Teknium da26ff986b fix(approval): detect recursive rm when flags follow operands ...

Port from openai/codex#33464: GNU rm permutes options, so
`rm build/ -rf`, `rm build/ -r -f`, and `rm build/ --recursive
--force` are equivalent to the flags-first spellings — but every
existing rm pattern required the flag group BEFORE the path, so these
spellings ran with no approval prompt at all (proven live on main).

The hardline floor was NOT affected: protected paths (/, system dirs,
$HOME) match regardless of flag position because the hardline path
matcher does not require flags. The gap was the approval-prompt layer
for arbitrary paths.

New DANGEROUS_PATTERNS entry with a tempered operand run: cannot cross
command separators (; | & newline), quotes, or a bare -- end-of-options
separator (after --, -rf is a literal filename). Flag token must be
whitespace-anchored so the r inside long options like --registry does
not count.

9 positive + 7 negative shapes in tests; approval cluster (868 tests)
green.

2026-07-26 20:58:52 -07:00

..

computer_use

fix(update): never blind-reinstall cua-driver during hermes update

2026-07-26 13:47:35 -07:00

environments

fix(environments): exclude multiline session env from terminal snapshots

2026-07-26 19:30:02 -07:00

neutts_samples

refactor(tts): replace NeuTTS optional skill with built-in provider + setup flow

2026-03-17 02:33:12 -07:00

__init__.py

Merge branch 'main' into rewbs/tool-use-charge-to-subscription

2026-03-31 08:48:54 +09:00

ansi_strip.py

fix(cli): sanitize terminal escapes when replaying stored history (/resume recap, /status recap)

2026-07-17 04:53:38 -07:00

approval.py

fix(approval): detect recursive rm when flags follow operands

2026-07-26 20:58:52 -07:00

async_delegation.py

feat(delegation): structured stall metadata + live per-child status in /agents

2026-07-26 17:13:52 -07:00

binary_extensions.py

fix(tools): address PR review — remove _extract_raw_output, BudgetConfig everywhere, read_file hardening

2026-04-08 02:24:32 -07:00

blueprints.py

fix: widen UTF-8 BOM tolerance to all sibling frontmatter parsers

2026-07-17 04:52:02 -07:00

browser_camofox_state.py

feat(browser): add persistent Camofox sessions and VNC URL discovery (salvage #4400) (#4419)

2026-04-01 04:18:50 -07:00

browser_camofox.py

fix(browser): block Camofox input on private pages

2026-07-03 03:27:47 -07:00

browser_cdp_tool.py

fix(browser): apply private-page guard to browser_cdp frame_id routing

2026-07-03 03:27:47 -07:00

browser_dialog_tool.py

feat: auto-launch Chromium-family browser for CDP

2026-05-19 22:34:05 -07:00

browser_supervisor.py

fix(browser): harden browser tool safety boundaries

2026-07-01 05:04:41 -07:00

browser_tool.py

fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428)

2026-07-24 11:45:57 -07:00

budget_config.py

fix(agent): scale tool-output budget to the model context window (#23767)

2026-06-21 17:46:38 +05:30

checkpoint_manager.py

feat(diff): cross-surface /diff with staged/all/session modes

2026-07-26 18:28:20 -07:00

clarify_gateway.py

feat(clarify): extend multi-select to gateway text fallback and TUI bridge

2026-07-26 17:46:55 -07:00

clarify_tool.py

fix(clarify): route multi_select through current dispatch paths and harden callback detection

2026-07-26 17:46:55 -07:00

close_terminal_tool.py

fix(config): accept 'on' as truthy for env flags via shared env_var_enabled helper

2026-07-02 03:00:59 -07:00

code_execution_tool.py

fix(kanban): harden delegated-child mutation boundary

2026-07-23 07:33:36 -07:00

computer_use_tool.py

feat(computer_use): cross-platform cua-driver (macOS/Windows/Linux)

2026-06-22 06:42:30 -07:00

credential_files.py

fix(credentials): hoist read-guard import, fail closed loudly (#67665)

2026-07-20 09:21:08 -07:00

cronjob_tools.py

fix(cron): reconcile external provider after a claimed direct run (#70479)

2026-07-24 13:37:04 +10:00

daemon_pool.py

fix(cli): reliable interrupts, bounded exit, and exit feedback (#57000)

2026-07-02 04:20:43 -07:00

debug_helpers.py

feat(moa): expose MoA presets as selectable virtual models (#46081)

2026-06-25 13:52:06 -07:00

delegate_tool.py

fix(delegation): route delegated-child API calls inline to avoid nested-pool wedge (#60203)

