hermes-agent/tests/tools
kshitij 6fa646e7d8 fix(skills): reject colon in bundle path components (NTFS ADS bypass)
_normalize_bundle_path rejected absolute paths, .. traversal, and a bare
drive-letter prefix, but permitted a colon inside a later path component.
On NTFS a bundle member named scripts/helper.py:payload writes a hidden
Alternate Data Stream into the visible file scripts/helper.py. The skill
scanner walks with rglob('*'), which does not enumerate streams, so both
operator review and the guard scanner miss the executable bytes.

Reject a colon in any component (the whole class, not just the trailing
one). This subsumes the previous bare drive-letter check, which is folded
into the single colon guard. '/' is the only legal separator once
normalized, so no portable bundle path needs a colon.

Adds an OS-independent quarantine_bundle regression plus a direct
normalizer unit test covering leading/mid/trailing-component colons,
bare/qualified drive letters, and the empty stream name.

Reported-by: JoaoMarcos44 <87440198+JoaoMarcos44@users.noreply.github.com>
2026-08-10 10:36:59 +05:30
..
__init__.py
conftest.py
test_accretion_caps.py
test_ansi_strip.py
test_approval.py
test_approval_config_readonly.py
test_approval_deny_rules.py
test_approval_interrupt.py
test_approval_mode_parity.py
test_approval_plugin_hooks.py
test_approved_command_clean_slate.py
test_async_delegation.py
test_async_delegation_fd_leak.py
test_audio_container.py
test_base_environment.py
test_blocked_command_guidance.py
test_blueprints.py
test_browser_camofox.py
test_browser_camofox_auth.py
test_browser_camofox_ensure_tab.py
test_browser_camofox_persistence.py
test_browser_camofox_private_page_guard.py
test_browser_camofox_state.py
test_browser_camofox_timeout.py
test_browser_cdp_override.py
test_browser_cdp_tool.py
test_browser_chromium_autoinstall.py
test_browser_chromium_check.py
test_browser_cleanup.py
test_browser_cloud_fallback.py
test_browser_cloud_provider_cache.py
test_browser_command_timeout_race.py
test_browser_console.py
test_browser_console_ssrf.py
test_browser_content_none_guard.py
test_browser_eval_ssrf.py
test_browser_eval_supervisor_path.py
test_browser_get_images_ssrf.py
test_browser_hardening.py
test_browser_headed_mode.py
test_browser_homebrew_paths.py
test_browser_hybrid_routing.py
test_browser_lightpanda.py
test_browser_open_timeout.py
test_browser_orphan_reaper.py
test_browser_private_page_action_guard.py
test_browser_secret_exfil.py
test_browser_snapshot_ssrf.py
test_browser_ssrf_local.py
test_browser_supervisor.py
test_browser_supervisor_healthcheck.py
test_browser_type_redaction.py
test_browser_use_session_expiry.py
test_budget_config.py
test_build_subprocess_env.py
test_checkpoint_manager.py
test_clarify_gateway.py
test_clarify_tool.py
test_clipboard.py test: convert the last host-OS fakes and guard double markers 2026-08-09 22:09:49 -04:00
test_code_execution.py test(tools): cover UTF-8 BOM input in json_parse sandbox helper 2026-08-08 12:32:23 -07:00
test_code_execution_modes.py
test_code_execution_windows_env.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_command_guards.py
test_computer_use.py
test_computer_use_approval_isolation.py
test_computer_use_capture_routing.py
test_computer_use_cua_0_9.py
test_computer_use_cua_0_10_permissions.py
test_computer_use_cua_backend_linux.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_computer_use_delivery_ladder.py
test_computer_use_null_pid_windows.py
test_computer_use_vision_routing.py
test_config_null_guard.py
test_container_cwd_sanitize.py
test_credential_files.py fix(docker): close the cold-container and multi-backend gaps in attachment delivery 2026-08-08 05:44:18 -07:00
test_credential_pool_env_fallback.py
test_cron_approval_mode.py
test_cron_prompt_injection.py
test_cronjob_run_background.py fix(cron): deliver manual runs on gateway loop 2026-08-06 23:14:55 -07:00
test_cronjob_run_immediate.py fix(cron): thread per-run prompt through cronjob(action='run') (#57331) 2026-08-06 23:14:55 -07:00
test_cronjob_tools.py
test_cross_profile_guard.py
