teknium1 cfbc7ed1f9 fix(browser): narrow credential-query denylist to unambiguous names ... Follow-up on the salvaged #49830 hardening. The contributor's sensitive query-param set included bare English words (code, key, auth, session, sig) that double as ordinary page facets — ?code= on promo/challenge pages, ?key= as a search facet, ?session= on blogs — so web_extract and cloud browser_navigate would refuse a large slice of normal browsing. Narrow the set to unambiguously credential-named params (access_token, authorization, client_secret, password, token, x-amz-signature, ...). Prefix-based vendor-key redaction (is_safe_url) still catches recognizable key shapes; this set is the belt-and-suspenders for opaque secrets carried under an explicit credential-named parameter. Also fixes two intra-PR-staleness test breakages surfaced by salvaging onto current main: - web_extract_tool() no longer accepts use_llm_processing= (signature changed since the PR was authored) — dropped the invalid kwarg. - agent.redact now fully masks keyed 'token=<secret>' to 'token=***' instead of partial 'sk-...'; the console-redaction test now asserts the real invariant (secret body gone) rather than the exact mask format. Added a regression test that generic English-word query params are NOT blocked by the credential guard.		2026-07-01 05:04:41 -07:00
..
acp	fix(acp): also preserve archived rows on model-switch / restore saves	2026-07-01 17:16:51 +05:30
acp_adapter
agent	fix(subdirectory_hints): catch RuntimeError from Path.expanduser()	2026-07-01 04:55:15 -07:00
ci
cli	fix(cli): flush un-persisted messages before /resume and /branch end the old session	2026-07-01 17:08:55 +05:30
computer_use
cron	fix(cron): prevent multi-target delivery loop crash on per-target failure	2026-07-01 03:48:37 -07:00
docker	fix(s6): dot-prefix gateway staging dir so svscan ignores it mid-build (#54834)	2026-06-29 21:33:00 +10:00
e2e	fix(gateway): route SessionDB calls through AsyncSessionDB	2026-06-29 15:51:57 -07:00
fakes
fixtures/plugins/example-dashboard/dashboard
gateway	fix(gateway): pairing store cannot bypass configured allowlist	2026-07-01 04:56:25 -07:00
hermes_cli	fix(auth): widen portal_base_url allowlist guard to runtime credential path	2026-07-01 04:57:40 -07:00
hermes_state
honcho_plugin
integration	feat(web_extract): truncate-and-store instead of LLM summarization (#54843)	2026-06-29 10:00:49 -07:00
manual	docs(cron): scope in_channel to channels; document DM continuation knob	2026-07-01 03:16:13 -07:00
openviking_plugin
plugins	fix: protect cron output root from cleanup	2026-07-01 15:42:04 +05:30
providers
run_agent	fix(agent): apply persist override to the DB row only, never the live list (#48677)	2026-07-01 17:28:04 +05:30
scripts	revert(windows): roll back terminal-popup PRs #53791 #53810 #53829 (#53853)	2026-06-27 15:59:00 -07:00
skills
stress
tools	fix(browser): narrow credential-query denylist to unambiguous names	2026-07-01 05:04:41 -07:00
tui_gateway	fix(tui_gateway): drop emit-only session.info from _LONG_HANDLERS	2026-06-30 03:11:13 -07:00
website
__init__.py
conftest.py
run_interrupt_test.py
test_account_usage.py
test_assistant_ui_tap_compat.py
test_atomic_replace_symlinks.py
test_background_review_session_isolation.py	test(review): add integration guards for the two isolation wirings (review)	2026-07-01 16:21:39 +05:30
test_base_url_hostname.py
test_batch_runner_checkpoint.py
test_bitwarden_secrets.py
test_cli_file_drop.py
test_cli_manual_compress.py
test_cli_skin_integration.py
test_code_skew.py
test_ctx_halving_fix.py
test_dashboard_sidecar_close_on_disconnect.py
test_delegate_cascade_49148.py
test_desktop_electron_pin.py
test_desktop_mac_entitlements.py
test_dispatch_session_id.py
test_empty_model_fallback.py
test_empty_session_hygiene.py
test_env_loader_secret_sources.py
test_evidence_store.py
test_fast_safe_load.py	perf(startup): parse config + plugin manifests with libyaml CSafeLoader (#54486)	2026-06-28 15:38:39 -07:00
test_gateway_streaming_nested_config.py
test_get_tool_definitions_cache_isolation.py
test_hermes_bootstrap.py	revert(windows): roll back terminal-popup PRs #53791 #53810 #53829 (#53853)	2026-06-27 15:59:00 -07:00
