Ben 034ad95fed fix(dashboard-auth): propagate next= through login page + PKCE cookie ...

The gate's _unauth_response set next=<path> on the /login redirect URL,
but nothing downstream read it: render_login_html ignored next=,
auth_login dropped it, and auth_callback read next= from its own query
string — which an IDP never sets on the callback URL (real IDPs only
echo back code+state). The _validate_post_login_target plumbing in the
callback was unreachable on the happy path, so users always landed on
"/" regardless of what they originally requested.

Worse: reading next= from the callback URL was a latent open-redirect
sink, since an attacker could craft /auth/callback?...&next=/admin and
have the server honour it post-auth.

Fix carries next= through the round trip on a server-controlled channel:

  1. login_page reads request.query_params['next'] and passes it (post-
     validation) to render_login_html.
  2. render_login_html threads next= URL-encoded into each provider
     button's href, with HTML-attribute escaping as defence in depth.
  3. auth_login accepts ?next= as a query param, re-validates, and
     appends it as a fourth segment (next=<urlquoted>) in the PKCE
     cookie payload alongside provider/state/verifier.
  4. auth_callback no longer accepts a next: str = "" query param. It
     parses next= out of the PKCE cookie and validates that with the
     same same-origin rules. Any attacker-supplied ?next= on the
     callback URL is silently ignored — server-only carrier.

Test coverage adds three classes:

  - TestAuthCallbackNext drives /login → /auth/login → IDP-bounce →
    /auth/callback end-to-end without smuggling next= onto the callback
    URL (which is what the previous tests did and why they didn't
    catch the bug). Includes test_attacker_callback_next_param_is_ignored
    to pin the security property that the URL value is never read.
  - TestRenderLoginHtmlNext covers the rendering function at the
    unit boundary so a regression that drops next_path is caught
    without spinning up the full app.
  - TestAuthLoginPkceCookieNext inspects the Set-Cookie header on
    /auth/login responses so a regression in cookie encoding is caught
    without driving the full round trip.

Mutation-tested: reverting auth_callback to read next= from the URL
trips 3 of 6 TestAuthCallbackNext tests (the safe-path and attacker-
hardening ones), confirming the suite discriminates between the cookie
read and the URL read.

2026-05-27 02:12:27 -07:00

..

__init__.py

test: reorganize test structure and add missing unit tests

2026-02-26 03:20:08 +03:00

conftest_dashboard_auth.py

fix(dashboard-auth): use fixed-length sig suffix in stub token framing

2026-05-27 02:12:27 -07:00

conftest.py

fix(update): quarantine hermes.exe vs concurrent Windows instance (#26670) (#26677)

2026-05-19 11:10:51 -07:00

test_anthropic_model_flow_stale_oauth.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_anthropic_oauth_flow.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_anthropic_provider_persistence.py

refactor(tests): re-architect tests + fix CI failures (#5946)

2026-04-07 17:19:07 -07:00

test_api_key_providers.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_apply_model_switch_result_context.py

fix(cli): /model picker honors provider-specific context caps (#16030)

2026-04-26 05:43:31 -07:00

test_apply_profile_override.py

fix(profiles): honour active_profile when HERMES_HOME points to hermes root

2026-05-09 11:10:53 -07:00

test_arcee_provider.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_argparse_flag_propagation.py

Fix CLI verbose tool progress config fallback

2026-05-23 21:03:51 -07:00

test_at_context_completion_filter.py

fix(tui): @folder: only yields directories, @file: only yields files

2026-04-21 14:31:48 -05:00

test_atomic_json_write.py

refactor(tests): re-architect tests + fix CI failures (#5946)

2026-04-07 17:19:07 -07:00

test_atomic_yaml_write.py

refactor(tests): re-architect tests + fix CI failures (#5946)

2026-04-07 17:19:07 -07:00

test_auth_codex_provider.py

fix(model): let Codex setup reuse or reauthenticate

2026-04-24 04:53:32 -07:00

test_auth_commands.py

test(auth): align copilot-remove test with borrowed-credential policy (#31416)

2026-05-25 01:23:31 -07:00

test_auth_loopback_ssh_hint.py

fix(auth): improve xAI OAuth SSH hint with visual header and auto-detected host

2026-05-18 10:26:55 -07:00

test_auth_manual_paste.py

test+docs(oauth): pin manual-paste semantics and document browser-only path (#26923)

2026-05-18 20:10:52 -07:00

test_auth_nous_provider.py

fix(auth) fix a few cases where refresh tokens were not rotated.

