ethernet
e8fcb007b9
Merge remote-tracking branch 'upstream/main' into ethie/pm-clean
...
# Conflicts:
# AGENTS.md
# acp_adapter/edit_approval.py
# acp_adapter/server.py
# agent/agent_init.py
# agent/anthropic_adapter.py
# agent/anthropic_credentials.py
# agent/auxiliary_client.py
# agent/azure_identity_adapter.py
# agent/bedrock_adapter.py
# agent/browser_registry.py
# agent/chat_completion_helpers.py
# agent/coding_context.py
# agent/context_references.py
# agent/conversation_loop.py
# agent/copilot_acp_client.py
# agent/credits_tracker.py
# agent/curator.py
# agent/curator_backup.py
# agent/deadline.py
# agent/display.py
# agent/errors.py
# agent/estop.py
# agent/i18n.py
# agent/image_gen_registry.py
# agent/image_routing.py
# agent/learning_graph.py
# agent/learning_mutations.py
# agent/lsp/servers.py
# agent/model_metadata.py
# agent/models_dev.py
# agent/monitoring/gateway_health_export.py
# agent/monitoring/otlp_exporter.py
# agent/pet/store.py
# agent/process_bootstrap.py
# agent/prompt_builder.py
# agent/proxy_sources/iron_proxy.py
# agent/secret_sources/_cache.py
# agent/secret_sources/bitwarden.py
# agent/secret_sources/registry.py
# agent/shell_hooks.py
# agent/skill_bundles.py
# agent/skill_commands.py
# agent/skill_utils.py
# agent/ssl_guard.py
# agent/ssl_verify.py
# agent/system_prompt.py
# agent/terminal_env_registry.py
# agent/trace_upload.py
# agent/transcription_registry.py
# agent/tts_registry.py
# agent/verify/environment.py
# agent/vertex_adapter.py
# agent/video_gen_registry.py
# agent/web_search_registry.py
# cli.py
# cron/jobs.py
# cron/scheduler.py
# gateway/agent_cache_pressure.py
# gateway/cgroup_cleanup.py
# gateway/channel_directory.py
# gateway/config.py
# gateway/control_socket.py
# gateway/dead_targets.py
# gateway/drain_control.py
# gateway/hooks.py
# gateway/kanban_watchers.py
# gateway/lifecycle_ledger.py
# gateway/mirror.py
# gateway/pairing.py
# gateway/platform_registry.py
# gateway/platforms/helpers.py
# gateway/platforms/weixin.py
# gateway/readiness.py
# gateway/restart_loop_guard.py
# gateway/rich_sent_store.py
# gateway/run.py
# gateway/session.py
# gateway/shutdown_flush.py
# gateway/shutdown_forensics.py
# gateway/slash_commands.py
# gateway/status.py
# gateway/sticker_cache.py
# gateway/whatsapp_identity.py
# hermes_bootstrap.py
# hermes_cli/_early_recovery.py
# hermes_cli/_install_repair.py
# hermes_cli/_startup_fast.py
# hermes_cli/_subprocess_compat.py
# hermes_cli/agent_plugins.py
# hermes_cli/auth.py
# hermes_cli/backup.py
# hermes_cli/banner.py
# hermes_cli/browser_connect.py
# hermes_cli/build_info.py
# hermes_cli/cli_agent_setup_mixin.py
# hermes_cli/cli_commands_mixin.py
# hermes_cli/codex_models.py
# hermes_cli/config.py
# hermes_cli/config_defaults.py
# hermes_cli/config_migrations.py
# hermes_cli/container_boot.py
# hermes_cli/dashboard_auth/registry.py
# hermes_cli/debug.py
# hermes_cli/dep_ensure.py
# hermes_cli/doctor.py
# hermes_cli/doctor_live.py
# hermes_cli/dump.py
# hermes_cli/env_loader.py
# hermes_cli/foreign_sessions.py
# hermes_cli/gateway.py
# hermes_cli/gateway_windows.py
# hermes_cli/gui_uninstall.py
# hermes_cli/image_provenance.py
# hermes_cli/install_identity.py
# hermes_cli/kanban.py
# hermes_cli/kanban_db.py
