Teknium 4d23b2238e fix(dashboard-auth): harden the public native-authorize surface ... Two tightenings on /auth/native/authorize (a public pre-auth route): - Per-IP pending cap (8): the broker store is capacity-bounded fail-closed at 256 entries with a 600s TTL, so one unauthenticated spammer could fill it and deny native sign-in gateway-wide for the pending window. Pending entries now record the requester IP and each address is capped well above any legitimate concurrent-login count; other addresses keep signing in. - Loopback redirect_uri accepts IP literals only (127.0.0.1 / ::1): 'localhost' can be re-pointed via the hosts file or a hostile resolver (RFC 8252 \u00a78.3 says to use loopback IP literals); the desktop always sends 127.0.0.1, so nothing legitimate used the name. 3 new tests: per-IP cap enforced, cap frees on TTL expiry, localhost redirect rejected at the route.		2026-07-22 06:50:50 -07:00
..
__init__.py
conftest.py
conftest_dashboard_auth.py
test_25106_global_switch_persists_base_url_api_mode.py	test(cli): cover picker-path persist_global=True in #25106 regression tests	2026-07-17 15:47:08 -07:00
test_active_sessions.py
test_anthropic_model_flow_stale_oauth.py
test_anthropic_oauth_flow.py
test_anthropic_oauth_routes_to_messages_api.py
test_anthropic_picker_curated.py	feat(models): add Claude Sonnet 5 support	2026-07-20 02:25:44 -07:00
test_anthropic_provider_persistence.py
test_api_key_providers.py	fix(ci): make tests, workflows, and attribution reliable under load (#66373)	2026-07-17 20:55:24 +00:00
test_apply_model_switch_result_context.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_apply_profile_override.py
test_arcee_provider.py
test_argparse_flag_propagation.py
test_at_context_completion_filter.py
test_atomic_json_write.py
test_atomic_yaml_write.py
test_auth_codex_provider.py
test_auth_codex_self_heal.py
test_auth_commands.py
test_auth_loopback_ssh_hint.py
test_auth_nous_provider.py
test_auth_profile_fallback.py
test_auth_provider_gate.py
test_auth_qwen_provider.py
test_auth_ssl_macos.py
test_auth_toctou_file_modes.py
test_auth_usable_secret.py
test_auth_xai_oauth_provider.py
test_authenticated_providers_exhausted_pool.py	fix(model-picker): show exhausted-pool providers in interactive /model picker (#66584)	2026-07-17 19:16:48 -04:00
test_aux_config.py
test_azure_detect.py
test_azure_foundry_entra.py
test_backup.py	fix(discord): harden reconnect message recovery	2026-07-18 14:01:33 -07:00
test_banner.py
test_banner_git_state.py
test_banner_pip_update.py
test_banner_skills.py
test_banner_skills_width.py
test_bedrock_model_picker.py
test_bedrock_region_scoped_picker.py
test_billing_cli.py	feat(cli): plan catalog on Free + plan= deep link + top-up/auto-refill copy split (#68689)	2026-07-22 08:11:09 +05:30
test_billing_portal_url.py
test_billing_scope_stepup.py
test_bitwarden_status.py	fix(secrets): validate bitwarden status token	2026-07-22 03:20:09 -07:00
test_browser_connect_dual_stack.py	fix: /browser connect times out when another app squats the CDP port	2026-07-18 02:49:28 -07:00
test_build_info.py
test_bundles.py
test_chat_skills_flag.py
test_claw.py
test_clear_stale_base_url.py
test_cli_active_session_limit.py
test_cli_model_once.py	feat: add /model --once one-turn model override (#29914)	2026-07-18 14:01:56 -07:00
test_cli_output.py
test_cmd_update.py
test_cmd_update_docker.py
test_coalesce_session_args.py
test_codex_cli_model_picker.py
test_codex_models.py	test(codex): cover ChatGPT-Account-Id header on /models probe	2026-07-21 05:27:13 -07:00