test_hermes_constants.py	fix(windows): cover remaining console-flash spawn legs (#54417)	2026-06-28 13:49:08 -07:00
test_hermes_home_profile_warning.py
test_hermes_logging.py	fix(logging): suppress Windows lock timeout tracebacks	2026-06-28 22:35:56 -07:00
test_hermes_state.py	fix(state): order conversation replay by id, not timestamp	2026-07-01 15:52:37 +05:30
test_hermes_state_compression_locks.py
test_hermes_state_wal_fallback.py
test_honcho_client_concurrency.py
test_honcho_client_config.py
test_honcho_session_context.py
test_honcho_startup_fail_open.py
test_install_diverged_update.py	test(installer): cover diverged managed-clone recovery in install scripts	2026-06-30 20:11:01 +07:00
test_install_lockfile_churn.py
test_install_no_initial_commit.py
test_install_ps1_native_stderr_eap.py
test_install_ps1_python_fallback_venv.py
test_install_ps1_uv_powershell_host.py
test_install_sh_browser_install.py	test(install): track run_with_timeout extraction after #39219 refactor (#54185)	2026-06-28 03:58:01 -07:00
test_install_sh_install_method_stamp.py
test_install_sh_node_global_prefix.py
test_install_sh_pythonpath_sanitization.py
test_install_sh_root_fhs_uv_python_path.py
test_install_sh_setup_wizard_tty_probe.py
test_install_sh_symlink_stomp.py
test_install_sh_termux_network_prereqs.py
test_install_unmerged_index.py
test_ipv4_preference.py
test_lazy_session_regressions.py
test_lint_config.py
test_live_system_guard_self_test.py
test_mcp_serve.py	fix(mcp): stop EventBridge silently dropping sessions.json-only changes	2026-07-01 04:55:50 -07:00
test_mini_swe_runner.py
test_minimax_model_validation.py
test_minimax_oauth.py
test_minisweagent_path.py
test_model_forces_max_completion_tokens.py
test_model_picker_scroll.py
test_model_tools.py
test_model_tools_async_bridge.py
test_ollama_num_ctx.py	test(vision): cover Ollama /api/show vision capability routing (#54511)	2026-06-28 22:52:59 -07:00
test_output_cap_parsing.py	fix(context): parse vLLM's token-based output-cap error format	2026-07-01 03:17:48 -07:00
test_package_json_lazy_deps.py
test_packaging_metadata.py	security(deps): enforce aiohttp CVE floor on all lazy messaging paths + coverage guard	2026-07-01 02:51:45 -07:00
test_plugin_skills.py
test_plugin_utils.py
test_process_loop_event_loop_warning.py
test_profile_isolation_runtime.py	test(profile): two-profile regression suite + preserve skills_hub monkeypatch seam	2026-06-30 15:30:06 -07:00
test_project_metadata.py	fix(memory): lazy-install supermemory + mem0 SDKs like honcho/hindsight	2026-06-29 00:25:36 -07:00
test_retry_utils.py
test_run_tests_parallel.py	fix(tests): bare pytest flags pass through run_tests.sh without a '--' separator (#54008)	2026-06-27 22:43:26 -07:00
test_sanitize_tool_error.py
test_setup_temporary_outputs.py
test_slash_worker_watchdog.py
test_sql_injection.py
test_stale_utils_module_import.py
test_state_db_malformed_repair.py
test_subprocess_home_isolation.py
test_termux_all_extra_compat.py
test_timezone.py
test_toolset_distributions.py
test_toolsets.py
test_trajectory_compressor.py
test_trajectory_compressor_async.py
test_transform_llm_output_hook.py
test_transform_tool_result_hook.py
test_tui_gateway_loop_noise.py	fix(tui_gateway): suppress WS peer-hangup teardown error flood (#50005) (#54126)	2026-06-28 02:35:01 -07:00
test_tui_gateway_queue_on_busy.py
test_tui_gateway_server.py	fix(tui_gateway): reject negative truncate_before_user_ordinal to prevent silent history loss	2026-07-01 01:52:58 -07:00
test_tui_gateway_ws.py	fix(tui): start MCP discovery for websocket sessions	2026-06-28 04:14:12 -07:00
test_tui_mcp_late_refresh.py
test_utils_truthy_values.py
test_web_server.py	test(web_server): assert ws-ping invariant, not frozen 20.0 literal	2026-06-30 03:11:13 -07:00
test_wheel_locales_e2e.py
test_windows_subprocess_no_window_flags.py	test: make windows no-window-flag assertions immune to update-check daemon	2026-06-30 01:35:55 -05:00
test_yaml_indent_consistency_31999.py
test_yuanbao_integration.py
test_yuanbao_markdown.py
test_yuanbao_pipeline.py	fix(gateway): fail-closed external-surface defaults + profile-aware multiplex authz	2026-07-01 03:56:28 -07:00
test_yuanbao_proto.py
test_yuanbao_shutdown.py