Brooklyn Nicholson 6afeea2bea harden(pets): host-pin asset downloads + sanitize slug paths ...

install_pet now refuses spritesheet/pet.json URLs that aren't on a petdex
host (matching thumbnail_png's existing _is_petdex_host guard), so a
spoofed manifest can't redirect a download at an arbitrary host. Slugs
are normalized to a single path segment before indexing into pets_dir(),
closing a path-traversal vector in load_pet/remove_pet/install_pet.

2026-06-23 19:13:08 -05:00

..

lsp

fix: prevent TUI gateway stdin EOF crash across all TUI-context subprocess calls

2026-06-08 22:46:57 -07:00

pet

harden(pets): host-pin asset downloads + sanitize slug paths

2026-06-23 19:13:08 -05:00

secret_sources

fix: prevent TUI gateway stdin EOF crash across all TUI-context subprocess calls

2026-06-08 22:46:57 -07:00

transports

feat(providers): remove google-gemini-cli + google-antigravity OAuth providers (#50492)

2026-06-21 19:53:27 -07:00

__init__.py

fix(agent): preload jiter native parser

2026-05-28 00:20:11 -07:00

account_usage.py

feat(billing): /credits command — balance + portal top-up handoff (#44776)

2026-06-12 08:51:10 +00:00

agent_init.py

fix(compress): reserve output tokens in the compaction threshold (#23767, #43547)

2026-06-22 17:26:17 +05:30

agent_runtime_helpers.py

refactor(memory): move write-mirror gating behind MemoryManager interface

2026-06-22 07:00:42 -07:00

anthropic_adapter.py

refactor(auth): drop dead select() fallback in anthropic pool resolver

2026-06-22 15:50:26 +05:30

async_utils.py

fix(async): close unscheduled coroutines in all threadsafe bridges (#26584)

2026-05-15 14:00:01 -07:00

auxiliary_client.py

fix Nous auth refresh for idle agents

2026-06-21 22:43:48 -07:00

azure_identity_adapter.py

feat(azure-foundry): add Microsoft Entra ID auth

2026-05-18 10:14:38 -07:00

background_review.py

feat(background-review): aux-model selector for the self-improvement review (#49252)

2026-06-22 14:54:53 -07:00

bedrock_adapter.py

fix(bedrock): check boto3 version >= 1.34.59 before using converse_stream

2026-06-15 05:25:17 -07:00

billing_view.py

feat(billing): /billing terminal billing — interactive TUI + CLI client (#45449)

2026-06-19 01:53:32 +05:30

browser_provider.py

fix(browser): self-review pass — dead-import, log levels, future-proofing

2026-05-17 04:04:15 -07:00

browser_registry.py

style: restore PEP8 blank-line separation after dead-code removal

2026-05-29 04:22:27 -07:00

chat_completion_helpers.py

fix(agent): keep system-prompt model identity in sync across provider failover

2026-06-20 10:46:01 -07:00

codex_responses_adapter.py

fix(xai): OAuth Responses native web_search, incomplete guard, grok-composer context

2026-06-17 17:33:32 -07:00

codex_runtime.py

fix(codex): seed app-server sessions with configured cwd

2026-06-21 16:39:02 -07:00

coding_context.py

feat(agent): expose coding-context project facts as structured data + project.facts RPC (#51259)

2026-06-23 08:00:01 +00:00

context_compressor.py

fix(compress): reserve output tokens in the compaction threshold (#23767, #43547)

2026-06-22 17:26:17 +05:30

context_engine.py

fix(compression): avoid repeat preflight compaction from rough estimates

2026-05-29 19:05:03 -07:00

context_references.py

fix(agent): make a binary @file: reference actionable instead of a dead end

2026-06-09 19:16:46 -05:00

conversation_compression.py

fix(agent): shrink anthropic-native image history

2026-06-22 18:23:21 -05:00

conversation_loop.py

fix(agent): persist tool calls before turn-end flush

2026-06-24 02:15:57 +05:30

copilot_acp_client.py

fix: make profile subprocess HOME policy explicit

2026-06-14 03:20:21 -07:00

credential_persistence.py

fix: avoid persisting borrowed credential secrets (#31416)

2026-05-25 00:32:08 -07:00

credential_pool.py

fix(auth): make load_pool() non-destructive for env-seeded credentials

2026-06-21 08:26:37 -07:00

credential_sources.py

docs(auth): replace stale 'hermes login' references with 'hermes auth add'

