teknium1 17a137d8a3 fix(tui-gateway): a SIGTERM-ignoring command no longer survives the gateway's SIGTERM exit ...

The SIGTERM handler arms a 1s os._exit timer, then runs _shutdown_sessions: a flush of up to
5s, then _stop_turns_before_exit, whose kill was the graceful TERM, wait 1s, KILL. A command
that ignores SIGTERM was still alive when the timer fired, and os._exit left it reparented to
init (live: `trap '' TERM; sleep 3600` survived a SIGTERM to `python -m tui_gateway.entry`).

- kill_live_foreground_processes(now=True): SIGKILL each in-flight foreground tree at once,
  no TERM grace, no wait (BaseEnvironment._force_kill_process; LocalEnvironment kills the
  recorded process group, never our own).
- The grace timer's exit (entry._hard_exit) runs it before os._exit.
- _stop_turns_before_exit SIGKILLs whatever is still alive halfway through its settle budget
  (it ignored the interrupt's TERM), so the tool call still ends with a result the teardown
  persists instead of a dangling tool_call in state.db.
- The other hard exits that skip cleanup do the same before os._exit: the serve parent-death
  watchdog, the CLI exit watchdog, the kanban worker's SIGTERM path, and the messaging
  gateway's shutdown and loop-liveness watchdogs.
- Deflake test_shutdown_mid_tool_kills_the_command_and_keeps_its_result: the 0.5s settle
  budget was too tight under -n 40 (1 red in 9 runs); the join returns when the turn ends.

2026-09-23 17:09:54 -07:00

..

dashboard_auth

…

local_runtime

refactor(platform): one native_arch for local-runtime assets, desktop PE gate, managed Node

2026-09-22 01:13:23 -07:00

observability

fix(relay): shared-metrics task close skips a scope buried under a concurrent turn

2026-09-19 23:42:20 -07:00

proxy

…

subcommands

Merge origin/main: browser fence composed with the dispatch/retry split (#115184); server registration, i18n, contracts

2026-09-23 03:25:06 -07:00

web_routers

fix(desktop): a member that fails after pre-tool text is reported, not posted as its reply

2026-09-23 16:58:39 -07:00

__init__.py

chore(release): v0.21.4 (v2026.9.21)

2026-09-21 11:10:32 -07:00

_early_recovery.py

…

_install_repair.py

…

_parser.py

fix(cli): --help lists gateway status and the --profile long form; trim epilogue tests

2026-09-18 09:50:52 -07:00

_scan_venv_blockers.py

…

_secrets_common.py

…

_startup_fast.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

_subprocess_compat.py

fix: startup update check no longer lazy-fetches history in partial clones

2026-09-23 14:55:40 -07:00

active_sessions.py

fix(sessions): skip POSIX zombie probe on Windows; prune registry snapshot after lock release

2026-09-20 13:21:24 -07:00

agent_import_sync.py

…

agent_import.py

…

agent_plugins.py

Portable plugins declare the application each MCP server needs; install refuses on an unsupported host (NS-942) (#119049)

2026-09-22 17:54:41 +05:30

AGENTS.md

fix: hermes update restarts only the gateways of the home it updates (#93349)

2026-09-23 05:36:30 -07:00

anon_auth.py

fix(auth): named profiles read the root auth.json again (revert #111724)

2026-09-21 09:55:40 -07:00

anon_sign_in_cli.py

…

anon_sign_in.py

…

approval_mode.py

…

approval_transport.py

…

approvals_suggest.py

…

approvals_test.py

…

archive_safe.py

…

auth_codex_browser.py

feat(auth): opt-in browser authorization-code + PKCE login for openai-codex

2026-09-19 12:11:58 -07:00

auth_codex.py

refactor(codex): keep the read-only quota guard, drop the preserve_corrupt plumbing

2026-09-22 20:44:30 +05:30

auth_commands.py

fix(auth): named profiles read the root auth.json again (revert #111724)

2026-09-21 09:55:40 -07:00

auth_constants.py

…

auth_device_flow.py

…

auth_error_copy.py

…

auth_minimax.py

…

auth_model_picker.py

feat(providers): external-process provider support for standalone model-provider plugins (from #105863)

2026-09-20 14:29:39 -07:00

auth_nous.py

chore(auth): drop the unused tool:invoke OAuth scope from the step-up request (#118036)

2026-09-21 15:55:09 +05:30

auth_oauth_grants.py

fix(auth): named profiles read the root auth.json again (revert #111724)

2026-09-21 09:55:40 -07:00

auth_oauth_pkce_plugin.py

fix(auth): PKCE token errors reuse the canonical grant-dead code set

2026-09-20 18:21:34 -07:00

auth_openrouter.py

…

auth_plugin_providers.py

fix(auth): user provider plugin owns its aliases and display name in the auth registry

2026-09-20 18:29:22 -07:00

auth_qwen.py

…

auth_spotify.py

…

auth_xai.py

fix(auth): named profiles read the root auth.json again (revert #111724)

2026-09-21 09:55:40 -07:00

auth_zai_kimi.py

fix(picker): curated fallback for cold OAuth rows; Z.AI failed-probe negative cache; trim salvage