# hermes_cli/linux_desktop_entry.py
# hermes_cli/local_runtime/binaries.py
# hermes_cli/local_runtime/endpoint.py
# hermes_cli/local_runtime/growth.py
# hermes_cli/local_runtime/supervisor.py
# hermes_cli/logs.py
# hermes_cli/macos_tcc_anchor.py
# hermes_cli/main.py
# hermes_cli/memory_setup.py
# hermes_cli/model_catalog.py
# hermes_cli/models.py
# hermes_cli/nous_subscription.py
# hermes_cli/npm_engine.py
# hermes_cli/plugin_index.py
# hermes_cli/plugins.py
# hermes_cli/plugins_cmd.py
# hermes_cli/profile_distribution.py
# hermes_cli/profiles.py
# hermes_cli/prompt_size.py
# hermes_cli/psutil_android.py
# hermes_cli/runtime_repair.py
# hermes_cli/security_advisories.py
# hermes_cli/security_audit.py
# hermes_cli/security_audit_startup.py
# hermes_cli/service_manager.py
# hermes_cli/session_export_md.py
# hermes_cli/setup.py
# hermes_cli/skills_hub.py
# hermes_cli/slack_cli.py
# hermes_cli/status.py
# hermes_cli/subcommands/gateway.py
# hermes_cli/subcommands/uninstall.py
# hermes_cli/tools_config.py
# hermes_cli/uninstall.py
# hermes_cli/update_cmd.py
# hermes_cli/update_contract.py
# hermes_cli/update_inventory.py
# hermes_cli/update_lock.py
# hermes_cli/update_receipt.py
# hermes_cli/urllib_security.py
# hermes_cli/web_routers/local_models.py
# hermes_cli/web_routers/profiles.py
# hermes_cli/web_routers/skills.py
# hermes_cli/web_server.py
# hermes_constants.py
# hermes_state.py
# plugins/disk-cleanup/__init__.py
# plugins/disk-cleanup/disk_cleanup.py
# plugins/google_meet/node/registry.py
# plugins/google_meet/node/server.py
# plugins/google_meet/process_manager.py
# plugins/google_meet/realtime/openai_client.py
# plugins/hermes-achievements/dashboard/plugin_api.py
# plugins/memory/hindsight/__init__.py
# plugins/memory/honcho/__init__.py
# plugins/memory/honcho/cli.py
# plugins/memory/honcho/client.py
# plugins/memory/honcho/oauth.py
# plugins/memory/honcho/session.py
# plugins/memory/mem0/__init__.py
# plugins/memory/mem0/_setup.py
# plugins/memory/openviking/__init__.py
# plugins/memory/retaindb/__init__.py
# plugins/memory/supermemory/__init__.py
# plugins/platforms/a2a/protocol.py
# plugins/platforms/dingtalk/adapter.py
# plugins/platforms/discord/adapter.py
# plugins/platforms/feishu/adapter.py
# plugins/platforms/google_chat/adapter.py
# plugins/platforms/matrix/adapter.py
# plugins/platforms/photon/adapter.py
# plugins/platforms/photon/auth.py
# plugins/platforms/photon/cli.py
# plugins/platforms/slack/adapter.py
# plugins/platforms/teams/adapter.py
# plugins/platforms/telegram/adapter.py
# plugins/platforms/wecom/callback_adapter.py
# plugins/platforms/whatsapp/adapter.py
# plugins/teams_pipeline/store.py
# plugins/video_gen/fal/__init__.py
# plugins/web/ddgs/provider.py
# plugins/web/exa/provider.py
# plugins/web/firecrawl/provider.py
# plugins/web/parallel/provider.py
# tests/agent/test_ssl_ca_guard.py
# tests/hermes_cli/test_certifi_repair.py
# tests/hermes_cli/test_cmd_update.py
# tests/hermes_cli/test_cmd_update_apt.py
# tests/hermes_cli/test_dashboard_unified_launch.py
# tests/hermes_cli/test_dep_ensure.py
# tests/hermes_cli/test_doctor.py
# tests/hermes_cli/test_doctor_live.py
# tests/hermes_cli/test_gui_command.py
# tests/hermes_cli/test_kanban_boards.py
