🦋 New version release

[brentrager]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@smooai/smooth-operator@1.36.5

Patch Changes

• 5d0a499: SECURITY (Python server): scope sessions by owner only when an owner exists (Option B, th-909995)

  The th-8fe998 scoping rule fail-closed on any principal without an email claim. On an
  auth-enabled server that locked out anonymous connections and authenticated-but-emailless
  principals entirely — the session they had just created was ownerless, so list_conversations
  returned empty, resume minted a fresh conversation, and get_session / get_conversation_messages
  / send_message all answered SESSION_NOT_FOUND. The identical rule in the .NET twin hung CI on
  a WebSocket ACL test and was reverted in Revert: .NET write-path scoping (#308) — hangs CI, denies anonymous/emailless principals #309.

  Option B: a session that HAS an owner is still owner-checked (case/whitespace-insensitive email
  match); a session with NO owner — anonymous, emailless, or predating ownership — is reachable, as
  it was before scoping shipped. An emailless scope matches no non-empty owner, so the reported P0
  stays closed: authenticated A cannot read, resume, or send_message into authenticated B's owned
  session, and a refusal appends nothing to B's log. Not-yours remains byte-identical to
  never-existed (no existence oracle), and the auth-disabled single-tenant flavor is unchanged.

  Option A (email ?? sub) was rejected: Go's anonymous principal uses the literal sub "anonymous"
  for every visitor, so keying on sub would pool all anonymous visitors together and leak their
  chats to each other.

  SessionStore.create_session / list_conversations gain a keyword-only enforced: bool = False
  that distinguishes "auth disabled, unscoped" from "authenticated but emailless" — both of which
  present as a None owner.

@smooai/smooth-operator-web-chat-example@0.0.41

Patch Changes

• Updated dependencies [5d0a499]
  • @smooai/smooth-operator@1.36.5