SHL0MS fda771498e docs(acp): warn that Buzz auto-approves Hermes tool permissions ... The Buzz Desktop section covered discovery only. The combination that actually needs stating: the hermes-acp toolset carries terminal and execute_code, and buzz-acp answers session/request_permission itself with allow_once instead of surfacing it. A Hermes agent in Buzz runs shell commands on the host unattended. Buzz defaults every agent to owner-only and that default holds through to the spawned process env, so nobody reaches the open state by accident. But Anyone is one dropdown change away with no warning shown, and it hands channel-wide shell access to the host. Also record that the two obvious mitigations do not work: approvals.mode manual raises the request but Buzz auto-approves it anyway, and platform_toolsets.acp does not narrow the ACP toolset. Both verified by running rm -rf through the ACP path under each setting. Amend the Approvals section too — it promised prompts route back to the editor, which is only true for hosts that choose to surface them. en + zh-Hans. Signed-off-by: SHL0MS <SHL0MS@users.noreply.github.com>		2026-07-28 11:53:12 -07:00
..
_category_.json
acp.md	docs(acp): warn that Buzz auto-approves Hermes tool permissions	2026-07-28 11:53:12 -07:00
api-server.md	docs(delegation,api): document stall detection, timeout metadata, /agents live status, runs-stream subagent lifecycle	2026-07-27 11:33:53 -07:00
batch-processing.md	feat(reasoning): add max and ultra effort levels (#62650)	2026-07-12 00:26:49 -07:00
browser.md	fix: widen headed-mode gate to config, add browser.headed default, tests, docs	2026-07-18 10:07:46 -07:00
built-in-plugins.md	docs: Plugins subcategory under Extending + secret-source plugin guide + 1Password sidebar fix (#59613)	2026-07-06 12:11:31 -07:00
code-execution.md	fix: drain thread no longer crashes on fd-less stdout streams (#34789)	2026-05-29 12:16:57 -07:00
codex-app-server-runtime.md	docs(codex): document live app-server display; AUTHOR_MAP entries	2026-07-17 13:44:12 -07:00
computer-use.md	fix(skills): move computer-use skill into the autonomous-ai-agents category	2026-07-23 21:06:39 -07:00
context-files.md	feat(prompt): make context-file truncation limit configurable	2026-06-16 11:28:35 -07:00
context-references.md
credential-pools.md	docs: warn that mid-session model switches break prompt caching (#58747)	2026-07-05 04:34:05 -07:00
cron.md	feat(cron): user-owned model pins + cron.model fleet default	2026-07-28 11:52:47 -07:00
curator.md	fix(curator): make the autonomous write policy consistent (#67140)	2026-07-25 19:27:17 -07:00
delegation.md	docs(delegation,api): document stall detection, timeout metadata, /agents live status, runs-stream subagent lifecycle	2026-07-27 11:33:53 -07:00
deliverable-mode.md	feat(skills): bundle docx, xlsx, and pdf office skills; refresh powerpoint (#68595)	2026-07-21 05:39:23 -07:00
extending-the-dashboard.md	docs(desktop): document the desktop plugin SDK (@hermes/plugin-sdk) (#67301)	2026-07-19 04:02:17 +00:00
fallback-providers.md	fix(compression): give fallback candidates their own timeout budget + escalate repeat-timeout cooldowns (#65143)	2026-07-15 12:28:09 -07:00
goals.md	feat(goals): completion contracts for /goal — evidence-based judging (#50501)	2026-06-22 12:20:09 -07:00
honcho.md	docs(honcho): clarify pinUserPeer pins only non-agent users	2026-06-15 21:34:09 +00:00
hooks.md	feat(delegate): expose redacted child tool history	2026-07-26 20:36:47 -07:00
image-generation.md	fix(image-gen): stop reporting the Codex tool_choice 400 as an account limit	2026-07-25 16:41:57 -07:00
kanban-tutorial.md	docs(kanban): clarify decomposer profile roles	2026-06-06 19:29:00 -07:00
kanban-worker-lanes.md	refactor(kanban): fold worker/orchestrator skills into injected guidance (#50473)	2026-06-21 17:06:48 -07:00
kanban.md	docs(kanban): explain why an unblocked task can later land in triage	2026-07-17 15:47:39 -07:00
lsp.md	fix(lsp): never report stale diagnostics — wait for fresh post-edit data	2026-07-20 13:43:36 -04:00
mcp.md	fix(mcp): make Figma remote OAuth work via DCR allowlist defaults	2026-07-28 00:53:16 -05:00
memory-providers.md	feat(honcho): add OAuth device-code login (RFC 8628) for headless environments	2026-07-24 07:53:12 -07:00
memory.md	feat(background-review): aux-model selector for the self-improvement review (#49252)	2026-06-22 14:54:53 -07:00
mixture-of-agents.md	feat(moa): default advisor fanout to user_turn — the cheapest cadence	2026-07-23 21:07:18 -07:00
overview.md	docs: fix 25 documentation/code inconsistencies (audit round 3)	2026-07-16 04:47:40 -07:00
personality.md	fix(website): cross-locale doc links + drop empty ko locale (#31895)	2026-05-24 23:16:20 -07:00
pets.md	refactor(skills): restructure hermes-agent into a hub + absorb themes, desktop-plugins, tui-widgets, petdex	2026-07-23 19:46:02 -07:00
plugins.md	docs: Plugins subcategory under Extending + secret-source plugin guide + 1Password sidebar fix (#59613)	2026-07-06 12:11:31 -07:00
provider-routing.md	fix(routing): preserve profile and delegation parity	2026-07-10 13:10:45 +05:30
skills.md	fix(skills): bind bundles to exact files and origins	2026-07-12 02:59:27 -07:00
skins.md	fix(website): cross-locale doc links + drop empty ko locale (#31895)	2026-05-24 23:16:20 -07:00
spotify.md	docs(spotify): document 6-month re-auth cycle and add client-level invalid_grant test	2026-06-20 23:23:47 -07:00
subscription-proxy.md	feat(cli): make hermes portal the human-readable Portal onboarding alias	2026-06-04 01:19:28 +05:30
tool-gateway.md	docs: deep audit — registry drift, stale claims, 2-week PR coverage, dashboard screenshot (#40952)	2026-06-07 01:39:06 -07:00
tool-search.md	feat(tools): tier-2 server-summary hint + per-server listing degradation; 5% default budget	2026-07-26 08:26:09 -07:00
tools.md	docs: reconcile docs with code across last 3 releases (#54254)	2026-06-28 12:47:50 -07:00
tts.md	fix(tools): address Copilot review on Groq STT language hint	2026-07-27 20:28:31 -07:00
vision.md	docs: 30-day overhaul — correctness audit, PR coverage, Nous Portal weave, sidebar reorg (#33782)	2026-05-28 02:41:36 -07:00
voice-mode.md	feat(voice): say 'stop' to end a voice chat hands-free	2026-07-27 21:26:23 -07:00
web-dashboard.md	rip out brew + pip/PyPI wheel support (#68217)	2026-07-22 16:51:01 -04:00
web-search.md	docs: fix 25 documentation/code inconsistencies (audit round 3)	2026-07-16 04:47:40 -07:00
x-search.md	docs(xai): clarify x_search vs xurl routing without schema cross-refs	2026-07-23 21:06:47 -07:00