Teknium ade5981429 fix(kanban): sanitize comment author rendering in build_worker_context (#22769) ... Operator-controlled HERMES_PROFILE values were rendered as '**${author}** (${ts}):' — markdown bold with no provenance prefix. Worker comment bodies render directly underneath. A misleading profile name like 'hermes-system' or 'operator' could be misread by the next worker as a system directive above attacker-influenced content (confused-deputy primitive gated on operator misconfig). The LLM-controlled author-forgery surface was already closed in #22435 (author removed from KANBAN_COMMENT_SCHEMA). This is defense-in-depth: render with an explicit 'comment from worker `<author>` at <ts>:' prefix so even 'hermes-system' resolves to 'comment from worker `hermes-system` at ...' — parseable as worker-comment metadata, not a system directive. Strip backticks from author so they can't break out of the fence. Update test_build_worker_context_caps_comments to count by body regex since the rendered author line now also starts with 'comment '. Closes #22452.		2026-05-09 12:47:58 -07:00
..
acp	fix(acp): preserve assistant reasoning metadata in session persistence	2026-05-05 10:18:28 -07:00
acp_adapter	feat(acp): pass image file attachments through as image_url parts	2026-05-07 09:24:32 -07:00
agent	fix(tests): pin UTF-8 encoding when reading source files on Windows	2026-05-09 02:47:28 -07:00
cli	feat: confirm prompt for destructive slash commands (#4069) (#22687)	2026-05-09 11:04:46 -07:00
cron	fix(cron): avoid github skill false positives in scanner	2026-05-09 11:11:45 -07:00
e2e	fix(gateway): move quick-command dispatch before built-in handlers	2026-05-04 01:39:23 -07:00
environments/benchmarks
fakes
gateway	fix: follow-up for salvaged PR #22263	2026-05-09 11:54:04 -07:00
hermes_cli	fix(kanban): sanitize comment author rendering in build_worker_context (#22769)	2026-05-09 12:47:58 -07:00
hermes_state
honcho_plugin	feat(honcho): explain why when honcho_profile returns an empty card	2026-04-27 12:37:33 -07:00
integration
openviking_plugin	fix(openviking): pre-check fs/stat to route file URIs before hitting directory-only endpoints	2026-04-30 02:35:29 -07:00
plugins	fix: always send tenant headers in OpenViking _headers() when account/user are set	2026-05-09 01:53:19 -07:00
providers	feat(providers): make all 33 providers pluggable under plugins/model-providers/	2026-05-05 13:40:01 -07:00
run_agent	fix(agent): notify context engine on commit_memory_session (#22764)	2026-05-09 12:28:42 -07:00
skills	fix(google-workspace): restore required_credential_files in SKILL.md (#16452)	2026-05-04 12:43:14 -07:00
stress	fix(kanban): gate claim + unblock on parent completion	2026-05-09 11:07:37 -07:00
tools	fix: move pytest.importorskip below pytest import in skip-guarded tests	2026-05-09 11:12:03 -07:00
tui_gateway	fix(tui): close slash parity gaps with CLI (#20339)	2026-05-05 15:42:39 -05:00
website	docs(skills): explain restoring bundled skills	2026-05-05 13:46:20 -07:00
__init__.py
conftest.py	fix(tests): avoid asyncio DeprecationWarning in event loop fixture on 3.12+	2026-05-07 07:05:05 -07:00
run_interrupt_test.py
test_account_usage.py
test_atomic_replace_symlinks.py	refactor: consolidate symlink-safe atomic replace into shared helper	2026-04-28 04:58:22 -07:00
test_base_url_hostname.py
test_batch_runner_checkpoint.py
test_cli_file_drop.py
test_cli_manual_compress.py	test(cli): regression test for manual /compress system_message	2026-04-28 05:21:49 -07:00
test_cli_skin_integration.py	fix(ci): stabilize main test suite regressions (#17660)	2026-04-29 23:18:55 -07:00
test_ctx_halving_fix.py