2026-05-17 16:56:37 -07:00

test_auth_profile_fallback.py

fix(auth): fall back to global-root auth.json for providers missing in profile

2026-05-06 13:29:54 -07:00

test_auth_provider_gate.py

fix: resolve CI test failures — add missing functions, fix stale tests (#9483)

2026-04-14 01:43:45 -07:00

test_auth_qwen_provider.py

fix(cli): validate runtime token refresh capability in Qwen auth status

2026-05-23 17:47:36 -07:00

test_auth_ssl_macos.py

fix(auth): honor SSL CA env vars across httpx + requests callsites

2026-04-24 03:00:33 -07:00

test_auth_toctou_file_modes.py

test: migrate stale os.kill monkeypatches to gateway.status._pid_exists

2026-05-08 14:27:40 -07:00

test_auth_usable_secret.py

security: harden API server key placeholder handling (#30738)

2026-05-24 04:25:32 -07:00

test_auth_xai_oauth_provider.py

fix(xai-oauth): pin inference base_url to x.ai origin (#28952)

2026-05-19 14:51:21 -07:00

test_aux_config.py

fix(aux): remove stale session_search model menu entry

2026-05-18 20:01:34 -07:00

test_azure_detect.py

feat(azure-foundry): add Microsoft Entra ID auth

2026-05-18 10:14:38 -07:00

test_azure_foundry_entra.py

feat(azure-foundry): add Microsoft Entra ID auth

2026-05-18 10:14:38 -07:00

test_backup.py

fix(backup): skip symlinked files in zip archives (#25289)

2026-05-25 05:07:52 -07:00

test_banner_git_state.py

fix: CLI/UX batch — ChatConsole errors, curses scroll, skin-aware banner, git state banner (#5974)

2026-04-07 17:59:42 -07:00

test_banner_pip_update.py

refactor: DRY cleanup from code review

2026-05-15 14:45:43 -07:00

test_banner_skills.py

fix: disabled skills respected across banner, system prompt, slash commands, and skill_view (#1897)

2026-03-18 03:17:37 -07:00

test_banner.py

feat(banner): hyperlink startup banner title to latest GitHub release (#14945)

2026-04-23 23:28:34 -07:00

test_bedrock_model_picker.py

test(ci): stabilize shared optional dependency baselines

2026-05-13 17:32:22 -07:00

test_bundles.py

feat(skills): add skill bundles — alias /<name> loads multiple skills (#28373)

2026-05-18 21:38:05 -07:00

test_chat_skills_flag.py

fix(termux): add local image chat route

2026-04-09 16:24:53 -07:00

test_claw.py

fix(ci): stabilize main test suite regressions (#17660)

2026-04-29 23:18:55 -07:00

test_clear_stale_base_url.py

fix: warn and clear stale OPENAI_BASE_URL on provider switch (#5161)

2026-04-11 01:52:58 -07:00

test_cli_output.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_cmd_update.py

fix(cli): plug silent-divergence holes in --branch flag

2026-05-21 02:14:08 -04:00

test_coalesce_session_args.py

fix(cli): handle unquoted multi-word session names in -c/--continue and -r/--resume

2026-03-09 21:36:29 -07:00

test_codex_cli_model_picker.py

test(codex-spark): add live-API regression and make picker test deterministic

2026-05-09 23:17:25 -07:00

test_codex_models.py

test(codex-spark): add live-API regression and make picker test deterministic

2026-05-09 23:17:25 -07:00

test_codex_runtime_plugin_migration.py

fix(codex-runtime): de-dup [plugins.X] tables and stop leaking HERMES_HOME into config.toml

2026-05-15 02:31:30 -07:00

test_codex_runtime_switch.py

chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

2026-05-17 02:29:41 -07:00

test_commands.py

fix(gateway): prioritize Telegram command menu

2026-05-20 19:14:21 -07:00

test_completion.py

test(cli): strengthen zsh completion regression coverage

2026-05-13 09:34:15 -07:00

test_config_drift.py

feat(delegate): orchestrator role and configurable spawn depth (default flat)

2026-04-21 14:23:45 -07:00

test_config_env_expansion.py

fix(ci): stabilize main test suite regressions (#17660)

2026-04-29 23:18:55 -07:00

test_config_env_refs.py

fix(config): preserve env refs when save_config rewrites config (#11892)

2026-04-17 19:03:26 -07:00

test_config_validation.py

fix(config): accept fallback_model list (chain) in validator + save

2026-04-28 01:40:25 -07:00

test_config.py

fix(dashboard): suffix-allowlist plugin assets + denylist subprocess-influencing env vars (#32277)

2026-05-25 15:07:19 -07:00

test_container_aware_cli.py

fix(ci): stabilize main test suite regressions (#17660)

2026-04-29 23:18:55 -07:00

test_container_boot.py

fix(container_boot): publish reconciled service dirs atomically

2026-05-24 18:05:33 -07:00

test_copilot_auth.py

fix: remove 115 verified dead code symbols across 46 production files

2026-04-10 03:44:43 -07:00

test_copilot_catalog_oauth_fallback.py

fix(copilot): require successful exchange when walking credential_pool catalog tokens