# tests/hermes_cli/test_kanban_db.py
# tests/hermes_cli/test_lazy_refresh_venv_repair.py
# tests/hermes_cli/test_memory_setup_provider_arg.py
# tests/hermes_cli/test_nous_subscription.py
# tests/hermes_cli/test_pip_install_detection.py
# tests/hermes_cli/test_profile_export_credentials.py
# tests/hermes_cli/test_psutil_android_extract.py
# tests/hermes_cli/test_status.py
# tests/hermes_cli/test_tui_npm_install.py
# tests/hermes_cli/test_update_fleet_restart_pending.py
# tests/hermes_cli/test_update_head_moved_gate.py
# tests/hermes_cli/test_update_interrupted_recovery.py
# tests/hermes_cli/test_web_server.py
# tests/hermes_cli/test_web_ui_build.py
# tests/test_hermes_logging.py
# tests/test_managed_runtime_resolution.py
# tests/tools/test_browser_chromium_autoinstall.py
# tests/tools/test_browser_chromium_check.py
# tests/tools/test_browser_homebrew_paths.py
# tests/tools/test_browser_lightpanda.py
# tests/tools/test_browser_npx_warmup.py
# tests/tools/test_browser_open_timeout.py
# tests/tools/test_browser_orphan_reaper.py
# tests/tools/test_browser_real_profile.py
# tests/tools/test_browser_suspect_recycle.py
# tests/tools/test_find_shell.py
# tests/tools/test_local_env_blocklist.py
# tests/tools/test_macos_protected_search.py
# tests/tui_gateway/test_compute_host.py
# tools/approval.py
# tools/blueprints.py
# tools/bot_mode_dm.py
# tools/bot_mode_probe.py
# tools/bot_relay.py
# tools/browser_tool.py
# tools/browser_use_cli.py
# tools/checkpoint_manager.py
# tools/code_execution_tool.py
# tools/code_kernel.py
# tools/computer_use/cua_backend.py
# tools/cronjob_tools.py
# tools/discord_tool.py
# tools/environments/base.py
# tools/environments/daytona.py
# tools/environments/local.py
# tools/environments/modal.py
# tools/environments/vercel_sandbox.py
# tools/fal_common.py
# tools/file_operations.py
# tools/lazy_deps.py
# tools/mcp_tool.py
# tools/neutts_synth.py
# tools/process_registry.py
# tools/read_extract.py
# tools/registry.py
# tools/skill_ledger.py
# tools/skill_linter.py
# tools/skill_manager_tool.py
# tools/skill_usage.py
# tools/skills_ast_audit.py
# tools/skills_guard.py
# tools/skills_hub.py
# tools/skills_sync.py
# tools/skills_sync_client.py
# tools/skills_tool.py
# tools/terminal_scope.py
# tools/terminal_tool.py
# tools/tirith_security.py
# tools/transcription_tools.py
# tools/tts_tool.py
# tools/vision_tools.py
# tools/voice_mode.py
# tools/wake_word.py
# tools/web_result_cache.py
# tools/website_policy.py
# tools/working_diff.py
# tools/write_approval.py
# tui_gateway/entry.py
# tui_gateway/methods_tools.py
# tui_gateway/server.py
2026-09-04 13:03:39 -04:00
ethernet
9c80d20f8b
docs: fix stale packaging/SSL/PHOTON references
...
- desktop.md: dist:win is MSIX-only, not NSIS+MSI
- BUILDING.md: sign-nested-chromium is LIVE (after-pack.mjs wires it), not dead
- pyproject: lazy_deps.py comment -> pm
- photon docs: drop dead PHOTON_NODE_BIN rows (adapter is pm-store-first);
restore PHOTON_MENTION_PATTERNS row my earlier edit wrongly removed
- urllib_security/models docstrings: SSL_CERT_FILE/certifi fallback ->
platform trust store (post truststore port)
2026-09-04 02:08:39 -04:00
ethernet
2f20ceb6f7
refactor(tls): trust the OS certificate store, one resolver
...
