KeelTrace d0c588972e fix(email): parse the From mailbox with the stdlib, not a first angle-bracket match ...

_extract_email_address took the FIRST <...> pair, so
From: "Victim <victim@example.com>" <attacker@evil.test> resolved to the
victim. The attacker's own domain passes DMARC truthfully, so the
allowlist (EMAIL_ALLOWED_USERS), pairing and session identity were all
evaluated against an address the sender does not control.

Use email.utils.parseaddr, which keeps the quoted text as the display
name and returns the real addr-spec. RFC 5322 folding is unfolded first
so a folded quoted display name is not mistaken for the mailbox.

Salvages #124322.

2026-09-27 20:49:08 +05:30

..

_fixtures

…

acp_adapter

fix(acp): stamp ended_at on ACP sessions at adapter shutdown (#118216)

2026-09-26 21:00:46 -05:00

agent

fix(files): one live-DB refusal source; hold the lock through /api/files/read

2026-09-27 20:45:56 +05:30

ci

…

compat

…

computer_use

…

conformance

…

cron

fix(cron): fail closed inside the merge peek; keep merge on mergeable repairs

2026-09-27 18:30:44 +05:30

dashboard

…

desktop

…

docker

…

e2e

test(e2e/network): drop the #124653 gate; the channel 503 cell passes

2026-09-27 03:41:42 -07:00

evals

…

fakes

test(e2e/platforms): address review — non-vacuous stream finalize, stranger refusal, redelivery transcript, known_failure gates

2026-09-26 11:57:54 -07:00

fixtures

…

gateway

fix(email): parse the From mailbox with the stdlib, not a first angle-bracket match

2026-09-27 20:49:08 +05:30

hermes_cli

fix(tui): import SessionActiveWriteGuardError inside session.delete

2026-09-27 20:49:04 +05:30

hermes_platform

…

hermes_state

fix(sessions): guard delegate children that a delete would cascade

2026-09-27 20:49:04 +05:30

honcho_plugin

…

install

test(e2e/windows): accept Hermes-Setup.exe's legacy receipt as a permanent shape

2026-09-27 04:15:09 -07:00

installation

…

integration

…

manual

…

monitoring

…

openviking_plugin

…

perf_guards

…

plugins

fix(kanban): run clock ticks from the current run, not the task's first start

2026-09-26 16:51:19 -05:00

pm

test(pm): keep FFmpeg's musl gaps when the re-pin test narrows its gap table

2026-09-27 03:24:39 -07:00

providers

…

scripts

test: trim musl coverage to two invariants

2026-09-27 03:24:39 -07:00

secret_sources

…

security

…

skills

…

tools

test(delegate): tidy #121572 follow-ups

2026-09-27 18:17:20 +05:30

tui_gateway

fix(tui): import SessionActiveWriteGuardError inside session.delete

2026-09-27 20:49:04 +05:30

verify

…

website

fix(website): batch the plugin stars probe at 100 repos per GraphQL request

2026-09-27 03:34:56 -07:00

__init__.py

…

conftest.py

…

git_safety.py

…

home_io_guard.py

test: check guarded paths with strings, not pathlib

2026-09-25 19:28:59 -05:00

installation_launcher_fixture.py

…

live_process_fixtures.py

…

run_interrupt_test.py

…

termux_fixtures.py

…

test_agent_close_lifecycle.py

…

test_atomic_json_writers_unified.py

…

test_atomic_replace_symlinks.py

…

test_atomic_write_fsync_dir_target.py

…

test_atomic_write_text_metadata.py

…

test_audit_old_updater_imports.py

…

test_base_url_hostname.py

…

test_basetemp_isolation.py

…

test_batch_runner_checkpoint.py

…

test_batch_runner_discard_resume.py

…

test_batch_runner_durability.py

…

test_credential_file_permissions.py

…

test_dispatch_session_id.py

…

test_display_hermes_home.py

…

test_engines_satisfiable.py

…

test_fast_safe_load.py

…

test_get_tool_definitions_cache_isolation.py

…

test_git_safety_boundary.py

…

test_hermes_bootstrap.py

…

test_hermes_constants.py

…

test_hermes_home_key_cache.py

…

test_hermes_home_profile_warning.py

…

test_hermes_logging.py

…

test_hermes_yaml.py

…

test_ipv4_preference.py

…

test_live_system_guard_self_test.py

…

test_live_system_guard.py

…

test_load_yaml_file_readonly.py

…

test_log_isolation.py

…

test_managed_runtime_resolution.py

…

test_mcp_serve.py

…

test_mini_swe_runner.py

…

test_model_forces_max_completion_tokens.py

…

test_model_tools_async_bridge.py

…

test_no_shadowed_test_definitions.py

…

test_old_updater_compat_surface.py

…

test_os_marker_gating.py

…

test_packaging_build_guard.py

…

test_packaging_metadata.py

…

test_packaging_py_modules.py

…

test_platforms_marker.py

…

test_project_metadata.py

…

test_sanitize_tool_error.py

…

test_scratch_dir.py

…

test_scratch_scan_failures.py

…

test_search_cjk_prefix_wildcard.py

fix: picker/input cluster — vendor casing, variant tags, submenu keyboard path, stale moa pick, CJK search star

2026-09-26 18:16:44 -05:00

test_tests_tree_layout.py

…

test_trajectory_compressor_async.py

…

test_trajectory_compressor.py

fix(slack,trajectory): mint the compression marker for agent-facing truncations

2026-09-26 23:49:25 +05:30

test_utils_atomic_roundtrip_yaml_save.py

…

test_utils_atomic_writers_deleted_profile.py

…

test_utils_rmtree_readonly.py

…

test_utils_truthy_values.py

…

test_wal_reset_repair_hint.py

…

test_windows_subprocess_no_window_flags.py

…

test_yaml_indent_consistency.py

…