2026-04-28 01:18:09 -07:00

test_copilot_context.py

fix(copilot): wire live /models max_prompt_tokens into context-window resolver

2026-04-24 05:09:08 -07:00

test_copilot_in_model_list.py

fix(model): repair Discord Copilot /model flow

2026-04-24 03:33:29 -07:00

test_copilot_token_exchange.py

fix(copilot): exchange raw GitHub token for Copilot API JWT

2026-04-24 05:09:08 -07:00

test_cron.py

feat: add cron job profile support

2026-05-18 17:39:50 +00:00

test_curator_archive_prune.py

feat(curator): add archive and prune subcommands (#20200)

2026-05-05 05:15:54 -07:00

test_curator_recent_run_notice.py

feat(curator): show rename map in user-visible summary (#22910)

2026-05-09 18:43:40 -07:00

test_curator_run.py

fix(curator): make manual runs synchronous

2026-05-07 05:27:47 -07:00

test_curator_status.py

fix(curator): make manual runs synchronous

2026-05-07 05:27:47 -07:00

test_curses_color_compat.py

fix(cli): clamp curses color 8 for 8-color terminals (Docker)

2026-05-21 23:40:58 -07:00

test_custom_provider_context_length.py

fix(context): honor custom_providers context_length on /model switch + bump probe tier to 256K (#15844)

2026-04-25 18:47:53 -07:00

test_custom_provider_model_switch.py

fix(model): match custom provider by active base url

2026-05-19 14:50:38 -07:00

test_dashboard_auth_401_reauth.py

fix(dashboard-auth): propagate next= through login page + PKCE cookie

2026-05-27 02:12:27 -07:00

test_dashboard_auth_audit.py

feat(dashboard-auth): json-lines audit log at $HERMES_HOME/logs/dashboard-auth.log

2026-05-27 02:12:27 -07:00

test_dashboard_auth_cookies.py

feat(dashboard-auth): cookie helpers for session_at/session_rt/pkce

2026-05-27 02:12:27 -07:00

test_dashboard_auth_gate.py

feat(dashboard-auth): Nous plugin always-on; default portal URL; specific error messages

2026-05-27 02:12:27 -07:00

test_dashboard_auth_middleware.py

feat(dashboard-auth): Phase 6 — 401 re-auth envelope + next= propagation

2026-05-27 02:12:27 -07:00

test_dashboard_auth_plugin_hook.py

feat(plugins): add register_dashboard_auth_provider hook on PluginContext

2026-05-27 02:12:27 -07:00

test_dashboard_auth_provider_base.py

test(dashboard-auth): cover registry register/get/list/clear semantics

2026-05-27 02:12:27 -07:00

test_dashboard_auth_status_endpoint.py

feat(dashboard-auth): Phase 7 — SPA AuthWidget + /api/status auth fields

2026-05-27 02:12:27 -07:00

test_dashboard_auth_stub_provider.py

test(dashboard-auth): stub auth provider for E2E gate testing

2026-05-27 02:12:27 -07:00

test_dashboard_auth_ws_auth.py

fix(dashboard-auth): bypass loopback WS peer check in gated mode

2026-05-27 02:12:27 -07:00

test_dashboard_auth_ws_tickets.py

feat(dashboard-auth): single-use WS tickets + POST /api/auth/ws-ticket

2026-05-27 02:12:27 -07:00

test_dashboard_browser_safe_imports.py

Merge upstream/main and address Copilot review feedback

2026-04-30 06:43:22 -04:00

test_dashboard_lifecycle_flags.py

feat(dashboard): add --stop and --status flags (#17840)

2026-04-30 02:30:20 -07:00

test_dashboard_profiles_nav_label.py

fix(dashboard): UI polish — modals, layout, consistency, test fixes

2026-05-12 13:59:22 -04:00

test_debug.py

fix(debug): redact BlueBubbles webhook secrets

2026-05-24 15:43:48 -07:00

test_dep_ensure.py

feat(dep_ensure): complete Windows bootstrap — dep_ensure + install.ps1 + detection (#27845)

2026-05-18 16:34:24 +05:30

test_deprecated_cwd_warning.py

fix: enforce config.yaml as sole CWD source + deprecate .env CWD vars + add hermes memory reset (#11029)

2026-04-16 06:48:33 -07:00

test_destructive_slash_confirm_gate.py

feat: confirm prompt for destructive slash commands (#4069) (#22687)

