.

- `inlineScript` without a `language`. `traverse_app_inline_scripts` only reports
  a script whose language parses and stops descending at the key, which is right
  for locking and wrong for an authorization check the author's fields control.
  Replaced with `app_value_has_inline_script`, which refuses the key itself.

Also: the builder flag gates writes and was cached per process, so revoking it
left every other replica authorizing until its own entry expired. An
`AFTER UPDATE OF operator_settings` trigger now emits `notify_operator_settings_change`
and `process_notify_event` drops the entry, the same way the other
authorization-adjacent caches propagate.

And `CreateActionsMenu`'s option list read the store outside a reactive context,
so switching workspace without a reload kept the previous workspace's kinds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-16 22:00:23 +00:00

..

src

fix: close three holes in the operator builder boundary

2026-08-16 22:00:23 +00:00

Cargo.toml

fix: keep native triggers attached when a runnable is renamed (#10432)

2026-07-31 23:44:25 +02:00