kshitijk4poor 48975fcaa2 fix(debug): scrub a key-shaped free-text Bearer value before ="..." ...

The RFC 6750 guard in `_SUPPORT_BEARER_RE` kept any `<letters>="` after
Bearer as an auth-param, so `Bearer qwertyuiopas="v"` (and UPPER/Capitalised
or 20+ letter runs) reached the support upload whole; the merge base scrubbed
it. Found by the REDACT2 fold5 leak table (`="v"` tail), which must show zero
head-only leaks.

Keep only the named challenge params (realm, scope, error,
error_description, error_uri): `Bearer realm="api"` still stays, anything
else key-shaped is scrubbed (fail closed).

2026-10-05 13:18:19 +05:30

..

dashboard_auth

…

local_runtime

fix(local-runtime): leave a live owner's server to its existing path; keep legacy owner check

2026-10-03 23:06:58 -04:00

observability

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

proxy

…

subcommands

refactor: remove Skill Sync (hermes sync) and the org skill mirror from core

2026-10-03 23:05:48 -07:00

web_routers

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

__init__.py

…

_early_recovery.py

…

_install_repair.py

…

_launchers.py

fix(cli): read a POSIX launcher's interpreter the way sh does

2026-10-03 22:46:14 -04:00

_old_updater.py

…

_parser.py

…

_scan_venv_blockers.py

…

_secrets_common.py

…

_startup_fast.py

…

_subprocess_compat.py

…

_update_takeover.py

…

active_sessions.py

…

agent_import_sync.py

…

agent_import.py

…

agent_plugins.py

…

AGENTS.md

docs: hermes_cli, gateway and desktop AGENTS.md keep rules, long form moves to docs

2026-10-04 23:05:42 -07:00

anon_auth.py

…

anon_sign_in_cli.py

…

anon_sign_in.py

…

approval_mode.py

…

approval_transport.py

…

approvals_suggest.py

…

approvals_test.py

…

archive_safe.py

…

auth_codex_browser.py

…

auth_codex.py

…

auth_commands.py

…

auth_constants.py

…

auth_device_flow.py

…

auth_error_copy.py

…

auth_minimax.py

…

auth_model_picker.py

…

auth_nous.py

…

auth_oauth_grants.py

…

auth_oauth_pkce_plugin.py

…

auth_openrouter.py

…

auth_plugin_providers.py

…

auth_qwen.py

…

auth_spotify.py

…

auth_xai.py

…

auth_zai_kimi.py

…

auth.py

fix(auth): find the Claude CLI outside PATH in external-process and setup-token checks

2026-10-04 17:51:24 -07:00

azure_detect.py

…

backend_retirement.py

…

backup_restore.py

…

backup_sqlite.py

…

backup.py

…

bang_shell.py

…

banner.py

…

blueprint_cmd.py

…

boot_bootstrap.py

…

browser_connect.py

…

browser_runtime.py

…

build_info.py

…

bundled_app.py

…

bundles.py

…

callbacks.py

…

chat_catalog.py

…

checkpoints.py

…

claw.py

…

cli_agent_setup_mixin.py

…

cli_auto_maintenance.py

…

cli_billing_mixin.py

…

cli_chat_error_copy.py

…

cli_chat_turn_mixin.py

…

cli_commands_mixin.py

…

cli_config_load.py

…

cli_footer_split.py

…

cli_info_mixin.py

fix(cli): keep plugin skill lookup live and align slash precedence

2026-10-05 00:23:05 -07:00

cli_init_mixin.py

…

cli_loops_mixin.py

…

cli_modal_mixin.py

…

cli_model_switch_mixin.py

…

cli_output.py

…

cli_process_dock.py

…

cli_process_notifications.py

…

cli_render.py

…

cli_session_dock.py

…

cli_session_mixin.py

fix(tui_gateway): TUI/Desktop /save json exports the stored session and obeys the export cap

2026-10-03 23:28:02 +05:30

cli_shutdown.py

…

cli_single_query.py

fix(kanban): stop goal loop on worker/judge failures (#91264)

