fix(security): salvage six P1 hardening PRs — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport, matrix sync isolation - #57660

Merged

teknium1 merged 8 commits into

mainfrom

hermes/hermes-ee61d46a

Jul 3, 2026

Commits on Jul 3, 2026

fix(browser): block Camofox input on private pages

necoweb3
authored and
teknium1
committed
4f9ec7a
fix(browser): apply private-page guard to browser_cdp frame_id routing

srojk34
authored and
teknium1
committed
19359fd
security(gateway): anchor api_server MEDIA tag resolution to safe paths

srojk34
authored and
teknium1
committed
29d5d00
fix(dashboard): block .env files from managed-files API

liuhao1024
authored and
teknium1
committed
318ab0c
fix(dashboard): use pattern match for .env sensitive file guard

liuhao1024
authored and
teknium1
committed
2f40802
fix(security): remove model-controlled delegate ACP transport

authored and
teknium1
committed
d9813ef
fix(matrix): isolate per-event failures in _dispatch_sync gather

Que0x
authored and
teknium1
committed
b8ec200
fix(dashboard): make .env sensitive-file guard case-insensitive
teknium1
committed
2109a54