fix(security): cherry-pick upstream security hardening - #2

Merged

jecruz merged 227 commits into

mainfrom

fix/upstream-security-v5

Apr 5, 2026

Commits on Mar 26, 2026

feat: add managed tool gateway and Nous subscription support
rewbs
committed
95dc9aa
Merge branch 'main' into rewbs/tool-use-charge-to-subscription
rewbs
committed
e95965d

Commits on Mar 30, 2026

Gate tool-gateway behind an env var, so it's not in users' faces until we're ready. Even if users enable it, it'll be blocked server-side for now, until we unlock for non-admin users on tool-gateway.
rewbs
committed
1cbb1b9
Optimize Dockerfile: combine RUN commands, clear caches, add .dockerignore
Bryan Cross
committed
8210e7a
Merge branch 'NousResearch:main' into docker-optimization
bcross
authored
fdef045
Further npm optimizations
bcross
authored
48942c8
Simplify dockerignore
bcross
authored
5de312c
Merge branch 'NousResearch:main' into docker-optimization
bcross
authored
4f4d7c4
Add build-essential to Dockerfile dependencies
bcross
authored
3a1e489
Optimize Playwright install
Bryan Cross
committed
0287597
Merge branch 'main' into rewbs/tool-use-charge-to-subscription
rewbs
committed
6e4598c

Commits on Mar 31, 2026

Merge branch 'main' into rewbs/tool-use-charge-to-subscription
rewbs
committed
1126284
Fixes and refactors enabled by recent updates to main.
rewbs
committed
1b7473e
Merge branch 'NousResearch:main' into docker-optimization
bcross
authored
289df5d
fix(security): add missing GitHub OAuth token patterns and snapshot redact flag

dlkakbs
authored and
teknium1
committed
6dcc333
fix: patch _REDACT_ENABLED in test fixture for module-level snapshot
teknium1
committed
fad3f33
fix(browser): skip SSRF check for local backends (Camofox, headless Chromium) (#4292)
teknium1
authored
cca0996
feat: support * wildcard in platform allowlists and improve WhatsApp docs
teknium1
authored
84a541b
fix(gateway): parse thread_id from delivery target format

MacroAnarchy
authored and
teknium1
committed
49d7210
fix(cli): allow empty strings and falsy values in config set

authored and
teknium1
committed
c1606ae
fix: strip orphaned think/reasoning tags from user-facing responses

arasovic
authored and
teknium1
committed
0240baa
docs+feat: comprehensive local LLM provider guides and context length warning (#4294)
teknium1
authored
5762532
fix: first-run guard stuck in loop when provider configured via config.yaml (#4298)
teknium1
authored
143b74e
fix: credential pool 401 recovery rotates to next credential after failed refresh (#4300)
teknium1
authored
161acb0
fix: harden codex responses transport handling

curtitoo
authored and
teknium1
committed
e75964d
test: add codex transport drop regression

curtitoo
authored and
teknium1
committed
cac9d20
feat: add --max-turns CLI flag to hermes chat
teknium1
authored
7f670a0
fix: allow voice mode in WSL when PulseAudio bridge is configured

0xbyt4
authored and
teknium1
committed
08171c1
fix(profiles): validate tar archive member paths on import

Gutslabs
authored and
teknium1
committed
0f2ea20
fix(security): reject path traversal in credential file registration

maymuneth
authored and
teknium1
committed
a97641b
fix: apply same path traversal checks to config-based credential files
teknium1
committed
7f78dee
fix(cli): use atomic write in save_config_value to prevent config loss on interrupt

authored and
teknium1
committed
c94a5fa
fix(security): protect .docker, .azure, and .config/gh from read and write

maymuneth
authored and
teknium1
committed
655eea2
fix(security): add .config/gh to read protection for @file references (#4327)
teknium1
authored
d3f1987
feat(file_tools): harden read_file with size guard, dedup, and device blocking (#4315)
teknium1
authored
e3f8347
fix: root-level provider in config.yaml no longer overrides model.provider
teknium1
authored
1b62ad9
fix: add CAMOFOX_PORT=9377 to Docker commands for camofox-browser (#4340)
teknium1
authored
f5cc597
feat(file_tools): detect stale files on write and patch (#4345)
teknium1
authored
f049860
feat(skills): unify hermes-agent and hermes-agent-setup into single skill (#4332)
teknium1
authored
b118f60
fix(cli): anchor input prompt near bottom of terminal after responses (#4359)
teknium1
authored
f8cb54b
Merge pull request #4034 from bcross/docker-optimization
benbarclay
authored
c36aa5f

