Teknium 469cd16fe0 fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944) ... Salvaged from PRs #5800 (memosr), #5806 (memosr), #5915 (Ruzzgar), #5928 (Awsh1). Changes: - Use hmac.compare_digest for API key comparison (timing attack prevention) - Apply provider env var blocklist to Docker containers (credential leakage) - Replace tar.extractall() with safe extraction in TerminalBench2 (CVE-2007-4559) - Add SSRF protection via is_safe_url to ALL platform adapters: base.py (cache_image_from_url, cache_audio_from_url), discord, slack, telegram, matrix, mattermost, feishu, wecom (Signal and WhatsApp protected via base.py helpers) - Update tests: mock is_safe_url in Mattermost download tests - Add security tests for tar extraction (traversal, symlinks, safe files)		2026-04-07 17:28:37 -07:00
..
builtin_hooks	refactor: replace inline HERMES_HOME re-implementations with get_hermes_home()	2026-04-07 10:40:34 -07:00
platforms	fix(security): consolidated security hardening — SSRF, timing attack, tar traversal, credential leakage (#5944)	2026-04-07 17:28:37 -07:00
__init__.py	Enhance CLI with multi-platform messaging integration and configuration management	2026-02-02 19:01:51 -08:00
channel_directory.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00
config.py	fix(matrix): hard-fail E2EE when python-olm missing + stable MATRIX_DEVICE_ID	2026-04-06 16:54:16 -07:00
delivery.py	refactor: remove 24 confirmed dead functions — 432 lines of unused code	2026-04-07 11:41:26 -07:00
hooks.py	feat: built-in boot-md hook — run BOOT.md on gateway startup (#3733)	2026-03-29 10:19:54 -07:00
mirror.py	chore: remove ~100 unused imports across 55 files (#3016)	2026-03-25 15:02:03 -07:00
pairing.py	fix: multiple platform adaptors concurrency	2026-04-06 16:49:54 -07:00
run.py	fix(gateway): show full session id and title in /status	2026-04-07 17:27:09 -07:00
session.py	feat: shared thread sessions by default — multi-user thread support (#5391)	2026-04-05 19:46:58 -07:00
status.py	refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)	2026-03-25 15:54:28 -07:00
sticker_cache.py	chore: remove ~100 unused imports across 55 files (#3016)	2026-03-25 15:02:03 -07:00
stream_consumer.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00