Austin Pickett dcf99b55a3 fix(security): address CodeQL path-traversal and info-exposure findings ...

- Add _validate_plugin_name() guard on all {name} path param endpoints
  (rejects /, \, .. before reaching plugin logic)
- Strip after_install_path from install response (no internal paths to client)
- Update nix/tui.nix lockfile hash to match committed package-lock.json

2026-04-30 18:50:28 -04:00

..

__init__.py

chore: release v0.12.0 (2026.4.30) (#18057)

2026-04-30 11:31:01 -07:00

_parser.py

refactor(cli): derive relaunch flag table from argparse introspection

2026-04-29 20:33:29 -07:00

auth_commands.py

feat(cli): add minimax-oauth provider with PKCE browser flow

2026-04-29 09:53:42 -07:00

auth.py

chore(salvage): strip duplicated/merge-corrupted blocks from PR #17664

2026-04-29 21:56:51 -07:00

azure_detect.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

backup.py

feat(claw-migrate): harden OpenClaw import with plan-first apply, redaction, and pre-migration backup (#16911)

2026-04-28 01:50:23 -07:00

banner.py

fix(banner): show correct update status on nix-built hermes (#17550)

2026-04-30 07:03:00 +05:30

browser_connect.py

fix(browser): address Copilot review on /browser connect

2026-04-28 22:11:10 -07:00

callbacks.py

fix: ESC cancels secret/sudo prompts, clearer skip messaging (#9902)

2026-04-14 16:11:37 -07:00

claw.py

feat(claw-migrate): harden OpenClaw import with plan-first apply, redaction, and pre-migration backup (#16911)

2026-04-28 01:50:23 -07:00

cli_output.py

refactor: remove dead code — 1,784 lines across 77 files (#9180)

2026-04-13 16:32:04 -07:00

clipboard.py

feat: fix img pasting in new ink plus newline after tools

2026-04-11 13:14:32 -05:00

codex_models.py

feat(codex): add gpt-5.5 and wire live model discovery into picker (#14720)

2026-04-23 13:32:43 -07:00

colors.py

feat: respect NO_COLOR env var and TERM=dumb (#4079)

2026-03-30 17:07:21 -07:00

commands.py

chore(salvage): strip duplicated/merge-corrupted blocks from PR #17664

2026-04-29 21:56:51 -07:00

completion.py

fix: preserve profile name completion in dynamic shell completion

2026-04-14 10:45:42 -07:00

config.py

fix(curator): seed defaults on update, create logs/curator dir, defer fire import (#17927)

2026-04-30 04:52:28 -07:00

copilot_auth.py

fix(copilot): exchange raw GitHub token for Copilot API JWT

2026-04-24 05:09:08 -07:00

cron.py

feat(cron): per-job workdir for project-aware cron runs (#15110)

2026-04-24 05:07:01 -07:00

curator.py

feat(curator): show most-used and least-used skills in hermes curator status (#18033)

2026-04-30 10:37:33 -07:00

curses_ui.py

feat: ungate Tool Gateway — subscription-based access with per-tool opt-in

2026-04-16 12:36:49 -07:00

debug.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

default_soul.py

fix: reset default SOUL.md to baseline identity text (#3159)

2026-03-26 01:34:27 -07:00

dingtalk_auth.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

doctor.py

fix(ci): stabilize main test suite regressions (#17660)

2026-04-29 23:18:55 -07:00

dump.py

refactor(redact): canonical mask_secret helper; fix status.py DIM drift (#17207)

2026-04-28 21:04:35 -07:00

env_loader.py

refactor: consolidate symlink-safe atomic replace into shared helper

2026-04-28 04:58:22 -07:00

fallback_cmd.py

feat(cli): add 'hermes fallback' command to manage fallback providers (#16052)

2026-04-26 06:19:04 -07:00

gateway.py

fix: handle gateway Ctrl+C shutdown cleanly

2026-04-30 03:29:57 -07:00

hooks.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

logs.py

feat: component-separated logging with session context and filtering (#7991)