test_codex_runtime_plugin_migration.py
test_codex_runtime_switch.py
test_commands.py
test_completion.py
test_config.py	fix(providers): align custom route scoping	2026-07-22 11:19:37 +05:30
test_config_drift.py
test_config_env_expansion.py
test_config_env_ref_parity.py	feat(config): resolve ${env:VAR} SecretRefs in config.yaml, matching MCP config (#69267)	2026-07-22 04:39:57 -07:00
test_config_env_refs.py
test_config_validation.py	fix(config): remove unknown-top-level-key warning — top-level keys bridge to env (#67924)	2026-07-20 02:25:33 -07:00
test_configured_builtin_models.py
test_console_engine.py	test(config): use schema-known key in config-set confirm-flow test	2026-07-20 05:38:59 -07:00
test_container_aware_cli.py
test_container_boot.py
test_context_switch_guard.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_copilot_auth.py
test_copilot_catalog_oauth_fallback.py
test_copilot_context.py
test_copilot_in_model_list.py
test_copilot_token_exchange.py
test_credential_lifecycle.py	fix(credentials): unified provider key delete/update across .env, auth.json, config.yaml (#67213)	2026-07-19 03:02:21 -07:00
test_cron.py
test_cron_dashboard_off_loop.py
test_cron_fire_dashboard.py
test_cron_parser_builder.py
test_ctrlg_editor_submit.py
test_curator_archive_prune.py
test_curator_recent_run_notice.py
test_curator_run.py
test_curator_status.py
test_curator_usage.py
test_curses_arrow_keys.py
test_curses_color_compat.py
test_curses_ui_fuzzy_rank.py
test_curses_ui_search.py
test_custom_provider_context_length.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_custom_provider_extra_headers.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_custom_provider_identity.py
test_custom_provider_model_switch.py
test_custom_provider_tls.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_dashboard_admin_endpoints.py	fix(credentials): suppress re-seeding when a pool entry is deleted via API (#55217) (#67429)	2026-07-19 03:48:48 -07:00
test_dashboard_auth_401_reauth.py
test_dashboard_auth_audit.py
test_dashboard_auth_cookies.py
test_dashboard_auth_gate.py
test_dashboard_auth_middleware.py
test_dashboard_auth_native_flow.py	fix(dashboard-auth): harden the public native-authorize surface	2026-07-22 06:50:50 -07:00
test_dashboard_auth_password_login.py
test_dashboard_auth_plugin_hook.py
test_dashboard_auth_prefix.py
test_dashboard_auth_provider_base.py
test_dashboard_auth_status_endpoint.py	fix(status): make gateway_updated_at a stable RFC3339-or-null contract (#68657)	2026-07-21 13:12:41 -07:00
test_dashboard_auth_stub_provider.py
test_dashboard_auth_ws_auth.py
test_dashboard_auth_ws_tickets.py
test_dashboard_basic_auth_plugin_enable.py
test_dashboard_browser_safe_imports.py
test_dashboard_lifecycle_flags.py
test_dashboard_oauth_endpoints_server_gate.py
test_dashboard_profiles_nav_label.py
test_dashboard_register.py
test_dashboard_token_auth.py
test_dashboard_tui_backcompat.py
test_dashboard_unified_launch.py
test_dashboard_web_dist_validation.py	fix(dashboard): attempt one recovery build when --skip-build finds no dist	2026-07-21 12:41:41 -07:00
test_debug.py
test_default_interface_resolution.py
test_dep_ensure.py
test_deprecated_cwd_warning.py
test_desktop_repo_discovery_config.py	feat(desktop): configure repository discovery (supersedes #67630) (#68642)	2026-07-21 10:09:31 -04:00
test_destructive_slash_confirm_gate.py
test_detect_api_mode_for_url.py
test_determine_api_mode_hostname.py
test_diagnostics_upload.py
test_dingtalk_auth.py
test_discord_skill_clamp_warning.py