test_daemon_pool.py
test_daytona_environment.py
test_debug_helpers.py
test_delegate.py feat(delegation): validate batch task quality before spawning children 2026-08-07 08:57:57 -07:00
test_delegate_apiserver_background.py
test_delegate_batch_validation.py fix: post-merge audit follow-ups for #81138/#81139/#81141/#81148 2026-08-08 05:21:09 -07:00
test_delegate_composite_toolsets.py
test_delegate_cost_footer.py feat(delegation): surface per-delegation cost in the result entry 2026-08-07 08:58:02 -07:00
test_delegate_kanban_isolation.py
test_delegate_output_schema.py test: use valid 2-task batches in schema-rejection tests 2026-08-07 09:07:42 -07:00
test_delegate_subagent_timeout_diagnostic.py
test_delegate_summary_budget.py
test_delegate_toolset_scope.py
test_delegation_live_log.py
test_denial_circuit_breaker.py
test_desktop_ui.py
test_discord_send_message_caption.py
test_discord_tool.py
test_docker_cgroup_limits.py
test_docker_config_migrate.py
test_docker_daemon_redirect.py
test_docker_environment.py
test_docker_find.py
test_docker_network_config.py
test_docker_orphan_reaper_integration.py
test_docker_rebootstrap_nous_session.py
test_docker_session_isolation.py fix(docker): per-session container isolation and session-scoped workspace mounts 2026-08-09 14:35:02 -07:00
test_dockerfile_immutable_install.py
test_dockerfile_node_modules_perms.py
test_dockerfile_pid1_reaping.py
test_ensure_task_env.py fix(tools): lazily bring up sandbox for vision_analyze reads 2026-08-07 09:11:48 -07:00
test_env_passthrough.py
test_env_probe.py
test_execute_code_approval_cluster.py
test_execution_flag_detection.py
test_fal_common.py
test_feishu_tools.py
test_file_operations.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_file_operations_edge_cases.py
test_file_ops_cwd_tracking.py
test_file_read_guards.py
test_file_staleness.py
test_file_state_registry.py
test_file_sync.py
test_file_sync_back.py
test_file_sync_perf.py
test_file_sync_sigint.py
test_file_tools.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_file_tools_container_config.py
test_file_tools_cwd_resolution.py
test_file_tools_live.py
test_file_tools_tilde_profile.py
test_file_write_safety.py feat(security): protected agent-instruction files always require write approval 2026-08-07 08:58:38 -07:00
test_file_write_surrogate_roundtrip.py test(file_operations): pin early surrogate rejection over the backstop (#79178) 2026-08-08 12:31:19 -07:00
test_find_shell.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_flux3_video_tool.py
test_focus_pane_tool.py fix(agent): the desktop's tools reach it on remote and cloud backends too 2026-08-06 19:35:47 -06:00
test_force_dangerous_override.py
test_fuzzy_match.py
test_gateway_cwd_contract.py
test_generation_source_confinement.py fix(image_gen): confine generation source images to the terminal backend 2026-08-08 04:19:38 -07:00
test_gnu_long_option_abbreviation_bypass.py
test_hardline_blocklist.py
test_heartbeat_stale_thresholds.py
test_hermes_subprocess_env.py
test_hidden_dir_filter.py
test_homeassistant_tool.py
test_hook_output_spill.py
test_hub_lock_non_utf8_68053.py
test_image_generation.py Add more FAL models to nous portal (#82019) 2026-08-08 19:59:12 -04:00
test_image_generation_artifacts.py
test_image_generation_env.py
test_image_generation_image_to_image.py feat(media): default-on upscaling for sub-2MP image models (FAL + Krea) 2026-08-08 14:49:28 -07:00
test_image_generation_plugin_dispatch.py
test_image_source.py fix(vision): retry container exec-read for Docker cold-start, surface stderr (#76566) 2026-08-08 03:59:42 -07:00
test_init_session_cwd_respect.py
test_interrupt.py
test_kanban_comment_injection.py
test_kanban_redaction.py
test_kanban_tools.py
test_lazy_deps.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_lazy_deps_durable_target.py fix(tools): preserve document extraction boundaries 2026-08-08 05:13:46 -07:00
test_lazy_deps_managed.py
test_line_ending_preservation.py
test_llm_content_none_guard.py
test_local_background_child_hang.py
test_local_cwd_permission_fallback.py
