Teknium 5eeafc8d25 fix(security): cache OSV malware preflight verdicts and stop double component discovery (#75485) ... Two amplifiers behind the 779K api.osv.dev DNS queries/16h report: 1. tools/osv_check.py: check_package_for_malware() hit OSV on EVERY call. MCP reconnect ladders, stdio recycles, and parked-server self-probes re-run the preflight for the same package on every spawn attempt, so a flapping server became a sustained OSV query/DNS stream. Verdicts (clean or blocked) are now cached for 1h (OSV_CHECK_CACHE_TTL to tune); network failures stay uncached so fail-open never masks a real advisory once connectivity returns. 2. hermes_cli/security_audit.py: cmd_security_audit() ran full component discovery twice per audit (_count_components + run_audit). Discovery now runs once via _discover_components() and run_audit() accepts the pre-discovered list. Both regression tests fail against the previous code (verified via sabotage run).		2026-08-01 10:47:20 -07:00
..
dashboard_auth	…
observability	…
proxy	…
subcommands	…
web_routers	fix(api): enforce pagination bounds on session/message list routes	2026-07-31 22:35:49 -07:00
__init__.py	chore: release v0.19.1 (2026.7.30)	2026-07-30 16:45:08 -07:00
_early_recovery.py	…
_parser.py	…
_scan_venv_blockers.py	fix(desktop): use the canonical gateway matcher for the preflight exemption	2026-07-31 22:34:28 -07:00
_subprocess_compat.py	…
active_sessions.py	…
agent_import.py	…
approval_mode.py	…
approvals_suggest.py	…
auth.py	fix(auth): a transient read failure is not corruption	2026-07-31 22:34:52 -07:00
auth_commands.py	…
azure_detect.py	…
backup.py	…
bang_shell.py	feat(cli): ! shell mode — run a command without spending a model turn	2026-07-31 21:21:20 -07:00
banner.py	…
blueprint_cmd.py	…
browser_connect.py	…
build_info.py	…
bundles.py	…
callbacks.py	…
checkpoints.py	…
claw.py	…
cli_agent_setup_mixin.py	fix(update): make the git-path import check non-destructive	2026-08-01 16:09:27 +05:30
cli_billing_mixin.py	…
cli_commands_mixin.py	fix(cli): dispatch /indicator to set the busy-indicator style (#50618)	2026-07-31 22:33:16 -07:00
cli_output.py	…
clipboard.py	…
codex_models.py	…
codex_runtime_plugin_migration.py	…
codex_runtime_switch.py	…
colors.py	…
commands.py	fix(cli): dispatch /indicator to set the busy-indicator style (#50618)	2026-07-31 22:33:16 -07:00
completion.py	…
config.py	fix(terminal): honor explicit config keys over stale env	2026-08-01 15:03:42 +05:30
config_defaults.py	fix(caching): honor prompt_caching.cache_ttl disable in config	2026-08-01 14:14:15 +05:30
config_migrations.py	…
console_engine.py	fix(sessions): keep kanban worker runs out of the session lists	2026-07-31 13:53:04 -05:00
container_boot.py	…
context_switch_guard.py	…
copilot_auth.py	fix(copilot): add explicit UTF-8 encoding to JWT store read/write	2026-07-31 22:31:09 -07:00
credential_lifecycle.py	…
cron.py	…
curator.py	…
curses_ui.py	…
dashboard_procs.py	…
dashboard_register.py	…
debug.py	…
default_soul.py	…
dep_ensure.py	…
diagnostics_upload.py	…
dingtalk_auth.py	…
doctor.py	fix(cli): stabilize custom provider identities	2026-07-31 17:26:42 +05:30
dump.py	…
env_loader.py	…
fallback_cmd.py	…
fallback_config.py	fix(auth): resolve fallback api keys through secret_scope, not raw env	2026-07-31 22:35:26 -07:00
focus_view.py	…
gateway.py	fix(update): let callers pass the platform verdict to the venv helpers	2026-08-01 16:45:00 +05:30
gateway_enroll.py	…
gateway_windows.py	…
goals.py	…
gui_uninstall.py	…
hooks.py	…
init_command.py	…
input_sanitize.py	…
inventory.py	…
journey.py	…
kanban.py	…
kanban_db.py	fix(kanban): deliver notifications from non-dispatch gateways	2026-07-31 21:52:11 -07:00
kanban_decompose.py	…
kanban_diagnostics.py	…
kanban_specify.py	…
kanban_swarm.py	…
lifecycle.py	…
logs.py	…
