John Paul Soliva 921aa60164 fix(mcp): a profile only adopts a shared connection whose resolved identity matches its own ...

_same_server_route judged "same credentials" from the static config alone, but a
connection is also opened with per-profile values the config never shows: a stdio
child's env carries every external secret-source value (Bitwarden, 1Password,
secrets.command) from the owner's secret scope, identity_header value_from: profile
resolves to the owner's profile name, and a stdio child's default cwd is the owner
session's runtime cwd. A multiplexed profile with a byte-identical config therefore
adopted the owner's live connection and its MCP calls ran as the owner.

The connecting task now records a SHA-256 of those resolved inputs on every connect
attempt, in its own scope; cross-profile adoption and the stale-overlay check
recompute it under the adopter's scope and refuse to share on a mismatch. Only the
hash is kept. Same-profile checks are unchanged.

(cherry picked from commit e59d0dfb9918db03482ccd4bf5a7599efc3cd72e)

2026-09-26 22:40:54 +05:30

..

bot_desktop

fix(encoding): read kernel pseudo-files as plain utf-8

2026-09-24 11:50:30 -04:00

computer_use

Merge origin/main into ethie/pm-clean

2026-09-23 20:04:27 -04:00

connectors

fix(mcp): scope late OAuth attempts by profile

2026-09-23 06:46:02 -07:00

environments

fix(tools): resolve ssh paths against the remote home, keep guards intact

2026-09-26 06:20:21 +05:30

neutts_samples

…

wakewords

…

__init__.py

…

AGENTS.md

feat(terminal): heartbeat notifications for long background processes

2026-09-21 15:02:49 -07:00

annotate_preview_tool.py

…

ansi_strip.py

…

apply_layout_tool.py

…

approval_context.py

…

approval_detection.py

fix(approval): keep the git branch force-delete gate off the safe -d delete

2026-09-20 15:32:00 -07:00

approval_floors.py

…

approval_gateway_wait.py

…

approval_human_wait.py

…

approval_prompt.py

…

approval_smart.py

fix(approval): warn on empty smart-approval guardian answers

2026-09-20 15:32:42 -07:00

approval.py

fix(agent): protect the runtime's own interpreter from agent deletes

2026-09-25 16:24:21 -05:00

arg_coercion.py

…

async_delegation_recovery_hints.py

fix(delegation): keep encoding= on the text=True line so the line-based footgun scanner sees it

2026-09-20 18:50:37 -07:00

async_delegation.py

fix(delegation): hand a dropped orphan offer back to the sweep

2026-09-24 02:41:14 -05:00

audio_container.py

…

binary_extensions.py

…

blueprints.py

…

bot_failure_reasons.py

fix(gateway): a peer DM retries a transient turn failure once, like the other two lanes

2026-09-20 10:16:51 -07:00

bot_live_delivery.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

bot_mode_dm.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-24 06:55:33 -04:00

bot_mode_probe.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-24 06:30:41 -04:00

bot_relay.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

browser_camofox_state.py

…

browser_camofox.py

…

browser_cdp_tool.py

…

browser_dialog_tool.py

…

browser_extension_router.py

…

browser_lightpanda.py

Merge origin/main into ethie/pm-clean

2026-09-23 20:04:27 -04:00

browser_supervisor_dialogs.py

…

browser_supervisor_frames.py

…

browser_supervisor.py

…

browser_tool_cdp.py

…

browser_tool_cloud.py

…

browser_tool_eval_policy.py

…

browser_tool_install.py

fix(encoding): read kernel pseudo-files as plain utf-8

2026-09-24 11:50:30 -04:00

browser_tool_lifecycle.py

Merge origin/main into ethie/pm-clean

2026-09-23 10:13:26 -04:00

browser_tool_lightpanda_fallback.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-23 07:36:31 -04:00

browser_tool_origin.py

…

browser_tool_real_profile.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-23 07:36:31 -04:00

browser_tool_session.py

fix(encoding): read kernel pseudo-files as plain utf-8

2026-09-24 11:50:30 -04:00

browser_tool_snapshot.py

…

browser_tool_vision.py

…

browser_tool.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-23 07:36:31 -04:00

browser_use_cli.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-23 07:36:31 -04:00

browser_vault_tool.py

…

budget_config.py

…

checkpoint_maintenance.py

refactor: separate checkpoint store maintenance from snapshots

2026-09-24 01:55:51 -04:00

checkpoint_manager_profile_rename.py

fix: align Python CI contracts with current PM and checkout behavior

2026-09-24 03:42:38 -04:00

checkpoint_manager.py

refactor: separate checkpoint store maintenance from snapshots

2026-09-24 01:55:51 -04:00

checkpoint_pruning.py

fix(checkpoints): a checkpoint never waits on git gc; the periodic prune reclaims

