janniclas.loosenandClaude Opus 5.5
1df655a74e
- AbilityRegistrar: wrap permission_callback in try/catch(Throwable) like execute_callback, so a throwing permission() denies (Errors::internal()) instead of skipping rest_request_after_callbacks and leaving RequestContext's flag set for a later request in the same PHP worker. - RequestContext::recordRoute() now recomputes the flag (and bearer token) unconditionally on every matched REST request instead of only setting it true for our own route, so a stale true left behind by an earlier request is reset by the next non-matching one (fail closed, defense in depth). - RequestContext::recordRoute() matches the Authorization "Bearer" scheme case-insensitively. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7