2026-05-09 11:04:46 -07:00

test_detect_api_mode_for_url.py

fix: restrict provider URL detection to exact hostname matches

2026-04-20 22:14:29 -07:00

test_determine_api_mode_hostname.py

fix: extend hostname-match provider detection across remaining call sites

2026-04-20 22:14:29 -07:00

test_dingtalk_auth.py

test(dingtalk): cover QR device-flow auth + OpenClaw branding disclosure

2026-04-17 05:08:07 -07:00

test_discord_skill_clamp_warning.py

test: add tests for cmd_key preservation through name clamping

2026-05-03 03:25:45 -07:00

test_doctor_command_install.py

feat(doctor): add Command Installation check for hermes bin symlink

2026-04-14 23:13:11 -07:00

test_doctor_dedicated_provider_skip.py

fix(doctor): skip pluggable provider profiles when a dedicated check exists (#22346)

2026-05-09 13:36:33 -07:00

test_doctor.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_env_load_cache.py

perf(tools): cache get_nous_auth_status() and load_env() to fix slow hermes tools menus (#25341)

2026-05-13 18:40:14 -07:00

test_env_loader.py

fix(env): strip null bytes from .env before python-dotenv loads

2026-05-23 17:17:05 -07:00

test_env_sanitize_on_load.py

clarify placeholder telegram credential in tests

2026-05-04 15:31:15 -04:00

test_fallback_cmd.py

fix(fallback): merge fallback_providers with legacy fallback_model configurations

2026-05-23 05:24:57 -07:00

test_gateway_linger.py

fix(termux): disable gateway service flows on android

2026-04-09 16:24:53 -07:00

test_gateway_platform_gating.py

fix(install): use --extra all not --all-extras; drop lazy-covered extras from [all] (#24515)

2026-05-12 15:06:25 -07:00

test_gateway_proc_fallback.py

fix(gateway): detect gateway process via /proc in Docker without procps

2026-05-09 17:54:17 -07:00

test_gateway_runtime_health.py

fix(gateway): harden Telegram polling conflict handling

2026-03-14 12:11:23 -07:00

test_gateway_s6_dispatch.py

fix(service_manager): friendly errors for missing slots and s6-svc failures

2026-05-24 18:05:33 -07:00

test_gateway_service_paths.py

fix(gateway): build service PATH from existing dirs only, include ~/.hermes/node_modules

2026-05-15 14:45:43 -07:00

test_gateway_service.py

ci(tests): add pytest-timeout 60s hard cap to break suite-teardown deadlock (#28861)

2026-05-19 17:27:24 -07:00

test_gateway_windows.py

test(gateway-windows): make ctypes.windll monkeypatch tolerant on non-Windows

2026-05-19 11:23:15 -07:00

test_gateway_wsl.py

ci(tests): add pytest-timeout 60s hard cap to break suite-teardown deadlock (#28861)

2026-05-19 17:27:24 -07:00

test_gateway.py

fix(gateway): harden Windows gateway install lifecycle

2026-05-19 11:23:15 -07:00

test_gemini_free_tier_setup_block.py

feat(gemini): block free-tier keys at setup + surface guidance on 429 (#15100)

2026-04-24 04:46:17 -07:00

test_gemini_provider.py

test: stop testing mutable data — convert change-detectors to invariants (#13363)

2026-04-20 23:20:33 -07:00

test_gmi_provider.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_goals.py

feat(goals): /subgoal — user-added criteria appended to active /goal (#25449)

2026-05-13 22:55:09 -07:00

test_hooks_cli.py

feat: shell hooks — wire shell scripts as Hermes hook callbacks

2026-04-20 20:53:51 -07:00

test_ignore_user_config_flags.py

refactor(cli): derive relaunch flag table from argparse introspection

2026-04-29 20:33:29 -07:00

test_image_gen_picker.py

refactor(image_gen): port FAL backend to plugins/image_gen/fal

2026-05-22 04:10:45 -07:00

test_install_cua_driver.py

fix(cli): pre-check CUA release asset for Intel macOS before install

2026-05-21 19:17:45 -07:00

test_inventory.py

refactor(inventory): extract shared ConfigContext + build_models_payload

2026-05-13 22:31:11 -07:00

test_kanban_blocked_sticky.py

test(kanban): cover sticky blocks for worker-initiated kanban_block (#28712)

2026-05-19 17:26:23 -07:00

test_kanban_boards.py

fix(kanban): align board_exists with board discovery rules

2026-05-18 20:17:10 -07:00

test_kanban_cli.py

feat(kanban): configure worktree paths and branches

2026-05-18 21:33:08 -07:00

test_kanban_core_functionality.py

fix(tests): catch up 25 stale tests after recent merges (#28626)

2026-05-19 01:28:32 -07:00

test_kanban_db_init.py

fix(kanban): serialize DB initialization

2026-05-18 20:17:48 -07:00

test_kanban_db.py

fix(kanban): scratch tasks must not inherit board.default_workdir (#28818)

