codex/security hermes bridge token - #68470
Closed
zhenheco wants to merge 34 commits into
Closed
Conversation
added 30 commits
June 12, 2026 00:16
….x compatibility Gemini 3.x OpenAI-compatible tool-call responses can attach an opaque thought_signature directly on each tool_call. Hermes only preserved the older extra_content.google.thought_signature shape, so multi-turn replay dropped the direct signature and the next Gemini request could fail with INVALID_ARGUMENT for missing thought_signature. Preserve direct thought_signature metadata in the chat_completions transport, expose it on normalized ToolCall objects, write it into stored assistant tool_calls, and replay it through the Gemini native and CloudCode request translators without interpreting the value. Existing extra_content replay still works, and unsigned Gemini 2.x-style tool calls omit the signature field. Tests run: - pytest tests/agent/transports/test_chat_completions.py tests/agent/test_gemini_native_adapter.py tests/agent/test_gemini_cloudcode.py tests/run_agent/test_run_agent.py::TestBuildAssistantMessage -q - pytest tests/agent/test_gemini_native_adapter.py tests/agent/test_gemini_cloudcode.py tests/agent/test_gemini_schema.py tests/agent/test_gemini_fast_fallback.py tests/agent/test_gemini_free_tier_gate.py tests/hermes_cli/test_gemini_provider.py tests/hermes_cli/test_gemini_free_tier_setup_block.py -q - pytest tests/agent/transports/test_types.py -q - git diff --check
cherry-pick 至 v0.15.2 時 run_agent.py 衝突取 forwarder 側,遺漏將直掛 tool_call 的 thought_signature 寫入持久化 history,致 replay 掉 signature (test_tool_call_direct_thought_signature_preserved 紅燈)。 - build_assistant_message 補搬直 thought_signature(對稱 extra_content) - streaming accumulator 同步補(delta→acc→mock_tool_calls) - gemini_cloudcode_adapter 回復 skip_thought_signature_validator 哨兵 fallback (v0.15.2 upstream 本有;無真 sig 時 Code Assist 仍需),真 sig 優先 - native adapter 維持經 extra_content carrier round-trip(新回歸測試實證) Codex 交叉驗證找出 P1;Gemini 複審 native gap 經 round-trip 測試實證反駁。 全測 522 passed。
Author
|
Opened against wrong base repo by mistake; closing. |
alt-glitch
added
invalid
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
textbutton variant; use for aux-model actionshermes dashboard registerfor self-hosted OAuth clientconfig set#38611)markdowndep — cron delivery silently falls back to plain text despite PR #5271 #32486) (fix(deps): promote markdown to a core dependency so rich delivery works out of the box (#32486) #38649)cron listwhen a job's repeat is nullhermes updateonce on first-run crash (fix(update/windows): retry handoff hermes update once on first-run crash #39831)max_tokensfrom config.yaml is silently ignored — never propagated to AIAgent, causing output truncation on Ollama Cloud / zai / custom endpoints #20741)