ethernet
e8fcb007b9
Merge remote-tracking branch 'upstream/main' into ethie/pm-clean
...
# Conflicts:
# AGENTS.md
# acp_adapter/edit_approval.py
# acp_adapter/server.py
# agent/agent_init.py
# agent/anthropic_adapter.py
# agent/anthropic_credentials.py
# agent/auxiliary_client.py
# agent/azure_identity_adapter.py
# agent/bedrock_adapter.py
# agent/browser_registry.py
# agent/chat_completion_helpers.py
# agent/coding_context.py
# agent/context_references.py
# agent/conversation_loop.py
# agent/copilot_acp_client.py
# agent/credits_tracker.py
# agent/curator.py
# agent/curator_backup.py
# agent/deadline.py
# agent/display.py
# agent/errors.py
# agent/estop.py
# agent/i18n.py
# agent/image_gen_registry.py
# agent/image_routing.py
# agent/learning_graph.py
# agent/learning_mutations.py
# agent/lsp/servers.py
# agent/model_metadata.py
# agent/models_dev.py
# agent/monitoring/gateway_health_export.py
# agent/monitoring/otlp_exporter.py
# agent/pet/store.py
# agent/process_bootstrap.py
# agent/prompt_builder.py
# agent/proxy_sources/iron_proxy.py
# agent/secret_sources/_cache.py
# agent/secret_sources/bitwarden.py
# agent/secret_sources/registry.py
# agent/shell_hooks.py
# agent/skill_bundles.py
# agent/skill_commands.py
# agent/skill_utils.py
# agent/ssl_guard.py
# agent/ssl_verify.py
# agent/system_prompt.py
# agent/terminal_env_registry.py
# agent/trace_upload.py
# agent/transcription_registry.py
# agent/tts_registry.py
# agent/verify/environment.py
# agent/vertex_adapter.py
# agent/video_gen_registry.py
# agent/web_search_registry.py
# cli.py
# cron/jobs.py
# cron/scheduler.py
# gateway/agent_cache_pressure.py
# gateway/cgroup_cleanup.py
# gateway/channel_directory.py
# gateway/config.py
# gateway/control_socket.py
# gateway/dead_targets.py
# gateway/drain_control.py
# gateway/hooks.py
# gateway/kanban_watchers.py
# gateway/lifecycle_ledger.py
# gateway/mirror.py
# gateway/pairing.py
# gateway/platform_registry.py
# gateway/platforms/helpers.py
# gateway/platforms/weixin.py
# gateway/readiness.py
# gateway/restart_loop_guard.py
# gateway/rich_sent_store.py
# gateway/run.py
# gateway/session.py
# gateway/shutdown_flush.py
# gateway/shutdown_forensics.py
# gateway/slash_commands.py
# gateway/status.py
# gateway/sticker_cache.py
# gateway/whatsapp_identity.py
# hermes_bootstrap.py
# hermes_cli/_early_recovery.py
# hermes_cli/_install_repair.py
# hermes_cli/_startup_fast.py
# hermes_cli/_subprocess_compat.py
# hermes_cli/agent_plugins.py
# hermes_cli/auth.py
# hermes_cli/backup.py
# hermes_cli/banner.py
# hermes_cli/browser_connect.py
# hermes_cli/build_info.py
# hermes_cli/cli_agent_setup_mixin.py
# hermes_cli/cli_commands_mixin.py
# hermes_cli/codex_models.py
# hermes_cli/config.py
# hermes_cli/config_defaults.py
# hermes_cli/config_migrations.py
# hermes_cli/container_boot.py
# hermes_cli/dashboard_auth/registry.py
# hermes_cli/debug.py
# hermes_cli/dep_ensure.py
# hermes_cli/doctor.py
# hermes_cli/doctor_live.py
# hermes_cli/dump.py
# hermes_cli/env_loader.py
# hermes_cli/foreign_sessions.py
# hermes_cli/gateway.py
# hermes_cli/gateway_windows.py
# hermes_cli/gui_uninstall.py
# hermes_cli/image_provenance.py
# hermes_cli/install_identity.py
# hermes_cli/kanban.py
# hermes_cli/kanban_db.py
# hermes_cli/linux_desktop_entry.py
# hermes_cli/local_runtime/binaries.py
# hermes_cli/local_runtime/endpoint.py
# hermes_cli/local_runtime/growth.py
# hermes_cli/local_runtime/supervisor.py
# hermes_cli/logs.py
# hermes_cli/macos_tcc_anchor.py
# hermes_cli/main.py
# hermes_cli/memory_setup.py
# hermes_cli/model_catalog.py
# hermes_cli/models.py
# hermes_cli/nous_subscription.py
# hermes_cli/npm_engine.py
# hermes_cli/plugin_index.py
# hermes_cli/plugins.py
# hermes_cli/plugins_cmd.py
# hermes_cli/profile_distribution.py
# hermes_cli/profiles.py
# hermes_cli/prompt_size.py
# hermes_cli/psutil_android.py
# hermes_cli/runtime_repair.py
# hermes_cli/security_advisories.py
# hermes_cli/security_audit.py
# hermes_cli/security_audit_startup.py
# hermes_cli/service_manager.py
# hermes_cli/session_export_md.py
# hermes_cli/setup.py
# hermes_cli/skills_hub.py
# hermes_cli/slack_cli.py
# hermes_cli/status.py
# hermes_cli/subcommands/gateway.py
# hermes_cli/subcommands/uninstall.py
# hermes_cli/tools_config.py
# hermes_cli/uninstall.py
# hermes_cli/update_cmd.py
# hermes_cli/update_contract.py
# hermes_cli/update_inventory.py
# hermes_cli/update_lock.py
# hermes_cli/update_receipt.py
# hermes_cli/urllib_security.py
# hermes_cli/web_routers/local_models.py
# hermes_cli/web_routers/profiles.py
# hermes_cli/web_routers/skills.py