2026-05-24 15:48:58 -07:00

test_kanban_decompose_db.py

fix(kanban): detect cycles in decompose_triage_task sibling-link pre-validation

2026-05-18 09:40:44 -07:00

test_kanban_decompose.py

fix: assign single-task kanban decompositions

2026-05-18 20:26:02 -07:00

test_kanban_diagnostics.py

fix(kanban): honor severity thresholds in diagnostics

2026-05-18 20:47:01 -07:00

test_kanban_notify.py

fix(tests): allowlist tmp_path for kanban_notify artifact delivery (#30852)

2026-05-23 02:34:34 -07:00

test_kanban_promote.py

feat(kanban): --ids bulk promote + AUTHOR_MAP entry for #29464

2026-05-23 23:10:36 -07:00

test_kanban_specify_db.py

feat(kanban): add specify — auxiliary LLM fleshes out triage tasks (#21435)

2026-05-07 13:04:41 -07:00

test_kanban_specify.py

feat(kanban): add specify — auxiliary LLM fleshes out triage tasks (#21435)

2026-05-07 13:04:41 -07:00

test_kanban_swarm.py

feat(cli): add kanban swarm topology helper

2026-05-18 21:10:12 -07:00

test_launcher.py

fix: use argparse entrypoint in top-level launcher (#3874)

2026-03-29 21:54:36 -07:00

test_list_picker_providers.py

fix(gateway): preserve model picker current context

2026-05-06 03:50:59 -07:00

test_logs.py

feat: component-separated logging with session context and filtering (#7991)

2026-04-11 17:23:36 -07:00

test_managed_installs.py

fix(tests): catch up 25 stale tests after recent merges (#28626)

2026-05-19 01:28:32 -07:00

test_mcp_add_command_dest.py

fix(mcp): give 'mcp add --command' a distinct argparse dest

2026-05-07 05:17:03 -07:00

test_mcp_catalog.py

feat(mcp): Nous-approved MCP catalog with interactive picker (#30870)

2026-05-26 12:48:14 -07:00

test_mcp_config.py

fix(mcp): give 'mcp add --command' a distinct argparse dest

2026-05-07 05:17:03 -07:00

test_mcp_reload_confirm_gate.py

feat(gateway,cli): confirm /reload-mcp to warn about prompt cache invalidation

2026-04-29 21:56:47 -07:00

test_mcp_tools_config.py

feat(mcp): Nous-approved MCP catalog with interactive picker (#30870)

2026-05-26 12:48:14 -07:00

test_memory_reset.py

chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

2026-05-17 02:29:41 -07:00

test_migrate_xai.py

fix(xai): align migrate retirement map with docs

2026-05-20 09:18:23 -07:00

test_model_catalog.py

fix(nous): surface Portal-flagged free models in picker even when curated list is stale (#24082)

2026-05-11 18:08:16 -07:00

test_model_normalize.py

fix(model-normalize): pass DeepSeek V-series IDs through instead of folding to deepseek-chat

2026-04-24 05:24:54 -07:00

test_model_picker_viewport.py

refactor(cli): align model picker viewport with PR #11260 vocabulary

2026-04-17 06:33:21 -07:00

test_model_provider_persistence.py

feat(custom): prompt and persist explicit api_mode for custom providers

2026-05-13 13:21:33 -07:00

test_model_switch_context_display.py

fix(context): honor custom_providers context_length on /model switch + bump probe tier to 256K (#15844)

2026-04-25 18:47:53 -07:00

test_model_switch_copilot_api_mode.py

fix: recompute Copilot api_mode after model switch

2026-04-16 01:16:14 -07:00

test_model_switch_custom_providers.py

fix(model-switch): mark bare custom provider as current

2026-05-19 10:57:35 -07:00

test_model_switch_opencode_anthropic.py

fix(opencode): derive api_mode from target model, not stale config default (#15106)

2026-04-24 04:58:46 -07:00

test_model_switch_variant_tags.py

fix(models): preserve OpenRouter variant tags (:free, :extended, :fast) during model switch (#6383)

2026-04-08 19:58:16 -07:00

test_model_validation.py

feat(opencode-go): route qwen3.7-max via anthropic_messages

2026-05-26 20:44:43 -07:00

test_models_dev_preferred_merge.py

feat(/model): merge models.dev entries for lesser-loved providers (#14221)

2026-04-22 17:33:42 -07:00

test_models.py

chore(models): swap qwen3.6-plus → qwen3.7-max in openrouter+nous lists (#32809)

2026-05-26 14:01:47 -07:00

test_non_ascii_credential.py

fix(env_loader): warn when non-ASCII stripped from credential env vars (#13300)

2026-04-20 22:14:03 -07:00

test_nous_auth_status_cache.py

perf(tools): cache get_nous_auth_status() and load_env() to fix slow hermes tools menus (#25341)

