kshitij 8b243dff62 fix: security + efficiency review fixes for salvaged PR #74379 ... 1. Use open_credentialed_url() instead of bare urlopen() in templates.py apply_template() and probe_existing_customization(). Both send Authorization: Bearer headers; bare urlopen forwards credentials on cross-origin redirects. The codebase has open_credentialed_url() in hermes_cli/urllib_security.py that strips credentials on cross-origin redirects — used by 4 other modules. 2. Guard unavailable_reason() with the dedup set check before calling it. The gateway builds a fresh AIAgent per message, so without this guard unavailable_reason() (which calls _load_config() → stat + file read + JSON parse, and _check_local_runtime() → importlib probes) runs on every gateway turn for an unavailable provider, even though the warning is deduped after the first. 3. Move INDICATOR_GLYPH from Hindsight's eye emoji to a generic brain (🧠) in core (agent/memory_provider.py). Hindsight overrides with its own _HINDSIGHT_GLYPH (👁️) in recall_status() and _emit_saving_indicator(). Other memory providers no longer inherit Hindsight's brand mark as the default glyph.		2026-08-13 23:15:25 +05:30
..
lsp	…
monitoring	fix(otlp): span exporter now inherits configured resource_attributes	2026-08-08 18:11:02 -07:00
pet	…
proxy_sources	…
secret_sources	fix(plugins): preserve force-path platform sweep + scoped plugin-source listing after rebase	2026-08-12 19:13:32 -07:00
transports	fix: complete kanban review lifecycle	2026-08-10 12:43:46 -07:00
verify	Integrate verify subsystem with the existing verification stack	2026-08-07 10:11:05 -07:00
__init__.py	…
account_usage.py	…
agent_init.py	fix: security + efficiency review fixes for salvaged PR #74379	2026-08-13 23:15:25 +05:30
agent_runtime_helpers.py	refactor: hoist preflight clear into restart handler, single-source qwen predicate	2026-08-13 15:24:47 +05:30
anthropic_adapter.py	fix: send Hermes Agent attribution headers to OpenCode Zen and Go	2026-08-13 02:03:40 -07:00
async_utils.py	…
aux_accounting.py	…
auxiliary_client.py	fix(auxiliary): keep /anthropic base_url for anthropic_messages custom endpoints	2026-08-13 10:32:51 -07:00
azure_identity_adapter.py	…
backend_identity.py	…
background_review.py	simplify: match delegate_tool.py hasattr pattern, drop change-detector test	2026-08-09 16:13:52 +05:30
battery.py	…
bedrock_adapter.py	…
billing_links.py	…
billing_usage.py	…
billing_view.py	…
bounded_response.py	…
browser_provider.py	feat(browser): integrate Browser Use CLI 3.0	2026-08-10 10:45:44 -07:00
browser_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00
chat_completion_helpers.py	feat(plugins): add streaming output observer hooks	2026-08-12 18:38:25 -07:00
codex_responses_adapter.py	fix(compression): prune pre-checkpoint history on native compaction replay	2026-08-13 01:51:24 -07:00
codex_runtime.py	fix: widen APIConnectionError handling to finalization drain loop	2026-08-12 12:42:39 +05:30
coding_context.py	…
context_breakdown.py	…
context_compressor.py	fix: double-paren bug in dropped-tools prefix + add empty-response nudge sibling	2026-08-09 16:20:48 +05:30
context_engine.py	Revert "fix: rewire DCP context engine to current main architecture"	2026-08-08 23:09:45 +05:30
context_references.py	feat(plugins): allow plugins to register custom @-prefix context references	2026-08-12 18:41:59 -07:00
conversation_compression.py	feat(relay): session-span segmentation for continuous sessions	2026-08-13 10:45:15 -07:00