2026-05-26 15:41:11 -07:00

credits_tracker.py

feat(billing): /credits command — balance + portal top-up handoff (#44776)

2026-06-12 08:51:10 +00:00

curator_backup.py

fix(curator): stop the rollback safety snapshot from pruning its target

2026-06-17 05:40:05 -07:00

curator.py

feat(curator): make skill consolidation opt-in (prune stays default-on) (#47840)

2026-06-17 05:20:32 -07:00

display.py

fix: harden salvaged session and browser improvements

2026-06-15 07:46:34 -07:00

error_classifier.py

fix(agent): route 'thinking blocks cannot be modified' 400 to recovery

2026-06-10 12:39:44 -07:00

errors.py

fix(agent,gateway,doctor): add SSL CA cert bundle fail-fast guard

2026-06-13 21:14:32 -07:00

file_safety.py

fix(file-safety): relax user-write deny policy (#45947)

2026-06-14 02:07:32 -07:00

gemini_native_adapter.py

fix(gemini): strip native self prefixes before generateContent (#36141)

2026-06-13 13:47:08 -07:00

gemini_schema.py

…

i18n.py

fix(packaging): ship locales/ i18n catalogs in wheel, sdist, and Nix (#38383)

2026-06-03 12:00:27 -07:00

image_gen_provider.py

feat(image-gen): add image-to-image / editing to image_generate (#48705)

2026-06-18 22:13:07 -07:00

image_gen_registry.py

fix(plugins): filter resolution by is_available() in web + image_gen registries

2026-05-13 22:31:28 -07:00

image_routing.py

fix(vision): honor custom_providers per-model supports_vision (#41036)

2026-06-07 21:50:57 -07:00

insights.py

refactor(insights): drop dead pricing/duration wrappers, call usage_pricing directly (#40618)

2026-06-07 18:33:20 -07:00

iteration_budget.py

refactor(run_agent): extract OpenAI proxy, safe stdio, IterationBudget

2026-05-16 17:59:32 -07:00

jiter_preload.py

fix(agent): preload jiter native parser

2026-05-28 00:20:11 -07:00

learn_prompt.py

feat(skills): /learn — distill a reusable skill from anything you describe (#51506)

2026-06-23 13:51:28 -07:00

lmstudio_reasoning.py

feat(agent): add lmstudio integration

2026-04-28 12:27:36 -07:00

manual_compression_feedback.py

fix(compression): include system prompt + tool schemas in token estimates (#18265)

2026-04-30 23:03:54 -07:00

markdown_tables.py

fix(cli): vertical fallback for markdown tables wider than terminal (#23948)

2026-05-11 16:49:13 -07:00

memory_manager.py

refactor(memory): move write-mirror gating behind MemoryManager interface

2026-06-22 07:00:42 -07:00

memory_provider.py

fix(backup): capture memory-provider state stored outside HERMES_HOME (#50325)

2026-06-21 12:03:46 -07:00

message_content.py

fix(openviking): preserve structured sync attribution

2026-06-19 15:23:41 +08:00

message_sanitization.py

revert: drop cumulative-resend tool-arg heuristic from shared streaming path (#35718) (#35860)

2026-05-31 06:14:32 -07:00

model_metadata.py

fix(xai): scope native web_search to swap-only + reconcile composer ctx to 200k

2026-06-17 17:33:32 -07:00

models_dev.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

moonshot_schema.py

fix(moonshot): handle union type arrays in tool schemas

2026-06-13 05:51:41 -07:00

nous_rate_guard.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

onboarding.py

feat(onboarding): opt-in structured profile-build path on first contact (#41114)

2026-06-07 08:36:48 -07:00

oneshot.py

feat(agent): one-shot LLM helper + llm.oneshot gateway RPC (#51261)

2026-06-23 08:01:50 +00:00

plugin_llm.py

feat(plugins): run any LLM call from inside a plugin via ctx.llm (#23194)

2026-05-10 07:09:28 -07:00

portal_tags.py

feat(nous): unified client=hermes-client-v<version> tag on every Portal request (#24779)

2026-05-12 20:49:20 -07:00

process_bootstrap.py

refactor(run_agent): extract OpenAI proxy, safe stdio, IterationBudget

2026-05-16 17:59:32 -07:00

prompt_builder.py

feat(computer_use): cross-platform cua-driver (macOS/Windows/Linux)

