teknium1 f45ace9318 feat(security): startup security posture audit (warn-on-load) ... Surface dangerous host/deployment posture at gateway startup so operators get the 'you're exposed' signal the June 2026 MCP-config persistence campaign victims never had. Warn-only — never blocks startup, never raises. Checks (each independently fail-safe): - Running as root (POSIX uid 0) - SSH daemon with PasswordAuthentication enabled (incl. the 'yes' default) - Running in a container with no persistent volume mount over HERMES_HOME - Network-accessible API server with no API_SERVER_KEY New module hermes_cli/security_audit_startup.py; invoked once per process from start_gateway() right after setup_logging(). Cross-platform (root/SSH checks no-op on Windows). Idea: @Cthulhu.		2026-06-21 19:05:27 -07:00
..
assets	fix: improve telegram topic mode setup	2026-05-04 12:07:17 -07:00
builtin_hooks	remove: BOOT.md built-in hook (#17093)	2026-04-28 09:50:27 -07:00
platforms	fix(security): close hermes-0day MCP-persistence attack surface	2026-06-21 19:05:27 -07:00
relay	fix(relay): make hosted gateways actually connect AND complete the inbound/outbound round-trip (#48828)	2026-06-19 16:30:24 +10:00
__init__.py	docs(gateway): mention Weixin in gateway help and docstrings	2026-05-12 17:08:51 -07:00
authz_mixin.py	fix(gateway): preserve WeCom per-group sender allowlists	2026-06-13 07:18:54 -07:00
channel_directory.py	fix: harden WhatsApp target alias salvage	2026-06-15 05:51:47 -07:00
config.py	fix(gateway): don't lazy-install SDKs for unconfigured platforms on startup	2026-06-21 16:41:17 -07:00
delivery.py	fix(gateway): drop outbound silence-narration messages pre-send	2026-05-29 19:06:05 -07:00
display_config.py	feat(gateway): rename to tool_progress_grouping, add config/docs/tests	2026-06-16 05:49:24 -07:00
hooks.py	feat(hooks): expose thread_id and chat_type in agent:start/end context (#41672)	2026-06-07 19:16:36 -07:00
kanban_watchers.py	fix(kanban): honor kanban.auto_decompose toggle live, without a gateway restart (#50358)	2026-06-21 12:43:44 -07:00
memory_monitor.py	Port from cline/cline#10343: periodic gateway memory logging (#27102)	2026-05-16 12:55:23 -07:00
message_timestamps.py	feat(gateway): inject stable human-readable message timestamps	2026-06-16 15:49:59 -07:00
mirror.py	refactor(gateway): drop _append_to_jsonl from mirror	2026-05-20 13:00:57 -07:00
pairing.py	fix(gateway): preserve WhatsApp pairing approvals across JID/LID alias flips	2026-05-23 01:46:34 -07:00
platform_registry.py	refactor(plugins): add apply_yaml_config_fn registry hook	2026-05-13 22:20:30 -07:00
response_filters.py	fix(gateway): suppress exact silence tokens without mutating history	2026-06-14 03:25:08 -07:00
restart.py	fix(gateway): address restart review feedback	2026-04-10 21:18:34 -07:00
rich_sent_store.py	fix(telegram): resolve replies to rich (sendRichMessage) messages	2026-06-16 13:04:20 -07:00
run.py	feat(security): startup security posture audit (warn-on-load)	2026-06-21 19:05:27 -07:00
runtime_footer.py	chore: prune unused imports and duplicate import redefinitions	2026-05-28 22:26:25 -07:00
session.py	refactor(session): simplify traversal guard to a helper + logger, harden non-leading separators	2026-06-21 15:23:36 -07:00
session_context.py	fix(api-server): stop silently promising async delivery on stateless HTTP path (#50319)	2026-06-21 12:15:14 -07:00
shutdown_forensics.py	chore: ruff auto-fixes — collapsible-else-if, if-stmt-min-max, dict.fromkeys (#23926)	2026-05-11 11:03:29 -07:00
slash_access.py	feat(gateway): per-platform admin/user split for slash commands (salvage of #4443) (#23373)	2026-05-10 12:33:54 -07:00
slash_commands.py	fix(model-switch): a failed in-place swap must be a no-op, not a dead session (#50375)	2026-06-21 13:33:23 -07:00
status.py	fix(status): cross-platform start-time fingerprint via psutil fallback	2026-06-21 17:23:33 -07:00
sticker_cache.py	fix: guard yaml.safe_load, flock unlock, TOCTOU races, and atomic writes	2026-05-19 00:12:41 -07:00
stream_consumer.py	fix(gateway): respect adapter decline of fresh-final to prevent double delivery	2026-06-21 13:55:50 -07:00
stream_dispatch.py	feat(gateway): structured stream-event protocol + Telegram draft formatting parity (#37250)	2026-06-02 00:33:50 -07:00
stream_events.py	feat(gateway): structured stream-event protocol + Telegram draft formatting parity (#37250)	2026-06-02 00:33:50 -07:00
whatsapp_identity.py	fix(whatsapp): normalize bare phone targets to JIDs before bridge send	2026-06-21 13:32:22 -07:00