# hermes_cli/web_server.py
# hermes_constants.py
# hermes_state.py
# plugins/disk-cleanup/__init__.py
# plugins/disk-cleanup/disk_cleanup.py
# plugins/google_meet/node/registry.py
# plugins/google_meet/node/server.py
# plugins/google_meet/process_manager.py
# plugins/google_meet/realtime/openai_client.py
# plugins/hermes-achievements/dashboard/plugin_api.py
# plugins/memory/hindsight/__init__.py
# plugins/memory/honcho/__init__.py
# plugins/memory/honcho/cli.py
# plugins/memory/honcho/client.py
# plugins/memory/honcho/oauth.py
# plugins/memory/honcho/session.py
# plugins/memory/mem0/__init__.py
# plugins/memory/mem0/_setup.py
# plugins/memory/openviking/__init__.py
# plugins/memory/retaindb/__init__.py
# plugins/memory/supermemory/__init__.py
# plugins/platforms/a2a/protocol.py
# plugins/platforms/dingtalk/adapter.py
# plugins/platforms/discord/adapter.py
# plugins/platforms/feishu/adapter.py
# plugins/platforms/google_chat/adapter.py
# plugins/platforms/matrix/adapter.py
# plugins/platforms/photon/adapter.py
# plugins/platforms/photon/auth.py
# plugins/platforms/photon/cli.py
# plugins/platforms/slack/adapter.py
# plugins/platforms/teams/adapter.py
# plugins/platforms/telegram/adapter.py
# plugins/platforms/wecom/callback_adapter.py
# plugins/platforms/whatsapp/adapter.py
# plugins/teams_pipeline/store.py
# plugins/video_gen/fal/__init__.py
# plugins/web/ddgs/provider.py
# plugins/web/exa/provider.py
# plugins/web/firecrawl/provider.py
# plugins/web/parallel/provider.py
# tests/agent/test_ssl_ca_guard.py
# tests/hermes_cli/test_certifi_repair.py
# tests/hermes_cli/test_cmd_update.py
# tests/hermes_cli/test_cmd_update_apt.py
# tests/hermes_cli/test_dashboard_unified_launch.py
# tests/hermes_cli/test_dep_ensure.py
# tests/hermes_cli/test_doctor.py
# tests/hermes_cli/test_doctor_live.py
# tests/hermes_cli/test_gui_command.py
# tests/hermes_cli/test_kanban_boards.py
# tests/hermes_cli/test_kanban_db.py
# tests/hermes_cli/test_lazy_refresh_venv_repair.py
# tests/hermes_cli/test_memory_setup_provider_arg.py
# tests/hermes_cli/test_nous_subscription.py
# tests/hermes_cli/test_pip_install_detection.py
# tests/hermes_cli/test_profile_export_credentials.py
# tests/hermes_cli/test_psutil_android_extract.py
# tests/hermes_cli/test_status.py
# tests/hermes_cli/test_tui_npm_install.py
# tests/hermes_cli/test_update_fleet_restart_pending.py
# tests/hermes_cli/test_update_head_moved_gate.py
# tests/hermes_cli/test_update_interrupted_recovery.py
# tests/hermes_cli/test_web_server.py
# tests/hermes_cli/test_web_ui_build.py
# tests/test_hermes_logging.py
# tests/test_managed_runtime_resolution.py
# tests/tools/test_browser_chromium_autoinstall.py
# tests/tools/test_browser_chromium_check.py
# tests/tools/test_browser_homebrew_paths.py
# tests/tools/test_browser_lightpanda.py
# tests/tools/test_browser_npx_warmup.py
# tests/tools/test_browser_open_timeout.py
# tests/tools/test_browser_orphan_reaper.py
# tests/tools/test_browser_real_profile.py
# tests/tools/test_browser_suspect_recycle.py
# tests/tools/test_find_shell.py
# tests/tools/test_local_env_blocklist.py
# tests/tools/test_macos_protected_search.py
# tests/tui_gateway/test_compute_host.py
# tools/approval.py
# tools/blueprints.py
# tools/bot_mode_dm.py
# tools/bot_mode_probe.py
# tools/bot_relay.py
# tools/browser_tool.py
# tools/browser_use_cli.py
# tools/checkpoint_manager.py
# tools/code_execution_tool.py
# tools/code_kernel.py
# tools/computer_use/cua_backend.py
# tools/cronjob_tools.py
# tools/discord_tool.py
# tools/environments/base.py
# tools/environments/daytona.py
# tools/environments/local.py
# tools/environments/modal.py
# tools/environments/vercel_sandbox.py
# tools/fal_common.py
# tools/file_operations.py
# tools/lazy_deps.py
# tools/mcp_tool.py
# tools/neutts_synth.py
# tools/process_registry.py
# tools/read_extract.py
# tools/registry.py
# tools/skill_ledger.py
# tools/skill_linter.py
# tools/skill_manager_tool.py
# tools/skill_usage.py
# tools/skills_ast_audit.py
# tools/skills_guard.py
# tools/skills_hub.py
# tools/skills_sync.py
# tools/skills_sync_client.py
# tools/skills_tool.py
# tools/terminal_scope.py
# tools/terminal_tool.py
# tools/tirith_security.py
# tools/transcription_tools.py
# tools/tts_tool.py
# tools/vision_tools.py
# tools/voice_mode.py
# tools/wake_word.py
# tools/web_result_cache.py
# tools/website_policy.py
# tools/working_diff.py
# tools/write_approval.py
# tui_gateway/entry.py
# tui_gateway/methods_tools.py
# tui_gateway/server.py
2026-09-04 13:03:39 -04:00
ethernet
2f20ceb6f7
refactor(tls): trust the OS certificate store, one resolver
...
