This website requires JavaScript.
64b3eb0dd7
docs: surface Nous Portal on pages where it solves a real problem the page describes (#30874 )
2026-05-23 02:47:53 -07:00
f3fb7899d0
docs: surface 'hermes setup --portal' and 'hermes portal' across user-facing pages (#30869 )
2026-05-23 02:42:31 -07:00
9acf949e34
feat(telegram): edit status messages in place instead of appending (#30864 )
2026-05-23 02:42:10 -07:00
4b6d68bd64
test(fast-command): stub _load_gateway_runtime_config too
2026-05-23 02:40:14 -07:00
61ac118724
fix(webhook): enforce INSECURE_NO_AUTH safety rail on dynamic route reloads
2026-05-22 15:52:14 +03:00
b4cf5b65dd
feat(portal): one-shot setup, status CLI, and Nous-included markers (#30860 )
2026-05-23 02:39:09 -07:00
6942b1836e
fix(skills_guard): explain why --force is rejected on dangerous verdicts
2026-05-23 02:36:59 -07:00
789043b691
fix(security): update tests for verdict and --force changes
2026-03-27 00:27:30 +03:00
0f8215f633
fix(security): correct verdict logic and enforce --force limitation in skills_guard
2026-03-27 00:08:02 +03:00
db489a315f
fix(tests): allowlist tmp_path for kanban_notify artifact delivery (#30852 )
2026-05-23 02:34:34 -07:00
5b6f0b695b
test(tls-fd-recycle): pin shutdown-only + thread-aware close contract (#29507 )
2026-05-21 07:20:23 +07:00
30c22f1158
fix(api-call): defer client.close() to owning worker thread on interrupt (#29507 )
2026-05-21 07:20:12 +07:00
e2a7d73a66
fix(force_close_tcp_sockets): shutdown only, do not release FD (#29507 )
2026-05-21 07:20:01 +07:00
53cb6d32be
fix(agent): use atomic_json_write for request debug dumps instead of bare write_text
2026-05-22 23:58:02 +03:00
b183be95a2
fix(gateway-windows): atomic write for .cmd and startup launcher scripts
2026-05-22 16:08:49 +03:00
60b0a0e006
fix(qqbot): fix SILK magic byte detection slice length
2026-05-18 18:42:43 +08:00
0e7448d63a
fix(qqbot): use original attachment filename for cached files
2026-05-18 18:38:31 +08:00
a54f5afc70
fix(qqbot): handle op 7/9 and expand fatal close code set
2026-05-18 17:37:20 +08:00
bbd77d165c
fix(qqbot): add INTERACTION intent and expose video/file cached paths
2026-05-18 17:25:47 +08:00
66d81f9e14
fix(gateway): don't swallow expansion errors in runtime config helper
2026-05-23 01:46:51 -07:00
2362cc4688
fix(gateway): enforce env variable template expansion on runtime config loaders
2026-05-23 10:44:32 +03:00
d21ac579e9
fix(gateway): honor key_env in auth-failure fallback resolution
2026-05-23 09:11:22 +03:00
99671a8634
test(kanban): allow tmp_path artifacts past media-delivery validator
2026-05-23 02:19:01 -07:00
5772e638c9
chore: drop in-repo infographic/ directory; keep PR-body URLs only (#30854 )
2026-05-23 02:25:03 -07:00
b2e6fdd3bf
fix(agent): log warning when fallback model normalization fails instead of silently swallowing
2026-05-22 16:13:46 +03:00
70aaa774be
fix(opencode-go): emit Kimi reasoning_effort, match KimiProfile shape
2026-05-23 01:49:26 -07:00
3589960e03
fix(provider): expose OpenCode Go reasoning controls
2026-05-22 23:19:53 -04:00
71291d83cd
test: keep tirith checks hermetic
2026-05-22 17:05:23 -06:00
52a368fa72
fix(gateway): preserve WhatsApp pairing approvals across JID/LID alias flips
2026-05-23 10:25:35 +03:00
3127a41cb1
test(acp): pin parse_model_input in slash-command tests
2026-05-23 01:42:15 -07:00
6a2df9f451
docs(env): clarify HERMES_ENABLE_PROJECT_PLUGINS contract (#29156 )
2026-05-20 20:04:07 +07:00
8bf99227f0
fix(plugins): block plugin-api path traversal + project RCE (#29156 )