2026-05-13 18:40:14 -07:00

test_nous_hermes_non_agentic.py

fix(cli): narrow Nous Hermes non-agentic warning to actual hermes-3/-4 models

2026-04-13 04:33:52 -07:00

test_nous_inference_url_validation.py

fix(security): wire Nous URL allowlist into refresh / mint persistence sites

2026-05-22 14:17:40 -07:00

test_nous_subscription.py

fix(cli): coerce use_gateway config flags in tool routing

2026-04-26 19:02:55 -07:00

test_ollama_cloud_auth.py

fix(opencode): derive api_mode from target model, not stale config default (#15106)

2026-04-24 04:58:46 -07:00

test_ollama_cloud_provider.py

fix(models): strip :cloud/-cloud suffix from models.dev Ollama Cloud IDs

2026-05-04 12:38:15 -07:00

test_openai_codex_model_validation_fallback.py

fix(codex-spark): defensive 128k entry in DEFAULT_CONTEXT_LENGTHS + clarify validation test docstring

2026-05-09 23:17:25 -07:00

test_opencode_go_flat_namespace.py

fix(opencode-go): keep users on opencode-go instead of hijacking to native providers (#20802)

2026-05-06 09:08:33 -07:00

test_opencode_go_in_model_list.py

chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

2026-05-17 02:29:41 -07:00

test_opencode_go_validation_fallback.py

fix(/model): accept provider switches when /models is unreachable

2026-04-21 05:19:43 -07:00

test_overlay_slug_resolution.py

fix(model_picker): detect mapped-provider auth-store credentials

2026-04-24 05:20:05 -07:00

test_path_completion.py

feat(cli): add file path autocomplete in the input prompt (#1545)

2026-03-16 06:07:45 -07:00

test_pin_kanban_board_env.py

test(kanban): isolate HERMES_KANBAN_BOARD writes in pin-env tests

2026-05-05 04:37:47 -07:00

test_pip_install_detection.py

feat(config): add install-method stamping + Docker detection (#27843)

2026-05-18 16:34:10 +05:30

test_placeholder_usage.py

fix: cover remaining config placeholder help text

2026-03-14 10:35:14 -07:00

test_plugin_auxiliary_tasks.py

feat(plugins): add register_auxiliary_task() to PluginContext API

2026-05-23 17:49:47 -07:00

test_plugin_cli_registration.py

test: remove 169 change-detector tests across 21 files (#11472)

2026-04-17 01:05:09 -07:00

test_plugin_scanner_recursion.py

feat(plugins): pluggable image_gen backends + OpenAI provider (#13799)

2026-04-21 21:30:10 -07:00

test_plugins_cmd.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_plugins_transcription_registration.py

feat(stt): add register_transcription_provider() plugin hook

2026-05-25 01:41:19 -07:00

test_plugins_tts_registration.py

feat(tts): add register_tts_provider() plugin hook (closes #30398)

2026-05-24 18:04:54 -07:00

test_plugins.py

feat(plugins): tool override flag for replacing built-in tools (closes #11049) (#26759)

2026-05-15 22:12:57 -07:00

test_post_setup_gating.py

fix(tools): install cua-driver when Computer Use is enabled via 'hermes tools' (#22765)

2026-05-09 13:02:25 -07:00

test_profile_describer.py

feat(kanban): orchestrator-driven auto-decomposition on triage (#27572)

2026-05-17 13:54:12 -07:00

test_profile_distribution.py

fix(profile): reject symlinks in distributions (#25292)

2026-05-25 05:07:58 -07:00

test_profile_export_credentials.py

fix: also exclude .env from default profile exports

2026-04-01 11:20:33 -07:00

test_profiles_s6_hooks.py

fix(profiles): short-circuit s6 hooks on host before importing service_manager

2026-05-24 18:07:47 -07:00

test_profiles.py

refactor(profiles): remove dead generate_bash_completion / generate_zsh_completion

2026-05-13 09:34:15 -07:00

test_project_plugin_rce_bypass.py

test(plugins): regression coverage for project-plugin RCE chain (#29156)

2026-05-23 01:43:52 -07:00

test_prompt_api_key.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_provider_config_validation.py

fix(config): add request_timeout_seconds and stale_timeout_seconds to provider _KNOWN_KEYS

2026-04-28 01:28:25 -07:00

test_proxy.py

docs(auth): replace stale 'hermes login' references with 'hermes auth add'

2026-05-26 15:41:11 -07:00

test_pty_bridge.py

test: use subprocesses for each test file (#29016)

2026-05-21 16:40:04 +05:30

test_reasoning_effort_menu.py

fix: normalize reasoning effort ordering in UI

2026-04-09 14:20:16 -07:00

test_redact_config_bridge.py

feat(security): enable secret redaction by default (#17691, #20785) (#21193)

2026-05-07 05:10:33 -07:00

test_regression_16767.py

test(cli): regression coverage for user-provider routing fix (#16767)