2026-10-04 13:50:13 -05:00

cli_status_bar_mixin.py

…

cli_stream_mixin.py

…

cli_subagent_monitor.py

…

cli_terminal_input.py

…

cli_terminal_mixin.py

…

cli_tui_mixin.py

fix(cli): keep batch clarify choices inside the viewport

2026-10-04 12:55:11 -04:00

cli_tui_runtime_mixin.py

refactor: remove Skill Sync (hermes sync) and the org skill mirror from core

2026-10-03 23:05:48 -07:00

cli_unknown_command.py

…

cli_voice_mixin.py

…

clipboard.py

…

codex_models.py

…

codex_runtime_plugin_migration.py

…

codex_runtime_switch.py

…

colors.py

…

commands_completion.py

fix(cli): keep plugin skill lookup live and align slash precedence

2026-10-05 00:23:05 -07:00

commands_platforms.py

…

commands.py

docs(goal): show the -- <text> escape in the /goal args hint

2026-10-03 20:44:07 +05:30

completion.py

…

config_backups.py

…

config_check_diagnostics.py

…

config_defaults.py

feat(plugins): run third-party plugins in a per-profile plugin host (plugins.isolation: host)

2026-10-03 10:15:11 -07:00

config_effective.py

…

config_env_routing.py

…

config_home.py

…

config_language.py

…

config_migrations.py

…

config_providers.py

…

config_read_errors.py

…

config.py

…

console_engine.py

…

container_boot.py

…

context_switch_guard.py

…

copilot_auth.py

…

credential_lifecycle.py

…

cron.py

…

curator.py

…

curses_ui.py

…

dashboard_procs.py

refactor(serve): name the Desktop backend lock file once

2026-10-03 19:51:54 +05:30

dashboard_register.py

…

data_cleanup_holders.py

…

data_cleanup.py

…

debug_redaction.py

fix(debug): scrub a key-shaped free-text Bearer value before ="..."

2026-10-05 13:18:19 +05:30

debug.py

refactor(debug): simplify the truncated flag and hoist the share_nous import

2026-10-03 21:15:17 +05:30

default_soul.py

…

desktop_build_lock.py

…

desktop_console.py

…

desktop_update_verify.py

…

diagnostics_upload.py

fix(debug): keep share_to_nous exception types

2026-10-03 21:15:17 +05:30

dingtalk_auth.py

…

doctor_config.py

…

doctor_connectivity.py

…

doctor_live.py

…

doctor_platform.py

…

doctor_report.py

…

doctor_state.py

…

doctor_tools.py

…

doctor.py

…

dump.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

env_loader.py

…

fallback_cmd.py

…

fallback_config.py

…

focus_view.py

…

foreign_sessions_browser.py

…

foreign_sessions.py

…

free_tier_bootstrap.py

…

fs_utils.py

…

gateway_command_errors.py

…

gateway_enroll.py

…

gateway_launchd.py

…

gateway_migrate_guards.py

…

gateway_migrate.py

…

gateway_multiplex_mode.py

…

gateway_multiplex_s6.py

…

gateway_multiplex_served.py

fix(whatsapp): serve a paired WhatsApp session on every profile under the host multiplexer

2026-10-03 21:57:13 -04:00

gateway_profile_lifecycle.py

…

gateway_setup_wizard.py

…

gateway_supervised_restart.py

…

gateway_windows_legacy.py

…

gateway_windows.py

…

gateway.py

fix(launchers): fall back to the runtime store only when the tree has none

2026-10-03 21:44:47 -04:00

git_credentials.py

…

github_api.py

…

gitlock.py

fix(update): stop folding lazy-fetch packs during hermes update

2026-10-04 17:18:50 -07:00

goal_command.py

refactor(goal): one control first-word set for is_goal_control

2026-10-03 20:44:07 +05:30

goals.py

fix(kanban): stop goal loop on worker/judge failures (#91264)

2026-10-04 13:50:13 -05:00

gui_uninstall.py

…

heartbeat.py

…

home_data_layout.py

…

hooks.py

…

image_provenance.py

…

init_command.py

…

input_sanitize.py

…

install_identity.py

…

inventory.py

fix(cli): stop _apply_featured() shortlisting user-defined providers

2026-10-04 12:55:51 -05:00

journey.py

…

kanban_boards.py

…

kanban_db_connect.py

…

kanban_db_dispatch.py

…

kanban_db_graph.py

…

kanban_db_notify.py

…

kanban_db_workspace.py

…

kanban_db.py

…

kanban_decompose.py

…

kanban_diagnostics.py

…

kanban_ops.py

…

kanban_output.py

…

kanban_parser.py

…

kanban_pr_acceptance_store.py

…

kanban_pr_acceptance.py

…

kanban_specify.py

…

kanban_swarm.py

…

kanban_transfer.py

…

kanban.py

…

left_core_migration.py

fix: send_message to a Home Assistant target names the install command while its plugin is absent

