aaronagent 9afe1784bd fix: hidden_div regex bypass with newlines, credential config silent failure, webhook route error severity ... prompt_builder.py: The `hidden_div` detection pattern uses `.*` which does not match newlines in Python regex (re.DOTALL is not passed). An attacker can bypass detection by splitting the style attribute across lines: `<div style="color:red;\ndisplay: none">injected content</div>` Replace `.*` with `[\s\S]*?` to match across line boundaries. credential_files.py: `_load_config_files()` catches all exceptions at DEBUG level (line 171), making YAML parse failures invisible in production logs. Users whose credential files silently fail to mount into sandboxes have no diagnostic clue. Promote to WARNING to match the severity pattern used by the path validation warnings at lines 150 and 158 in the same function. webhook.py: `_reload_dynamic_routes()` logs JSON parse failures at WARNING (line 265) but the impact — stale/corrupted dynamic routes persisting silently — warrants ERROR level to ensure operator visibility in alerting pipelines. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>		2026-04-10 03:05:04 -07:00
..
browser_providers	feat: switch managed browser provider from Browserbase to Browser Use (#5750)	2026-04-07 08:40:22 -04:00
environments	feat(environments): unified file sync with change tracking and deletion	2026-04-10 03:01:46 -07:00
neutts_samples	refactor(tts): replace NeuTTS optional skill with built-in provider + setup flow	2026-03-17 02:33:12 -07:00
__init__.py	Merge branch 'main' into rewbs/tool-use-charge-to-subscription	2026-03-31 08:48:54 +09:00
ansi_strip.py	fix: strip ANSI at the source — clean terminal output before it reaches the model	2026-03-23 07:43:12 -07:00
approval.py	fix(approval,mcp): log silent exception handlers, narrow OAuth catches, close server on error	2026-04-10 03:05:04 -07:00
binary_extensions.py	fix(tools): address PR review — remove _extract_raw_output, BudgetConfig everywhere, read_file hardening	2026-04-08 02:24:32 -07:00
browser_camofox.py	fix: cleanup_all_camofox_sessions respects managed persistence (#6820)	2026-04-09 14:54:07 -07:00
browser_camofox_state.py	feat(browser): add persistent Camofox sessions and VNC URL discovery (salvage #4400) (#4419)	2026-04-01 04:18:50 -07:00
browser_tool.py	fix: deduplicate _is_termux() into hermes_constants.is_termux()	2026-04-09 16:24:53 -07:00
budget_config.py	fix: preserve existing thresholds, remove pre-read byte guard	2026-04-08 02:24:32 -07:00
checkpoint_manager.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
clarify_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
code_execution_tool.py	fix(termux): harden execute_code and mobile browser/audio UX	2026-04-09 16:24:53 -07:00
credential_files.py	fix: hidden_div regex bypass with newlines, credential config silent failure, webhook route error severity	2026-04-10 03:05:04 -07:00
cronjob_tools.py	feat(gateway): add BlueBubbles iMessage platform adapter (#6437)	2026-04-08 23:54:03 -07:00
debug_helpers.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00
delegate_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
env_passthrough.py	refactor: migrate 10 config.yaml inline loaders to read_raw_config()	2026-04-07 17:28:23 -07:00
file_operations.py	fix(tools): address PR review — remove _extract_raw_output, BudgetConfig everywhere, read_file hardening	2026-04-08 02:24:32 -07:00
file_tools.py	fix: preserve existing thresholds, remove pre-read byte guard	2026-04-08 02:24:32 -07:00
fuzzy_match.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
homeassistant_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
image_generation_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
interrupt.py	feat: enhance interrupt handling and container resource configuration	2026-02-23 02:11:33 -08:00
managed_tool_gateway.py	fix(tools): add debug logging for token refresh and tighten domain check	2026-04-02 12:40:03 +11:00
mcp_oauth.py	fix(approval,mcp): log silent exception handlers, narrow OAuth catches, close server on error	2026-04-10 03:05:04 -07:00
mcp_tool.py	fix: use camelCase structuredContent attr, prefer structured over text	2026-04-07 18:00:01 -07:00
memory_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
mixture_of_agents_tool.py	fix: guard aux LLM calls against None content + reasoning fallback + retry (salvage #3389) (#3449)	2026-03-27 15:28:19 -07:00
neutts_synth.py	fix(tts): document NeuTTS provider and align install guidance (#1903)	2026-03-18 02:55:30 -07:00
openrouter_client.py	refactor: route ad-hoc LLM consumers through centralized provider router	2026-03-11 20:02:36 -07:00
osv_check.py	feat: OSV malware check for MCP extension packages (#5305)	2026-04-05 12:46:07 -07:00
patch_parser.py	fix: handle addition-only hunks in V4A patch parser (#3325)	2026-03-26 19:38:04 -07:00
process_registry.py	fix(termux): harden env-backed background jobs	2026-04-09 16:24:53 -07:00
registry.py	fix(tools): address PR review — remove _extract_raw_output, BudgetConfig everywhere, read_file hardening	2026-04-08 02:24:32 -07:00
rl_training_tool.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00
send_message_tool.py	fix: add SOCKS proxy support, DISCORD_PROXY env var, and send_message proxy coverage	2026-04-09 14:19:06 -07:00
session_search_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
skill_manager_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
skills_guard.py	fix: guard aux LLM calls against None content + reasoning fallback + retry (salvage #3389) (#3449)	2026-03-27 15:28:19 -07:00
skills_hub.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00
skills_sync.py	refactor: consolidate get_hermes_home() and parse_reasoning_effort() (#3062)	2026-03-25 15:54:28 -07:00
skills_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
terminal_tool.py	fix: reject foreground timeout above cap instead of clamping	2026-04-10 02:58:54 -07:00
tirith_security.py	chore: fix 154 f-strings, simplify getattr/URL patterns, remove dead code (#3119)	2026-03-25 19:47:58 -07:00
todo_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
tool_backend_helpers.py	Merge branch 'main' into rewbs/tool-use-charge-to-subscription	2026-03-31 08:48:54 +09:00
tool_result_storage.py	fix(termux): honor temp dirs for local temp artifacts	2026-04-09 16:24:53 -07:00
transcription_tools.py	fix(tools): use correct import path for mistralai SDK	2026-04-08 13:47:08 -07:00
tts_tool.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
url_safety.py	fix(security): add SSRF protection to vision_tools and web_tools (hardened)	2026-03-23 15:40:42 -07:00
vision_tools.py	refactor: add tool_error/tool_result helpers + read_raw_config, migrate 129 callsites	2026-04-07 13:36:38 -07:00
voice_mode.py	fix: deduplicate _is_termux() into hermes_constants.is_termux()	2026-04-09 16:24:53 -07:00
web_tools.py	fix: align auth-by-message classification with status-code path, decode URLs before secret check	2026-04-10 03:05:04 -07:00
website_policy.py	refactor: codebase-wide lint cleanup — unused imports, dead code, and inefficient patterns (#5821)	2026-04-07 10:25:31 -07:00