2026-07-26 20:37:51 -07:00

delegation_live_log.py

fix(delegation): redact credentials in live subagent transcripts

2026-07-20 06:50:31 -07:00

desktop_ui.py

feat(desktop): agent can focus panes + shared desktop-UI event bridge

2026-07-22 12:13:01 -05:00

discord_tool.py

fix(discord): bound REST response reads

2026-07-07 02:40:04 -07:00

env_passthrough.py

fix(security): strip dynamic Hermes secrets from all subprocess spawn env

2026-07-01 14:37:22 +05:30

env_probe.py

fix(windows): re-fit env_probe console suppression to the temp-file _run + add no-window tests (#67690 follow-up)

2026-07-23 18:20:24 -07:00

fal_common.py

refactor(image_gen): port FAL backend to plugins/image_gen/fal

2026-05-22 04:10:45 -07:00

feishu_doc_tool.py

perf(cli): cut ~19s from 'hermes' cold start (skills cache + lazy Feishu + no Nous HTTP) (#22138)

2026-05-08 16:39:32 -07:00

feishu_drive_tool.py

perf(cli): cut ~19s from 'hermes' cold start (skills cache + lazy Feishu + no Nous HTTP) (#22138)

2026-05-08 16:39:32 -07:00

file_operations.py

fix(file-safety): distinguish safe-root write denial from credential blocks

2026-07-14 17:09:40 +05:30

file_state.py

feat(delegate): cross-agent file state coordination for concurrent subagents (#13718)

2026-04-21 16:41:26 -07:00

file_tools.py

refactor(terminal,file-tools): delete legacy env-side cwd tracking (step 4)

2026-07-16 00:18:38 -07:00

focus_pane_tool.py

feat(desktop): agent can focus panes + shared desktop-UI event bridge

2026-07-22 12:13:01 -05:00

fuzzy_match.py

fix(tools): normalize Unicode space family and minus sign in patch fuzzy matching

2026-07-26 20:58:43 -07:00

homeassistant_tool.py

fix: clean up description escaping, add string-data tests

2026-04-13 04:45:07 -07:00

hook_output_spill.py

feat(hooks): spill oversized hook-injected context to disk (#20468)

2026-07-05 13:51:26 -07:00

image_generation_tool.py

fix(deepinfra): harden multimodal provider routing

2026-07-14 02:59:39 +05:30

image_source.py

security(vision): route local-file inputs through the shared credential-read guard

2026-07-05 00:47:54 -07:00

interrupt.py

fix(interrupt): run user-approved commands from a clean interrupt slate

2026-07-06 04:58:42 -07:00

kanban_tools.py

fix: scope kanban auto-subscriptions to active profile

2026-07-26 16:27:52 -07:00

lazy_deps.py

fix(update): refresh cve dependency pins

2026-07-26 19:29:07 -07:00

managed_tool_gateway.py

fix(windows): sweep remaining bare read_text/write_text sites + linter rule

2026-07-24 17:10:39 -07:00

mcp_dashboard_oauth.py

fix(mcp): preserve live OAuth state during reauth

2026-07-17 04:50:47 -07:00

mcp_oauth_manager.py

fix(mcp): preserve live OAuth state during reauth

2026-07-17 04:50:47 -07:00

mcp_oauth.py

fix(mcp): preserve live OAuth state during reauth

2026-07-17 04:50:47 -07:00

mcp_stdio_watchdog.py

fix(mcp): use direct parent identity in stdio watchdog

2026-07-18 04:15:13 -07:00

mcp_tool.py

feat(mcp): fnmatch glob support in tools.include/exclude filters

2026-07-26 08:26:09 -07:00

memory_tool.py

fix(memory): close second-read drift race and treat invalid UTF-8 as unreadable

2026-07-24 15:58:01 -07:00

microsoft_graph_auth.py

feat(msgraph): add auth and client foundation

2026-05-08 09:27:26 -07:00

microsoft_graph_client.py

fix(msgraph): stream download_to_file body instead of buffering

2026-05-08 09:27:26 -07:00

neutts_synth.py

fix(tts): document NeuTTS provider and align install guidance (#1903)

2026-03-18 02:55:30 -07:00

open_preview_tool.py

feat(desktop): agent can focus panes + shared desktop-UI event bridge

2026-07-22 12:13:01 -05:00

openrouter_client.py

refactor: route ad-hoc LLM consumers through centralized provider router

2026-03-11 20:02:36 -07:00

osv_check.py

fix(osv_check): honor npx --package/-p install target when parsing package arg (#40567)

2026-06-06 18:30:39 -07:00

patch_parser.py

fix(patch): ignore inert context-only hunks (#63678)

2026-07-13 02:42:18 -07:00

path_security.py

refactor: extract shared helpers to deduplicate repeated code patterns (#7917)

2026-04-11 13:59:52 -07:00

process_registry.py

fix(process_registry): reader loop no longer hangs when an orphaned grandchild holds the stdout pipe

2026-07-24 15:59:02 -07:00

project_tools.py

feat(tools): add project workspace tools

2026-06-25 16:40:27 -05:00

read_extract.py

feat(read): extract notebook and office documents (#37082)

