Rodrigo Gomes da Silva 1bd3c72e17 fix: close connection on extension-sidecar provenance rejection ...

Same class as the auth/CSRF close-on-reject: the sidecar proxy's
same-origin provenance check runs before read_body(), so an HTTP/1.1
connection reused after a 403 would parse the unread body as the next
request line. Flag close_connection on this path too.

Found by Greptile review of #6658; covered by a new unit test.

2026-09-22 12:06:08 +00:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

agent_compat.py

fix: resolve Hermes Agent names moved by the Sep 2026 decomposition

2026-09-17 21:26:50 +00:00

agent_health.py

fix: fail closed on wrapped gateway pid helpers

2026-07-14 16:36:23 +08:00

agent_runtime.py

fix(agent_runtime): fail closed when Git identity disappears (#7407)

2026-09-15 22:14:09 -07:00

agent_sessions.py

fix: classify Signal gateway sessions as messaging (#7572)

2026-09-15 16:16:57 -07:00

auth_oidc.py

fix(auth): name both config forms in the allowlist warning (#6603)

2026-07-31 20:27:32 -04:00

auth.py

fix: keep server.py under the 750-line guard after auth-reject close

2026-09-22 12:06:08 +00:00

background_process.py

fix(async): close pre-ACTIVE_RUNS stream window, never strand wakeup admission (#6989)

2026-09-20 10:36:36 +00:00

background.py

feat(commands): /background, /btw slash commands + undo button + reasoning chip

2026-04-24 01:24:51 +00:00

clarify.py

fix(clarify): honor agent.clarify_timeout and support unlimited wait (#7163)

2026-08-20 09:28:23 +00:00

commands.py

fix: resolve Hermes Agent names moved by the Sep 2026 decomposition

2026-09-17 21:26:50 +00:00

compression_anchor.py

Address compaction marker and redaction review

2026-06-26 00:12:09 +00:00

compression_continuation.py

fix: resume local interactive compression lineages

2026-09-20 22:18:32 +00:00

compression_recovery.py

Live Stream: add compression recovery action

2026-07-04 21:42:32 +08:00

config.py

fix(config): drop synthetic `{provider}/{model}` alias from configured-model badges (#7290)

2026-09-22 10:10:10 +00:00

crash_visibility.py

fix: keep SIGUSR1 stack dumps non-terminating

2026-07-29 17:41:46 +00:00

dashboard_probe.py

fix: preserve IPv6 dashboard link brackets

2026-05-19 21:35:10 -04:00

extension_sidecar_auth.py

feat(extensions): token-v1 proxy→sidecar authentication boundary (#6331)

2026-07-20 17:49:23 +00:00

extensions.py

Keep static-serving path validator strict; scope dotfile allowance to archive members

2026-08-18 19:23:41 +00:00

gateway_chat.py

Fix gateway approval settlement lifecycle

2026-09-22 06:29:27 +00:00

gateway_restart.py

fix: harden gateway restart recovery targeting

2026-07-14 16:01:56 +08:00

gateway_watcher.py

fix(gateway_watcher): park idle poll loop when no SSE subscribers

2026-09-22 05:38:49 +00:00

goals.py

Batch release exp-v0.52.237 — profile goal isolation (#6899) + hermes-webui entry point (#6742) (#7108)

2026-08-17 10:45:59 +00:00

helpers.py

Merge PR #7641: fix(redaction): validate MPF JPEG attachments before the native-image exemption

2026-09-20 02:25:35 +00:00

kanban_bridge.py

fix: resolve Hermes Agent names moved by the Sep 2026 decomposition

2026-09-17 21:26:50 +00:00

media_snapshots.py

# Session MEDIA auth and snapshot capture inspect Codex commentary sidecars (#7565)

2026-09-20 08:49:36 +00:00

metering.py

feat(#6006): instrument send-to-first-token latency

2026-07-13 17:56:44 -04:00

models.py

Merge PR #7630: fix(projects): tag scan-minted system projects to the scanned profile

2026-09-20 03:14:22 +00:00

oauth.py

fix: resolve Hermes Agent names moved by the Sep 2026 decomposition

2026-09-17 21:26:50 +00:00

office_documents.py

#5142: office-doc preview + safe docx editing (#540), rebased on master; optional deps

2026-07-02 01:15:57 +00:00

onboarding.py

fix(onboarding): use OpenRouter namespace z-ai/ for Z.AI models (#7514)

2026-09-10 22:30:44 -03:00

passkeys.py

gate fixes: opt-in pipe separator (#7331) + IPv6-safe Origin (#6772)

2026-09-08 01:53:01 +00:00

paths.py

fix(config): restore read-only-target protection for atomic writes

2026-07-18 20:32:56 +02:00

plugin_providers.py

Release v0.51.270 — Release IL (stage-u1 — un-hold batch: #3517 #3624 #3613) (#3674)

2026-06-05 11:35:26 -07:00

plugins.py

fix(#2622): plugin card UX — legible Open button, single badge, visible toggle + reject protocol-relative tab.path