test_local_env_blocklist.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_local_env_cwd_recovery.py
test_local_env_relative_cwd.py
test_local_env_session_leak.py
test_local_env_windows_msys.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_local_interrupt_cleanup.py
test_local_shell_init.py
test_local_tempdir.py
test_managed_browserbase_and_modal.py test: stub EnvironmentConnectionError in environments.base module stub 2026-08-07 09:07:55 -07:00
test_managed_media_gateways.py
test_managed_modal_environment.py
test_managed_tool_gateway.py
test_mcp_bridge_single_failure.py
test_mcp_cancelled_error_propagation.py
test_mcp_capability_gating.py
test_mcp_circuit_breaker.py
test_mcp_client_cert.py
test_mcp_config_whitespace_warning.py
test_mcp_dashboard_oauth.py
test_mcp_discovery_cross_process.py
test_mcp_dynamic_discovery.py
test_mcp_elicitation.py
test_mcp_empty_error_message.py
test_mcp_failure_classification.py fix(mcp): let a server that 401s at startup come back after re-login 2026-08-08 02:21:36 -05:00
test_mcp_identity_header.py feat(kanban,mcp): orphaned-card reconciliation + per-server MCP identity header 2026-08-07 08:58:20 -07:00
test_mcp_image_content.py
test_mcp_initial_connect_shutdown.py fix(mcp): let a server that 401s at startup come back after re-login 2026-08-08 02:21:36 -05:00
test_mcp_invalid_url.py
test_mcp_lazy_start.py
test_mcp_list_pagination.py
test_mcp_loop_profile_override.py
test_mcp_oauth.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_mcp_oauth_bidirectional.py
test_mcp_oauth_cold_load_expiry.py
test_mcp_oauth_integration.py
test_mcp_oauth_manager.py
test_mcp_oauth_metadata.py
test_mcp_parked_self_probe.py
test_mcp_poll_loop_oom_integration.py
test_mcp_preflight_content_type.py
test_mcp_probe.py
test_mcp_rapid_drop_budget.py
test_mcp_reconnect_log_hygiene.py
test_mcp_reconnect_retry_reset.py
test_mcp_reconnect_signal.py
test_mcp_register_wakes_stale.py
test_mcp_resource_content.py
test_mcp_schema_cache.py
test_mcp_server_log_notifications.py
test_mcp_sse_transport.py
test_mcp_stability.py
test_mcp_stdio_encoding_handler.py
test_mcp_stdio_init_timeout.py
test_mcp_stdio_watchdog.py
test_mcp_structured_content.py
test_mcp_tool.py feat(plugins): map portable Agent Plugins streamable-http entries into the native MCP runtime 2026-08-08 23:56:46 -07:00
test_mcp_tool_401_handling.py
test_mcp_tool_issue_948.py
test_mcp_tool_session_expired.py
test_mcp_transport_group_reconnect.py
test_mcp_trust_gating.py feat(mcp): trust-tier gating for write-capable MCP tools via readOnlyHint 2026-08-07 08:58:32 -07:00
test_mcp_utility_capability_gating.py
test_media_caption_split.py
test_memory_tool.py fix: finish the missing-encoding sweep — BOM-tolerant reads for user-edited stores 2026-08-08 12:32:23 -07:00
test_memory_tool_import_fallback.py
test_memory_tool_schema.py
test_microsoft_graph_auth.py
test_microsoft_graph_client.py
test_modal_bulk_upload.py
test_modal_sandbox_fixes.py
test_modal_snapshot_isolation.py
test_notify_on_complete.py
test_open_preview_tool.py fix(agent): the desktop's tools reach it on remote and cloud backends too 2026-08-06 19:35:47 -06:00
test_osv_check.py
test_parse_env_var.py
test_patch_already_applied.py
test_patch_failure_tracking.py
test_patch_multimatch_locations.py
test_patch_parser.py
test_patch_ws_diagnosis.py
test_pr_6656_regressions.py
test_process_registry.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_process_registry_write_stdin_surrogates.py fix(process_registry): surrogateescape-safe PTY stdin writes (#79178) 2026-08-08 12:31:19 -07:00
test_process_wait_clarity.py
test_read_extract.py feat(read_extract): label each unreadable PDF gap with its preceding section text 2026-08-08 05:51:33 -07:00
test_read_file_utf8_binary_regression.py test(file-ops): end-to-end regression suite for the UTF-8-flagged-as-binary class 2026-08-08 12:34:06 -07:00
test_read_loop_detection.py
test_read_preview_tool.py fix(agent): the desktop's tools reach it on remote and cloud backends too 2026-08-06 19:35:47 -06:00
