mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-09 13:21:42 +00:00
2d8d08cae6
/health/detailed leaked runtime state (gateway state, connected platforms, active-agent counts, PID, exit reason) with no auth. Gate it behind the same Bearer auth as other API routes; plain /health stays open for liveness probes. Also refuse to start on a placeholder/too-short (<16 char) API_SERVER_KEY regardless of bind address — a guessable key on a terminal-capable endpoint is RCE-adjacent even on loopback, since any local process can reach it. The required-key check was already unconditional; this extends the strength floor to loopback binds too. Startup guards are hoisted above app/background-task creation so a rejected start leaves no partial state. Salvaged from #44073 (external-surface hardening), split into a focused PR per maintainer request. Co-authored-by: Hermes Agent <agent@nousresearch.com> |
||
|---|---|---|
| .. | ||
| qqbot | ||
| __init__.py | ||
| _http_client_limits.py | ||
| ADDING_A_PLATFORM.md | ||
| api_server.py | ||
| base.py | ||
| bluebubbles.py | ||
| helpers.py | ||
| msgraph_webhook.py | ||
| signal.py | ||
| signal_format.py | ||
| signal_rate_limit.py | ||
| webhook.py | ||
| weixin.py | ||
| whatsapp_cloud.py | ||
| whatsapp_common.py | ||
| yuanbao.py | ||
| yuanbao_media.py | ||
| yuanbao_proto.py | ||
| yuanbao_sticker.py | ||