2026-06-02 03:58:02 +00:00

process_event_utils.py

Settle verification turns from exact turn ownership

2026-07-29 18:36:24 +00:00

profiles.py

fix(workspace): preserve remote POSIX paths across Session & streaming callsites (#7131) (#7168)

2026-09-15 15:37:11 -07:00

providers.py

fix(providers): reduce pool-exhaustion TTL for HTTP 402 from 1h to 2min (#6626)

2026-08-13 20:15:30 -07:00

request_diagnostics.py

perf(webui/session-load-latency) tier4: fix CI failures — lint B009/B905 + _emit_slow format args

2026-07-09 04:22:21 +00:00

request_logging.py

fix: preserve access logs during agent stdout capture (#2684)

2026-09-19 07:26:12 -04:00

rollback.py

Release — suppress Windows git console windows (#6534) (#7115)

2026-08-18 04:25:26 +00:00

route_approvals.py

Fix gateway approval settlement lifecycle

2026-09-22 06:29:27 +00:00

route_session_list_cache.py

fix: harden bounded sidebar cache projection (#7489)

2026-09-09 23:36:41 +00:00

routes.py

fix: close connection on extension-sidecar provenance rejection

2026-09-22 12:06:08 +00:00

run_journal.py

docs(run-journal): specify live-only metering and optional writes (#7272)

2026-09-21 23:03:24 +08:00

runner_client.py

fix(gateway): correct approval URL and thread session history into runs API (#4479)

2026-06-19 13:16:39 -04:00

runtime_adapter.py

Stage 398: PR #2696 — feat(runtime): add runner-local adapter selection (RuntimeAdapter slice 4c, feature-flagged)

2026-05-21 17:43:54 +00:00

session_discoverability.py

fix: close leaked state.db read-only connections in session discoverability/recovery

2026-08-07 21:34:34 +00:00

session_events.py

feat(sessions): carry changed session_id in session-list-changed events (#4221) (#4233)

2026-06-15 00:10:01 -07:00

session_export_html.py

#4968: export chat to self-contained themed HTML, rebased on master

2026-07-02 02:36:09 +00:00

session_lifecycle.py

fix(#5543): fire-and-forget commit_session_memory + drain-safe managed stop

2026-07-04 21:40:21 +00:00

session_ops.py

fix(regeneration): refuse bounded tail on in-tail duplicate keys + real WAL interleaving test (#6826 r5)

2026-08-26 00:24:07 +00:00

session_recovery.py

Release: preserve intentional transcript shrinks (#6954) (#6997)

2026-08-13 20:44:06 +00:00

shares.py

fix(share): harden _embed_share_media with path allow-list + mime validation (#6174)

2026-07-23 01:21:59 +00:00

skill_usage.py

fix: remove webui-side writer to avoid conflict with agent

2026-05-27 20:57:32 +08:00

sse_chunked.py

stage #4447: opt-in chunked SSE for buffering proxies (#4447) + v0.51.524 CHANGELOG

2026-06-19 22:09:17 +00:00

startup.py

fix: P0 hotfixes — API regression, code block parser, chmod override

2026-05-01 12:10:48 +00:00

state_sync.py

fix(state-sync): repoint to renamed agent SessionDB API + fix agent-coupled tests

2026-09-07 23:34:45 +00:00

streaming.py

fix(streaming): tolerate null tool call history

2026-09-22 07:13:40 +00:00

subprocess_utils.py

Release — suppress Windows git console windows (#6534) (#7115)

2026-08-18 04:25:26 +00:00

system_health.py

Release: provider-filter + memory diagnostics (#6338 #6363) (#6994)

2026-08-13 17:47:46 +00:00

terminal.py

fix(terminal): close the reaper's selection→reconnect→close TOCTOU

2026-07-25 00:33:41 +02:00

todo_state.py

Release v0.51.261 — Release IC (stage-r11) (#3616)

2026-06-04 16:46:20 -07:00

turn_journal.py

Release v0.51.326 — Release KP (#3618 + #3802 + #3762 + #3810) (#3816)

2026-06-07 23:18:51 -07:00

updates.py

fix(updates): harden Windows restart isolation (#7195)

2026-08-24 10:19:53 -04:00

upload.py

fix(workspace): preserve remote POSIX paths across Session & streaming callsites (#7131) (#7168)

2026-09-15 15:37:11 -07:00

usage.py

fix: display canonical cache hit percentage

2026-05-19 02:27:12 -06:00

webui_session_db.py

fix: preserve compression recovery child markers in sidecar rebuild

2026-07-05 06:45:50 +08:00

workspace_git.py

Release — suppress Windows git console windows (#6534) (#7115)

2026-08-18 04:25:26 +00:00

workspace.py

fix(webui): scope profile-home resolve cache to one session-list build

2026-09-19 00:20:05 +01:00

worktrees.py

Release — suppress Windows git console windows (#6534) (#7115)

2026-08-18 04:25:26 +00:00