2026-06-13 14:42:51 -07:00

read_terminal_tool.py

fix(config): accept 'on' as truthy for env flags via shared env_var_enabled helper

2026-07-02 03:00:59 -07:00

registry.py

perf(tools): text prefilter before AST parse in tool discovery

2026-07-13 18:14:15 -04:00

schema_sanitizer.py

fix(tools): rename provider-illegal property keys in tool schemas, reverse-map at dispatch

2026-07-26 08:26:09 -07:00

send_message_tool.py

fix(gateway,tools): add missing .3gp and .webm to video extension sets

2026-07-26 12:52:31 -07:00

session_search_tool.py

fix(session-search): allow scrolling compacted lineage history

2026-07-26 16:18:31 -07:00

skill_manager_tool.py

fix(skills): fail closed on unknown curator ownership

2026-07-25 20:15:37 -07:00

skill_provenance.py

fix(curator): only mark agent-created for background-review sediment (#19621)

2026-05-04 02:42:16 -07:00

skill_usage.py

fix(curator): make the autonomous write policy consistent (#67140)

2026-07-25 19:27:17 -07:00

skills_ast_audit.py

refactor(skills): slim AST diagnostic to single entry point

2026-05-23 17:47:26 -07:00

skills_guard.py

fix(skills): bind bundles to exact files and origins

2026-07-12 02:59:27 -07:00

skills_hub.py

fix(skills): never change a skill's source registry on update

2026-07-26 19:29:56 -07:00

skills_sync.py

feat(curator): surface unmanaged skills and add curator adopt

2026-07-25 18:10:24 -07:00

skills_tool.py

fix(skills): scope 60-char description enforcement to the create path

2026-07-24 07:54:21 -07:00

slash_confirm.py

fix(async): close unscheduled coroutines in all threadsafe bridges (#26584)

2026-05-15 14:00:01 -07:00

terminal_tool.py

fix(kanban): keep delegated results in worker turn

2026-07-23 08:33:55 -07:00

thread_context.py

fix(code-exec): propagate agent-turn context into tool worker threads

2026-05-29 03:44:49 -07:00

threat_patterns.py

fix: bound threat-pattern/FTS5 regex input and cover V4A Move-File edits

2026-07-01 01:05:28 -07:00

tirith_security.py

fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428)

2026-07-24 11:45:57 -07:00

todo_tool.py

fix(compression): preserve synthetic user provenance

2026-07-22 06:56:53 -07:00

tool_backend_helpers.py

feat(tools): surface the free tool pool in entitlement + setup (#36153)

2026-06-01 06:32:48 +05:30

tool_output_limits.py

fix: tool_output_limits re-reads config on every call (no caching)

2026-05-31 00:50:19 -07:00

tool_result_storage.py

fix: keep persisted tool results inside their storage directory

2026-06-30 16:39:41 -07:00

tool_search.py

feat(tools): tier-2 server-summary hint + per-server listing degradation; 5% default budget

2026-07-26 08:26:09 -07:00

transcription_tools.py

fix(tools): utf-8 decode for STT/TTS command-provider popen_kwargs

2026-07-24 15:47:12 -07:00

tts_streaming.py

feat(voice): speech-interrupted latch in the TTS streaming core

2026-07-22 17:53:06 -05:00

tts_tool.py

fix(tools): utf-8 decode for STT/TTS command-provider popen_kwargs

2026-07-24 15:47:12 -07:00

url_safety.py

fix(url_safety): harden proxy DNS delegation — literal IPs stay fail-closed + regression tests

2026-07-24 10:37:29 -07:00

video_generation_tool.py

feat(providers): Support DeepInfra as an LLM provider

2026-07-14 02:59:39 +05:30

vision_tools.py

fix(security): pin DNS resolutions for SSRF-safe fetches

2026-07-23 11:44:43 -07:00

voice_mode.py

fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428)

2026-07-24 11:45:57 -07:00

web_tools.py

fix: add encoding="utf-8" to Path.write_text() calls (P1)

2026-07-24 17:10:39 -07:00

website_policy.py

fix(website-policy): key blocklist cache on the real default config path

2026-07-04 15:08:49 -07:00

working_diff.py

feat(diff): cross-surface /diff with staged/all/session modes

2026-07-26 18:28:20 -07:00

write_approval.py

fix(memory,skills): repair write-approval inline prompt, gateway staging, and gateway /skills review (#43452)

2026-06-10 02:57:15 -07:00

x_search_tool.py

docs(xai): clarify x_search vs xurl routing without schema cross-refs

2026-07-23 21:06:47 -07:00

xai_http.py

fix: add UTF-8 encoding to read_text/write_text in tools/ and agent/

2026-07-24 17:10:39 -07:00

xai_video_tools.py

feat(xai): Imagine public-URL storage, chaining & video edit/extend

2026-06-29 21:11:58 -07:00

yuanbao_tools.py

Fix unsafe gateway media path delivery

2026-05-23 01:40:35 -07:00