Cherry-pick of 03b45db777 from ethie/bundles-local-models: TLS trust was
five hand-rolled ladders (agent/ssl_verify, hermes_cli/auth,
agent/model_metadata, hermes_cli/urllib_security, gateway/run's SSL_CERT_FILE
mutation) all ultimately pointing at certifi's frozen list. Trust now comes
from the platform verifier via truststore: CryptoAPI on Windows,
Security.framework on macOS, OpenSSL's store on Linux; install_truststore()
patches ssl.SSLContext process-wide. agent/ssl_verify.py is the one
authority; agent/ssl_guard.py deleted.
Also closes the session-flagged coverage gap: hermes_cli/main.py (CLI
entrypoint) and tui_gateway/entry.py now call install_truststore() so
subcommands/help that never construct an AIAgent still get OS-store trust.
2026-09-04 01:57:30 -04:00
Teknium
ad50496b75
refactor(hermes_cli/web): compact git router (module-level imports, _probe_gh_auth), urllib_security, verify_cmd (_readiness_status), vercel_auth (_present inlined), seam docstrings
2026-09-02 21:28:23 -07:00
Teknium
cfa327e5dc
refactor(hclib): remaining hermes_cli library modules — dead code, unified helpers, flattened branches
2026-09-02 15:03:42 -07:00
Justin Bennington
167dd48b40
fix(models): trust certifi for credentialed catalogs (E-1002)
2026-08-14 16:43:37 -07:00
SHL0MS
b21e0bd8c9
fix(providers): honor per-provider TLS on custom /models and pricing probes
...
Per-provider ssl_ca_cert / ssl_verify reached the httpx chat client and the
auxiliary clients (#56681 ), but the endpoint discovery and pricing probes did
not. Both probe families resolved TLS from process-wide env vars only:
- the requests-based metadata/pricing probe
(agent/model_metadata.py::_resolve_requests_verify)
- the urllib-based /models catalog probe
(hermes_cli/models.py::probe_api_models)
A custom endpoint whose chain verifies against the provider's configured
bundle, but not the process SSL_CERT_FILE, then logged a spurious
CERTIFICATE_VERIFY_FAILED on every probe even though the chat path worked.
Pointing a global CA env var at the bundle fixes it but changes verification
for every provider, defeating the point of a per-provider setting.
This threads the selected provider's TLS settings into both probe paths,
reusing get_custom_provider_tls_settings so there is no second precedence
chain:
- _resolve_requests_verify(base_url) looks up the provider's ssl_verify /
ssl_ca_cert before falling back to the env vars. Callers with no base_url
keep the exact env-only behavior.
- probe_api_models builds an ssl.SSLContext from the provider settings and
passes it through open_credentialed_url, which gains an ssl_context seam on
the cloned secure opener. Unmatched or public endpoints pass None and keep
urllib's default policy.
Tests: tests/agent/test_custom_provider_ca_probes.py covers both probe
families (provider CA, ssl_verify:false, unmatched, missing file, config
lookup failure) plus end-to-end assertions that the resolved verify value and
SSLContext actually reach the request seam. Verified against the neighboring
metadata, pricing, TLS, and urllib-security suites (266 tests) with no
regressions.
2026-08-14 16:37:36 -07:00
kshitijk4poor
1f46145e03
fix(security): order sanitizer after installed hooks
2026-07-11 12:28:55 +05:30
kshitijk4poor
92c2146039
fix(security): sanitize after installed request hooks
2026-07-11 12:28:55 +05:30
kshitijk4poor
4530a4ca4c
fix(security): preserve opener-level header policy
2026-07-11 12:28:55 +05:30
kshitijk4poor
cf34a1e8c7
fix(security): cover remaining catalog credential paths
2026-07-11 12:28:55 +05:30
kshitijk4poor
27a1042b13
fix(security): preserve installed urllib policies
2026-07-11 12:28:55 +05:30
kshitijk4poor
6e75ba7fa0
fix(security): enforce one redirect credential policy
2026-07-11 12:28:55 +05:30
