Austin Pickett 290acdb59c fix(auth): address PR review comments for Google Workspace OAuth ...

- Secure token file permissions (0o600) in dashboard callback handler
- Validate refresh_token presence after code exchange
- HTML-escape all dynamic values in callback pages (XSS prevention)
- Raise error when only placeholder credentials are available
- Fix docstring to match actual behavior (no standalone fallback)
- Validate OAuth state parameter in headless mode
- Reduce client_id log exposure to 8 chars
- Use configurable port for dashboard redirect URI (app.state.bound_port)
- Read HERMES_DASHBOARD_PORT env var instead of hardcoding 9119

2026-05-08 13:35:41 -04:00

..

transports

feat: provider modules — ProviderProfile ABC, 33 providers, fetch_models, transport single-path

2026-05-05 13:40:01 -07:00

__init__.py

…

account_usage.py

feat(account-usage): add per-provider account limits module

2026-04-21 01:56:35 -07:00

anthropic_adapter.py

fix: avoid unsupported anthropic context beta by default

2026-05-07 05:43:20 -07:00

auxiliary_client.py

refactor(gmi): move User-Agent to profile.default_headers

2026-05-08 03:22:11 -07:00

bedrock_adapter.py

fix(bedrock): preserve reasoningContent across converse normalization

2026-05-07 05:17:16 -07:00

codex_responses_adapter.py

fix(agent): preserve Codex message items for replay

2026-04-25 18:22:06 -07:00

context_compressor.py

fix(compressor): soften summary prompt for content filters

2026-05-07 06:42:32 -07:00

context_engine.py

fix(compress): don't reach into ContextCompressor privates from /compress (#15039)

2026-04-24 02:55:43 -07:00

context_references.py

fix(agent): fall back when rg is blocked for @folder references

2026-04-20 01:56:41 -07:00

copilot_acp_client.py

fix(oauth,gateway): monotonic deadlines for polling/timeout loops

2026-05-07 05:09:39 -07:00

credential_pool.py

fix(auth): shorten credential 401 cooldown

2026-05-07 06:15:33 -07:00

credential_sources.py

feat(minimax-oauth): full integration with peer OAuth providers

2026-04-29 09:53:42 -07:00

curator_backup.py

fix(curator): authoritative absorbed_into on delete + restore cron skill links on rollback (#18671) (#18731)

2026-05-02 01:29:57 -07:00

curator.py

fix(curator): prevent false-positive consolidation from substring matching

2026-05-04 01:21:23 -07:00

display.py

fix(cli): honor positive tool preview length

2026-05-07 05:26:28 -07:00

error_classifier.py

fix(tool-schemas): reactive strip of pattern/format on llama.cpp grammar 400s

2026-05-05 04:25:18 -07:00

file_safety.py

fix(security): apply file safety to copilot acp fs

2026-04-21 01:31:58 -07:00

gemini_cloudcode_adapter.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

gemini_native_adapter.py

fix(gemini): extract usageMetadata from streaming chunks for token tracking

2026-05-04 02:33:30 -07:00

gemini_schema.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

google_code_assist.py

chore: remove unused imports and dead locals (ruff F401, F841) (#17010)

2026-04-28 06:46:45 -07:00

google_oauth.py

fix(google_oauth): close TOCTOU window when saving credentials

2026-05-04 03:16:19 -07:00

google_workspace_oauth.py

fix(auth): address PR review comments for Google Workspace OAuth

2026-05-08 13:35:41 -04:00

i18n.py

feat(i18n): add Turkish (tr) locale

2026-05-05 17:29:12 -07:00

image_gen_provider.py

feat(plugins): pluggable image_gen backends + OpenAI provider (#13799)

2026-04-21 21:30:10 -07:00

image_gen_registry.py

feat(plugins): pluggable image_gen backends + OpenAI provider (#13799)

2026-04-21 21:30:10 -07:00

image_routing.py

fix(image-routing): sniff magic bytes for image MIME, ignore misleading suffix

2026-05-07 05:58:11 -07:00

insights.py

Merge branch 'main' into feat/dashboard-skill-analytics

2026-04-20 05:25:49 -07:00

lmstudio_reasoning.py

feat(agent): add lmstudio integration

2026-04-28 12:27:36 -07:00

manual_compression_feedback.py

fix(compression): include system prompt + tool schemas in token estimates (#18265)

2026-04-30 23:03:54 -07:00

memory_manager.py

fix: salvage batch — compaction guidance, memory authority, cache eviction after compression

2026-05-05 22:33:45 -07:00

memory_provider.py

docs(agent): remove stale BuiltinMemoryProvider references from memory module docstrings

2026-05-05 13:33:49 -07:00

model_metadata.py

feat: provider modules — ProviderProfile ABC, 33 providers, fetch_models, transport single-path

2026-05-05 13:40:01 -07:00

models_dev.py

fix(models): prefer image modalities for vision routing

2026-05-07 05:54:12 -07:00

moonshot_schema.py

fix(moonshot): also strip nullable/enum after anyOf collapse

2026-04-30 23:14:31 -07:00

nous_rate_guard.py

refactor: consolidate symlink-safe atomic replace into shared helper

2026-04-28 04:58:22 -07:00

onboarding.py

docs(onboarding): lead OpenClaw residue banner with migrate, warn that cleanup breaks OpenClaw (#17507)

2026-04-29 08:08:36 -07:00

prompt_builder.py

fix: add PLATFORM_HINTS entry for api_server platform

2026-05-05 05:46:16 -07:00

prompt_caching.py

…

rate_limit_tracker.py

refactor: remove dead code — 1,784 lines across 77 files (#9180)

2026-04-13 16:32:04 -07:00

redact.py

feat(security): enable secret redaction by default (#17691, #20785) (#21193)

2026-05-07 05:10:33 -07:00

retry_utils.py

…

shell_hooks.py

refactor: consolidate symlink-safe atomic replace into shared helper

2026-04-28 04:58:22 -07:00

skill_commands.py

fix(skills): rescan skill_commands cache when platform scope changes (#18739)

2026-05-02 01:36:53 -07:00

skill_preprocessing.py

fix(skills): apply inline shell in skill_view

2026-04-24 15:15:07 -07:00

skill_utils.py

fix(skills): exclude .archive from skill index walk

2026-04-30 04:59:22 -07:00

subdirectory_hints.py

…

think_scrubber.py

fix(agent): stateful streaming scrubber for reasoning-block leaks (#17924) (#20184)

2026-05-05 04:33:38 -07:00

title_generator.py

fix: improve telegram topic mode setup

2026-05-04 12:07:17 -07:00

tool_guardrails.py

fix(guardrails): preserve display _detect_tool_failure semantics

2026-04-30 20:43:15 -07:00

trajectory.py

…

usage_pricing.py

fix(analytics): prevent silent token loss and add Claude 4.5–4.7 pricing (#21455)

2026-05-07 13:24:31 -07:00