2026-10-04 00:08:20 -07:00

lifecycle.py

…

linux_desktop_entry.py

…

logs.py

…

loops.py

…

macos_signing.py

…

macos_tcc_anchor.py

…

main_agent_cmds.py

…

main_dashboard.py

…

main_dep_hints.py

…

main_desktop.py

…

main_install_repair.py

…

main_platform_setup.py

refactor: remove Skill Sync (hermes sync) and the org skill mirror from core

2026-10-03 23:05:48 -07:00

main_profile_recovery.py

…

main_provider_setup.py

feat(cli): local models in hermes model

2026-10-03 22:32:13 -04:00

main_tui_launch.py

…

main_web_build.py

…

main.py

refactor: remove Skill Sync (hermes sync) and the org skill mirror from core

2026-10-03 23:05:48 -07:00

managed_scope.py

…

managed_uv.py

…

mcp_app_detection.py

…

mcp_catalog.py

…

mcp_config.py

…

mcp_picker.py

…

mcp_security.py

…

mcp_startup.py

…

mem_trim.py

…

memory_oauth.py

…

memory_provider_migration.py

…

memory_setup.py

…

middleware.py

fix(plugins): trim request-middleware chaining to the minimal shape

2026-10-05 00:22:31 -07:00

migrate.py

…

moa_cmd.py

…

moa_config.py

…

model_catalog.py

…

model_cost_guard.py

…

model_data_policy_guard.py

…

model_normalize.py

…

model_search.py

…

model_selection_guards.py

…

model_setup_flows_azure.py

…

model_setup_flows_bedrock.py

…

model_setup_flows_common.py

…

model_setup_flows_custom.py

…

model_setup_flows_local.py

feat(cli): local models in hermes model

2026-10-03 22:32:13 -04:00

model_setup_flows.py

…

model_switch_providers.py

…

model_switch.py

…

models_catalog_static.py

…

models_detect.py

…

models_local.py

…

models_pricing.py

…

models_profile_cache.py

…

models_reasoning_caps.py

…

models_validate.py

…

models.py

fix(models): keep Daybreak and gpt-5.6-cyber on the Priority speed tier

2026-10-04 02:12:57 +05:30

nous_account.py

refactor(web): drop the gate's leftovers and keep the tier rules tested

2026-10-04 00:10:54 +05:30

nous_auth_keepalive.py

…

nous_billing.py

…

nous_subscription.py

…

npm_engine.py

…

old_updater_deps.py

…

old_updater_main.py

…

onepassword_secrets_cli.py

…

oneshot.py

fix(cli): finalize one-shot Relay sessions (#79471)

2026-10-03 19:01:42 -07:00

pairing.py

…

partial_compress.py

…

personality.py

…

pets.py

…

platform_actions.py

…

platforms.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

plugin_capabilities.py

…

plugin_catalog_presence.py

feat(plugins): requires.gpu gates a plugin server on the host's GPU vendor

2026-10-03 10:26:12 -07:00

plugin_catalog.py

…

plugin_compat.py

…

plugin_dev.py

…

plugin_events.py

…

plugin_host_child.py

fix: plugin host review findings (async ctx, caller session, restarts, per-profile dashboard)

2026-10-03 10:15:11 -07:00

plugin_host_profiles.py

fix(plugins): model-provider plugins load under plugins.isolation: host on Windows

2026-10-03 10:15:11 -07:00

plugin_host_wire.py

fix: plugin host review findings (async ctx, caller session, restarts, per-profile dashboard)

2026-10-03 10:15:11 -07:00

plugin_host.py

fix: plugin host review findings (async ctx, caller session, restarts, per-profile dashboard)

2026-10-03 10:15:11 -07:00

plugin_isolation_audit.py

feat(plugins): run third-party plugins in a per-profile plugin host (plugins.isolation: host)

2026-10-03 10:15:11 -07:00

plugin_isolation.py

feat(plugins): run third-party plugins in a per-profile plugin host (plugins.isolation: host)

2026-10-03 10:15:11 -07:00

plugin_packs.py

…

plugin_validate_core_override.py

fix(plugins): no core override check catches patch helpers that are methods

2026-10-03 13:34:08 -07:00

plugin_validate_desktop.py

fix(plugins): lint every Desktop entry layout the installer accepts, incl. repo-root plugin.js

