hermes-agent

Files

T

Teknium 26f178e5fa fix(terminal): gate the BUZZ_* terminal carve-out on actual Buzz agent context

Compose the two salvaged approaches (#78065 + #78511):

- Keep #78065's terminal-only scrub-path exemption (first-party prefix
  predicate in _make_run_env / _sanitize_subprocess_env, plain env values
  never scope-resolved, snapshot exclusion for cross-profile isolation,
  every non-terminal surface sealed).
- Fold #78511's BUZZ_MANAGED_AGENT signal into a context gate instead of
  an import-time blocklist discard: the blocklist is shared by every
  scrub surface, so discarding there would leak BUZZ_PRIVATE_KEY into
  execute_code / hermes_subprocess_env children too.
- New gate _buzz_terminal_context_active(): BUZZ_MANAGED_AGENT in the
  process env (Buzz Desktop buzz-acp harness, #76243) OR the live
  session's platform is buzz (HERMES_SESSION_PLATFORM ContextVar,
  concurrency-safe under a multi-session gateway). A Telegram/CLI/cron
  session on a host that also runs a Buzz gateway does NOT get the
  signing key in its terminal children (maintainer triage note on
  #76243: don't expose the key to unrelated shell commands).
- Snapshot exclusion stays prefix-only (conservative even when the gate
  is inactive).
- Tests updated for the gate + new negative test (non-Buzz session
  strips) and positive test (buzz session platform enables carve-out);
  docs updated accordingly.

Closes #78026, closes #76243.

2026-08-31 07:35:47 -07:00

emails

fix(terminal): gate the BUZZ_* terminal carve-out on actual Buzz agent context

2026-08-31 07:35:47 -07:00

README.md

fix(ci): make tests, workflows, and attribution reliable under load (#66373 )

2026-07-17 20:55:24 +00:00

README.md

This directory replaces appending entries to AUTHOR_MAP in scripts/release.py. The old dict caused constant merge conflicts when several salvage PRs landed at once — every PR edited the same lines of the same file. Here, each mapping is its own file, and file additions never conflict.

Adding a mapping

One file per commit-author email, under emails/:

python3 scripts/add_contributor.py <email> <github-login>
# or by hand:
echo "<github-login>" > contributors/emails/<email>

File name = the exact commit-author email (as shown by git log --format='%ae').
File content = the GitHub login on the first non-comment line. Lines starting with # are comments (use them for the PR reference).

Example — contributors/emails/jane.doe@example.com:

janedoe
# PR #12345 salvage (gateway: fix session key routing)

Rules

Do NOT add new entries to AUTHOR_MAP in scripts/release.py. That dict is frozen legacy data; the release tooling merges it with this directory (directory entries win on duplicates).
GitHub noreply emails (<id>+<login>@users.noreply.github.com and <login>@users.noreply.github.com) auto-resolve — no file needed.
The Contributor Attribution Check CI job fails a PR whose commits carry an unmapped email; the failure message prints the exact command to run.

README.md

Contributor email → GitHub login mappings

Adding a mapping

Rules