AlexFucuson9 fccc222bd7 fix(slack): warn when slack_tokens.json is group/world-readable ... The OAuth multi-workspace token file contains plaintext bot tokens for all saved Slack workspaces. Unlike the Google Chat adapter which sets 0o600 when writing credentials, the Slack token file has no permission enforcement — a default umask 022 makes it world-readable. Fix: check file permissions on read and emit a warning log with remediation instructions if the file is group- or world-readable.		2026-07-23 11:44:43 -07:00
..
browser	fix: guard int(os.getenv()) casts against malformed env vars (#40598)	2026-06-07 06:14:24 -07:00
context_engine	feat(context-engine): host contract for external context engines	2026-05-28 01:45:30 -07:00
cron_providers	fix(cron): harden execution attempt ledger	2026-07-17 04:58:35 -07:00
dashboard_auth	feat(dashboard_auth): support confidential clients (client_secret) in self-hosted OIDC (#55344)	2026-06-30 13:32:51 +10:00
disk-cleanup	docs(disk-cleanup): clarify cron output-root protection is exact-match	2026-07-01 15:42:04 +05:30
google_meet	refactor(setup): route dependency installs through the canonical uv→pip→ensurepip ladder	2026-07-07 04:09:35 -07:00
hermes-achievements	fix(achievements): stop card hover click loop	2026-07-16 04:34:57 -07:00
image_gen	fix(deepinfra): harden multimodal provider routing	2026-07-14 02:59:39 +05:30
kanban	feat(kanban): per-task model dropdown — set/override worker model+provider from the board (#69876)	2026-07-22 22:23:24 -07:00
memory	fix(memory): preserve genuine pre-delimiter content in merged compaction rows	2026-07-22 06:59:14 -07:00
model-providers	feat(nous): send top-level session_id for provider sticky routing (#69253)	2026-07-22 04:39:20 -07:00
observability	fix(nemo-relay): align dynamic plugin configuration	2026-07-13 17:01:08 -06:00
platforms	fix(slack): warn when slack_tokens.json is group/world-readable	2026-07-23 11:44:43 -07:00
security-guidance	plugins: add security-guidance — pattern-matched warnings on dangerous code writes (#33131)	2026-05-27 02:07:21 -07:00
spotify	chore: prune unused imports and duplicate import redefinitions	2026-05-28 22:26:25 -07:00
teams_pipeline	fix(teams-pipeline): reject dot-only recording display_name	2026-07-01 02:03:48 -07:00
video_gen	fix(video-gen): omit duration for range-based FAL families when unspecified	2026-07-16 04:24:10 -07:00
web	fix: sanitize subprocess env for DDGS worker	2026-07-21 11:51:01 +05:30
__init__.py	feat(memory): pluggable memory provider interface with profile isolation, review fixes, and honcho CLI restoration (#4623)	2026-04-02 15:33:51 -07:00
plugin_utils.py	fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150)	2026-06-08 09:35:22 -07:00