test_read_window_tool.py feat(agent): read_window_below tool — which OS window is underneath the desktop app 2026-08-08 12:17:50 -05:00
test_refresh_agent_mcp_tools.py
test_registry.py fix(tools): bound the exception text dispatch writes into its own log line 2026-08-08 14:56:38 +05:30
test_request_tool_approval.py
test_resolve_path.py
test_restored_delegation_ownership.py
test_sandbox_failure_hints.py
test_schema_sanitizer.py feat(mcp): collapse const-only anyOf/oneOf unions to property enums 2026-08-07 08:58:25 -07:00
test_search_auto_multiline.py
test_search_budget_truncation.py
test_search_error_guard.py
test_search_hidden_dirs.py test(search): update grep command mirrors to -rnHE for fidelity with production 2026-08-06 05:31:17 +05:30
test_search_zero_match_and_multipath.py
test_self_repo_guard.py fix(tools): keep non-bash -c invocations covered by the shell guard 2026-08-08 14:56:38 +05:30
test_send_message_missing_platforms.py
test_send_message_react.py
test_send_message_slack.py
test_send_message_target_parse.py
test_send_message_telegram_proxy.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_send_message_tool.py
test_session_cwd_store.py
test_session_search.py
test_shared_container_task_id.py
test_shell_bypass_denylist.py
test_signal_media.py
test_singularity_preflight.py
test_skill_bundle_provenance.py
test_skill_env_passthrough.py
test_skill_improvements.py
test_skill_linter.py feat(skills): advisory SKILL.md convention linter on create 2026-08-08 11:12:27 -07:00
test_skill_manager_tool.py
test_skill_provenance.py
test_skill_size_limits.py
test_skill_usage.py
test_skill_view_dedup.py
test_skill_view_path_check.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_skill_view_traversal.py
test_skills_ast_audit.py
test_skills_guard.py
test_skills_hub.py fix(skills): reject colon in bundle path components (NTFS ADS bypass) 2026-08-10 10:36:59 +05:30
test_skills_hub_browse_sh.py
test_skills_hub_clawhub.py
test_skills_list_modified_diff.py
test_skills_sync.py
test_skills_sync_client.py
test_skills_tool.py
test_skills_tool_discovery_cache.py
test_skills_tool_profile_scope.py
test_slack_send_message_media.py
test_slash_confirm.py
test_smart_approval_injection.py
test_smart_approval_policy.py
test_snapshot_multiline_session_env_injection.py
test_snapshot_session_id_leak.py
test_spotify_client.py
test_ssh_bulk_upload.py
test_ssh_environment.py
test_stage2_hook_seed_one_symlinks.py
test_stage2_hook_symlink_chown.py
test_stt_cloud_trim.py refactor(stt): fold review findings into the cloud silence trim 2026-08-07 19:26:04 +05:30
test_stt_default_language.py
test_stt_idle_unload.py fix(stt): close idle-unload races — strong model ref, single long-lived watcher 2026-08-07 19:26:12 +05:30
test_stt_language_resolution.py
test_stt_silence_hallucinations.py
test_subagent_steer.py fix(delegation): bind steering to session generation 2026-08-06 09:40:27 -07:00
test_subprocess_stdin_guard.py
test_subprocess_utf8_encoding.py
test_symlink_prefix_confusion.py
test_sync_back_backends.py
test_telegram_send_message_caption.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_terminal_compound_background.py
test_terminal_config_env_sync.py
test_terminal_cwd_echo.py
test_terminal_degraded_mode.py feat(terminal): graceful degradation for remote backend connection failures 2026-08-07 09:07:55 -07:00
test_terminal_env_bridge.py fix(terminal): preserve SSH remote home cwd 2026-08-07 18:41:57 -06:00
test_terminal_error_redaction.py fix(terminal-tool): redact terminal error result fields 2026-08-08 04:28:19 -07:00
test_terminal_exit_semantics.py
test_terminal_foreground_timeout_cap.py
test_terminal_hints.py
test_terminal_none_command_guard.py
test_terminal_output_transform_hook.py
test_terminal_requirements.py
test_terminal_self_repo_guard.py fix(tools): harden live source checkout guard 2026-08-08 14:56:38 +05:30
test_terminal_task_cwd.py
test_terminal_timeout_output.py
test_terminal_tool.py
test_terminal_tool_exception_redaction.py fix(security): redact terminal exception results and ACP stderr logs (#77484) 2026-08-08 04:19:49 -07:00
test_terminal_tool_pty_fallback.py