Cherry-pick of 03b45db777 from ethie/bundles-local-models: TLS trust was
five hand-rolled ladders (agent/ssl_verify, hermes_cli/auth,
agent/model_metadata, hermes_cli/urllib_security, gateway/run's SSL_CERT_FILE
mutation) all ultimately pointing at certifi's frozen list. Trust now comes
from the platform verifier via truststore: CryptoAPI on Windows,
Security.framework on macOS, OpenSSL's store on Linux; install_truststore()
patches ssl.SSLContext process-wide. agent/ssl_verify.py is the one
authority; agent/ssl_guard.py deleted.
Also closes the session-flagged coverage gap: hermes_cli/main.py (CLI
entrypoint) and tui_gateway/entry.py now call install_truststore() so
subcommands/help that never construct an AIAgent still get OS-store trust.
2026-09-04 01:57:30 -04:00
Teknium
624a752e79
refactor(agent/runtime): deadline/file_safety/estop/lifecycle leaf modules — dedupe result plumbing, drop dead guard code
...
- deadline: _result()/_abandon() replace 7 BoundedResult constructions and 2
cancel+callback sites; timers handled as a list; dead raise_if_timed_out removed.
- file_safety: retired classify_cross_profile_target (0 refs; get_cross_profile_warning
stub kept for external callers), _home_and_resolved/_mirror_warning shared by
the sandbox/container mirror guards; _find_sandbox_mirror_segments inlined.
- estop: _hermes_home/_canonical_root now the file_safety helpers;
_reset_log_state_for_tests inlined into its only test.
- subagent_lifecycle: _validate_request driven by _UNSUPPORTED_REQUEST_FIELDS table.
- turn_liveness: dead start()/_abort_message removed, _emit_warning shared.
- process_bootstrap: _enable_happy_eyeballs reused by the client variant.
- Comment/docstring compaction across the remaining leaf modules.
2026-09-02 13:29:48 -07:00
Teknium
4c0546c9cc
fix(moa): surface stale presets without retries
...
Keep invalid persisted preset names fail-closed, list the valid configured choices, and classify the local lookup failure as deterministic so it reaches Desktop immediately.
2026-07-17 13:49:12 -07:00
Simplelife
f4af35f90d
fix(streaming): retry zero-chunk streams
2026-07-15 10:58:36 +05:30
chromalinx
a218a0f156
fix(agent,gateway,doctor): add SSL CA cert bundle fail-fast guard
...
A stale certifi CA bundle after a partial `hermes update` used to crash
the agent on the first outbound HTTPS call with a raw traceback and
trap the gateway in a retry loop.
This patch:
* Adds `agent/errors.py` with a typed `SSLConfigurationError`
* Adds `agent/ssl_guard.py` with a `verify_ca_bundle()` pre-flight
that asserts the bundle exists, is non-trivial in size, and can build
a working SSLContext. On macOS, it falls back to the system trust
store when the bundle is empty but the system store is healthy
(covers corporate proxies / MDM setups).
* Wires the guard into `run_agent.py` and `gateway/run.py` right
after the `hermes_bootstrap` import, inside a try/except so a bug
in the guard itself can never prevent startup.
* Adds a `SSL / CA Certificates` section to `hermes_cli doctor` so
users can detect the failure with one command.
* Adds unit tests covering the healthy, missing, empty, skip-env, and
macOS-fallback paths.
* Adds an RCA document describing the failure mode and the recovery
path (`pip install -e .`).
When the bundle is broken the user sees:
\u26a0\ufe0f SSL certificate bundle issue detected.
Run: pip install -e .
`HERMES_SKIP_SSL_GUARD=1` disables the check for sandboxed
environments that ship their own trust store.
2026-06-13 21:14:32 -07:00