2026-04-11 17:23:36 -07:00

main.py

Merge upstream/main and address Copilot review feedback

2026-04-30 06:43:22 -04:00

mcp_config.py

refactor(config): migrate remaining 33 cfg_get call sites (#17311)

2026-04-29 04:03:03 -07:00

memory_setup.py

fix(memory): discover user-installed memory providers from $HERMES_HOME/plugins/ (#10529)

2026-04-15 14:25:40 -07:00

model_catalog.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

model_normalize.py

feat(minimax-oauth): full integration with peer OAuth providers

2026-04-29 09:53:42 -07:00

model_switch.py

fix: prevent bare 'custom' slug in model.provider (#17478)

2026-04-30 04:32:11 -07:00

models.py

fix(anthropic): reactive recovery for OAuth 1M-context beta rejection (#17752)

2026-04-29 21:56:54 -07:00

nous_subscription.py

fix(cli): coerce use_gateway config flags in tool routing

2026-04-26 19:02:55 -07:00

oneshot.py

fix(tui): honor launch toolsets (#17623)

2026-04-29 16:55:27 -07:00

pairing.py

fix(pairing): handle null user_name in pairing list display

2026-04-23 02:34:11 -07:00

platforms.py

feat: complete plugin platform parity — all 12 integration points

2026-04-29 21:56:51 -07:00

plugins_cmd.py

feat(dashboard): add Plugins page with enable/disable, auth status, install/remove

2026-04-30 17:41:10 -04:00

plugins.py

feat(plugins): bundled platform plugins auto-load by default

2026-04-29 21:56:51 -07:00

profiles.py

Merge upstream/main and address Copilot review feedback

2026-04-30 06:43:22 -04:00

providers.py

fix: prevent bare 'custom' slug in model.provider (#17478)

2026-04-30 04:32:11 -07:00

pty_bridge.py

fix: mobile chat in new layout

2026-04-24 12:07:46 -04:00

relaunch.py

remove relaunch_chat

2026-04-29 20:33:29 -07:00

runtime_provider.py

fix(runtime_provider): _get_named_custom_provider must honour transport field on v12+ providers dict

2026-04-30 03:29:48 -07:00

setup.py

feat(plugins): bundled platform plugins auto-load by default

2026-04-29 21:56:51 -07:00

skills_config.py

refactor(config): migrate remaining 33 cfg_get call sites (#17311)

2026-04-29 04:03:03 -07:00

skills_hub.py

feat(skills): install skills from a direct HTTP(S) URL (#16323)

2026-04-26 20:57:10 -07:00

skin_engine.py

fix(tui): restore macOS copy behavior and theme polish (#17131)

2026-04-28 18:47:14 -05:00

slack_cli.py

feat(slack): register every gateway command as a native slash (Discord/Telegram parity) (#16164)

2026-04-26 11:38:32 -07:00

status.py

feat: complete plugin platform parity — all 12 integration points

2026-04-29 21:56:51 -07:00

timeouts.py

refactor(timeouts): drop redundant ImportError in except clause

2026-04-26 20:48:20 -07:00

tips.py

feat(tips): add cost-saving tips from April 30 tip-of-the-day (#17841)

2026-04-30 02:30:36 -07:00

tools_config.py

feat(tts): add Piper as a native local TTS provider (closes #8508) (#17885)

2026-04-30 02:53:20 -07:00

uninstall.py

feat(uninstall): offer to remove named profiles when uninstalling from default

2026-04-18 19:18:13 -07:00

vercel_auth.py

feat: add Vercel Sandbox backend

2026-04-29 07:22:33 -07:00

voice.py

fix(tui): ignore SIGPIPE so stderr back-pressure can't kill the gateway

2026-04-23 16:18:15 -07:00

web_server.py

fix(security): address CodeQL path-traversal and info-exposure findings

2026-04-30 18:50:28 -04:00

webhook.py

refactor(config): migrate remaining 33 cfg_get call sites (#17311)

2026-04-29 04:03:03 -07:00