2026-04-28 01:47:20 -07:00

test_relaunch.py

fix(windows): prefer npm.cmd over npm.ps1, skip .py argv0 in relaunch

2026-05-08 14:27:40 -07:00

test_resolve_last_session.py

fix(cli): tighten MRU lookup and session DB cleanup

2026-04-27 08:52:12 -07:00

test_runtime_provider_resolution.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_secret_prompt.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_security_advisories.py

feat(security): supply-chain advisory checker + lazy-install framework + tiered install fallback (#24220)

2026-05-12 01:02:25 -07:00

test_security_audit.py

feat(security): on-demand supply-chain audit via OSV.dev (#31460)

2026-05-24 15:15:16 -07:00

test_send_cmd.py

fix(review): address Copilot follow-up on sanitizer and file decode errors

2026-05-16 23:00:58 -05:00

test_service_manager.py

fix(docker): make s6 lifecycle work for the unprivileged hermes user

2026-05-25 12:23:23 +10:00

test_session_browse.py

fix(sessions): /save lands under $HERMES_HOME, widen browse+TUI picker, force-refresh ollama-cloud on setup (#16296)

2026-04-26 18:49:48 -07:00

test_session_handoff.py

feat(session): make /handoff actually transfer the session live

2026-05-10 13:06:25 -07:00

test_session_recap.py

feat(status): append session recap to /status output (#27176)

2026-05-16 16:51:42 -07:00

test_sessions_delete.py

test(sessions): wire sessions_dir through auto-prune + file-cleanup regression tests

2026-04-26 18:31:07 -07:00

test_set_config_value.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_setup_agent_settings.py

fix(gateway): shutdown + restart hygiene (drain timeout, false-fatal, success log) (#18761)

2026-05-02 02:08:06 -07:00

test_setup_hermes_script.py

chore: remove Atropos RL environments and tinker-atropos integration (#26106)

2026-05-15 10:36:38 +05:30

test_setup_irc.py

feat(plugins): bundled platform plugins auto-load by default

2026-04-29 21:56:51 -07:00

test_setup_matrix_e2ee.py

docs(matrix): update all references from matrix-nio to mautrix

2026-04-10 21:15:59 -07:00

test_setup_model_provider.py

fix(cli): preserve setup config picker writes

2026-05-19 14:23:19 -07:00

test_setup_noninteractive.py

feat(setup): auto-reconfigure on existing installs (#15879)

2026-04-25 22:02:02 -07:00

test_setup_ollama_cloud_force_refresh.py

fix(sessions): /save lands under $HERMES_HOME, widen browse+TUI picker, force-refresh ollama-cloud on setup (#16296)

2026-04-26 18:49:48 -07:00

test_setup_openclaw_migration.py

fix(tests): catch up 25 stale tests after recent merges (#28626)

2026-05-19 01:28:32 -07:00

test_setup_prompt_menus.py

fix(cli): show masked feedback for secret prompts

2026-05-25 01:20:33 -07:00

test_setup_reconfigure.py

fix(setup): drop post-setup chat handoff (#25067)

2026-05-13 13:28:25 -07:00

test_setup.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_skills_config.py

fix(tests): resolve 17 persistent CI test failures (#15084)

2026-04-24 03:46:46 -07:00

test_skills_hub.py

fix: harden skill trust source matching (#31229)

2026-05-25 01:51:15 -07:00

test_skills_install_flags.py

fix: add --yes flag to bypass confirmation in /skills install and uninstall (#1647)

2026-03-17 01:59:07 -07:00

test_skills_skip_confirm.py

fix(skills): cache-aware /skills install and uninstall in TUI (#3586)

2026-03-28 14:32:23 -07:00

test_skills_subparser.py

fix(cli): resolve duplicate 'skills' subparser crash on Python 3.11+

2026-03-11 00:50:39 -07:00

test_skin_engine.py

fix(tui): improve charizard completion menu contrast

2026-05-18 20:05:23 -07:00

test_slack_cli.py

fix(slack): enable writable app home DMs in manifest

2026-05-08 17:01:12 -07:00

test_spotify_auth.py

fix(auth): keep Spotify logout from resetting model config

2026-05-07 05:53:14 -07:00

test_startup_plugin_gating.py

perf(cli): skip eager plugin discovery on known built-in subcommands (#22120)

2026-05-08 16:07:23 -07:00

test_status_model_provider.py

feat(agent): add lmstudio integration

2026-04-28 12:27:36 -07:00

test_status.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_subparser_routing_fallback.py

test: remove 169 change-detector tests across 21 files (#11472)

2026-04-17 01:05:09 -07:00

test_subprocess_timeouts.py

fix(cli): add missing subprocess.run() timeouts in doctor and status (#4009)