Commits on Apr 1, 2026

feat: add qwen/qwen3.6-plus-preview:free to OpenRouter and Nous model lists (#4376)
teknium1
authored
3604665
fix(security): redact secrets from execute_code sandbox output
teknium1
authored
0a6d366
feat(discord): only create threads and reactions for authorized users

lbatalha
authored and
teknium1
committed
f4d44c7
fix: skip empty/whitespace text in Telegram send to prevent 400 errors

SHL0MS
authored and
teknium1
committed
83dec2b
fix(file_tools): refresh staleness timestamp after writes (#4390)
teknium1
authored
ef2ae3e
fix: preserve credential_pool through smart routing and defer eager fallback on 429 (#4361)
teknium1
authored
a7f7e87
fix(cli): initialize ctx_len before compact banner path

Johannnnn506
authored and
teknium1
committed
9b99ea1
fix: add missing provider attrs to cli_obj test fixture
teknium1
committed
efa327a
fix(docs): restrict backdrop-filter to desktop to fix mobile sidebar

xsmyile
authored and
teknium1
committed
7baee0b
fix(docs): use compound selector instead of media query

xsmyile
authored and
teknium1
committed
8327f7c
fix(gateway): resume agent after /approve executes blocked command

Nick
authored and
teknium1
committed
9a581bb
fix(client): handle is_closed as method in OpenAI SDK

Bartok9
authored and
teknium1
committed
afa75a6
fix(cli): pin entire TUI to bottom of terminal on startup (#4412)
teknium1
authored
996250d
fix(cli): support exporting the default root profile (#4366)

devorun
authored and
teknium1
committed
f04977f
fix: comprehensive default profile export exclusions and import guard
teknium1
committed
68fc4ae
feat: add inline diff previews for write actions

kshitijk4poor
authored and
teknium1
committed
935137f
fix(insights): show cache tokens in overview so total adds up (#4428)
teknium1
authored
c9dc6c4
fix(skills): move unified hermes-agent skill into autonomous-ai-agents category (#4435)
teknium1
authored
85e96a4
feat(browser): add persistent Camofox sessions and VNC URL discovery (salvage #4400) (#4419)

teknium1
and
analista
authored
70744ad
feat(skills): size limits for agent writes + fuzzy matching for patch (#4414)
teknium1
authored
f6ada27
fix: restore _config_version to 11 (reverted by stale-branch merge in #4419) (#4440)
teknium1
authored
e0abf24
fix(gateway): remap HERMES_HOME to target user in system service unit

authored and
teknium1
committed
e905768
fix: update fetch_transcript.py for youtube-transcript-api v1.x

analista
authored and
teknium1
committed
3400098
fix(gateway): wire -v/-q flags to stderr logging

alanjds
authored and
teknium1
committed
5bd01b8
fix: use RedactingFormatter on stderr handler, update types and test mock
teknium1
committed
bacc86d
fix(security): exclude auth.json and .env from profile exports

dieutx
authored and
teknium1
committed
d435acc
fix: also exclude .env from default profile exports
teknium1
committed
b267516
fix(skill_utils): add type check for metadata field in extract_skill_conditions

authored and
teknium1
committed
3ff9e01
feat(api-server): support X-Hermes-Session-Id header for session continuity

txchen
authored and
teknium1
committed
bf19623
fix: lazy-init SessionDB on adapter instance instead of per-request
teknium1
committed
7e91009
security: block secret exfiltration via browser URLs and auxiliary LLM calls

0xbyt4
authored and
teknium1
committed
712aa44
security: redact secrets from auxiliary and vision LLM responses