test_doctor.py	feat(config): warn on unknown top-level keys + report deprecated keys/env in doctor	2026-07-19 01:09:04 -07:00
test_doctor_command_install.py
test_doctor_dedicated_provider_skip.py
test_dump_env_visibility.py
test_dump_git_commit.py
test_dump_terminal_backend.py
test_ensure_hermes_home_memo.py
test_ensure_hermes_home_uid_34107.py
test_ensure_utf8_locale.py
test_env_custom_keys.py
test_env_export_line_lifecycle.py	fix(credentials): unified provider key delete/update across .env, auth.json, config.yaml (#67213)	2026-07-19 03:02:21 -07:00
test_env_export_prefix.py
test_env_load_cache.py
test_env_loader.py	fix(cli): warn once per path for UTF-32 .env refuse-to-mangle	2026-07-18 19:01:10 -04:00
test_env_sanitize_on_load.py
test_fallback_cmd.py
test_fallback_config.py
test_fireworks_provider.py
test_gateway.py	fix(gateway): hard-exit on KeyboardInterrupt path too	2026-07-22 09:53:51 +05:30
test_gateway_external_supervisor.py
test_gateway_linger.py
test_gateway_platform_gating.py
test_gateway_proc_fallback.py
test_gateway_restart_loop.py
test_gateway_run_hard_exit.py	fix(gateway): hard-exit on KeyboardInterrupt path too	2026-07-22 09:53:51 +05:30
test_gateway_runtime_health.py	test(gateway): cover stale gateway_state.json detection (TTL + PID liveness)	2026-07-21 12:39:59 -07:00
test_gateway_s6_dispatch.py
test_gateway_service.py	fix(gateway): recover Discord websocket and event-loop stalls	2026-07-18 20:01:55 +05:30
test_gateway_service_paths.py
test_gateway_windows.py
test_gateway_wsl.py
test_gemini_free_tier_setup_block.py
test_gemini_provider.py
test_gmi_provider.py
test_goals.py	fix(goals): update judge consumers for transport result	2026-07-20 05:38:25 -07:00
test_gpt56_registration.py
test_graphical_browser_detection.py
test_gui_command.py
test_gui_uninstall.py
test_hooks_cli.py
test_ignore_user_config_flags.py
test_image_gen_picker.py
test_input_sanitize.py
test_install_cua_driver.py
test_inventory.py	fix: speed up CLI /model picker by skipping non-current custom provider probing (#65652)	2026-07-19 19:33:49 -04:00
test_inventory_pricing.py
test_jobs_json_utf8_bom.py	fix(cron): accept UTF-8 BOM when reading jobs.json	2026-07-18 02:31:20 -07:00
test_journey_render.py
test_kanban_block_kinds.py
test_kanban_blocked_sticky.py
test_kanban_boards.py
test_kanban_cli.py
test_kanban_cli_dispatch_passthrough.py
test_kanban_core_functionality.py
test_kanban_db.py
test_kanban_db_init.py
test_kanban_db_repair.py	feat(kanban): add hermes kanban repair CLI verb	2026-07-21 12:41:14 -07:00
test_kanban_decompose.py
test_kanban_decompose_db.py
test_kanban_default_assignee.py
test_kanban_diagnostics.py
test_kanban_dispatch_lock.py
test_kanban_goal_mode.py	fix: migrate CLI kanban gate + remaining mocks to 5-value judge contract	2026-07-20 05:38:25 -07:00
test_kanban_init_lock_bounded.py
test_kanban_lifecycle_hooks.py
test_kanban_notify.py
test_kanban_per_profile_cap.py
test_kanban_project_link.py
test_kanban_promote.py
test_kanban_reclaim_claim_lock_guard.py
test_kanban_specify.py
test_kanban_specify_db.py
test_kanban_swarm.py
test_kanban_worker_image_extraction.py
test_kanban_worker_spawn_toolsets.py
test_kanban_worker_terminal_cwd.py
test_kanban_write_txn_busy_retry.py
test_kimi_cn_provider_listing.py	fix: preserve kimi-coding-cn provider identity	2026-07-20 10:17:57 -07:00
test_launcher.py
test_list_picker_providers.py	fix(model): collapse kimi alias/canonical to one /model picker row	2026-07-20 10:17:57 -07:00
test_logs.py
test_main_model_custom_provider_normalization.py
test_managed_installs.py