2026-09-18 11:01:52 -07:00

auth.py

refactor(config): move read-failure reporting into hermes_cli/config_read_errors.py

2026-09-23 15:05:44 -07:00

azure_detect.py

fix(cli): bound Azure detect response reads

2026-09-19 09:23:22 -07:00

backend_retirement.py

…

backup.py

fix(config): route every config.yaml writer through one comment-preserving writer

2026-09-22 01:07:59 -07:00

bang_shell.py

fix(cli): fail closed without bang shell sanitizer

2026-09-20 18:20:44 -07:00

banner.py

fix: startup update check no longer lazy-fetches history in partial clones

2026-09-23 14:55:40 -07:00

blueprint_cmd.py

…

browser_connect.py

…

build_info.py

…

bundles.py

…

callbacks.py

…

checkpoints.py

…

claw.py

fix: doctor, cron status, claw and gateway status report the real host topology

2026-09-21 05:06:45 -07:00

cli_agent_setup_mixin.py

feat(connectors): one backend-owned connection operation, with a setup card on Desktop, TUI and CLI (#111008)

2026-09-21 10:04:32 +05:30

cli_auto_maintenance.py

refactor(cli): move cli.py module-level helper clusters into topical siblings; cli.py lands under 2,000 lines (#116911)

2026-09-20 20:42:17 -07:00

cli_billing_mixin.py

…

cli_chat_error_copy.py

fix: WAF 403s stop reading as key rejections; anthropic_messages routes send custom_providers extra_headers

2026-09-19 09:57:21 -07:00

cli_chat_turn_mixin.py

chore: merge origin/main (resolve website/docs/user-guide/features/fallback-providers.md)

2026-09-19 10:47:48 -07:00

cli_commands_mixin.py

fix(sessions): a /branch child row carries the parent's system prompt (CLI + TUI/Desktop)

2026-09-23 17:06:48 -07:00

cli_config_load.py

refactor(cli): move cli.py module-level helper clusters into topical siblings; cli.py lands under 2,000 lines (#116911)

2026-09-20 20:42:17 -07:00

cli_footer_split.py

fix: keep cli_footer_split importable under the prompt_toolkit test stubs

2026-09-20 13:35:09 -07:00

cli_info_mixin.py

feat(cli): live dock shows the standing /goal and queued prompts

2026-09-23 10:05:40 -07:00

cli_init_mixin.py

fix(cli): don't flag plugin toolsets as unknown at startup

2026-09-21 23:26:19 -07:00

cli_loops_mixin.py

feat: label a model.context_length pin and warn once when it disagrees with the provider

2026-09-19 10:28:34 -07:00

cli_modal_mixin.py

feat(connectors): the backend API for the desktop Connectors page; connect an app without a chat session (#115191)

2026-09-22 13:57:51 +05:30

cli_model_switch_mixin.py

fix: a chat switched to Codex no longer sends its model to the previous provider's endpoint

2026-09-23 04:44:31 -07:00

cli_output.py

…

cli_process_dock.py

feat(process_registry): stamp exited_at and expose it on process.list

2026-09-20 13:55:03 -07:00

cli_process_notifications.py

feat(notifications): opt-in suppression of user-channel warning notifications

2026-09-18 01:43:35 +05:30

cli_render.py

refactor(cli): move cli.py module-level helper clusters into topical siblings; cli.py lands under 2,000 lines (#116911)

2026-09-20 20:42:17 -07:00

cli_session_dock.py

feat(cli): live dock shows the standing /goal and queued prompts

2026-09-23 10:05:40 -07:00

cli_session_mixin.py

fix(sessions): transcript exports keep compacted turns, so --delete-after-verified no longer deletes them unseen

2026-09-23 22:22:32 +05:30

cli_shutdown.py

fix(tui-gateway): a SIGTERM-ignoring command no longer survives the gateway's SIGTERM exit

2026-09-23 17:09:54 -07:00

cli_single_query.py

fix(tui-gateway): a SIGTERM-ignoring command no longer survives the gateway's SIGTERM exit

2026-09-23 17:09:54 -07:00

cli_status_bar_mixin.py

feat: label a model.context_length pin and warn once when it disagrees with the provider

2026-09-19 10:28:34 -07:00

cli_stream_mixin.py

feat(connectors): the backend API for the desktop Connectors page; connect an app without a chat session (#115191)

2026-09-22 13:57:51 +05:30

cli_subagent_monitor.py

fix(cli): make function-key workflows reliable on macOS (#120666)

2026-09-23 22:05:49 +00:00

cli_terminal_input.py

refactor(cli): move cli.py module-level helper clusters into topical siblings; cli.py lands under 2,000 lines (#116911)

2026-09-20 20:42:17 -07:00

cli_terminal_mixin.py

…

cli_tui_mixin.py

fix(cli): make function-key workflows reliable on macOS (#120666)

2026-09-23 22:05:49 +00:00

cli_tui_runtime_mixin.py

refactor(cli): move HermesCLI init phases and TUI run-loop phases into mixin siblings (#116911)

