Hinotoi-agent 3bace071bf fix(state): restrict sensitive store file permissions ... response_store.db (api server) holds conversation history including tool payloads, prompts, and results. webhook_subscriptions.json holds per-route HMAC secrets. Under a permissive umask (e.g. 0o022, default on most distros) both files were created mode 0o644 — readable by other local users on shared boxes. - gateway/platforms/api_server.py: ResponseStore tightens itself + WAL/SHM sidecars to 0o600 after __init__, then trusts the inode. (Original contributor patch chmod'd after every _commit() — wasteful on a hot api_server path; chmod-on-create is sufficient since SQLite preserves mode bits across writes.) - hermes_cli/webhook.py: _save_subscriptions writes via tempfile.mkstemp (which itself creates the file with 0o600), chmods the temp before the atomic rename, and re-asserts 0o600 on the destination so an existing permissive file from before this fix gets narrowed. Tests cover (a) creation under permissive umask leaves 0o600 and (b) an existing 0o644 webhook_subscriptions.json gets narrowed on next save. Tests guarded with skipif os.name=='nt' since POSIX mode bits don't apply on Windows. Salvaged from PR #30917 by @Hinotoi-agent. Reworked the api_server.py side from chmod-on-every-commit to chmod-on-create. Co-authored-by: teknium1 <127238744+teknium1@users.noreply.github.com>		2026-05-24 04:55:18 -07:00
..
proxy	fix(security): validate Nous Portal inference_base_url against host allowlist	2026-05-22 14:17:40 -07:00
__init__.py	chore: release v0.14.0 (2026.5.16) (#26862)	2026-05-16 02:58:57 -07:00
_parser.py	Fix CLI verbose tool progress config fallback	2026-05-23 21:03:51 -07:00
_subprocess_compat.py
auth.py	security: harden API server key placeholder handling (#30738)	2026-05-24 04:25:32 -07:00
auth_commands.py	feat(cli): wire --manual-paste into `hermes auth add and hermes model`	2026-05-18 20:10:52 -07:00
azure_detect.py	feat(azure-foundry): add Microsoft Entra ID auth	2026-05-18 10:14:38 -07:00
backup.py
banner.py
browser_connect.py	feat: auto-launch Chromium-family browser for CDP	2026-05-19 22:34:05 -07:00
bundles.py	feat(skills): add skill bundles — alias /<name> loads multiple skills (#28373)	2026-05-18 21:38:05 -07:00
callbacks.py
checkpoints.py
claw.py
cli_output.py
clipboard.py
codex_models.py
codex_runtime_plugin_migration.py
codex_runtime_switch.py	chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)	2026-05-17 02:29:41 -07:00
colors.py
commands.py	feat(skills): add opt-in AST deep diagnostics	2026-05-23 17:47:26 -07:00
completion.py
config.py	feat(secrets/bitwarden): EU Cloud + self-hosted server URL support (#31378)	2026-05-24 02:19:57 -07:00
copilot_auth.py
cron.py	feat: add cron job profile support	2026-05-18 17:39:50 +00:00
curator.py
curses_ui.py	fix(cli): clamp curses color 8 for 8-color terminals (Docker)	2026-05-21 23:40:58 -07:00
debug.py
default_soul.py
dep_ensure.py	feat(dep_ensure): complete Windows bootstrap — dep_ensure + install.ps1 + detection (#27845)	2026-05-18 16:34:24 +05:30
dingtalk_auth.py
doctor.py	feat(doctor): surface xAI model retirement in hermes doctor	2026-05-20 09:18:23 -07:00
dump.py	fix(skills): prune dependency/venv dirs from all skill scanners (#30042)	2026-05-21 14:18:02 -07:00
env_loader.py	feat(secrets/bitwarden): EU Cloud + self-hosted server URL support (#31378)	2026-05-24 02:19:57 -07:00
fallback_cmd.py	fix(fallback): merge fallback_providers with legacy fallback_model configurations	2026-05-23 05:24:57 -07:00
fallback_config.py	fix(fallback): merge fallback_providers with legacy fallback_model configurations	2026-05-23 05:24:57 -07:00
gateway.py	fix(gateway): stop enabling dingtalk allow-all during setup (#30743)	2026-05-24 04:24:44 -07:00