2026-05-20 20:00:03 +07:00
da636e982b
test(plugins): regression coverage for project-plugin RCE chain (#29156 )
2026-05-20 20:03:45 +07:00
09f85f2cf7
fix(plugins): apply truthy env semantics to project-plugin gate (#29156 )
2026-05-20 19:58:50 +07:00
11e6dd3c60
chore(release): add AUTHOR_MAP entry for egilewski (PR #30432 ) (#30833 )
2026-05-23 01:41:31 -07:00
41d2c758c3
Fix unsafe gateway media path delivery
2026-05-22 14:47:23 +02:00
4a91e36495
fix(gateway): separate observed Telegram group context
2026-05-21 19:07:40 -04:00
729a778af0
infographic: PR #17659 read-deny credentials salvage
2026-05-22 20:14:15 -07:00
97e975edd2
fix(file-safety): widen read-deny to .env, mcp-tokens/, webhook secrets, root
2026-05-22 20:11:16 -07:00
567ea61298
fix(file-safety): block auth.json read via TERMINAL_CWD relative path
2026-04-29 17:09:41 -07:00
056e00a77e
fix(file-safety): block read_file on HERMES_HOME credential stores (#17656 )
2026-04-29 16:18:17 -07:00
7f7245bf62
infographic: PR #6656 skill hub safety audit salvage
2026-05-22 19:58:32 -07:00
3f78d8073c
fix(skills): make content_hash filename-sensitive too (symmetric with bundle_content_hash)
2026-05-22 19:55:58 -07:00
b82608a6f5
fix(skills,pairing): path traversal guard in uninstall, lock list_pending, hash file paths
2026-04-09 22:29:23 +08:00
8cf977c8b1
fix(plugins): widen _sanitize_plugin_name for category-namespaced names
2026-05-22 19:48:59 -07:00
487c398dcf
refactor(web): dashboard typography & contrast pass
2026-05-22 19:46:55 -07:00
dc4b0465b5
feat(ci): use 6-way slicing based on benchmark results
2026-05-22 17:46:38 -04:00
e7cb5d4b68
fix: clean push triggers
2026-05-22 16:54:39 -04:00
f89afdbd17
fix(test): deflake two intermittent CI failures
2026-05-22 15:59:17 -04:00
510df6eaf4
test: 4-way slice benchmark (with cache save)
2026-05-22 15:49:52 -04:00
b689624aee
feat(ci): 4-way matrix slicing with LPT duration-balanced distribution
2026-05-21 11:01:15 -04:00
a84cec61ca
fix(minimax-oauth): refresh short-lived access tokens per request (#30619 )
2026-05-22 15:16:15 -07:00
2f320cb35a
fix(ci): supply-chain-audit uses two-dot diff, causing false positives on stale-branch PRs
2026-05-22 17:50:56 -04:00
2233b8b244
infographic: PR #30609 Termux cold-start salvage (#30618 )
2026-05-22 14:32:41 -07:00
a3beee475b
perf(termux): speed up bare cli prompt startup
2026-05-22 18:08:45 +01:00
6c3fd9714f
perf(termux): fast-path cli version startup
2026-05-22 16:37:21 +01:00
d11cbb1032
infographic: PR #30591 Discord adapter → bundled plugin salvage (#30614 )
2026-05-22 14:24:03 -07:00
7849a3d73f
fix(gateway,discord-plugin): _platform_status must respect is_connected=False, not silently fall back to check_fn
2026-05-22 14:08:08 -07:00
cc8e5ec2af
refactor(gateway): migrate Discord adapter to bundled plugin (full Teams parity)
2026-05-12 16:59:12 +05:30
4f988634f8
infographic: PR #27612 Nous URL allowlist salvage
2026-05-22 14:16:48 -07:00
e32d2ffc1d
fix(security): wire Nous URL allowlist into refresh / mint persistence sites
2026-05-22 14:14:32 -07:00
d33c99bbb1
fix(security): validate Nous Portal inference_base_url against host allowlist
2026-05-17 21:30:13 +00:00
09afafb87e
fix(xai): resolve Grok Build context for OAuth
2026-05-22 21:57:43 +04:00
1e71b7180e
infographic: PR #14157 control-plane write-deny salvage
2026-05-22 04:31:28 -07:00
42104218e0
fix(file-safety): also write-deny <root>/control-files in profile mode
2026-05-22 04:28:50 -07:00
1f5219fda5
fix(security): protect Hermes control-plane files from prompt injection