2026-09-20 18:43:11 -07:00

cli_unknown_command.py

…

cli_voice_mixin.py

…

clipboard.py

fix(clipboard): give image probes a valid stdin

2026-09-20 10:52:54 -07:00

codex_models.py

fix(models): drop gpt-6-terra, a tier OpenAI never published

2026-09-23 00:44:33 -07:00

codex_runtime_plugin_migration.py

chore: mark the deliberate /tmp literals and shrink the lint baseline to one code block

2026-09-19 10:44:26 -07:00

codex_runtime_switch.py

feat(codex): configure app-server binary

2026-09-19 09:30:56 -07:00

colors.py

…

commands_completion.py

…

commands_platforms.py

…

commands.py

fix(gateway): /help and /commands show a gated non-admin only the commands they can run

2026-09-21 01:06:02 -07:00

completion.py

…

config_backups.py

…

config_defaults.py

Merge origin/main: browser fence composed with the dispatch/retry split (#115184); server registration, i18n, contracts

2026-09-23 03:25:06 -07:00

config_effective.py

refactor(config): move read-failure reporting into hermes_cli/config_read_errors.py

2026-09-23 15:05:44 -07:00

config_env_routing.py

…

config_home.py

…

config_migrations.py

Profile editor MCP toggles take effect at runtime (#89441, salvage #107451) (#119536)

2026-09-22 21:09:44 +00:00

config_providers.py

refactor(config_providers): keep main's self-resolve, read the config through the read-only loader

2026-09-20 15:17:49 +05:30

config_read_errors.py

fix(config): a save refused over bad YAML says to fix the file, not "try again"

2026-09-23 15:05:44 -07:00

config.py

fix(config): an unreadable config.yaml no longer rebuilds its fallback on every load

2026-09-23 15:05:44 -07:00

console_engine.py

fix(console): accept the --force override the held-store refusal advertises

2026-09-20 20:13:33 -07:00

container_boot.py

fix(gateway): multiplex convergence works inside an s6 container; a standalone-on-a-guard host says so loudly

2026-09-23 10:58:15 -07:00

context_switch_guard.py

fix(cli): model-switch warning quotes the capped compression trigger

2026-09-19 16:28:57 +05:30

copilot_auth.py

hermes_platform.resolver: locate/inspect/probe tiers, AppResolver, gh lookup migrated (NS-921) (#118065)

2026-09-22 17:08:30 +05:30

credential_lifecycle.py

fix(config): route every config.yaml writer through one comment-preserving writer

2026-09-22 01:07:59 -07:00

cron.py

gateway: converge on multiplex-only — real migrate, no opt-out, no rollback, host lock refuses

2026-09-21 10:11:19 -07:00

curator.py

fix(curator): tarball skips regeneratable dirs; ledger --compact garbage-collects blobs

2026-09-19 09:20:54 -07:00

curses_ui.py

…

dashboard_procs.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

dashboard_register.py

…

debug.py

…

default_soul.py

…

dep_ensure.py

…

desktop_console.py

…

desktop_update_verify.py

…

diagnostics_upload.py

…

dingtalk_auth.py

…

doctor_config.py

feat(doctor): resolve every routed auxiliary.<task> block and report the dead ones

2026-09-19 12:30:32 -07:00

doctor_connectivity.py

fix: doctor validates GitHub tokens against /rate_limit so Actions installation tokens pass (review follow-up)

2026-09-20 12:15:07 -07:00

doctor_live.py

…

doctor_platform.py

fix(host-topology): a createTime-null record is not a live gateway, and the restart we print must run

2026-09-21 05:06:45 -07:00

doctor_report.py

…

doctor_state.py

fix(memory): user-dir memory providers keep Desktop config + OAuth

2026-09-23 01:07:08 -07:00

doctor_tools.py

fix(doctor): stop prescribing audit fixes that updates revert (#116774)

2026-09-20 15:57:25 -07:00

doctor.py

refactor(doctor,gateway): share the migrate preflight's duplicate-credential check with doctor and status

2026-09-21 18:53:36 -07:00

dump.py

…

env_loader.py

fix(profiles): pin the launch home so a mirrored HERMES_HOME cannot flip routed-profile decisions

2026-09-23 08:09:47 -07:00

fallback_cmd.py

…

fallback_config.py

fix(cron): a pinned job never falls back to the global fallback chain (#120312)

2026-09-23 10:42:18 -04:00

focus_view.py

…

foreign_sessions_browser.py

…

foreign_sessions.py

…

free_tier_bootstrap.py

fix(setup): reconcile_record() only reconciles the launch profile's record

2026-09-18 12:52:36 -07:00

gateway_command_errors.py

…

gateway_enroll.py

…

gateway_launchd.py

fix(gateway): launchd install honours --no-start-now and the wizard's "start now" answer

2026-09-23 07:48:32 -07:00

gateway_migrate_guards.py

fix(migrate): auto-fold a unit-less default when every secondary shares one manager

2026-09-21 10:11:19 -07:00

gateway_migrate.py

docs: in-container s6 convergence, 'unset means on', and the loud standalone warning; migrate labels an s6 slot as parked, not uninstalled