2026-10-04 17:53:20 -07:00

plugin_validate_locales.py

…

plugin_validate.py

fix(plugins): --install-deps probe imports from the synced environment

2026-10-04 12:08:04 -07:00

plugins_activation_live.py

…

plugins_activation.py

…

plugins_admission.py

…

plugins_cadence.py

…

plugins_cmd_capabilities.py

…

plugins_cmd_catalog.py

fix(plugins): --install-deps probe imports from the synced environment

2026-10-04 12:08:04 -07:00

plugins_cmd_git.py

…

plugins_cmd_install.py

fix(plugins): a forced reinstall of the same source keeps the user's files

2026-10-03 21:40:42 -04:00

plugins_cmd_listing.py

feat(plugins): run third-party plugins in a per-profile plugin host (plugins.isolation: host)

2026-10-03 10:15:11 -07:00

plugins_cmd_remove.py

…

plugins_cmd_toggle.py

…

plugins_cmd_update.py

…

plugins_cmd.py

fix(plugins): a user-installed model provider reports enabled, as the loader treats it

2026-10-04 18:19:16 -07:00

plugins_discovery.py

…

plugins_dispatch.py

fix(plugins): trim request-middleware chaining to the minimal shape

2026-10-05 00:22:31 -07:00

plugins_ledger.py

…

plugins_loader.py

feat(plugins): run third-party plugins in a per-profile plugin host (plugins.isolation: host)

2026-10-03 10:15:11 -07:00

plugins_manifest.py

…

plugins_provenance.py

…

plugins_settings.py

…

plugins_state.py

…

plugins_transaction.py

…

plugins_updates.py

…

plugins.py

chore(plugins): keep the approval-hook kwargs comment within the file's line budget

2026-10-05 00:23:41 -07:00

portal_cli.py

…

post_update.py

…

process_identity.py

…

profile_channels.py

fix: a channel-less profile clone drops Home Assistant identity while its plugin is absent

2026-10-04 00:08:20 -07:00

profile_cmd.py

…

profile_describer.py

…

profile_distribution.py

…

profile_identity.py

…

profile_memory_config.py

…

profiles_service_cleanup.py

…

profiles.py

fix(profiles): keep .docker/.azure/.config/gh/.config/gcloud out of profile exports

2026-10-04 13:53:34 +05:30

projects_cmd.py

…

projects_db.py

…

prompt_size.py

…

prompt_stash.py

…

provider_catalog.py

…

providers.py

…

proxy_cli.py

…

psutil_android.py

…

pt_input_extras.py

…

pty_bridge.py

…

pty_session.py

…

quiet_single_query.py

…

relaunch.py

…

relay_plugin_cutover.py

…

relay_plugin_migrate.py

…

release_channels.py

…

resource_limits.py

…

route_identity.py

…

runtime_paths.py

…

runtime_provider_backends.py

…

runtime_provider_custom.py

…

runtime_provider.py

…

runtime_state.py

…

sandbox_image_switch.py

…

secret_prompt.py

…

secrets_cli.py

…

security_advisories.py

…

security_audit_startup.py

…

security_audit.py

fix(security-audit): skip the agent's placeholder dist when no release is known

2026-10-05 12:37:47 +05:30

send_cmd.py

…

service_manager.py

…

session_export_html.py

…

session_export_md.py

…

session_export.py

fix(tui_gateway): TUI/Desktop /save json exports the stored session and obeys the export cap

