feat: Add Turkish Code Analyzer Agent - #86
Closed
zagiscoming wants to merge 7 commits into
Closed
Conversation
Investigation CompleteRoot cause identified and fixed:
Skills Created/Updated
PR Status
Documentation
|
|
Investigation complete. Root cause: cleanup using wrong column (created_at instead of created_time). Fixed in PR #87. Skills created: ict-yellow-signal-missing-debug. Documentation saved to brain and imported to GBrain. |
dizhaky
referenced
this pull request
in dizhaky/hermes-agent
Jun 23, 2026
…AN-1385) (#26) baileys 7.0.0-rc.9->rc13 (clears #43 critical) + protobufjs 7.6.4 (#59,#58) in whatsapp-bridge; esbuild+tsx (#46,#61) in ui-tui; @babel/core (#84) in web; joi+http-proxy-middleware (#51,#89) in website. js-yaml #86 accepted (no in-range fix via gray-matter). Bridge startup verified. #93/#94 (code fixes) separate. Co-Authored-By: Claude <noreply@anthropic.com>
dizhaky
referenced
this pull request
in dizhaky/hermes-agent
Jun 24, 2026
* fix(security): validate Host/Origin on WebSocket upgrades (GHSA-4pqm-j46f-795x) Dependabot alerts #93 (HIGH) and #94 (MEDIUM): DNS-rebinding bypass via the dashboard WebSocket endpoints. FastAPI's @app.middleware("http") host-header guard does not run on WebSocket routes, so /api/pty, /api/ws, /api/pub, and /api/events accepted upgrades from any Host/Origin as long as the connection peer was loopback — which a TTL-flipped attacker hostname satisfies. Port the upstream fix (NousResearch/hermes-agent, patched in v2026.6.5): add _ws_host_origin_is_allowed() reusing the existing _is_accepted_host HTTP-layer defence, and call it in all four WS handlers before accept(). Non-browser clients (no Origin) and native app:// / file:// origins remain allowed — the session token stays their auth boundary. Adds regression coverage in TestWebSocketHostOriginGuard and sends a loopback Host header in the sidecar-url WS test (now required by the guard). Refs: GHSA-4pqm-j46f-795x, CVE-2026-53869 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(deps): remove vulnerable js-yaml 3.x from website (GHSA-h67p-54hq-rp68) Dependabot alert #86 (MEDIUM): quadratic-complexity DoS in js-yaml merge-key handling, fixed in 4.2.0. The flagged copy was gray-matter's hard dependency (Docusaurus -> @docusaurus/utils -> gray-matter -> js-yaml ^3, resolving to 3.14.2); js-yaml 3.x has no patched release. gray-matter 4.0.3 is the latest release and calls yaml.safeLoad/safeDump, both removed in js-yaml 4 — so an `overrides` bump alone breaks the docs build. Force js-yaml to 4.2.0 via overrides AND patch gray-matter's default engine to use yaml.load/yaml.dump (load is safe-by-default in v4, equivalent to the removed safeLoad). Applied at install time via patch-package. Verified: only js-yaml 4.2.0 remains in the lockfile, `npm audit` reports 0 vulnerabilities, and `npm run build` succeeds for all locales. Refs: GHSA-h67p-54hq-rp68 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Meraniya
pushed a commit
to Meraniya/hermes-agent
that referenced
this pull request
Aug 6, 2026
) hermes doctor now warns when SLACK_BOT_TOKEN is set but slack.allowed_channels is empty, since the bot will respond in every channel it's a member of (including any privileged ones it's since been invited to). Informational only — it never sets or infers a channel list; that decision stays with the user. Claude-Session: https://claude.ai/code/session_01P96ZSh1Dc9mX3vCd29dieZ Co-authored-by: Claude <noreply@anthropic.com>
sijav
added a commit
to sijav/sijav-agent
that referenced
this pull request
Aug 7, 2026
…p-wide (NousResearch#86) --muted-foreground (11 refs), --accent (6), --border (2) and --destructive (2) were referenced across the app but defined NOWHERE, so each resolved to its hardcoded var() fallback — dark-theme-tuned literals like #8a8a8a text and #2a2a2a borders — and silently stopped following the theme. --foreground WAS defined, which is why the partial set was easy to miss. Mapped onto the real --ui-* scale (text-tertiary / stroke-secondary / accent-secondary / red). Added an app-wide guard test with TWO rules, because the shapes differ: * HARD: var(--x) with NO fallback must be defined — otherwise the declaration is invalid at computed-value time and the property renders unset. * SOFT: var(--x, fb) that is undefined still renders, so it is only a bug when the token was meant to be a theme value. Deliberate optional-override hooks (--right-rail-top-inset, --pane-tab-*, --fit-max, …) are listed explicitly with a reason, and a staleness check stops that allowlist becoming a blanket suppression. Definitions are collected from every form in use: CSS declarations, style-object keys (incl. ['--x' as string]), and setProperty(). Two collector bugs were found and fixed while building it: a naive /* */ comment stripper swallowed real code in .tsx, and a greedy [^\]]* wildcard spanned lines so one match hid every later definition in a file (it reported 14 correctly-defined tokens as missing). Desktop suite: 397 files, 3434 tests, all passing.
sijav
added a commit
to sijav/sijav-agent
that referenced
this pull request
Aug 7, 2026
…list, record coverage-measurement learnings - TODO_BOARD: NousResearch#82 moved to DONE (404c53657); NousResearch#85 severity raised to HIGH/turn-killing with the roast's receipt; NousResearch#86 moved from FEATURES into BUGS; slice-B status corrected (committed, 53 tests); NousResearch#79 unblocked and marked in progress. - WORKLIST: pruned 149 -> 56 lines, dropping the abandoned parallel-worker scaffolding that read as live instruction (worker pool, refill, dead PENDINGs). - New learnings: aggregate coverage must go through scripts/run_tests_parallel.py (AGENTS.md:1368) and REQUIRES --with coverage; a scope-limited coverage number is not the real number; the Stop hook's relative-path bug that silently killed the loop.
sijav
added a commit
to sijav/sijav-agent
that referenced
this pull request
Aug 7, 2026
…earch#86) The target picker is a native <select> whose popup is drawn by the OS, not the page. It set `background: transparent` with `color: var(--foreground, #eee)`, so on a light desktop the popup fell back to the platform's white background while the option text stayed near-white — invisible text, the concrete repro recorded under NousResearch#86. Both halves of the colour pair now have to be explicit, and because inline styles cannot reach `option` from the parent, the pair is applied per option as well (shared QUICK_OPTION_STYLE so the closed control and the open popup can't drift apart). Added a render test that asserts the PAIR exists rather than a specific palette: a future theme change stays free, but silently returning to transparent/unset does not. Mutation-verified — reverting to the old styling fails all three assertions. tsc clean (0 diagnostics); 3 new + 17 existing quick-entry tests pass.
sijav
added a commit
to sijav/sijav-agent
that referenced
this pull request
Aug 7, 2026
…entry NousResearch#85 and NousResearch#86 marked done with their receipts. The NousResearch#86 entry had been left as a spliced-together paragraph by an earlier scripted edit (the replacement landed mid-sentence); rewritten as one coherent entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat: Add Turkish Code Analyzer Agent