2026-09-23 10:58:15 -07:00

gateway_multiplex_mode.py

fix(gateway): gateway.multiplex_profiles has one valid value; a retired false is rewritten to true with a one-time boxed notice

2026-09-23 10:58:15 -07:00

gateway_multiplex_s6.py

fix(gateway): multiplex convergence works inside an s6 container; a standalone-on-a-guard host says so loudly

2026-09-23 10:58:15 -07:00

gateway_multiplex_served.py

…

gateway_profile_lifecycle.py

fix(gateway): parking composes with gateway.standalone and the dashboard Stop/Start twin

2026-09-23 08:25:28 -07:00

gateway_service_unit.py

refactor(gateway): retire the --replace drop-in in one step, two invariant tests

2026-09-23 06:27:24 -07:00

gateway_setup_wizard.py

fix(gateway): launchd install honours --no-start-now and the wizard's "start now" answer

2026-09-23 07:48:32 -07:00

gateway_supervised_restart.py

…

gateway_windows_legacy.py

fix: a secondary profile no longer removes the default profile's bare-named gateway launchers (review follow-up)

2026-09-20 12:47:14 -07:00

gateway_windows.py

fix(update): pending fleet restart leaves gateways already on the checkout code alone

2026-09-20 18:52:45 -07:00

gateway.py

fix(gateway): multiplex convergence works inside an s6 container; a standalone-on-a-guard host says so loudly

2026-09-23 10:58:15 -07:00

git_credentials.py

fix(git-auth): a rejected GITHUB_TOKEN yields to the gh CLI login instead of failing the clone (#115257)

2026-09-20 10:44:52 -07:00

gitlock.py

fix(checkpoints): sweep tmp_pack debris stranded by timed-out store gcs

2026-09-20 12:03:06 -07:00

goal_command.py

…

goals.py

fix(time): tolerate Windows locale strftime errors

2026-09-23 18:29:35 -05:00

gui_uninstall.py

…

heartbeat.py

…

hooks.py

feat(plugins): fire pre/post_auxiliary_call events on every auxiliary LLM call (#79733)

2026-09-22 01:19:12 -07:00

image_provenance.py

…

init_command.py

…

input_sanitize.py

…

install_identity.py

…

inventory.py

refactor(models): drop the duplicate ollama TTL clamp and per-model kwargs dicts

2026-09-23 21:53:47 +05:30

journey.py

…

kanban_boards.py

…

kanban_db_connect.py

…

kanban_db_dispatch.py

fix(profile-scope): stamp profile_home only for FOREIGN homes; cache the gate-prefix scan

2026-09-23 06:46:02 -07:00

kanban_db_graph.py

…

kanban_db_notify.py

fix(gateway): close sender-routing gaps found in review

2026-09-18 22:36:24 -07:00

kanban_db_workspace.py

fix(kanban): NFC-normalize worktree path identity checks

2026-09-20 10:41:25 -07:00

kanban_db.py

refactor(kanban): share one _retention_seconds helper across both gc sweeps

2026-09-22 13:41:11 +05:30

kanban_decompose.py

fix(kanban): decomposed cards fall back to the root task's assignee, never the dispatcher's own profile

2026-09-18 09:48:41 -07:00

kanban_diagnostics.py

fix(kanban): dispatcher blocks a card on the first terminal provider error

2026-09-18 20:34:16 -07:00

kanban_ops.py

kanban gc: validate retention flags before the workspace sweep

2026-09-22 13:41:11 +05:30

kanban_output.py

fix(kanban): expose task runtime limit in JSON

2026-09-20 18:43:59 -07:00

kanban_parser.py

refactor(kanban): narrow _nonnegative_int except to ValueError

2026-09-22 13:41:11 +05:30

kanban_pr_acceptance_store.py

…

kanban_pr_acceptance.py

…

kanban_specify.py

fix(kanban): board identity follows the bound profile override, not the launch env

2026-09-23 08:09:47 -07:00

kanban_swarm.py

…

kanban_transfer.py

…

kanban.py

fix(kanban): board identity follows the bound profile override, not the launch env

2026-09-23 08:09:47 -07:00

lifecycle.py

fix(gateway): await async pre_gateway_dispatch callbacks on the event loop

2026-09-21 23:47:51 -07:00

linux_desktop_entry.py

…

logs.py

…

loops.py

…

macos_tcc_anchor.py

…

main_agent_cmds.py

…

main_dashboard.py

fix(dashboard): one desktop-owned-child predicate, exit 78 on host-owner refusal

2026-09-23 07:09:45 -07:00

main_dep_hints.py

…

main_desktop.py

refactor(platform): one native_arch for local-runtime assets, desktop PE gate, managed Node

2026-09-22 01:13:23 -07:00

main_install_repair.py

fix(update): drop the --reinstall plumbing; a plain editable install already rewrites the finder

2026-09-23 06:51:47 -07:00

main_platform_setup.py

…

main_provider_setup.py

feat(providers): remove the keyless opencode-free tier

2026-09-18 15:40:37 +05:30

main_tui_launch.py

fix(windows): route every bare-bash spawn through _find_bash and surface silent interpreter failures