0xbyt4
authored and
teknium1
committed
127a4e5
fix: rewrite test mock secrets and add redaction fixture
teknium1
committed
1515e8c
fix(gateway): persist memory flush state to prevent redundant re-flushes on restart (#4481)
teknium1
authored
16d9f58
fix(security): cherry-pick upstream security hardening

claude
authored and
jecruz
committed
9a23abf
fix: profile model.model promoted to model.default when default not set
teknium1
committed
c59ab8b
feat: use 'developer' role for GPT-5 and Codex models (#4498)
teknium1
authored
3628ccc
fix(security): restore missing browser_camofox_state module

jecruz
and
claude
committed
7a7684b
fix: remove hardcoded OpenRouter/opus defaults
teknium1
committed
de9bba8
test(e2e): add telegram gateway e2e test infrastructure

pefontana
authored and
teknium1
committed
ba48cfe
test(e2e): add telegram slash command e2e tests

pefontana
authored and
teknium1
committed
bff34b1
ci: add e2e test workflow

pefontana
authored and
teknium1
committed
67e1170
test(e2e): add intentional failure to verify CI detection

pefontana
authored and
teknium1
committed
b209dc0
test(e2e): revert intentional failure after CI verification

pefontana
authored and
teknium1
committed
ecd9bf2
test(e2e): add authorization, session lifecycle, and resilience tests

pefontana
authored and
teknium1
committed
04e60cf
ci: merge e2e into tests workflow as separate job

pefontana
authored and
teknium1
committed
1f1297f
test(e2e): remove unused imports and duplicate fixtures

pefontana
authored and
teknium1
committed
99e6f44
test(e2e): remove section separator comments

pefontana
authored and
teknium1
committed
bd9e0b6

Commits on Apr 2, 2026

Merge branch 'main' into rewbs/tool-use-charge-to-subscription
benbarclay
committed
a2e56d0
fix: resolve post-merge issues in auxiliary_client and model flow

benbarclay
and
claude
committed
647f99d
fix(tools): add debug logging for token refresh and tighten domain check
Rafa-Ross
committed
a0f5fc2
Merge pull request #3287 from NousResearch/rewbs/tool-use-charge-to-subscription
benbarclay
authored
5101f85
fix(update): preserve optional extras during fallback install

kshitijk4poor
authored and
teknium1
committed
c91f4ef
fix: scope extras retry to [all] group only
teknium1
committed
f4bc6aa
fix(cli): detect dragged file paths instead of treating them as slash commands

rolme
authored and
teknium1
committed
1841886
refactor: extract _detect_file_drop() + add 28 tests

rolme
authored and
teknium1
committed
c4e626b
fix(state): quote dotted terms in FTS5 queries

Lume
authored and
teknium1
committed
9825cd7
fix: merge dotted+hyphenated FTS5 quoting into single pass
teknium1
committed
e4db72e
fix: invalidate update cache for all profiles, not just current
teknium1
committed
835defe
fix: preserve allowed_users during setup reconfigure and quiet unconfigured provider warnings

kshitijk4poor
authored and
teknium1
committed
e94b4b2
fix(gateway): seed DM thread sessions with parent transcript to preserve context

garygcchiu
authored and
teknium1
committed
8cb3596
cleanup: use _generate_session_key for parent key, fix trailing whitespace
teknium1
committed
64584a9
fix: make gateway approval block agent thread like CLI does (#4557)
teknium1
authored
624ad58
chore: merge upstream/main into fix/upstream-security-v5
jecruz
committed
fee8074
fix(tests): fix 11 real test failures + major cascade poisoner (#4570)
teknium1
authored
acea9ee
fix: exclude matrix from [all] extras — python-olm is upstream-broken (#4615)
teknium1
authored
661a1b0
feat(honcho): scope host and peer resolution to active Hermes profile

erosika
authored and
teknium1
committed
18c156a
feat(honcho): add cross-profile observability for Honcho integration

erosika
authored and
teknium1
committed
d1189f2
feat(honcho): auto-clone config to new profiles on creation

erosika
authored and
teknium1
committed
37458e7
feat(honcho): eager peer creation + enable/disable per profile

erosika
authored and
teknium1
committed
0e90df1
fix(honcho): remove linkedHosts from peers table

erosika
authored and
teknium1
committed
f27da5f
fix(honcho): share workspace across profiles by default

erosika
authored and
teknium1
committed
5f6bf2a
feat(honcho): --target-profile flag + peer card display in status

erosika
authored and
teknium1
committed
89eab74
feat(honcho): sync command + auto-sync on hermes update