2026-04-23 02:29:22 +05:30
6f436a463e
infographic: PR #27784 anthropic adapter refactor salvage
2026-05-22 04:16:52 -07:00
9d61408837
refactor: extract 7 helpers from convert_messages_to_anthropic
2026-05-12 00:36:51 +05:30
ec2ab5bfaf
infographic: PR #8056 hash pairing codes salvage
2026-05-22 04:10:40 -07:00
82c2035823
fix(pairing): handle legacy plaintext pending entries during upgrade
2026-05-22 04:08:26 -07:00
2e509422ef
fix(security): hash gateway pairing codes instead of storing plaintext
2026-04-12 09:19:41 +08:00
3ac2125140
refactor(image_gen): port FAL backend to plugins/image_gen/fal
2026-05-18 17:42:02 +05:30
7dea33303a
infographic: PR #30373 aux model picker parity salvage
2026-05-22 04:10:00 -07:00
d246f9a278
fix(aux-picker): drop stale session_search slot
2026-05-22 04:03:06 -07:00
c1e93aa331
fix: add missing aux model slots to model picker
2026-05-22 11:46:40 +01:00
8b49012a0a
infographic: PR #8306 webhook HMAC bypass salvage
2026-05-22 03:44:40 -07:00
3fc715ddf5
test(webhook): regression cases for empty-secret HMAC bypass
2026-05-22 03:40:45 -07:00
9c90b3a597
fix(security): validate secret in _reload_dynamic_routes to prevent HMAC bypass
2026-04-12 13:26:33 +03:00
22b0d6dc1a
test(tools): centralize disable_lazy_stt_install fixture in conftest
2026-05-22 03:11:55 -07:00
5dc232a6e2
test(tools): disarm lazy-install probe so _HAS_FASTER_WHISPER patches work
2026-05-22 02:11:31 -07:00
c25f9d1d36
feat(secrets): label detected credentials with their source (Bitwarden) (#30364 )
2026-05-22 03:32:58 -07:00
d617858896
fix(openviking): target-aware mirror subdir, drop private-attr access, dedupe URI builder
2026-05-22 01:21:27 -07:00
2d587c5662
fix(openviking): store memories via content/write API instead of session messages
2026-05-21 02:15:04 -06:00
caf0f30eab
chore(release): add sgtworkman to AUTHOR_MAP
2026-05-22 01:20:22 -07:00
70d53d8b75
fix: run computer use post-setup when enabling tool
2026-05-09 15:42:49 -04:00
fbdca64f73
fix(computer-use): skip capture_after when action failed (ok=False)
2026-05-09 15:19:26 -03:00
07b7cf6fe4
chore(release): add rodrigoeqnit to AUTHOR_MAP
2026-05-21 23:47:59 -07:00
c52cd48e25
fix(computer-use): add set_value to ComputerUseBackend ABC and _NoopBackend stub
2026-05-09 15:18:02 -03:00
d3f62c6913
fix(cli): clamp curses color 8 for 8-color terminals (Docker)
2026-04-23 21:40:40 +10:00
c769be344a
fix(agent): recover from providers rejecting list-type tool content (#27344 ) (#30259 )
2026-05-21 23:40:16 -07:00
372e9a18cd
fixup: log lazy-install errors at debug + AUTHOR_MAP for CipherFrame
2026-05-21 23:26:34 -07:00
b5c6d9ac08
fix: wire STT lazy-install into transcription_tools.py
2026-05-21 17:33:08 -04:00
f6f25b9449
fix(agent): fail fast on small Ollama runtime context
2026-05-21 14:49:02 -06:00
e77f1ed5f7
fix(agent): widen toolset gate to context engine tools (#5544 sibling)
2026-05-21 19:23:14 -07:00
4c61fb6cf6
fix(agent): gate memory tool injection on enabled_toolsets (#5544 )
2026-05-21 19:22:06 -07:00
1264fab156
fix(tui): surface verbose tool details (#30225 )
2026-05-22 00:16:52 -05:00
4e2c66a098
chore(release): add AUTHOR_MAP entry for Stark-X
2026-05-21 19:16:35 -07:00
eb51fb6f50
fix(ssh): keep bulk sync extraction scoped to .hermes
2026-05-11 16:39:52 +08:00
4a2fa77c15
fix(cli): pre-check CUA release asset for Intel macOS before install
2026-05-13 05:06:25 +08:00
9896e43db5
fix(skills): load Linux-tagged skills on Termux (android sys.platform)
2026-05-21 17:24:41 -07:00
Teknium