2026-09-20 15:50:26 -07:00

main_web_build.py

perf(update): skip the web build's npm ci when the manifests digest is unchanged

2026-09-20 16:41:21 +05:30

main.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

managed_scope.py

perf(gateway): parse readiness and bundled-manifest YAML with the C loader

2026-09-23 21:26:49 +05:30

managed_uv.py

fix(install): reinstall a managed uv that no longer runs

2026-09-19 02:44:02 -07:00

mcp_app_detection.py

…

mcp_catalog.py

fix(mcp): one reader for mcp_servers.<name>.enabled (#119567)

2026-09-22 22:00:24 +00:00

mcp_config.py

fix(mcp): one reader for mcp_servers.<name>.enabled (#119567)

2026-09-22 22:00:24 +00:00

mcp_picker.py

…

mcp_security.py

…

mcp_startup.py

fix(mcp_startup): take the deferred slot under the lock so two racing first clients fire once

2026-09-20 18:16:47 +05:30

mem_trim.py

…

memory_oauth.py

fix(memory): resolve OAuth flow in requested profile scope

2026-09-23 07:49:35 -07:00

memory_provider_migration.py

fix(memory): recover catalog provider once per profile

2026-09-23 07:49:35 -07:00

memory_setup.py

chore(memory): remove the bundled hindsight provider (moved to the plugin catalog)

2026-09-23 01:16:41 -07:00

middleware.py

fix(plugins): route execution middleware through lazy discovery (#105827)

2026-09-21 23:47:51 -07:00

migrate.py

…

moa_cmd.py

…

moa_config.py

…

model_catalog.py

…

model_cost_guard.py

…

model_data_policy_guard.py

…

model_normalize.py

fix: strip a matching provider: prefix like provider/ in model normalization

2026-09-19 09:34:40 -07:00

model_search.py

…

model_selection_guards.py

…

model_setup_flows_azure.py

…

model_setup_flows_bedrock.py

…

model_setup_flows_common.py

…

model_setup_flows_custom.py

fix: custom-provider key_env in the CLI picker/catalog helpers reads through the profile secret scope

2026-09-19 10:26:08 -07:00

model_setup_flows.py

feat(providers): external-process provider support for standalone model-provider plugins (from #105863)

2026-09-20 14:29:39 -07:00

model_switch_providers.py

perf(picker): stop blocking the model picker on TTL-expired catalogs

2026-09-23 21:53:47 +05:30

model_switch.py

fix(model): prefer the current provider's alias on implicit switches too

2026-09-23 17:08:21 -07:00

models_catalog_static.py

fix(models): drop gpt-6-terra, a tier OpenAI never published

2026-09-23 00:44:33 -07:00

models_detect.py

…

models_local.py

fix: custom-provider key_env in the CLI picker/catalog helpers reads through the profile secret scope

2026-09-19 10:26:08 -07:00

models_pricing.py

refactor(credits): gate the re-warm on the pricing cache's own failure window

2026-09-20 14:02:17 +05:30

models_profile_cache.py

…

models_reasoning_caps.py

…

models_validate.py

fix(models_validate): one profile-catalog helper decides accept/reject before the generic listing

2026-09-20 16:22:25 -07:00

models.py

fix(anthropic): send fast mode only to the Opus models the docs list

2026-09-23 13:40:44 -04:00

nous_account.py

feat(connectors): the backend API for the desktop Connectors page; connect an app without a chat session (#115191)

2026-09-22 13:57:51 +05:30

nous_auth_keepalive.py

fix(auth): scope Nous keepalive on multiplexed gateways

2026-09-23 06:46:02 -07:00

nous_billing.py

…

nous_subscription.py

fix(config): hermes doctor and plugins enable read a list-literal platform_toolsets string

2026-09-20 12:44:48 -07:00

npm_engine.py

…

onepassword_secrets_cli.py

…

oneshot.py

fix(mcp): one reader for mcp_servers.<name>.enabled (#119567)

2026-09-22 22:00:24 +00:00

pairing.py

…

partial_compress.py

…

personality.py

…

pets.py

…

platform_actions.py

…

platforms.py

…

plugin_capabilities.py

…

plugin_catalog_presence.py

feat: catalog marks onboarding plugins; catalog rows carry the app's presence

2026-09-23 09:26:07 +05:30

plugin_catalog.py

fix: curated catalog fields a published doc does not carry come from the checkout

2026-09-23 09:26:07 +05:30

plugin_compat.py

…

plugin_dev.py

fix(plugins): unload the doctor's temp plugin before removing its home

2026-09-22 00:06:29 -07:00

plugin_packs.py

fix(plugin-packs): refuse and strip secret/consent keys at every depth of a config seed

2026-09-22 00:06:29 -07:00

plugin_python_deps.py

fix(plugins): plugin dependencies follow the plugin's own security policy

2026-09-23 10:07:51 -07:00

plugin_validate_desktop.py

fix(plugins): admission lint refuses static URL-scheme imports in desktop/plugin.js

2026-09-21 22:39:35 -07:00

plugin_validate.py

Portable plugins declare the application each MCP server needs; install refuses on an unsupported host (NS-942) (#119049)