erosika
authored and
teknium1
committed
c146631
fix(honcho): address PR review findings

erosika
authored and
teknium1
committed
a0eae33
fix: patch _local_config_path in tests for write isolation

erosika
authored and
teknium1
committed
37d73d9
fix(honcho): remove redundant local HOST import in _all_profile_host_configs
teknium1
committed
8dc5b11
fix(cli): ensure zero exit code on successful quiet mode queries (#4601)

devorun
authored and
teknium1
committed
f4f64c4
fix: repair OpenCode model routing and selection (#4508)

teknium1
and
shenzennktz
authored
28a073e
fix: preserve Anthropic thinking block signatures across tool-use turns
teknium1
committed
585855d
fix(insights): persist token usage for non-CLI sessions

kshitijk4poor
authored and
teknium1
committed
20441cf
feat(website): add skills browse and search page to docs (#4500)
IAvecilla
authored
b8dd059
chore: gitignore generated skills.json
teknium1
committed
918d593
feat: per-turn primary runtime restoration and transport recovery (#4624)
teknium1
authored
3186668
feat(prompt): add Google model operational guidance for Gemini and Gemma (#4641)
teknium1
authored
d89cc7f
feat(slack): add reply_in_thread config option

amethystani
authored and
teknium1
committed
b9a968c
docs: add reply_in_thread config to Slack docs
teknium1
committed
241cbee
fix(agent): classify think-only empty responses before retrying

kshitijk4poor
authored and
teknium1
committed
d2b0840
docs: add Configuration Options section to Slack docs (#4644)
teknium1
authored
798a7b9
Replace ml-paper-writing with research-paper-writing: full research pipeline skill
SHL0MS
committed
b86647c
Merge pull request #4654 from SHL0MS/skill/research-paper-writing
SHL0MS
authored
6d68fbf
fix: webhook platform support — skip home channel prompt, disable tool progress (salvage #4363) (#4660)

teknium1
and
bennyhodl
authored
e0b2bdb
feat(memory): pluggable memory provider interface with profile isolation, review fixes, and honcho CLI restoration (#4623)
teknium1
authored
924bc67

Commits on Apr 3, 2026

feat(honcho): restore full integration parity in memory provider plugin

erosika
authored and
teknium1
committed
9e0fc62
feat(honcho): add configurable observation mode (unified/directional)

erosika
authored and
teknium1
committed
29c98e8
feat(acp): register client-provided MCP servers as agent tools

Jckwind
authored and
teknium1
committed
9b2fb1c
fix(acp): use raw server name as registry key, only sanitize for tool name prefixes

Jckwind
authored and
teknium1
committed
9aa82d4
fix(acp): include tool results in step_callback for ACP tool_call_update events

Jckwind
authored and
teknium1
committed
f66b3fe
fix(gateway): normalize step_callback prev_tools for backward compat
teknium1
committed
21c2d32
test(acp): add E2E tests for MCP registration and tool-result reporting
teknium1
committed
3659e1f
fix(gateway): race condition, photo media loss, and flood control in Telegram

kshitijk4poor
authored and
teknium1
committed
69f85a4
fix(gateway): downgrade empty/None response log from WARNING to DEBUG

kshitijk4poor
authored and
teknium1
committed
9bb83d1
fix(gateway): prevent stuck sessions with agent timeout and staleness eviction

kshitijk4poor
authored and
teknium1
committed
970042d
fix(gateway): STT config resolution, stream consumer flood control fallback

kshitijk4poor
authored and
teknium1
committed
28380e7
refactor: simplify and harden PR fixes after review

kshitijk4poor
authored and
teknium1
committed
0ed28ab
fix: move class-level attribute after docstring, clarify throttle comment
teknium1
committed
a933079
fix(cli): surface recent sessions inside /history and /resume

kshitijk4poor
authored and
teknium1
committed
4d99305
fix: allow running gateway service as root for LXC/container environments (#4732)
teknium1
authored
23addf4
fix(whatsapp): enforce require_mention in group chats

kshitijk4poor
authored and
teknium1
committed
714e494
fix(whatsapp): add free_response_chats, mention stripping, and interactive message unwrapping

kshitijk4poor
authored and
teknium1
committed
7165eff
fix(update): avoid launchd restart race on macOS

davetist
authored and
teknium1
committed
988ecc7
fix: remove redundant restart message from update launchd path
teknium1
committed
c66c688
fix(update): handle conflicted git index during hermes update (#4735)

teknium1
and
kshitijk4poor
authored
0109547
Add fork detection and upstream sync to hermes update

authored and
teknium1
committed
6b0022b
fix: use get_hermes_home(), consolidate git_cmd, update tests
teknium1
committed
67ae7a7
docs(acp): fix zed config

