John Paul Soliva c30ec25ec7 fix(proxy): judge Sec-Fetch-Site and compare Origin by host and port ...

Browsers send no Origin on a GET, so a cross-site page (or a DNS-rebound
page on a wildcard bind) could still reach /v1/models with the operator's
credential. Sec-Fetch-Site, which a page cannot forge, now refuses those.
The Origin check compares the parsed host and port instead of the raw
string, so an Origin that omits the default :80 or spells an IPv6
address differently is matched the way a browser means it.

Co-authored-by: JoaoMarcos44 <joaomarcosdias444@gmail.com>
(cherry picked from commit 72bf4e9c34f6c6200658e42345f775291462697c)

2026-10-03 16:29:17 +05:30

..

egress

…

features

fix(proxy): judge Sec-Fetch-Site and compare Origin by host and port

2026-10-03 16:29:17 +05:30

messaging

fix(wecom): split long messages instead of silently truncating them

2026-10-01 17:18:56 -07:00

secrets

…

skills

chore(memory): remove bundled honcho provider; install from the plugin catalog

2026-10-02 04:39:28 -07:00

_category_.json

…

bot-mode.md

docs(bot-mode): answer "what does this add over profiles?"

2026-09-30 09:57:33 -05:00

checkpoints-and-rollback.md

fix(checkpoints): label checkpoints that did not capture a nested repo

2026-09-29 14:12:41 -04:00

cli.md

fix(cli): make function-key workflows reliable on macOS (#120666)

2026-09-23 22:05:49 +00:00

configuration.md

fix(docker): keep per-process temp mounts out of the reuse fingerprint

2026-10-02 21:43:34 -05:00

configuring-models.md

…

desktop.md

fix(gui): keep shared workspace node_modules on uninstall --gui

2026-10-02 18:06:40 +00:00

docker.md

feat(cli): make the summary the default hermes status, --full for every section

2026-10-01 22:03:11 -07:00

git-worktrees.md

docs(worktrees): hermes -w checks out without the repository's hooks, fsmonitor and filters

2026-10-02 01:24:41 +05:30

import-from-other-agents.md

…

local-models.md

fix(local-runtime): Vulkan/HIP launches subtract what other programs hold on the card

2026-10-03 02:25:26 -07:00

managed-scope.md

…

multi-connection-desktop.md

fix(desktop): ⌘1…⌘9 switch the tab under the pointer again, and profiles when there is none

2026-09-27 18:00:11 -05:00

multi-profile-gateways.md

feat(cli): make the summary the default hermes status, --full for every section

2026-10-01 22:03:11 -07:00

profile-distributions.md

test(profiles): cover cron distribution ownership

2026-09-24 15:37:00 +05:30

profiles.md

docs(profiles): state only what the plugin clone verifies

2026-10-02 01:29:41 -07:00

security.md

Revert "docs: approvals.timeout and agent.clarify_timeout are the messaging-platform deadlines"

2026-10-01 13:23:12 -07:00

session-storage-recovery.md

fix(gateway): keep the operator restart tail on the home-channel storage notice

2026-09-20 20:13:33 -07:00

sessions.md

fix(sessions): un-hide an auto-archived chat when it is resumed or compressed

2026-09-28 21:03:09 -04:00

switching-to-source.md

docs: clarify Python updater range and test sandbox marker

2026-09-24 09:20:50 -04:00

tui.md

fix(cli): make function-key workflows reliable on macOS (#120666)

2026-09-23 22:05:49 +00:00

which-file-does-what.md

…

windows-native.md

fix(install): keep the ffmpeg lock label, drop the network liveness test, document -SkipSetup

2026-09-28 00:58:16 +05:30

windows-wsl-quickstart.md

Merge remote-tracking branch 'origin/main' into ethie/pm-clean

2026-09-19 22:57:07 -04:00