conversation_loop.py	fix: restore stale-base revert hunks in conversation_loop.py and moa_loop.py	2026-08-13 23:10:16 +05:30
copilot_acp_client.py	fix(file-safety): approval-gate ~/.ssh/config writes instead of hard-denying (#84663)	2026-08-12 11:04:45 -07:00
credential_persistence.py	…
credential_pool.py	fix(agent): rebind pool entry id after env credential refresh	2026-08-08 19:17:02 -07:00
credential_sources.py	fix(auth): read .env as utf-8-sig in the dotenv-vs-shell detector	2026-08-08 12:32:23 -07:00
credits_tracker.py	…
curator.py	…
curator_backup.py	refactor: fold simplify findings — 6th copy in update_cmd, drop dead wrapper + speculative kwarg, behavior-contract tests	2026-08-08 15:10:35 +05:30
delegation_context.py	…
display.py	feat(delegation): live orchestration of running subagents via delegate_task action param	2026-08-13 09:34:36 -07:00
error_classifier.py	feat(plugins): rename hook to transform_api_error_classification per #64231 verdict	2026-08-13 09:36:02 -07:00
errors.py	…
estop.py	fix: post-merge audit follow-ups for #81138/#81139/#81141/#81148	2026-08-08 05:21:09 -07:00
file_safety.py	fix(file-safety): approval-gate ~/.ssh/config writes instead of hard-denying (#84663)	2026-08-12 11:04:45 -07:00
gemini_native_adapter.py	…
gemini_schema.py	…
i18n.py	…
image_gen_provider.py	feat(media): opt-in upscale pass for image_generate and video_generate across FAL and Krea	2026-08-08 14:49:28 -07:00
image_gen_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00
image_routing.py	…
insights.py	…
interrupt_compat.py	…
iteration_budget.py	…
jiter_preload.py	…
kanban_stop.py	…
learn_prompt.py	fix(learn): process large sources incrementally	2026-08-08 05:09:43 -07:00
learning_graph.py	…
learning_graph_render.py	…
learning_mutations.py	…
lmstudio_reasoning.py	…
manual_compression_feedback.py	…
markdown_tables.py	…
memory_manager.py	fix: security + efficiency review fixes for salvaged PR #74379	2026-08-13 23:15:25 +05:30
memory_provider.py	fix: security + efficiency review fixes for salvaged PR #74379	2026-08-13 23:15:25 +05:30
message_content.py	…
message_sanitization.py	fix(agent): preserve destroyed tool-call argument bytes in the WARNING log	2026-08-07 16:57:11 +05:30
moa_loop.py	fix: restore stale-base revert hunks in conversation_loop.py and moa_loop.py	2026-08-13 23:10:16 +05:30
moa_trace.py	feat(langfuse): widen tracing to errors, sessions, subagents, and MoA fan-out	2026-08-13 23:10:16 +05:30
model_metadata.py	fix(model_metadata): generalize pre-catalog stale context-cache guard	2026-08-13 10:21:50 -07:00
models_dev.py	fix(models_dev): map meta-ai provider to models.dev 'meta' id (salvage #81418) (#84679)	2026-08-12 14:42:00 -04:00
moonshot_schema.py	…
native_compaction.py	fix(agent): keep native compaction checkpoints out of the thinking-only drop	2026-08-13 03:04:45 -07:00
nous_rate_guard.py	…
onboarding.py	…
oneshot.py	…
outbound_webhooks.py	…
plugin_llm.py	fix(plugins): complete task-routed LLM integration	2026-08-12 16:25:20 -07:00
plugin_stream_hooks.py	feat(plugins): add streaming output observer hooks	2026-08-12 18:38:25 -07:00
portal_tags.py	…
process_bootstrap.py	…
prompt_builder.py	feat(desktop): setup_mcp tool — inline MCP consent card over the clarify-style blocking bridge	2026-08-13 01:06:51 -05:00
prompt_cache_boundary.py	refactor(cache): share the boundary-declaration helper and simplify the registry	2026-08-09 15:25:12 +05:30