NexVeridian
authored and
teknium1
committed
388241f
fix: handle Anthropic long-context tier 429 by reducing to 200k
teknium1
committed
470c3ea
fix: correct qwen3.6-plus model slug
teknium1
committed
26d6083
fix: handle Anthropic Sonnet long-context tier 429 by reducing to 200k (#4747)
teknium1
authored
8fd9faf
fix: prevent compression death spiral from API disconnects (#2153) (#4750)
teknium1
authored
f374ae4
fix(mcp): stability fix pack — reload timeout, shutdown cleanup, event loop handler, OAuth non-blocking (#4757)
teknium1
authored
cc54818
fix: handle None mcp_servers in _get_platform_tools()
teknium1
committed
d50e5be
docs: add community FAQ entries — multi-model workflows, WhatsApp binding, verbose control, skills config, thread sessions, migration, install troubleshooting (#4797)
teknium1
authored
93334b2
fix(gateway): route /approve and /deny through running-agent guard (#4798)
teknium1
authored
b6f9b70
fix: respect per-platform disabled skills in Telegram menu and gateway dispatch (#4799)
teknium1
authored
5db630a
fix(discord): register /approve and /deny slash commands, wire up button-based approval UI (#4800)
teknium1
authored
aecbf7f
fix: persist API server sessions to shared SessionDB (state.db) (#4802)
teknium1
authored
67e3620
fix: route memory provider tools in sequential execution path (#4803)
teknium1
authored
e492420
chore: release v0.7.0 (2026.4.3) (#4812)
teknium1
authored
abf1e98
Merge remote-tracking branch 'upstream/main' into fix/upstream-security-v5
jecruz
committed
5bfe0e2
fix(memory): Fix ByteRover plugin - run brv query synchronously before LLM call

DatPham-6996
authored and
teknium1
committed
b3319b1
fix: regenerate uv.lock to sync with pyproject.toml v0.7.0 (#4842)
teknium1
authored
6d357bb
fix: resolve critical stability issues in core, web, and browser tools

Dusk1e
authored and
teknium1
committed
a09fa69
fix: complete browser_tool profile isolation — replace remaining 3 hardcoded HERMES_HOME instances
teknium1
committed
4979d77
fix(memory): profile-scoped memory isolation and clone support (#4845)
teknium1
authored
8a38462
feat: add .zip document support and auto-mount cache dirs into remote backends (#4846)
teknium1
authored
b175608
fix: normalise \r\n and \r line endings in pasted text

iRonin
authored and
teknium1
committed
de5aacd
feat: add arcee-ai/trinity-large-thinking to recommended models
teknium1
committed
7def061
refactor(skills): consolidate code verification skills into one (#4854)
teknium1
authored
52ddd6b
fix: scope gateway stop/restart to current profile, --all for global kill
teknium1
committed
84a875c
fix(memory): preserve holographic prompt and trust score rendering

hermes-agent
authored and
teknium1
committed
bef895b
fix: filter transcript-only roles from chat-completions payload (#4715)

kagura-agent
authored and
teknium1
committed
6bf5946
fix: also filter session_meta in /session switch restore path
teknium1
committed
3f21800
fix: clarify interrupt re-queue label, document busy_input_mode behaviour

teknium1
and
iRonin
committed
92dcdbf

Commits on Apr 4, 2026

fix: protect profile-scoped google workspace oauth tokens

kshitijk4poor
authored and
teknium1
committed
37e2ef6
refactor: simplify scope validation helpers in google workspace scripts

kshitijk4poor
authored and
teknium1
committed
5359921
fix(gateway): isolate approval session key per turn

