Tanish Manku 62b0d0bd60 Automation: an allowed command can't run a denied one on its behalf (#861) ... Untrusted sessions (MCP, the control channel) checked only the top-level command and the steps of `actions.play`. Any other command that runs commands internally ran them unchecked, so the allowed `file.automate.conditionalModeChange` could run `image.mode.*`, which the desktop gate denies because it resolves the user's configured colour profiles. `Session::dispatch` now applies `Session::authorize` to every command before any side effect, nested ones included, which closes the class rather than this one command. Sessions without a gate (local UI, `photocraft-cli run`) are unchanged.		2026-10-07 23:58:26 -07:00
..
src	Automation: an allowed command can't run a denied one on its behalf (#861)	2026-10-07 23:58:26 -07:00
book.toml	docs: add mdBook and security documentation foundation (#35)	2026-10-04 12:31:18 -04:00