2026-09-22 17:54:41 +05:30

plugins_activation_live.py

fix: two plugins installed together both go live with their MCP tools

2026-09-23 12:45:32 +05:30

plugins_activation.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

plugins_cmd_catalog.py

fix: plugins installed a second apart both keep their install record

2026-09-23 11:45:29 +05:30

plugins_cmd.py

perf(config): route the config and manifest loaders through fast_safe_load

2026-09-23 21:26:49 +05:30

plugins_discovery.py

fix(plugins): canonical activation keys + remove/toggle bookkeeping across CLI, dashboard and RPC

2026-09-22 00:13:50 -07:00

plugins_dispatch.py

feat(plugins): fire pre/post_auxiliary_call events on every auxiliary LLM call (#79733)

2026-09-22 01:19:12 -07:00

plugins_ledger.py

feat(desktop): the Connectors page replaces the MCP tab (#119074)

2026-09-22 17:16:00 +05:30

plugins_loader.py

feat(plugins): late-loaded plugins wire their platform handlers live (#87770)

2026-09-22 09:50:22 -07:00

plugins_manifest.py

Portable plugin MCP tools keep their names instead of a hash (64-char provider cap) (#119263)

2026-09-22 22:05:28 +05:30

plugins_settings.py

feat(desktop): render plugin-declared settings in the Plugins tab (#46600, #87934)

2026-09-22 01:48:18 -07:00

plugins_state.py

feat(desktop): render plugin-declared settings in the Plugins tab (#46600, #87934)

2026-09-22 01:48:18 -07:00

plugins.py

feat: installed plugins' MCP tools and skills are live in every open chat, no Connect-now (#119644)

2026-09-23 05:11:44 +05:30

portal_cli.py

…

process_identity.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

profile_channels.py

fix(config): route every config.yaml writer through one comment-preserving writer

2026-09-22 01:07:59 -07:00

profile_cmd.py

fix(profiles): --clone copies the active memory provider's config (#120115)

2026-09-23 05:37:40 -07:00

profile_describer.py

…

profile_distribution.py

Setup profile is minted by the backend and found by role, not by name (#119456)

2026-09-23 01:25:04 +05:30

profile_identity.py

…

profile_memory_config.py

fix(profiles): --clone copies the active memory provider's config (#120115)

2026-09-23 05:37:40 -07:00

profiles.py

fix(profiles): serialize cold skill-count scans

2026-09-23 21:26:49 +05:30

projects_cmd.py

…

projects_db.py

…

prompt_size.py

…

prompt_stash.py

…

provider_catalog.py

refactor(providers): drop the now-dead keyless provider plumbing

2026-09-18 15:40:37 +05:30

providers.py

fix(providers): restore the trimmed api_mode gates lost in the rebase onto #116853

2026-09-20 10:11:40 -07:00

proxy_cli.py

…

psutil_android.py

…

pt_input_extras.py

fix(cli): Super+<printable> under modifyOtherKeys types the character

2026-09-18 09:52:03 -07:00

pty_bridge.py

…

pty_session.py

fix(dashboard): a /chat tab's attach token is per tab, and one token maps to one PTY

2026-09-20 12:51:30 -07:00

quiet_single_query.py

fix(bot-relay): a relayed turn is booked from its turn report at the cap, not killed with its handoff

2026-09-20 11:55:07 -07:00

relaunch.py

…

relay_plugin_cutover.py

…

relay_plugin_migrate.py

…

resource_limits.py

…

route_identity.py

fix(config): provider switch via config set drops the previous provider's route (#113719)

2026-09-18 12:49:40 -07:00

runtime_provider_backends.py

fix(anthropic): keep OAuth rotation on accepted native proxies

2026-09-23 16:27:37 -07:00

runtime_provider_custom.py

fix(tui_gateway): scope manual compression to session profile

2026-09-20 11:19:50 -07:00

runtime_provider.py

fix: a chat switched to Codex no longer sends its model to the previous provider's endpoint

2026-09-23 04:44:31 -07:00

secret_prompt.py

…

secrets_cli.py

…

security_advisories.py

…

security_audit_startup.py

…

security_audit.py

…

send_cmd.py

refactor: resolve runtime temp paths via tempfile/TMPDIR instead of literal /tmp

2026-09-19 10:44:26 -07:00

service_manager.py

fix(service): drop the s6 chmod-after-chown reorder

2026-09-19 01:31:49 -07:00

session_export_html.py

…

session_export_md.py

…

session_export.py

fix(sessions): transcript exports keep compacted turns, so --delete-after-verified no longer deletes them unseen

2026-09-23 22:22:32 +05:30

session_filters.py

…

session_listing.py

…

session_lost_and_found.py

fix: key the tools[] pin by code version; never re-add config-excluded tools

2026-09-23 15:43:51 -07:00

session_recap.py

…

session_recovery.py

fix: key the tools[] pin by code version; never re-add config-excluded tools

2026-09-23 15:43:51 -07:00

session_schema_history.py

chore(sessions): record the transport_profile column in the schema history

2026-09-19 02:28:50 -07:00

sessions_cmd_browse.py

…

sessions_cmd_journal_mode.py

fix(sessions): make set-journal-mode portable and fail closed where it cannot prove quiescence