2026-09-19 01:03:23 -04:00

clarify_gateway.py

…

clarify_tool.py

…

close_preview_tool.py

…

close_terminal_tool.py

…

code_execution_env.py

feat: Hermes-owned scratch dir replaces the system temp dir for every process and child

2026-09-19 10:44:26 -07:00

code_execution_rpc.py

test: cover persist_on_release in sandbox stub contracts and shutdown kill fakes

2026-09-25 13:49:31 -05:00

code_execution_tool.py

fix: restore upstream behavior lost in PM conflict resolutions

2026-09-24 23:59:55 -04:00

code_kernel_remote.py

…

code_kernel.py

fix(tools): share the idle-expiry criteria between acquire and the reaper; plain once-latch

2026-09-20 15:49:52 -07:00

computer_use_tool.py

…

credential_files.py

…

cronjob_job_args.py

fix(cron): bound the Slack thread-origin horizon so an expired one-shot fails closed

2026-09-20 15:54:45 -07:00

cronjob_prompt_scan.py

…

cronjob_tools.py

merge origin/main (16 commits) into ethie/pm-clean

2026-09-21 06:09:56 -04:00

daemon_pool.py

…

debug_helpers.py

…

delegate_tool_child_run.py

feat(delegate): warn the child at 80% of its inactivity window before abandoning it

2026-09-20 15:50:20 -07:00

delegate_tool_config.py

fix(cron): a pinned job never falls back to the global fallback chain (#120312)

2026-09-23 10:42:18 -04:00

delegate_tool_dispatch.py

fix(delegation): retain recovery transcript locators

2026-09-20 09:52:22 -07:00

delegate_tool_progress.py

fix(delegation): make remaining-depth guidance unambiguous

2026-09-19 23:57:59 -07:00

delegate_tool_registry.py

…

delegate_tool_results.py

…

delegate_tool_tasks.py

…

delegate_tool_toolsets.py

…

delegate_tool.py

feat(connectors): the backend API for the desktop Connectors page; connect an app without a chat session (#115191)

2026-09-22 13:57:51 +05:30

delegation_live_log.py

…

delegation_output_schema.py

…

desktop_ui.py

…

discord_tool.py

…

drive_preview_tool.py

fix(preview): refuse unfocused type and abort leftover keystrokes

2026-09-25 17:33:06 -05:00

env_passthrough.py

fix(security): match credential env names case-insensitively

2026-09-20 12:53:47 -07:00

env_probe.py

…

fal_common.py

merge: refresh upstream models, notification expiry, and desktop controls

2026-09-21 14:01:47 -04:00

feishu_doc_tool.py

…

feishu_drive_tool.py

…

feishu_lark.py

…

file_operations_common.py

fix(file-ops): a failed byte-exact read is not an absent file

2026-09-25 14:58:09 -04:00

file_operations_lint.py

fix(file-ops): both patch modes read their write-back source byte-exactly

2026-09-25 14:58:09 -04:00

file_operations_search.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

file_operations.py

fix(file-ops): a dangling symlink is an occupied entry, never an absent path

2026-09-25 14:58:09 -04:00

file_state.py

…

file_tools_paths.py

fix(tools): resolve ssh paths against the remote home, keep guards intact

2026-09-26 06:20:21 +05:30

file_tools_read_tracking.py

fix: bind baseline reads to the task local path

2026-09-21 18:39:24 -07:00

file_tools_write_guards.py

docs(file-tools): trim remote-binary state helper docstring to its contract

2026-09-26 22:26:05 +05:30

file_tools.py

fix(terminal): do not cd an ssh session into the container home

2026-09-26 06:20:21 +05:30

focus_pane_tool.py

…

fuzzy_match.py

docs(fuzzy_match): keep the comment next to the line it explains

2026-09-24 15:58:26 +05:30

homeassistant_tool.py

…

hook_output_spill.py

…

image_generation_catalog.py

…

image_generation_managed.py

…

image_generation_tool.py

fix(image_gen): a gateway 429 is reported as a rate limit and retried once, not as a missing model

2026-09-21 10:40:03 -07:00

image_source.py

…

interpreter_shutdown.py

…

interrupt.py

…

kanban_tools_schemas.py

docs(prompts): model-facing tool descriptions stop suggesting /tmp

2026-09-19 10:44:26 -07:00

kanban_tools.py

fix(kanban): board identity follows the bound profile override, not the launch env