2026-10-03 23:28:02 +05:30

session_filters.py

…

session_listing.py

…

session_lost_and_found.py

docs(state): trim derived-id recognizer comments to the contract

2026-10-04 12:05:37 +05:30

session_recap.py

…

session_recovery.py

…

session_reset_retirement.py

…

session_schema_history.py

…

sessions_cmd_browse.py

…

sessions_cmd_journal_mode.py

…

sessions_cmd_repair_profiles.py

…

sessions_cmd.py

…

sessions_repair_profiles.py

…

setup_hidden_env.py

…

setup_migration.py

…

setup_platforms.py

…

setup_profile.py

…

setup_quick.py

…

setup_summary.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

setup_terminal.py

…

setup_tts.py

…

setup_whatsapp_cloud.py

…

setup.py

…

shared_profile_warning.py

…

shared_session_attach.py

…

sizefmt.py

…

skills_config.py

…

skills_hub.py

fix(skills): list and prompt index advertise only names skill_view loads

2026-10-04 02:54:56 +05:30

skin_cmd.py

…

skin_engine.py

…

slack_cli.py

…

slash_exec.py

…

source_build.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

source_check.py

…

source_completion.py

…

source_releases.py

…

source_stamp.py

…

sqlite_runtime.py

…

sqlite_safe_read.py

…

sqlite_util.py

…

ssh_workspace_fs.py

…

stale_modules.py

…

status_auth.py

…

status_bar_git.py

…

status_report.py

…

status.py

…

stderr_timestamp.py

…

stdio.py

…

steward.py

…

stream_json.py

…

suggestions_cmd.py

…

telegram_managed_bot.py

…

terminal_breadcrumbs.py

…

terminal_notify.py

…

timefmt.py

…

timeouts.py

…

tips.py

…

tool_availability_notices.py

…

tools_config_cua.py

…

tools_config_mcp.py

…

tools_config_post_setup.py

…

tools_config_providers.py

…

tools_config.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

toolset_scope.py

…

toolset_validation.py

…

uninstall.py

…

update_abort_recovery.py

…

update_channel.py

…

update_cmd_check.py

fix(update): stop folding lazy-fetch packs during hermes update

2026-10-04 17:18:50 -07:00

update_cmd_common.py

…

update_cmd_config.py

…

update_cmd_drain_report.py

…

update_cmd_fleet_checkout.py

…

update_cmd_fleet_gatewayless.py

…

update_cmd_fleet.py

…

update_cmd_git.py

…

update_cmd_maint.py

…

update_cmd_stale_survivors.py

…

update_cmd_stash.py

…

update_cmd_validation.py

…

update_cmd_windows.py

…

update_cmd_zip.py

…

update_cmd.py

fix(update): stop folding lazy-fetch packs during hermes update

2026-10-04 17:18:50 -07:00

update_completion.py

fix(update): run the libatomic pre-install spawn only on Linux

2026-10-04 19:19:41 +05:30

update_contract.py

…

update_finish.py

…

update_fleet_scope.py

…

update_handoff.py

…

update_host_obligation.py

…

update_inventory.py

…

update_lock.py

…

update_owning_install.py

…

update_receipt.py

…

update_restart_recovery.py

…

update_serve_obligations.py

…

update_serve_resume.py

…

update_stage.py

…

urllib_security.py

…

vault.py

…

venv_sync.py

fix(pm): a borrowed HERMES_HOME leaves the source checkout to the root that owns it

2026-10-03 22:46:14 -04:00

vercel_auth.py

…

verify_cmd.py

…

version_info.py

…

voice.py

…

web_deps.py

…

web_git.py

…

web_models.py

…

web_read_coalescing.py

…

web_server_chat.py

…

web_server_config.py

…

web_server_cron.py

fix(dashboard): run gateway-liveness probes off the dashboard event loop

2026-10-04 11:57:03 +05:30

web_server_dashboard.py

fix: plugin host review findings (async ctx, caller session, restarts, per-profile dashboard)

2026-10-03 10:15:11 -07:00

web_server_files.py

fix(web): resolve Git Bash paths in Windows file APIs

2026-10-03 12:08:23 -04:00

web_server_gateway.py

…

web_server_idle_exit.py

…

web_server_idle_proof.py

…

web_server_lifecycle.py

…

web_server_mcp.py

…

web_server_memory.py

…

web_server_messaging.py

refactor: move Home Assistant out of core into the homeassistant catalog plugin

2026-10-04 00:08:20 -07:00

web_server_oauth.py

…

web_server_owner_exit.py

refactor(serve): one fenced retirement loop for the skew and owner watchdogs

2026-10-03 19:51:54 +05:30

web_server_profiles.py

…

web_server_sessions.py

refactor: remove Skill Sync (hermes sync) and the org skill mirror from core

2026-10-03 23:05:48 -07:00

web_server_skew_exit.py

refactor(serve): one fenced retirement loop for the skew and owner watchdogs

2026-10-03 19:51:54 +05:30

web_server.py

fix(process_registry): drop dashboard/serve worker scoping; make the hang test catch the hang

2026-10-03 17:03:54 -04:00

webhook.py

…

win_pty_bridge.py

…

windows_appinstaller_update.py

…

windows_ssh_runtime.py

…

windows_store_update.py

…

worktree_cmd.py

…

worktree_gc.py

revert: stale worktree reaping revalidation (#132260)

2026-10-03 22:03:44 +05:30

worktree_ops.py

revert: stale worktree reaping revalidation (#132260)

2026-10-03 22:03:44 +05:30

write_approval_commands.py

…

xai_retirement.py

…