Files
hermes-agent/hermes_cli/web_routers
Brooklyn Nicholson 28e6496a5e fix(web): scrub a session's on-disk artifacts in the delete endpoint
DELETE /api/sessions/{id} removed the DB row but never passed the
profile's sessions dir to SessionDB.delete_session, so the on-disk
transcript artifacts survived the UI delete: legacy session_<id>.json
snapshots (which can carry plaintext secrets) and the gateway's
request_dump_<id>_*.json dumps. The CLI delete path threaded the
directory all along; the endpoint was the outlier.

Also sweep the legacy session_<id>.json snapshot name in
SessionDB._remove_session_files so deletes and prunes clear it from
installs whose older builds wrote it.

Fixes #60207

Co-authored-by: izumi0uu <izumi0uu@gmail.com>
2026-09-26 22:52:51 -05:00
..
…
…
…
…
…