2026-09-20 20:13:25 -07:00

sessions_cmd_repair_profiles.py

feat(sessions): hermes sessions repair-profiles settles crossed-profile durable state

2026-09-18 22:36:41 -07:00

sessions_cmd.py

refactor(sessions): one transcript-format rule and one missing-display-index probe

2026-09-23 22:22:32 +05:30

sessions_repair_profiles.py

fix(sessions): repair-profiles moves a session whose title the target store already holds

2026-09-23 07:01:11 -07:00

setup_hidden_env.py

…

setup_migration.py

…

setup_platforms.py

…

setup_profile.py

Setup profile is minted by the backend and found by role, not by name (#119456)

2026-09-23 01:25:04 +05:30

setup_quick.py

…

setup_summary.py

…

setup_terminal.py

fix(cli): doctor and terminal setup resolve the container runtime too

2026-09-18 21:47:13 +05:30

setup_tts.py

fix(setup): xAI TTS wizard checks XAI_API_KEY before OAuth to match runtime

2026-09-18 09:47:06 -07:00

setup_whatsapp_cloud.py

…

setup.py

fix: render dict-form reasoning_effort in the TUI config.get and setup wizard readers

2026-09-19 09:25:29 -07:00

shared_session_attach.py

fix(cli): name the real state when cooperative attach is unavailable

2026-09-18 10:45:07 -07:00

sizefmt.py

…

skills_config.py

…

skills_hub.py

perf(skills): pool the guarded HTTP client across do_install's resolve + fetch

2026-09-22 15:59:17 +05:30

skin_cmd.py

…

skin_engine.py

…

slack_cli.py

…

slash_exec.py

fix(gateway): /help and /commands show a gated non-admin only the commands they can run

2026-09-21 01:06:02 -07:00

sqlite_runtime.py

…

sqlite_safe_read.py

…

sqlite_util.py

…

stale_modules.py

fix(update): bridge stale utils so pre-handoff upgrades finish restart

2026-09-18 09:38:34 -07:00

status_auth.py

fix(time): tolerate Windows locale strftime errors

2026-09-23 18:29:35 -05:00

status_bar_git.py

…

status_report.py

…

status.py

…

stderr_timestamp.py

fix(gateway): every launchd-identity reader accepts the wrapper-forwarded label

2026-09-23 07:48:32 -07:00

stdio.py

…

stream_json.py

…

suggestions_cmd.py

fix(cron): name the home-channel target when a non-push session's deliver=origin job is rerouted

2026-09-19 09:54:20 -07:00

telegram_managed_bot.py

…

terminal_breadcrumbs.py

…

terminal_notify.py

…

timefmt.py

…

timeouts.py

…

tips.py

chore(memory): remove the bundled hindsight provider (moved to the plugin catalog)

2026-09-23 01:16:41 -07:00

tool_availability_notices.py

…

tools_config_cua.py

fix(computer-use): windowless, non-interactive Windows autostart repair

2026-09-20 11:28:15 -07:00

tools_config_mcp.py

The last four MCP enabled-flag readers use the shared reader (ACP, hermes tools picker, desktop connector card, health sweep) (#119601)

2026-09-22 22:24:31 +00:00

tools_config_post_setup.py

fix(setup): Codex image post-setup names the auth command instead of starting a device login without a terminal

2026-09-19 10:05:26 -07:00

tools_config_providers.py

fix(tools): gate the browser picker on an actual backend choice

2026-09-20 20:29:14 +05:30

tools_config.py

fix(mcp): one reader for mcp_servers.<name>.enabled (#119567)

2026-09-22 22:00:24 +00:00

toolset_scope.py

…

toolset_validation.py

fix(config): hermes doctor and plugins enable read a list-literal platform_toolsets string

2026-09-20 12:44:48 -07:00

uninstall.py

…

update_abort_recovery.py

FLEET: one host-scoped update-restart obligation, one restart per host

2026-09-21 07:14:37 -07:00

update_cmd_common.py

…

update_cmd_config.py

…

update_cmd_deps.py

fix(update): the import-health probe sees the venv's editable finder, not the checkout cwd

2026-09-23 06:51:47 -07:00

update_cmd_drain_report.py

…

update_cmd_fleet_checkout.py

fix(update): a carried local commit no longer strands the fleet-restart obligation

2026-09-23 07:01:11 -07:00

update_cmd_fleet_gatewayless.py

fix(update): a Desktop-only host settles an inventory-less restart obligation (#120740)

2026-09-23 18:48:33 -05:00

update_cmd_fleet.py

fix(update): a Desktop-only host settles an inventory-less restart obligation (#120740)

2026-09-23 18:48:33 -05:00

update_cmd_git.py

…

update_cmd_maint.py

fix(gateway): gateway.multiplex_profiles has one valid value; a retired false is rewritten to true with a one-time boxed notice

2026-09-23 10:58:15 -07:00

update_cmd_stale_survivors.py

fix(cron): stale-code yield reads as an outage in cron status; hermes update restarts proven-stale gateways

