RomanNum3ral
/
hermes-agent
mirror of https://github.com/NousResearch/hermes-agent.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
hermes-agent/plugins/platforms
History
Kevin (OpenClaw Bot) 37481dccf4 fix(a2a): security hardening from code review 
Critical fixes:
- SSRF protection: validate push notification callback URLs (block
  internal/private/loopback/metadata, enforce http/https only)
- Request body size limit: 1MB max (prevents memory exhaustion DoS)
- Thread safety: module-level locks for turn tracking, rate limiting,
  and pending task registry (was lazily initialized, racy)
- Peer identity: fall back to client IP when 'peer' field absent
  (prevents rate limiting collapse to single 'unknown' bucket)

Minor fixes:
- Watchdog survives reconnect: clear _watchdog_stop in connect()
- Redact error messages before sending to peers
- Remove dead _streaming_queues state
- Fix duplicate tags key in Agent Card skills
- Always send contextId in a2a_call (fixes client/server mismatch)
- Clear push_callbacks on disconnect
- SSE streaming cleanup via try/finally

16 new tests covering SSRF, body size, thread safety, watchdog
reconnect, error redaction, contextId consistency.
Tests: 97 passed, 3 deselected, 0 failed.
 		2026-08-02 15:10:15 -07:00
..
a2a fix(a2a): security hardening from code review 2026-08-02 15:10:15 -07:00
buzz fix(secrets): Slack-pattern scoped credential reads — Feishu, WeCom, Photon, Buzz 2026-08-02 10:00:44 -07:00
dingtalk fix(secrets): Slack-pattern scoped credential reads — ntfy, Home Assistant, SMS, DingTalk 2026-08-02 10:00:44 -07:00
discord polish(discord): surface ffmpeg stderr on pcm_to_wav failure 2026-08-02 23:21:00 +05:30
email fix(email): Slack-pattern helper for unscoped default-profile adapter + scope ports/trust flag 2026-08-02 10:01:16 -07:00
feishu fix(secrets): Slack-pattern scoped credential reads — Feishu, WeCom, Photon, Buzz 2026-08-02 10:00:44 -07:00
google_chat fix(deps): repair Google transitive security floors (#72108) 2026-07-31 23:18:38 -07:00
homeassistant fix(secrets): Slack-pattern scoped credential reads — ntfy, Home Assistant, SMS, DingTalk 2026-08-02 10:00:44 -07:00
irc fix(secrets): Slack-pattern scoped credential reads — IRC, LINE, Teams, Mattermost 2026-08-02 10:00:44 -07:00
line fix(secrets): Slack-pattern scoped credential reads — IRC, LINE, Teams, Mattermost 2026-08-02 10:00:44 -07:00
matrix fix(secrets): scope-aware standalone-send and startup credential reads in platform adapters 2026-08-02 10:02:33 -07:00
mattermost fix(secrets): Slack-pattern scoped credential reads — IRC, LINE, Teams, Mattermost 2026-08-02 10:00:44 -07:00
ntfy fix(secrets): Slack-pattern scoped credential reads — ntfy, Home Assistant, SMS, DingTalk 2026-08-02 10:00:44 -07:00
photon fix(secrets): Slack-pattern scoped credential reads — Feishu, WeCom, Photon, Buzz 2026-08-02 10:00:44 -07:00
raft fix(security): widen non-ASCII compare_digest crash fix to all sibling sites 2026-07-16 07:22:24 -07:00
simplex feat(gateway): simplex channel enumeration + show configured platforms in hermes send --list 2026-08-02 15:08:45 -07:00
slack fix(secrets): scope-aware standalone-send and startup credential reads in platform adapters 2026-08-02 10:02:33 -07:00
sms fix(secrets): Slack-pattern scoped credential reads — ntfy, Home Assistant, SMS, DingTalk 2026-08-02 10:00:44 -07:00
teams fix(secrets): Slack-pattern scoped credential reads — IRC, LINE, Teams, Mattermost 2026-08-02 10:00:44 -07:00
telegram fix(secrets): scope-aware standalone-send and startup credential reads in platform adapters 2026-08-02 10:02:33 -07:00
wecom fix(secrets): Slack-pattern scoped credential reads — Feishu, WeCom, Photon, Buzz 2026-08-02 10:00:44 -07:00
whatsapp fix(whatsapp): default-profile UnscopedSecretError fallback + full bridge env set 2026-08-02 00:11:50 -07:00