test_managed_scope.py
test_managed_scope_cli_config.py
test_managed_scope_config.py
test_managed_scope_env.py
test_managed_scope_loaders.py
test_managed_scope_overlay.py
test_managed_scope_regression.py
test_managed_scope_surfacing.py
test_managed_scope_writeguard.py
test_managed_uv.py
test_mcp_add_command_dest.py
test_mcp_catalog.py
test_mcp_config.py
test_mcp_dashboard_oauth.py
test_mcp_reload_confirm_gate.py
test_mcp_security.py
test_mcp_startup.py	fix(mcp): allow background discovery retry after a run that connected nothing	2026-07-21 12:43:27 -07:00
test_mcp_tools_config.py
test_memory_reset.py
test_memory_setup.py
test_memory_setup_provider_arg.py
test_migrate_xai.py
test_moa_config.py	fix(moa): surface stale presets without retries	2026-07-17 13:49:12 -07:00
test_model_catalog.py
test_model_cost_guard.py
test_model_normalize.py
test_model_picker_excluded_providers.py	feat(model-switch): excluded_providers config to hide providers from /model picker	2026-07-20 03:06:02 -07:00
test_model_picker_expensive_confirm.py
test_model_picker_viewport.py
test_model_provider_persistence.py
test_model_switch_configured_provider_routing.py
test_model_switch_context_display.py	fix(providers): scope route-owned runtime settings	2026-07-22 11:19:37 +05:30
test_model_switch_copilot_api_mode.py
test_model_switch_custom_providers.py	feat(model-switch): excluded_providers config to hide providers from /model picker	2026-07-20 03:06:02 -07:00
test_model_switch_filter_unresolved.py
test_model_switch_once_flags.py	feat: add /model --once one-turn model override (#29914)	2026-07-18 14:01:56 -07:00
test_model_switch_openai_api_mode.py	fix(model-switch): override stale api_mode with host-mandated mode on OpenAI-direct switch	2026-07-17 15:47:08 -07:00
test_model_switch_opencode_anthropic.py
test_model_switch_persist_default.py	fix(model): default /model switches to session scope everywhere	2026-07-20 02:22:22 -07:00
test_model_switch_variant_tags.py
test_model_validation.py
test_models.py	fix(models): add Claude Sonnet 5 to curated model lists	2026-07-20 02:25:44 -07:00
test_models_dev_preferred_merge.py	fix(models): complete kimi-k3 rollout across Kimi-direct catalog surfaces	2026-07-20 08:47:55 -07:00
test_non_ascii_credential.py
test_nous_account.py
test_nous_auth_keepalive.py
test_nous_auth_status_cache.py
test_nous_billing_request.py	Terminal-billing client hardening: shared wire types, wire-layer tests, dead RPC removal (#61067)	2026-07-18 07:05:58 -07:00
test_nous_hermes_non_agentic.py
test_nous_inference_url_validation.py
test_nous_portal_staging_allowlist.py
test_nous_session_validity.py
test_nous_subscription.py
test_ollama_cloud_auth.py
test_ollama_cloud_provider.py
test_oneshot_usage_file.py
test_openai_codex_model_validation_fallback.py
test_openai_picker_curated.py
test_opencode_go_flat_namespace.py
test_opencode_go_in_model_list.py
test_opencode_go_validation_fallback.py
test_opencode_zen_model_limit.py
test_overlay_slug_resolution.py
test_path_completion.py
test_pet_toggle.py
test_picker_prewarm.py
test_pin_kanban_board_env.py
test_pip_install_detection.py
test_placeholder_usage.py	test(config): update placeholder usage assertion for --force flag	2026-07-20 05:38:59 -07:00
test_plugin_auxiliary_tasks.py
test_plugin_cli_registration.py
test_plugin_runtime_disable_gate.py
test_plugin_scanner_recursion.py
test_plugins.py
test_plugins_cmd.py
test_plugins_cmd_category_discovery.py
test_plugins_cmd_enable_disable_nested.py
test_plugins_cmd_list.py
test_plugins_transcription_registration.py
