Files
hermes-agent/tests/hermes_cli
teknium1 34de127200 fix(auth): widen portal_base_url allowlist guard to runtime credential path
The salvaged PR guarded only resolve_nous_access_token; the primary
resolve_nous_runtime_credentials path also POSTs the refresh token to
portal_base_url on refresh with no allowlist check. Mirror the guard
there so a poisoned host can't receive the bearer, and drop the stray
duplicated allowlist comment. Adds a sibling-site regression test.
2026-07-01 04:57:40 -07:00
..