2026-06-22 06:42:30 -07:00

prompt_caching.py

fix(cache): kill long-lived prefix layout — system prompt is now byte-static within a session (#24778)

2026-05-12 20:46:04 -07:00

rate_limit_tracker.py

…

redact.py

fix(redact): mask all Authorization schemes and x-api-key style headers

2026-06-21 14:08:06 -07:00

retry_utils.py

…

runtime_cwd.py

fix(desktop): stabilize project folder sessions (#37586)

2026-06-02 20:23:09 +00:00

secret_scope.py

feat(gateway): multiplex phase 2 — fail-closed profile credential isolation (Workstream A)

2026-06-19 07:34:15 -07:00

shell_hooks.py

docs: document per-event extra keys in shell-hook wire protocol

2026-06-20 23:23:47 -07:00

skill_bundles.py

feat(skills): add skill bundles — alias /<name> loads multiple skills (#28373)

2026-05-18 21:38:05 -07:00

skill_commands.py

fix(memory): strip skill scaffolding for all providers, not just openviking

2026-06-16 10:37:37 -07:00

skill_preprocessing.py

fix: prevent TUI gateway stdin EOF crash across all TUI-context subprocess calls

2026-06-08 22:46:57 -07:00

skill_utils.py

refactor(kanban): fold worker/orchestrator skills into injected guidance (#50473)

2026-06-21 17:06:48 -07:00

ssl_guard.py

fix(ssl): align guard docs and escape hatch

2026-06-13 21:14:32 -07:00

stream_diag.py

feat(agent): buffer retry/fallback status, surface only on terminal failure (#33816)

2026-05-28 04:53:27 -07:00

subdirectory_hints.py

fix(subdirectory_hints): prevent loading AGENTS.md outside workspace

2026-05-25 23:17:33 -07:00

system_prompt.py

feat(computer_use): cross-platform cua-driver (macOS/Windows/Linux)

2026-06-22 06:42:30 -07:00

think_scrubber.py

fix(agent): stateful streaming scrubber for reasoning-block leaks (#17924) (#20184)

2026-05-05 04:33:38 -07:00

title_generator.py

feat(titles): support language-aware title generation (#45296)

2026-06-19 17:15:52 -07:00

tool_dispatch_helpers.py

feat(security): promptware defense — shared threat patterns + memory load-time scan + tool-result delimiters (#32269)

2026-05-25 14:52:24 -07:00

tool_executor.py

fix(agent): handle concurrent tool submit shutdown

2026-06-24 02:56:56 +05:30

tool_guardrails.py

fix: add recovery hints to loop guard warnings

2026-05-19 00:12:12 -07:00

tool_result_classification.py

fix: classify landed file mutations with diagnostics

2026-05-13 06:46:23 -07:00

trajectory.py

…

transcription_provider.py

feat(stt): add register_transcription_provider() plugin hook

2026-05-25 01:41:19 -07:00

transcription_registry.py

feat(stt): add register_transcription_provider() plugin hook

2026-05-25 01:41:19 -07:00

tts_provider.py

feat(tts): add register_tts_provider() plugin hook (closes #30398)

2026-05-24 18:04:54 -07:00

tts_registry.py

feat(tts): add register_tts_provider() plugin hook (closes #30398)

2026-05-24 18:04:54 -07:00

turn_context.py

fix(agent): align preflight token-progress floor to 5% (#23767, #39548)

2026-06-22 15:51:52 +05:30

turn_finalizer.py

fix(agent): complete final text on last turn

2026-06-22 13:57:59 -07:00

turn_retry_state.py

fix(agent): fail over to fallback provider on persistent auth failure (401/403)

2026-06-20 11:38:01 -07:00

usage_pricing.py

fix(bedrock): price Claude prompt-cache tokens in /usage (#50307)

2026-06-21 11:48:43 -07:00

video_gen_provider.py

feat(video_gen): unified video_generate tool with pluggable provider backends (#25126)

2026-05-13 16:39:41 -07:00

video_gen_registry.py

feat(video_gen): unified video_generate tool with pluggable provider backends (#25126)

2026-05-13 16:39:41 -07:00

web_search_provider.py

chore(web): remove web_crawl tool + provider crawl plumbing (#33824)

2026-05-28 04:52:42 -07:00

web_search_registry.py

chore(web): remove web_crawl tool + provider crawl plumbing (#33824)

2026-05-28 04:52:42 -07:00