test_empty_model_fallback.py
test_evidence_store.py
test_get_tool_definitions_cache_isolation.py	fix(tools): isolate get_tool_definitions quiet_mode cache + dedup LCM injection (#17335)	2026-04-30 04:32:06 -07:00
test_hermes_bootstrap.py	fix(entry-points): guard hermes_bootstrap import so partial updates don't brick hermes (#22091)	2026-05-08 14:43:13 -07:00
test_hermes_constants.py	test(hermes_constants): cover parse_reasoning_effort()	2026-05-07 09:59:07 -07:00
test_hermes_home_profile_warning.py	fix(constants): warn once when get_hermes_home() falls back under an active profile (#18746)	2026-05-02 01:49:55 -07:00
test_hermes_logging.py	fix(logging): attach gateway log after cli init	2026-04-26 19:01:26 -07:00
test_hermes_state.py	fix(telegram): polish topic mode — CASCADE, General-topic handling, rename guard, debounce	2026-05-04 12:07:17 -07:00
test_hermes_state_wal_fallback.py	fix(sqlite): fall back to journal_mode=DELETE on NFS/SMB/FUSE (#22043)	2026-05-09 02:09:35 -07:00
test_honcho_client_config.py
test_install_sh_pythonpath_sanitization.py	fix: harden install.sh against inherited Python env leakage	2026-05-06 04:02:02 -07:00
test_install_sh_setup_wizard_tty_probe.py	fix(install): widen /dev/tty open-probe to sibling gates (#16746)	2026-04-28 06:45:55 -07:00
test_install_sh_termux_network_prereqs.py	fix: strengthen termux install network prerequisites	2026-05-07 13:04:08 -07:00
test_ipv4_preference.py
test_lazy_session_regressions.py	fix: resolve lazy session creation regressions (#18370 fallout) (#20363)	2026-05-06 01:11:49 +05:30
test_lint_config.py	lint: enable PLW1514 as a blocking ruff rule	2026-05-08 14:27:40 -07:00
test_mcp_serve.py	fix(mcp): unwrap platforms key in channels_list	2026-05-07 13:41:16 -07:00
test_mini_swe_runner.py
test_minimax_model_validation.py
test_minimax_oauth.py	test(cli): cover minimax-oauth resolution, refresh, menu wiring	2026-04-29 09:53:42 -07:00
test_minisweagent_path.py
test_model_picker_scroll.py
test_model_tools.py	fix(plugins): stop firing pre_tool_call hook twice per tool execution (#17611)	2026-04-29 12:43:39 -07:00
test_model_tools_async_bridge.py	fix(model_tools): cancel coroutine on timeout so worker thread exits + log full traceback	2026-04-29 05:00:40 -07:00
test_ollama_num_ctx.py
test_packaging_metadata.py
test_plugin_skills.py	fix(skills): support category-qualified local skill names	2026-05-05 10:15:31 -07:00
test_process_loop_event_loop_warning.py	fix(cli): replace get_event_loop() with get_running_loop() to silence RuntimeWarning in process_loop thread (#19285)	2026-05-07 06:35:54 -07:00
test_project_metadata.py
test_retry_utils.py
test_sql_injection.py
test_subprocess_home_isolation.py
test_termux_all_extra_compat.py	fix: add termux-all install profile and safe fallbacks	2026-05-07 13:04:08 -07:00
test_timezone.py
test_toolset_distributions.py
test_toolsets.py	fix: merge plugin tools into builtin toolsets	2026-05-05 10:14:17 -07:00
test_trajectory_compressor.py
test_trajectory_compressor_async.py
test_transform_llm_output_hook.py	test+docs: cover transform_llm_output hook + release author map	2026-05-07 05:46:05 -07:00
test_transform_tool_result_hook.py
test_tui_gateway_server.py	Merge pull request #20942 from NousResearch/austin/fix/personality	2026-05-07 18:54:29 -04:00
test_utils_truthy_values.py
test_yuanbao_integration.py	yuanbao platform (#16298)	2026-04-26 18:50:49 -07:00
test_yuanbao_markdown.py	yuanbao platform (#16298)	2026-04-26 18:50:49 -07:00
test_yuanbao_pipeline.py	yuanbao platform (#16298)	2026-04-26 18:50:49 -07:00
test_yuanbao_proto.py	yuanbao platform (#16298)	2026-04-26 18:50:49 -07:00