test_terminal_tool_requirements.py
test_terminal_truncation_spill.py
test_termux_api_detection.py
test_threaded_process_handle.py
test_threat_patterns.py
test_tirith_security.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_todo_tool.py
test_todo_tool_type_coercion.py
test_tool_backend_helpers.py
test_tool_output_limits.py
test_tool_result_storage.py
test_tool_search.py
test_tool_search_context_provider.py
test_transcription.py
test_transcription_command_providers.py
test_transcription_deepinfra.py
test_transcription_dotenv_fallback.py
test_transcription_plugin_dispatch.py
test_transcription_tools.py
test_tts_command_providers.py
test_tts_container_repair.py
test_tts_deepinfra.py
test_tts_dotenv_fallback.py
test_tts_gemini.py
test_tts_instructions.py
test_tts_kittentts.py
test_tts_long_form_chunking.py fix(tts): split long speech by provider and platform limits 2026-08-08 22:54:20 +05:30
test_tts_macos_output.py test: convert the last host-OS fakes and guard double markers 2026-08-09 22:09:49 -04:00
test_tts_max_text_length.py fix(tts): split long speech by provider and platform limits 2026-08-08 22:54:20 +05:30
test_tts_minimax_region.py
test_tts_mistral.py
test_tts_model_cache_lru.py
test_tts_openai_config.py
test_tts_opus_routing.py
test_tts_output_timestamp.py
test_tts_path_traversal.py
test_tts_piper.py
test_tts_plugin_dispatch.py
test_tts_prepare_spoken.py
test_tts_provider_base_urls.py
test_tts_pythonpath_fallback.py
test_tts_response_body_cap.py
test_tts_speed.py
test_tts_streaming.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_tts_streaming_e2e.py
test_tts_text_normalize.py
test_tts_xai_speech_tags.py
test_url_safety.py
test_vercel_sandbox_environment.py
test_video_analyze.py fix(video): route terminal-backend reads through the shared media resolver 2026-08-08 03:59:39 -07:00
test_video_generation_dispatch.py feat(media): opt-in upscale pass for image_generate and video_generate across FAL and Krea 2026-08-08 14:49:28 -07:00
test_video_generation_dynamic_schema.py Add more FAL models to nous portal (#82019) 2026-08-08 19:59:12 -04:00
test_video_generation_tool_surface_matrix.py Add more FAL models to nous portal (#82019) 2026-08-08 19:59:12 -04:00
test_vision_native_fast_path.py
test_vision_region.py feat(vision): optional region zoom crop on vision_analyze 2026-08-07 08:58:49 -07:00
test_vision_tools.py feat(vision): optional region zoom crop on vision_analyze 2026-08-07 08:58:49 -07:00
test_voice_cli_integration.py fix(tts): split long speech by provider and platform limits 2026-08-08 22:54:20 +05:30
test_voice_credential_pool_resolution.py
test_voice_mode.py test: convert the last host-OS fakes and guard double markers 2026-08-09 22:09:49 -04:00
test_voice_mode_playback_env_scrub.py
test_voice_stop_phrase.py
test_voice_thinking_sound.py
test_voice_tts_echo_guard.py fix(voice): require minimum evidence for fragment echo matching, use char windows 2026-08-07 14:38:02 +05:30
test_voice_wsl_pipewire.py
test_wake_word.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_watch_patterns.py
test_web_extract_robustness.py
test_web_providers.py
test_web_providers_brave_free.py
test_web_providers_ddgs.py
test_web_providers_searxng.py
test_web_providers_xai.py
test_web_tools_config.py
test_web_tools_dict_urls.py
test_web_tools_tavily.py
test_web_tools_truncate.py fix(tests): read and write test files as UTF-8 so the suite runs on Windows 2026-08-08 12:33:19 -07:00
test_website_policy.py
test_whatsapp_send_message_media.py
test_windows_compat.py fix: relax start_new_session assertion for systemd scope path 2026-08-08 01:12:16 +05:30
test_windows_native_support.py test: run os-specific tests on their real host, not a faked one 2026-08-09 22:09:49 -04:00
test_working_diff.py fix(tools): decode git output as UTF-8 in working_diff on Windows 2026-08-08 12:34:46 -07:00
test_write_approval.py
test_write_deny.py
test_write_file_syntax_gate.py
test_write_verification.py
test_x_search_tool.py
test_xai_http_credentials.py
test_xai_http_storage.py
test_yolo_mode.py
test_zombie_process_cleanup.py