main.py	fix(update): let callers pass the platform verdict to the venv helpers	2026-08-01 16:45:00 +05:30
managed_scope.py	…
managed_uv.py	fix(update): let callers pass the platform verdict to the venv helpers	2026-08-01 16:45:00 +05:30
mcp_catalog.py	…
mcp_config.py	…
mcp_picker.py	…
mcp_security.py	…
mcp_startup.py	fix(mcp): ensure MCP discovery completes before agent build in non-interactive sessions	2026-08-01 12:27:31 +05:30
memory_oauth.py	…
memory_setup.py	…
middleware.py	…
migrate.py	…
moa_cmd.py	…
moa_config.py	…
model_catalog.py	…
model_cost_guard.py	…
model_normalize.py	…
model_search.py	…
model_setup_flows.py	fix(cli): stabilize custom provider identities	2026-07-31 17:26:42 +05:30
model_switch.py	fix(gateway): offload /model context-length resolution off the event loop	2026-07-31 22:39:34 -07:00
models.py	fix(models): honor model.base_url in OpenAI discovery, cache identity, and listing authority	2026-07-31 21:31:56 -07:00
nous_account.py	…
nous_auth_keepalive.py	…
nous_billing.py	…
nous_subscription.py	…
npm_engine.py	fix(npm): self-upgrade a managed npm when engines.npm rejects it	2026-07-31 13:42:04 -04:00
onepassword_secrets_cli.py	…
oneshot.py	fix(mcp): ensure MCP discovery completes before agent build in non-interactive sessions	2026-08-01 12:27:31 +05:30
pairing.py	…
partial_compress.py	…
pets.py	…
platforms.py	…
plugins.py	…
plugins_cmd.py	…
portal_cli.py	…
profile_describer.py	…
profile_distribution.py	fix(distribution): path-aware allowlist; preserve legacy copy-everything when omitted	2026-07-31 22:39:34 -07:00
profiles.py	…
projects_cmd.py	…
projects_db.py	…
prompt_size.py	…
prompt_stash.py	feat(cli): complete the Ctrl+S prompt stash — keybinding, state machine, tests	2026-07-31 21:21:16 -07:00
provider_catalog.py	…
providers.py	refactor(providers): delegate is_official_openai_host to base_url_host_matches	2026-07-31 21:31:56 -07:00
proxy_cli.py	…
psutil_android.py	…
pt_input_extras.py	…
pty_bridge.py	…
pty_session.py	…
relaunch.py	…
route_identity.py	…
runtime_provider.py	fix(cli): heal a bare custom provider to its config key, not its display name	2026-07-31 22:36:15 -07:00
secret_prompt.py	…
secrets_cli.py	…
security_advisories.py	…
security_audit.py	fix(security): cache OSV malware preflight verdicts and stop double component discovery (#75485)	2026-08-01 10:47:20 -07:00
security_audit_startup.py	…
send_cmd.py	…
service_manager.py	…
session_export.py	…
session_export_html.py	…
session_export_md.py	…
session_filters.py	…
session_listing.py	fix(gateway): scope session lists before limiting	2026-07-31 22:36:55 -07:00
session_recap.py	…
session_recovery.py	…
sessions_cmd.py	…
setup.py	…
setup_hidden_env.py	…
setup_whatsapp_cloud.py	…
skills_config.py	…
skills_hub.py	…
skin_cmd.py	…
skin_engine.py	…
slack_cli.py	…
slash_exec.py	…
sqlite_runtime.py	…
sqlite_safe_read.py	fix(cli): untrack sqlite connections only after close succeeds	2026-07-31 23:18:12 -07:00
sqlite_util.py	…
status.py	…
stdio.py	…
suggestions_cmd.py	…
telegram_managed_bot.py	…
timeouts.py	…
tips.py	…
tools_config.py	Portal free user vision fix + flux3 polling improvements (#75448)	2026-07-31 10:17:55 -04:00
toolset_validation.py	…
uninstall.py	fix(install): expose hermes-agent and hermes-acp launchers on PATH	2026-07-31 22:39:11 -07:00
update_cmd.py	fix(update): discard staging litter when the commit phase fails	2026-08-01 17:25:08 +05:30
update_lock.py	fix(update): make the ancestor-PID lock handoff cross-platform via psutil	2026-07-31 22:28:46 -07:00
urllib_security.py	…
vercel_auth.py	…
voice.py	…
web_deps.py	…
web_git.py	…
web_models.py	…
web_server.py	Merge remote-tracking branch 'origin/main' into fix-73914-atomic-cancel	2026-07-31 03:35:08 -03:00
webhook.py	…
win_pty_bridge.py	…
windows_ssh_runtime.py	…
write_approval_commands.py	…
xai_retirement.py	…