?session= pins an attachment read, an edit, an unsend and a reaction to one conversation (SITP TP13)

Shipped

October 18, 2026 at 4:42 PM UTC

Author

Kamo

Commit

a17866a

The Tool Plane checks a run's audience on the conversation an SI names. A message id or an attachment id alone could reach another conversation the SI also belongs to, so these four endpoints now take an optional ?session=<guid>: a message or attachment of any other conversation answers 404 before anything is read or changed. Without the parameter every endpoint answers as before.