2026-03-30 11:17:15 -07:00

test_suppress_eio_on_interrupt.py

fix(cli): guard logger.debug in signal handler (#13710 regression) (#20673)

2026-05-06 03:55:47 -07:00

test_teams_pipeline_plugin_cli.py

feat(teams-pipeline): add plugin runtime and operator cli

2026-05-08 11:18:14 -07:00

test_tencent_tokenhub_provider.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_terminal_menu_fallbacks.py

Harden setup provider flows

2026-04-10 02:57:39 -07:00

test_timeouts.py

fix(codex): size and propagate timeouts for Responses-API requests; lower stale defaults

2026-05-25 01:47:55 -07:00

test_tips.py

refactor: remove dead code — 1,784 lines across 77 files (#9180)

2026-04-13 16:32:04 -07:00

test_tool_token_estimation.py

fix(tests): resolve 10 CI failures across hooks, tiktoken, plugins (#3848)

2026-03-29 20:05:59 -07:00

test_tools_config.py

fix: run computer use post-setup when enabling tool

2026-05-22 01:24:11 -07:00

test_tools_disable_enable.py

fix: MCP toolset resolution for runtime and config (#3252)

2026-03-26 13:39:41 -07:00

test_tts_picker.py

feat(tts): add register_tts_provider() plugin hook (closes #30398)

2026-05-24 18:04:54 -07:00

test_tui_bundled.py

feat(tui): find bundled entry.js from wheel before falling back to npm build

2026-05-15 14:45:43 -07:00

test_tui_npm_install.py

fix(tui): surface verbose tool details (#30225)

2026-05-22 00:16:52 -05:00

test_tui_resume_flow.py

perf(termux): speed up bare cli prompt startup

2026-05-22 14:27:38 -07:00

test_update_autostash.py

fix(ci): stabilize shared test state after 21012

2026-05-14 14:28:14 -07:00

test_update_check.py

refactor: DRY cleanup from code review

2026-05-15 14:45:43 -07:00

test_update_concurrent_quarantine.py

test+harden(cli): cover parent-chain walk in concurrent-instance detection

2026-05-24 19:51:46 -07:00

test_update_config_clears_custom_fields.py

fix(anthropic): complete third-party Anthropic-compatible provider support (#12846)

2026-04-19 22:43:09 -07:00

test_update_hangup_protection.py

fix(update): survive mid-update terminal disconnect (#11960)

2026-04-17 21:29:24 -07:00

test_update_post_pull_syntax_guard.py

feat(update): syntax-validate critical files post-pull, auto-rollback on failure (#28669)

2026-05-19 03:01:02 -07:00

test_update_stale_dashboard.py

chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

2026-05-17 02:29:41 -07:00

test_update_yes_flag.py

test: remove 50 stale/broken tests to unblock CI (#22098)

2026-05-08 14:55:40 -07:00

test_update_zip_symlink_reject.py

fix(tests): four pre-existing flakes from the security cluster merge (#32072)

2026-05-25 05:50:29 -07:00

test_user_providers_model_switch.py

test(model_switch): cover private user_providers override

2026-04-30 19:44:26 -07:00

test_video_gen_picker.py

fix(tools): video_gen picker reflects active xAI selection and runs xai_grok post_setup

2026-05-15 12:11:32 -07:00

test_voice_wrapper.py

fix(tui): restore voice push-to-talk parity (#20897)

2026-05-06 15:49:59 -07:00

test_web_oauth_dispatch.py

refactor(auth): collapse Nous inference fallback controls

2026-05-17 16:56:37 -07:00

test_web_server_cron_profiles.py

fix(cron): reject id mutation + validate output paths under OUTPUT_DIR

2026-05-25 01:15:24 -07:00

test_web_server_host_header.py

fix(dashboard): validate WebSocket Host and Origin

2026-05-24 15:00:44 -07:00

test_web_server_oauth_write.py

Protect dashboard OAuth credentials with the same file-safety guarantees as other auth paths

2026-05-24 17:47:24 -07:00

test_web_server.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_web_ui_build.py

fix(dashboard): validate dist exists when --skip-build is set

2026-05-11 09:27:05 -07:00

test_webhook_cli.py

fix(state): restrict sensitive store file permissions

2026-05-24 04:55:18 -07:00

test_whatsapp_setup_ordering.py

fix(gateway): keep running when platforms fail; add per-platform circuit breaker + /platform (#26600)

2026-05-15 14:32:14 -07:00

test_xai_oauth_pkce_token_exchange.py

test(xai-oauth): pin PKCE token-exchange wire format

2026-05-17 12:35:01 -07:00

test_xai_provider_labels.py

fix(model): include Premium+ in xAI OAuth label

2026-05-24 18:12:16 -07:00

test_xai_retirement.py

fix(xai): align migrate retirement map with docs

2026-05-20 09:18:23 -07:00

test_xiaomi_provider.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00