prompt_caching.py	refactor: hoist preflight clear into restart handler, single-source qwen predicate	2026-08-13 15:24:47 +05:30
rate_limit_tracker.py	…
reactions.py	…
reasoning_summaries.py	…
reasoning_timeouts.py	add grok 4.6 (#84661)	2026-08-12 13:37:04 -04:00
redact.py	fix: reuse redact_sensitive_text, fix leaky abstraction, fix test data	2026-08-13 23:10:16 +05:30
relay_llm.py	fix(relay): bypass managed execution for nested calls inside managed callbacks	2026-08-08 23:46:17 -07:00
relay_runtime.py	fix(relay): defer rotating-compaction session close while a turn is live	2026-08-13 10:45:15 -07:00
relay_tools.py	fix(relay): bypass managed execution for nested calls inside managed callbacks	2026-08-08 23:46:17 -07:00
replay_cleanup.py	…
retry_utils.py	…
runtime_cwd.py	…
secret_scope.py	…
session_activity.py	…
shell_hooks.py	fix(plugins): synthetic hook fixture, shell-hook exclusion, docs per review	2026-08-13 09:36:02 -07:00
skill_bundles.py	…
skill_commands.py	refactor(cache): share the boundary-declaration helper and simplify the registry	2026-08-09 15:25:12 +05:30
skill_preprocessing.py	…
skill_utils.py	…
ssl_guard.py	fix(ssl_guard): tolerate truststore SSLContext.get_ca_certs() NotImplementedError on Windows	2026-08-08 15:10:24 +05:30
ssl_verify.py	…
stream_diag.py	…
stream_single_writer.py	…
subagent_lifecycle.py	…
subdirectory_hints.py	…
subscription_view.py	…
system_prompt.py	feat(plugins): add cache-safe system prompt sections	2026-08-12 16:34:58 -07:00
think_scrubber.py	…
thinking_timeout_guidance.py	…
thread_scoped_output.py	…
title_generator.py	refactor(title): decide on the stored title and the real turns behind it	2026-08-09 04:33:58 -05:00
tool_dispatch_helpers.py	…
tool_executor.py	feat(delegation): live orchestration of running subagents via delegate_task action param	2026-08-13 09:34:36 -07:00
tool_guardrails.py	feat(delegation): live orchestration of running subagents via delegate_task action param	2026-08-13 09:34:36 -07:00
tool_result_classification.py	…
trace_upload.py	…
trajectory.py	…
transcription_provider.py	feat(plugins): add pre_transcription hook and STT prompt threading	2026-08-12 19:01:30 -07:00
transcription_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00
tts_provider.py	…
tts_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00
turn_context.py	feat(hindsight): memory provider improvements — recall_sync, retain_source, setup templates, memory indicators, error hints	2026-08-13 23:15:25 +05:30
turn_finalizer.py	fix(agent,gateway): class-level lone-surrogate chokepoints (#80366 #55143 #55309 #50959 #19819)	2026-08-08 12:31:19 -07:00
turn_retry_state.py	feat(compression): native OpenAI Responses server-side compaction for gpt-5.6	2026-08-08 11:24:45 -07:00
turn_summary.py	…
usage_pricing.py	fix: close provider-anthropic MiniMax proxy bypass + rework cache observability	2026-08-12 13:58:26 +05:30
verification_evidence.py	Integrate verify subsystem with the existing verification stack	2026-08-07 10:11:05 -07:00
verification_stop.py	fix: make verify_on_stop opt-in everywhere (default False, not auto) (#84383)	2026-08-12 01:15:25 -07:00
verify_hooks.py	…
vertex_adapter.py	…
video_gen_provider.py	feat(media): opt-in upscale pass for image_generate and video_generate across FAL and Krea	2026-08-08 14:49:28 -07:00
video_gen_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00
web_search_provider.py	…
web_search_registry.py	fix(plugins): isolate ownership by profile	2026-08-12 19:13:32 -07:00