2026-09-23 08:09:47 -07:00

kanban_toolset_context.py

…

lazy_deps.py

fix(plugins): plugin dependencies follow the plugin's own security policy

2026-09-23 10:07:51 -07:00

managed_gateway_auth.py

…

managed_tool_gateway.py

fix(scope): failed profile-scoped secret reads must not borrow os.environ

2026-09-23 06:46:02 -07:00

mcp_dashboard_oauth.py

feat(connectors): one backend-owned connection operation, with a setup card on Desktop, TUI and CLI (#111008)

2026-09-21 10:04:32 +05:30

mcp_death_supervisor.py

…

mcp_liveness.py

Application-backed MCP servers: live endpoint per attempt, tools follow app liveness, errors and the tool catalog say why (NS-943) (#119050)

2026-09-22 17:54:42 +05:30

mcp_oauth_device.py

fix(mcp): ask Google-hosted OAuth for offline access and normalize the device-flow issuer check

2026-09-20 18:22:18 -07:00

mcp_oauth_manager.py

fix(mcp): reload OAuth provider on first sight when no tokens in memory (#39551)

2026-09-25 14:27:51 +05:30

mcp_oauth_provider.py

refactor: make install-stamp.json the single runtime version identity

2026-09-23 11:41:01 -04:00

mcp_oauth.py

feat(pm): hermes pm install --extra NAME; one shared hint for missing extras

2026-09-21 19:08:19 -04:00

mcp_schema_cache.py

…

mcp_tool_agent.py

fix: key the tools[] pin by code version; never re-add config-excluded tools

2026-09-23 15:43:51 -07:00

mcp_tool_common.py

fix(mcp): one reader for mcp_servers.<name>.enabled (#119567)

2026-09-22 22:00:24 +00:00

mcp_tool_config.py

fix(mcp): move uv/uvx known-dir table into hermes_platform resolver

2026-09-25 18:31:02 -05:00

mcp_tool_content.py

…

mcp_tool_discovery.py

fix(secret-scope): scoped misses fail closed under a foreign-home scope

2026-09-23 06:46:02 -07:00

mcp_tool_errors.py

fix(mcp): redirect header stripper builds httpx.AsyncClient at call time so proxy mounts stay observable

2026-09-20 10:07:26 -07:00

mcp_tool_handlers.py

Application-backed MCP servers: live endpoint per attempt, tools follow app liveness, errors and the tool catalog say why (NS-943) (#119050)

2026-09-22 17:54:42 +05:30

mcp_tool_health.py

…

mcp_tool_lifecycle.py

Merge origin/main into ethie/pm-clean

2026-09-23 10:13:26 -04:00

mcp_tool_loop.py

…

mcp_tool_registration.py

fix(mcp): a profile only adopts a shared connection whose resolved identity matches its own

2026-09-26 22:40:54 +05:30

mcp_tool_sampling.py

…

mcp_tool_schema.py

fix(mcp): keep required-only constraint fragments in tool schemas

2026-09-21 13:14:22 -07:00

mcp_tool_scope.py

…

mcp_tool_server_run.py

fix(mcp): a profile only adopts a shared connection whose resolved identity matches its own

2026-09-26 22:40:54 +05:30

mcp_tool_transport.py

Application-backed MCP servers: live endpoint per attempt, tools follow app liveness, errors and the tool catalog say why (NS-943) (#119050)

2026-09-22 17:54:42 +05:30

mcp_tool.py

fix(mcp): cap discovery pass timeout and derive lock waiter budget from it

2026-09-21 01:44:16 -07:00

memory_tool_store.py

refactor(memory): derive batch receipts from the matched list

2026-09-24 15:38:22 +05:30

memory_tool.py

refactor(memory): derive batch receipts from the matched list

2026-09-24 15:38:22 +05:30

microsoft_graph_auth.py

…

microsoft_graph_client.py

…

neutts_synth.py

…

open_preview_tool.py

…

openrouter_client.py

fix(scope): failed profile-scoped secret reads must not borrow os.environ

2026-09-23 06:46:02 -07:00

osv_check.py

…

patch_parser.py

fix(patch): a Move or Add destination is free only when its read says absent

2026-09-25 14:58:09 -04:00

path_security.py

fix(tts): reject MEDIA directives and control chars in output_path

2026-09-20 10:57:35 -07:00

plugin_guard_context.py

fix(plugin-guard): v8 — four intake false-positive classes step down where inert

2026-09-20 11:49:00 -07:00

plugin_guard.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

preview_tool.py

…

process_registry_checkpoint.py

…

process_registry_notifications.py

feat(terminal): heartbeat notifications for long background processes

2026-09-21 15:02:49 -07:00

process_registry_results.py

…

process_registry.py

fix(processes): persist_on_release keeps background jobs alive across lifecycle kill sweeps (#41225)