2026-09-21 01:57:31 -07:00

update_cmd_stash.py

fix(update,plugins): address autostash entries by sha / bare index, never stash@{N}

2026-09-22 00:06:29 -07:00

update_cmd_windows.py

feat(gateway): stop, start and restart one profile under the host multiplexer

2026-09-23 08:25:28 -07:00

update_cmd_zip.py

fix(update): ZIP dirty-tree guard admits what the swap cannot destroy

2026-09-19 02:33:41 -07:00

update_cmd.py

chore(memory): remove the bundled hindsight provider (moved to the plugin catalog)

2026-09-23 01:16:41 -07:00

update_contract.py

…

update_fleet_scope.py

fix: hermes update restarts only the gateways of the home it updates (#93349)

2026-09-23 05:36:30 -07:00

update_handoff.py

fix(update): start the post-swap child in the checkout

2026-09-23 06:51:47 -07:00

update_host_obligation.py

fix(update): never disarm the host restart obligation, and never discharge unknown terms

2026-09-21 07:14:37 -07:00

update_inventory.py

fix(update): classify launchd-owned serve/dashboard rows as launchd, not manual-serve

2026-09-20 00:22:24 -07:00

update_lock.py

fix(update): an adopted own-pid claim is refreshed, not kept near expiry

2026-09-23 11:31:37 -07:00

update_receipt.py

fix(update): an in-gateway cron update no longer exits STALE for the gateway it runs inside

2026-09-23 06:51:47 -07:00

update_restart_recovery.py

FLEET: one host-scoped update-restart obligation, one restart per host

2026-09-21 07:14:37 -07:00

update_serve_obligations.py

fix(update): discharge an unreadable-create_time manual-serve row once its pid is provably dead

2026-09-19 23:59:11 -07:00

urllib_security.py

fix(urllib): log the default-certificates fallback once, after every bundle failed

2026-09-22 15:55:23 +05:30

vault.py

refactor(vault): trim the malformed-state coverage and drop the load_config shape guard

2026-09-20 10:21:52 -07:00

vercel_auth.py

…

verify_cmd.py

…

voice.py

…

web_deps.py

…

web_git.py

…

web_models.py

fix(desktop): custom endpoints pin an API mode and keep /v1/models alias metadata

2026-09-19 00:17:19 -07:00

web_read_coalescing.py

…

web_server_chat.py

Merge origin/main: browser fence composed with the dispatch/retry split (#115184); server registration, i18n, contracts

2026-09-23 03:25:06 -07:00

web_server_config.py

fix(plugins): per-plugin load deadline so a hung register() no longer hangs startup

2026-09-22 01:11:17 -07:00

web_server_cron.py

feat(gateway): stop, start and restart one profile under the host multiplexer

2026-09-23 08:25:28 -07:00

web_server_dashboard.py

fix(dashboard): bind the launch secret scope for the plugins-hub memory options

2026-09-23 07:49:35 -07:00

web_server_files.py

…

web_server_gateway.py

fix(gateway): multiplex convergence works inside an s6 container; a standalone-on-a-guard host says so loudly

2026-09-23 10:58:15 -07:00

web_server_idle_exit.py

docs(serve): say why turn_in_flight is kept as the bool view; one union spelling

2026-09-19 15:04:44 +05:30

web_server_idle_proof.py

docs(serve): say why turn_in_flight is kept as the bool view; one union spelling

2026-09-19 15:04:44 +05:30

web_server_lifecycle.py

fix(tui-gateway): a SIGTERM-ignoring command no longer survives the gateway's SIGTERM exit

2026-09-23 17:09:54 -07:00

web_server_mcp.py

fix(profile-scope): bind home and secret tokens inside the try that resets them

2026-09-23 06:46:02 -07:00

web_server_memory.py

chore(memory): remove the bundled hindsight provider (moved to the plugin catalog)

2026-09-23 01:16:41 -07:00

web_server_messaging.py

…

web_server_oauth.py

…

web_server_profiles.py

fix(secret-scope): scoped misses fail closed under a foreign-home scope

2026-09-23 06:46:02 -07:00

web_server_sessions.py

fix(state): per-profile store housekeeping under one multiplexed process

2026-09-21 02:56:31 -07:00

web_server.py

fix(dashboard): Desktop children publish their own host role; SSH spawn shape is Desktop-owned

2026-09-23 07:09:45 -07:00

webhook.py

…

win_pty_bridge.py

…

windows_ssh_runtime.py

fix(gateway): a failed host attach never exits 0, and SIGTERM clears the record

2026-09-21 02:51:58 -07:00

worktree_cmd.py

…

worktree_gc.py

…

worktree_ops.py

fix(lsp): release a worktree's language servers on removal; reap deleted roots

2026-09-19 01:29:03 -07:00

write_approval_commands.py

fix(memory): surface the overwritten entry on the /memory approve surface too

2026-09-21 14:26:37 +05:30

xai_retirement.py

fix(config): keep the xai migration emitter on the same no-fold width

2026-09-23 15:05:44 -07:00