test_plugins_tts_registration.py
test_post_setup_gating.py
test_profile_describer.py
test_profile_distribution.py
test_profile_export_credentials.py
test_profiles.py
test_profiles_s6_hooks.py
test_project_plugin_rce_bypass.py
test_projects_cli.py
test_projects_db.py	feat(desktop): configure repository discovery (supersedes #67630) (#68642)	2026-07-21 10:09:31 -04:00
test_prompt_api_key.py
test_prompt_compose_command.py
test_prompt_size.py
test_provider_catalog.py
test_provider_config_validation.py
test_provider_groups.py
test_provider_live_curated_merge.py
test_provider_parity.py
test_provider_precedence.py
test_provider_section3_grouping.py	fix: section-3 grouping follow-ups for salvaged PR #36998	2026-07-20 00:41:21 -07:00
test_proxy.py
test_psutil_android_extract.py
test_pty_bridge.py
test_quarantine_forensic_logging.py
test_reasoning_effort_menu.py
test_reasoning_full_command.py	feat(cli): make reasoning effort session-scoped	2026-07-20 02:22:22 -07:00
test_redact_config_bridge.py
test_regression_16767.py
test_relaunch.py
test_remote_spending_gate_contract.py	feat(tui+cli): change your Nous plan from the terminal (/subscription, /topup, terminal-billing UX) (#51639)	2026-07-18 14:30:24 +05:30
test_resolve_last_session.py
test_resolve_provider_openrouter_pool.py
test_run_with_idle_timeout.py
test_runtime_provider_resolution.py	fix(providers): align custom route scoping	2026-07-22 11:19:37 +05:30
test_safe_mode.py
test_secret_prompt.py
test_secrets_bitwarden_non_tty.py
test_secrets_token_rotation.py	feat(secrets): one-command token rotation + actionable startup errors for all secret sources (#68605)	2026-07-21 06:41:04 -07:00
test_security_advisories.py
test_security_audit.py
test_security_audit_startup.py
test_send_cmd.py
test_serve_command.py
test_service_manager.py
test_session_browse.py
test_session_export.py
test_session_export_html.py
test_session_export_html_escape.py
test_session_export_md.py
test_session_filters.py
test_session_handoff.py
test_session_listing.py
test_session_recap.py
test_sessions_delete.py
test_sessions_export_md_cli.py
test_set_config_value.py	fix(config): warn-after-write for unrecognized keys instead of refusing	2026-07-20 05:38:59 -07:00
test_setup.py
test_setup_agent_settings.py
test_setup_blank_slate.py
test_setup_hermes_script.py
test_setup_irc.py
test_setup_matrix_e2ee.py
test_setup_menu_curses_migration.py
test_setup_model_provider.py
test_setup_noninteractive.py
test_setup_ollama_cloud_force_refresh.py
test_setup_openclaw_migration.py
test_setup_prompt_menus.py
test_setup_reconfigure.py
test_signal_handler_kanban_worker.py
test_skills_config.py
test_skills_hub.py
test_skills_install_flags.py
test_skills_skip_confirm.py
test_skills_subparser.py
test_skin_cmd.py	feat(themes): hermes skin set — deterministic one-color tweak, bg untouched	2026-07-21 21:00:43 -05:00
test_skin_engine.py	feat(ui-tui): background-aware theme adaptation + paired palettes + /theme pin	2026-07-21 16:36:57 -05:00
test_skin_palettes.py	fix(ui-tui): light mode renders the vivid palette RAW, not WCAG-darkened	2026-07-21 16:36:57 -05:00
test_slack_cli.py
test_spotify_auth.py
test_ssh_ownership_endpoint.py
test_ssh_session_token_parser.py
test_startup_plugin_gating.py
test_status.py
test_status_model_provider.py
test_status_provider_label.py
test_subcommands_batch.py
test_subcommands_followup.py
test_subcommands_profile_gateway.py
test_subparser_routing_fallback.py
test_subprocess_timeouts.py
test_subscription_cli.py	feat(cli): plan catalog on Free + plan= deep link + top-up/auto-refill copy split (#68689)	2026-07-22 08:11:09 +05:30
