hermes-agent/plugins
Teknium 44f6f8435b test(slack): behavioral log-noise/privacy suite + keep clarify choice text out of INFO logs
Follow-up hardening for the C13 log-noise cluster:

- plugins/platforms/slack/adapter.py: clarify button resolution logged
  the full chosen option text at INFO (choice=%r). Choice text is user
  content — log the choice INDEX at INFO and the (truncated, %.100r)
  text at DEBUG only. Widens #58478's principle: no message content
  above DEBUG level anywhere in the adapter.

- tests/gateway/test_slack_log_noise.py (new): behavioral suite pinning
  the cluster's invariants:
  * catch-all ack registered AFTER every named handler (registration
    order is bolt's dispatch priority — no shadowing);
  * catch-all fires for an unsubscribed event type (reaction_added),
    logs only a DEBUG line naming the type, and never logs content;
  * named handlers still dispatch (message → _handle_slack_message);
  * end-to-end inbound message run leaves NO message text or block
    content in any adapter log record (caplog at DEBUG);
  * #30185's event-arrival diagnostic is metadata-only;
  * clarify resolution: INFO carries index/user only, text is
    DEBUG-only (fails with the adapter fix reverted — A/B verified).

Content-leak audit of all 139 logger call sites in the adapter found
two above-DEBUG leaks: the clarify choice line (fixed here) and none
else carrying message text; remaining sites log error strings, URLs
via safe_url_for_log, ids, and counts. The block-extraction DEBUG
preview was already removed by #58478 (chars= length only).
2026-07-23 11:34:11 -07:00
..
browser fix: guard int(os.getenv()) casts against malformed env vars (#40598) 2026-06-07 06:14:24 -07:00
context_engine feat(context-engine): host contract for external context engines 2026-05-28 01:45:30 -07:00
cron_providers fix(cron): harden execution attempt ledger 2026-07-17 04:58:35 -07:00
dashboard_auth feat(dashboard_auth): support confidential clients (client_secret) in self-hosted OIDC (#55344) 2026-06-30 13:32:51 +10:00
disk-cleanup docs(disk-cleanup): clarify cron output-root protection is exact-match 2026-07-01 15:42:04 +05:30
google_meet refactor(setup): route dependency installs through the canonical uv→pip→ensurepip ladder 2026-07-07 04:09:35 -07:00
hermes-achievements fix(achievements): stop card hover click loop 2026-07-16 04:34:57 -07:00
image_gen fix(deepinfra): harden multimodal provider routing 2026-07-14 02:59:39 +05:30
kanban feat(kanban): per-task model dropdown — set/override worker model+provider from the board (#69876) 2026-07-22 22:23:24 -07:00
memory fix(memory): preserve genuine pre-delimiter content in merged compaction rows 2026-07-22 06:59:14 -07:00
model-providers feat(nous): send top-level session_id for provider sticky routing (#69253) 2026-07-22 04:39:20 -07:00
observability fix(nemo-relay): align dynamic plugin configuration 2026-07-13 17:01:08 -06:00
platforms test(slack): behavioral log-noise/privacy suite + keep clarify choice text out of INFO logs 2026-07-23 11:34:11 -07:00
security-guidance plugins: add security-guidance — pattern-matched warnings on dangerous code writes (#33131) 2026-05-27 02:07:21 -07:00
spotify chore: prune unused imports and duplicate import redefinitions 2026-05-28 22:26:25 -07:00
teams_pipeline fix(teams-pipeline): reject dot-only recording display_name 2026-07-01 02:03:48 -07:00
video_gen fix(video-gen): omit duration for range-based FAL families when unspecified 2026-07-16 04:24:10 -07:00
web fix: sanitize subprocess env for DDGS worker 2026-07-21 11:51:01 +05:30
__init__.py feat(memory): pluggable memory provider interface with profile isolation, review fixes, and honcho CLI restoration (#4623) 2026-04-02 15:33:51 -07:00
plugin_utils.py fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150) 2026-06-08 09:35:22 -07:00