2026-09-25 13:49:31 -05:00

project_tools.py

fix(projects): CLI and pathless switches move the active project again

2026-09-24 03:52:03 -05:00

pty_query_responder.py

…

react_to_message_tool.py

…

read_extract.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-19 22:57:07 -04:00

read_preview_tool.py

fix(desktop): read the preview zone the user is looking at

2026-09-25 12:10:14 -05:00

read_terminal_tool.py

…

read_window_tool.py

…

registry.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-23 15:26:34 -04:00

schema_sanitizer.py

fix(tools): coerce a missing required to [] and pin the MCP normalizer entry (#56123)

2026-09-19 10:16:59 -07:00

self_repo_guard.py

fix(desktop): decode UTF-8 child output explicitly on the serve/agent path (#83851)

2026-09-23 18:52:49 -05:00

send_message_senders.py

feat(pm): hermes pm install --extra NAME; one shared hint for missing extras

2026-09-21 19:08:19 -04:00

send_message_targets.py

…

send_message_tool.py

fix(messaging): hermes send reports dropped MEDIA attachments instead of success:true

2026-09-20 11:12:48 -07:00

session_search_tool.py

fix(time): repair surrogate-bearing locale zone names at every strftime site

2026-09-23 18:29:35 -05:00

shell_heredoc.py

…

skill_ledger.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 07:05:11 -04:00

skill_linter.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 05:16:50 -04:00

skill_manager_batch.py

fix(skills): batch rollback undoes every file it wrote into an adopted dir

2026-09-24 16:49:18 +05:30

skill_manager_guards.py

…

skill_manager_tool.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-24 07:39:33 -04:00

skill_provenance.py

…

skill_usage.py

fix(skills): keep built-in provenance for skills the catalog dropped

2026-09-25 14:24:56 -05:00

skillevaluator_scan.py

…

skills_ast_audit.py

…

skills_guard.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

skills_hub_clawhub.py

fix(skills): route the ClawHub owner lookup through the hub connection pool

2026-09-22 15:59:17 +05:30

skills_hub_github.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 07:05:11 -04:00

skills_hub_install.py

fix(skills): write quarantined text members verbatim, without newline translation

2026-09-20 16:00:26 -07:00

skills_hub_models.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 07:05:11 -04:00

skills_hub_official.py

…

skills_hub_search.py

fix(skills): hoist the hub import out of the index retry loop

2026-09-22 15:59:17 +05:30

skills_hub_skillssh.py

fix(tools): resolve skills.sh skills whose SKILL.md sits at the repo root

2026-09-20 12:58:32 -07:00

skills_hub_sources.py

…

skills_hub.py

fix(compat): make skills hub hook installation idempotent

2026-09-22 09:28:52 -04:00

skills_sync_bundled_ops.py

…

skills_sync_client_org.py

…

skills_sync_client_wire.py

…

skills_sync_client.py

…

skills_sync_optional.py

…

skills_sync.py

fix(skills): keep built-in provenance for skills the catalog dropped

2026-09-25 14:24:56 -05:00

skills_tool_dedup.py

…

skills_tool_plugin.py

…

skills_tool_setup.py

…

skills_tool.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 09:55:47 -04:00

slash_confirm.py

…

spill_safety.py

…

subagent_worktree.py

fix(lsp): release language servers on every in-process workspace removal; pin the call sites

2026-09-19 01:29:03 -07:00

terminal_hints.py

…

terminal_scope.py

perf(gateway): enter each profile scope once per heartbeat-restore scan; signature-cache profile config.yaml parses

2026-09-22 16:15:34 +05:30

terminal_tool_backends.py

…

terminal_tool_background.py

fix(processes): persist_on_release keeps background jobs alive across lifecycle kill sweeps (#41225)

2026-09-25 13:49:31 -05:00

terminal_tool_config.py

fix(tools): resolve ssh paths against the remote home, keep guards intact

2026-09-26 06:20:21 +05:30

terminal_tool_guards.py

…

terminal_tool_lifecycle.py

fix(tui-gateway): exiting mid-tool no longer orphans the foreground command's process tree