test_suppress_eio_on_interrupt.py
test_system_stats_platform.py
test_systemd_optional_directives.py
test_systemd_watchdog_unit.py	fix(gateway): recover Discord websocket and event-loop stalls	2026-07-18 20:01:55 +05:30
test_teams_pipeline_plugin_cli.py
test_telegram_managed_bot.py
test_tencent_tokenhub_provider.py
test_terminal_menu_fallbacks.py
test_timeouts.py
test_timestamps_command.py
test_tips.py
test_tool_token_estimation.py
test_tools_config.py	fix(desktop): Windows browser-setup journey — console flash, idempotent setup, Nous Portal activation (#67473)	2026-07-19 05:22:10 -07:00
test_tools_disable_enable.py
test_toolset_validation.py
test_tts_picker.py
test_tui_bundled.py
test_tui_heap_sizing.py
test_tui_mouse_residue_suppression.py
test_tui_npm_install.py	fix(cli): try bundled TUI before requiring ui-tui workspace (#67116)	2026-07-18 17:17:25 -04:00
test_tui_resume_flow.py	test: use shutil.copy2 instead of os.link for cross-device tmp fixtures	2026-07-20 09:21:08 -07:00
test_uninstall_dry_run.py
test_uninstall_node_symlinks.py
test_update_autostash.py
test_update_check.py
test_update_concurrent_quarantine.py
test_update_config_clears_custom_fields.py
test_update_fleet_restart_timeout.py	test(update): cover fleet restart timeout isolation (#68523)	2026-07-22 10:35:50 +05:30
test_update_hangup_protection.py
test_update_interrupted_recovery.py
test_update_modified_notice.py
test_update_post_pull_syntax_guard.py
test_update_stale_dashboard.py	fix(cli): restart managed dashboard service after update (#39166)	2026-07-22 09:01:19 -04:00
test_update_venv_health.py
test_update_yes_flag.py
test_update_zip_atomic_replace.py
test_update_zip_symlink_reject.py
test_upstage_provider.py
test_urllib_security.py
test_user_providers_model_switch.py	feat(desktop): custom endpoint settings (supersedes #42745) (#67759)	2026-07-19 19:59:46 -04:00
test_uv_tool_update.py
test_verify_console_scripts.py
test_verify_core_dependencies.py
test_vertex_provider.py
test_video_gen_picker.py
test_voice_wrapper.py
test_web_oauth_dispatch.py
test_web_server.py	fix(status): make gateway_updated_at a stable RFC3339-or-null contract (#68657)	2026-07-21 13:12:41 -07:00
test_web_server_boot_handshake.py
test_web_server_console_ws.py
test_web_server_cron_profiles.py	fix(cron): resolve provider with the job's effective model; default dashboard cron creates to the backend's own profile	2026-07-19 09:57:21 -07:00
test_web_server_files.py	fix(secrets): harden encrypted Bitwarden cache	2026-07-22 04:40:07 -07:00
test_web_server_fs.py
test_web_server_gateway_topology.py
test_web_server_git.py
test_web_server_host_header.py
test_web_server_messaging_profiles.py
test_web_server_oauth_write.py
test_web_server_profile_unification.py
test_web_server_pty_import.py
test_web_server_pty_reconnect.py
test_web_server_session_search.py
test_web_server_skill_editor.py
test_web_server_skills_profiles.py
test_web_ui_build.py	test(cli): cover the web UI build flock contention paths	2026-07-21 12:42:07 -07:00
test_webhook_cli.py
test_whatsapp_cloud_setup.py
test_whatsapp_onboarding.py
test_whatsapp_setup_ordering.py
test_win_pty_bridge.py
test_windows_native_docs.py
test_xai_curated_models.py
test_xai_model_flow.py
test_xai_oauth_profile_auth.py
test_xai_oauth_refresh.py
test_xai_oauth_writethrough.py
test_xai_provider_labels.py
test_xai_retirement.py
test_xiaomi_provider.py	fix(secrets): scope BWS-injected provider keys	2026-07-22 04:39:17 -07:00
test_yolo_startup_order.py