What's Changed
- fix(api, sdk): tighten organization admin checks, SSO domains, and turn runtime ids by @mmabrouk in #7776
- chore(release): bump version to v0.123.1 by @mmabrouk in #7777
- ci: let the release branch workflow take an exact version by @mmabrouk in #7781
- fix(api, sdk): tighten credential, password reset, SSO and test_run checks by @mmabrouk in #7782
- fix(runner): bound sandbox reads and probe redirects, reserve MCP server names by @mmabrouk in #7783
- fix(api): cache miss locks expire after their TTL in seconds by @mmabrouk in #7784
- fix(api): workspace creation finds the caller by their user id by @mmabrouk in #7785
- fix(runner): a run whose access was removed ends with access denied by @mmabrouk in #7786
- docs(sharing): sharing program contract, OpenSpec changes and milestone designs by @mmabrouk in #7747
- feat(api): resolve project membership in one place and check project route permissions by @mmabrouk in #7748
- fix(api): keep the membership repair migration fast on large databases by @mmabrouk in #7787
- feat(api): give every run a principal and decide access in one place by @mmabrouk in #7754
- feat(api): store each mount's storage prefix by @mmabrouk in #7739
- [release] v0.124.0 by @github-actions[bot] in #7779
Full Changelog: v0.123.0...v0.124.0