gateway_windows.py	fix(gateway-windows): atomic write for .cmd and startup launcher scripts	2026-05-23 02:30:41 -07:00
goals.py	feat: inject current time into goal judge prompt	2026-05-16 23:05:27 -07:00
hooks.py
inventory.py
kanban.py	feat(kanban): --ids bulk promote + AUTHOR_MAP entry for #29464	2026-05-23 23:10:36 -07:00
kanban_db.py	feat(cli): kanban promote verb for manual todo->ready recovery	2026-05-23 23:10:36 -07:00
kanban_decompose.py	fix: assign single-task kanban decompositions	2026-05-18 20:26:02 -07:00
kanban_diagnostics.py	fix(kanban): honor severity thresholds in diagnostics	2026-05-18 20:47:01 -07:00
kanban_specify.py	fix(cli): make kanban specify max_tokens configurable	2026-05-18 20:15:20 -07:00
kanban_swarm.py	feat(cli): add kanban swarm topology helper	2026-05-18 21:10:12 -07:00
logs.py
main.py	Fix CLI verbose tool progress config fallback	2026-05-23 21:03:51 -07:00
mcp_config.py
memory_setup.py
migrate.py	feat(cli): hermes migrate xai [--apply] [--no-backup]	2026-05-20 09:18:23 -07:00
model_catalog.py
model_normalize.py
model_switch.py	fix(model-switch): mark bare custom provider as current	2026-05-19 10:57:35 -07:00
models.py
nous_subscription.py
oneshot.py	fix(provider): make config.yaml model.provider the single source of truth (#31222)	2026-05-23 18:18:41 -07:00
pairing.py
platforms.py
plugins.py	feat(plugins): add register_auxiliary_task() to PluginContext API	2026-05-23 17:49:47 -07:00
plugins_cmd.py	fix(plugins): widen _sanitize_plugin_name for category-namespaced names	2026-05-22 19:50:32 -07:00
portal_cli.py	feat(portal): one-shot setup, status CLI, and Nous-included markers (#30860)	2026-05-23 02:39:09 -07:00
profile_describer.py	fix(skills): prune dependency/venv dirs from all skill scanners (#30042)	2026-05-21 14:18:02 -07:00
profile_distribution.py	fix(skills): prune dependency/venv dirs from all skill scanners (#30042)	2026-05-21 14:18:02 -07:00
profiles.py	fix(skills): prune dependency/venv dirs from all skill scanners (#30042)	2026-05-21 14:18:02 -07:00
providers.py	fix: add default base_url_override for ollama-cloud provider	2026-05-18 14:31:37 -07:00
pt_input_extras.py
pty_bridge.py
relaunch.py
runtime_provider.py	fix(custom): pass custom provider extra body	2026-05-21 07:48:53 -07:00
secrets_cli.py	feat(secrets/bitwarden): EU Cloud + self-hosted server URL support (#31378)	2026-05-24 02:19:57 -07:00
security_advisories.py
send_cmd.py	fix(review): address Copilot follow-up on sanitizer and file decode errors	2026-05-16 23:00:58 -05:00
session_recap.py	chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)	2026-05-17 02:29:41 -07:00
setup.py	feat(portal): one-shot setup, status CLI, and Nous-included markers (#30860)	2026-05-23 02:39:09 -07:00
skills_config.py
skills_hub.py	refactor(skills): slim AST diagnostic to single entry point	2026-05-23 17:47:26 -07:00
skin_engine.py	fix(tui): improve charizard completion menu contrast	2026-05-18 20:05:23 -07:00
slack_cli.py
status.py	refactor(ntfy): convert built-in adapter to platform plugin	2026-05-23 16:13:01 -07:00
stdio.py
timeouts.py	perf(agent-loop): cut 47% of per-conversation function calls via 3 targeted hot-path optimizations (#28866)	2026-05-19 14:25:10 -07:00
tips.py	feat: auto-launch Chromium-family browser for CDP	2026-05-19 22:34:05 -07:00
tools_config.py	feat(portal): one-shot setup, status CLI, and Nous-included markers (#30860)	2026-05-23 02:39:09 -07:00
uninstall.py	docs(windows): avoid piping installer directly into iex	2026-05-18 20:05:47 -07:00
vercel_auth.py
voice.py
web_server.py	fix(dashboard): require auth for plugin rescan (#27340)	2026-05-24 04:45:07 -07:00
webhook.py	fix(state): restrict sensitive store file permissions	2026-05-24 04:55:18 -07:00
xai_retirement.py	fix(xai): align migrate retirement map with docs	2026-05-20 09:18:23 -07:00