Tranquil-Flow
authored and
teknium1
committed
3bfb39a
fix: add type hints to session key helpers, extend context-local key to terminal_tool
teknium1
committed
fb654c1
feat(telegram): add group_topics skill binding for supergroup forum topics

clawdolf
authored and
teknium1
committed
1cae9ac
test+docs: add group_topics tests and documentation
teknium1
committed
d4bf517
fix(opencode-go): strip trailing /v1 from base URL for Anthropic models (#4918)
teknium1
authored
36aace3
fix: prevent duplicate messages — gateway dedup + partial stream guard (#4878)

authored
cee761e
fix(gateway): write update-pending state atomically to prevent corruption

memosr
authored and
teknium1
committed
287ac15
fix(gateway): bypass active-session guard for /approve and /deny commands (#4926)
teknium1
authored
fb68c22
fix: don't treat bare file paths as slash commands

teknium1
and
iRonin
committed
8af6a08
fix(gateway): restore short preview truncation for all/new tool progress modes (#4935)
teknium1
authored
f1c0847
fix(openviking): send tenant-scoping headers on every request (#4825)

authored and
teknium1
committed
14e8732
fix(mem0): merge env vars with mem0.json instead of either/or

liviaellen
authored and
teknium1
committed
5e3303b
fix: use 'is not None and != ""' instead of truthiness for mem0.json merge
teknium1
committed
585a3b4
fix: use clean user message for all memory provider operations (#4940)
teknium1
authored
5a98ce5
feat: wire skills.external_dirs into all remaining discovery paths
teknium1
committed
ad4feea
docs: improve youtube-content skill structure and workflow

teknium1
and
fernandezbaptiste
committed
34308e4
fix(gateway): support infinite timeout + periodic notifications + actionable error (#4959)
teknium1
authored
1c0c5d9
perf: fix O(n²) catastrophic backtracking in redact regex + reorder file read guard

acsezen
authored and
teknium1
committed
831067c
feat: add MiniMax TTS provider support (speech-2.8)

octo-patch
authored and
teknium1
committed
f5c212f
fix: clear ghost status-bar lines on terminal resize (#4960)
teknium1
authored
b93fa23
fix: sync OAuth tokens between credential pool and credentials file

authored and
teknium1
committed
a70ee1b
style: add debug log for write-back failure in retry path

authored and
teknium1
committed
78ec8b0
feat: add docker_env config for explicit container environment variables (#4738)
teknium1
authored
43d3efd
docs: fix stale references across 8 doc pages
teknium1
committed
77a2aad
Merge remote-tracking branch 'upstream/main' into fix/upstream-security-v5
jecruz
committed
bc40007
fix: remove stale test skips, fix regex backtracking, file search bug, and test flakiness

LucidPaths
authored and
teknium1
committed
6367e1c
fix(doctor): sync provider checks, add config migration, WAL and mem0 diagnostics (#5077)
teknium1
authored
2aa3f19
fix(openviking): correct API endpoint paths and response parsing

catbusconductor
authored and
teknium1
committed
e09e485
feat(cron): add script field for pre-run data collection (#5082)
teknium1
authored
5d0f55c
fix: use main provider model for auxiliary tasks on non-aggregator providers (#5091)
teknium1
authored
93aa01c
fix(hindsight): overhaul hindsight memory plugin and memory setup wizard

cdbartholomew
authored and
teknium1
committed
28e1e21
feat: execute_code runs on remote terminal backends (#5088)
teknium1
authored
569e9f9
feat(gateway): add MATRIX_REQUIRE_MENTION and MATRIX_AUTO_THREAD support

authored and
teknium1
committed
d86be33
fix(gateway): match Discord mention-stripping behavior in Matrix adapter

authored and
teknium1
committed
2556cfd
Merge remote-tracking branch 'upstream/main' into fix/upstream-security-v5
jecruz
committed
bbb8fa1
fix(security,testing): redaction patterns, credential typing, test coverage

jecruz
and
claude
committed
b5835a2
feat(testing,docs): add credential typing fix, test suite, project docs

jecruz
and
claude
committed
e3134be
chore: merge origin/main into fix/upstream-security-v5

jecruz
and
claude
committed
3d657ee
chore(ci): opt into Node.js 24 for GitHub Actions runner

jecruz
and
claude
committed
570cb61
fix: patch get_all_skills_dirs and fix voice restart on no-speech
jecruz
committed
1bb5916