2026-09-23 17:09:54 -07:00

terminal_tool_result.py

…

terminal_tool_sudo.py

…

terminal_tool.py

fix(terminal): do not cd an ssh session into the container home

2026-09-26 06:20:21 +05:30

thread_context.py

…

threat_patterns.py

fix(skills): an env-var NAME constant is not an embedded credential

2026-09-20 11:30:03 -07:00

tip_tool.py

…

tirith_security.py

fix(security): don't warn while tirith's first download runs

2026-09-24 14:23:47 -04:00

todo_tool.py

…

tool_backend_helpers.py

fix(auth): a removed env:XAI_API_KEY no longer overrides xai-oauth for x_search

2026-09-20 10:17:04 -07:00

tool_labels.py

feat(connectors): the backend API for the desktop Connectors page; connect an app without a chat session (#115191)

2026-09-22 13:57:51 +05:30

tool_output_limits.py

…

tool_output_truncate.py

…

tool_result_storage.py

fix(environments): deliver heredoc stdin byte-exact

2026-09-25 14:14:06 -04:00

tool_search_catalog.py

Application-backed MCP servers: live endpoint per attempt, tools follow app liveness, errors and the tool catalog say why (NS-943) (#119050)

2026-09-22 17:54:42 +05:30

tool_search_validation.py

fix(tools): tool_call bridge treats blank arguments as no arguments

2026-09-19 10:03:11 -07:00

tool_search.py

fix: tool_search tells the model to send keyword queries, not questions

2026-09-23 11:54:30 +05:30

tour_tool.py

…

transcription_audio.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 05:16:50 -04:00

transcription_cloud.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-19 22:57:07 -04:00

transcription_command.py

…

transcription_common.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-19 22:57:07 -04:00

transcription_local.py

…

transcription_tools.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-22 05:16:50 -04:00

tts_command_provider.py

…

tts_streaming.py

fix(tts): single pump-side byte cap and bounded queue for xAI streaming

2026-09-26 06:19:34 +05:30

tts_text_normalize.py

fix(desktop): read table headers aloud instead of dropping tables silently

2026-09-23 18:30:12 -05:00

tts_tool_delivery.py

…

tts_tool_lifecycle.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-24 03:48:31 -04:00

tts_tool_local.py

…

tts_tool_openai.py

fix: forward tts.openai.consent_attestation to every OpenAI-compatible TTS request

2026-09-19 10:10:29 -07:00

tts_tool_plugins.py

…

tts_tool_providers.py

fix(tts): keep the Gemini API key out of request URLs

2026-09-26 06:19:34 +05:30

tts_tool_speaker.py

fix(tts): drop the empty mkstemp placeholder when the provider wrote elsewhere

2026-09-20 10:25:30 -07:00

tts_tool.py

feat(pm): hermes pm install --extra NAME; one shared hint for missing extras

2026-09-21 19:08:19 -04:00

url_safety.py

fix(url_safety): classify the IPv4-translated wrapper by its embedded IPv4

2026-09-20 15:28:59 -07:00

video_generation_tool.py

fix: video generation tools no longer let the agent pick the model

2026-09-19 12:22:44 -07:00

vision_tools_history_budget.py

fix: vision_analyze does not re-embed an image already attached natively to the current turn

2026-09-19 09:52:18 -07:00

vision_tools_image_prep.py

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-19 22:57:07 -04:00

vision_tools.py

merge origin/main (779 commits) into ethie/pm-clean

2026-09-21 00:58:39 -04:00

voice_client_config.py

chore: merge origin/main (resolve apps/desktop/src/lib/voice-client-direct.ts, hermes_cli/config_defaults.py, tools/voice_client_config.py, website/docs/user-guide/features/tts.md)

2026-09-19 10:54:38 -07:00

voice_live.py

…

voice_mode_transcript.py

…

voice_mode.py

refactor(voice): close recorder stream under suppress(Exception)

2026-09-26 06:19:34 +05:30

wake_word_engines.py

…

wake_word.py

feat(pm): hermes pm install --extra NAME; one shared hint for missing extras

2026-09-21 19:08:19 -04:00

web_result_cache.py

…

web_tools_extract.py

…

web_tools_rescue.py

feat(web): serve managed search through Perplexity

2026-09-24 16:17:16 -04:00

web_tools_truncate.py

feat(tools): read_file renders SQLite schemas and flags merge conflicts; web_extract refuses binary payloads

2026-09-19 03:07:47 -07:00

web_tools.py

feat(web): serve managed search through Perplexity

2026-09-24 16:17:16 -04:00

website_policy.py

…

working_diff.py

…

write_approval.py

…

x_search_tool.py

…

xai_http.py

refactor: make install-stamp.json the single runtime version identity

2026-09-23 11:41:01 -04:00

xai_video_tools.py

fix: video generation tools no longer let the agent pick the model

2026-09-19 12:22:44 -07:00

yuanbao_tools.py

…