EloquentBrush0x 784d8dd2c2 fix(matrix): fail-closed approval reaction auth when MATRIX_ALLOWED_USERS is empty ...

The _on_reaction approval handler used:

    if self._allowed_user_ids and sender not in self._allowed_user_ids:

When MATRIX_ALLOWED_USERS is not configured, _allowed_user_ids is an
empty set. The short-circuit on the empty set caused the deny block to
never execute, allowing any Matrix room member to approve or deny tool
calls via ✅/❎ reactions — even users that run.py's _is_user_authorized
would reject for regular messages.

Fix mirrors the Telegram _is_callback_user_authorized fix (commit
89d32052e, PR #28494): deny by default when no allowlist is configured,
unless GATEWAY_ALLOW_ALL_USERS=true is explicitly set.

2026-05-29 03:58:45 -07:00

..

acp

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

acp_adapter

feat(azure-foundry): add Microsoft Entra ID auth

2026-05-18 10:14:38 -07:00

agent

fix(auth): address Nous JWT fallback review

2026-05-29 02:24:48 -07:00

cli

fix(cli): ignore terminal focus reports (salvage of #16780)

2026-05-29 00:31:44 -07:00

cron

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

docker

fix(dashboard-auth): share /api/* public allowlist between legacy and OAuth gates

2026-05-29 12:17:12 +10:00

e2e

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

fakes

…

gateway

fix(matrix): fail-closed approval reaction auth when MATRIX_ALLOWED_USERS is empty

2026-05-29 03:58:45 -07:00

hermes_cli

refactor(auth): remove vestigial Nous min_key_ttl/inference_auth_mode params

2026-05-29 02:24:48 -07:00

hermes_state

feat(session_search): single-shape tool with discovery, scroll, browse — no LLM (#27590)

2026-05-17 23:28:45 -07:00

honcho_plugin

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

integration

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

openviking_plugin

…

plugins

feat(kanban): add POST /runs/{run_id}/terminate endpoint

2026-05-29 00:21:54 -07:00

providers

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

run_agent

fix(code-exec): propagate agent-turn context into tool worker threads

2026-05-29 03:44:49 -07:00

scripts

feat(acp-registry): switch to uvx distribution, drop npm launcher

2026-05-14 22:27:09 -07:00

skills

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

stress

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

tools

fix(code-exec): make dropped HERMES_* env vars diagnosable in sandbox scrub

2026-05-29 03:44:49 -07:00

tui_gateway

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

website

…

__init__.py

…

conftest.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

run_interrupt_test.py

…

test_account_usage.py

…

test_atomic_replace_symlinks.py

…

test_base_url_hostname.py

…

test_batch_runner_checkpoint.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_bitwarden_secrets.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_cli_file_drop.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_cli_manual_compress.py

fix(tests): catch up six stale tests after compression/aux/kanban changes (#28465)

2026-05-18 21:43:59 -07:00

test_cli_skin_integration.py

…

test_ctx_halving_fix.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_docker_home_override_scripts.py

docker: opt in to dashboard --insecure via env var, never derive from bind host

2026-05-29 09:56:40 +10:00

test_empty_model_fallback.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_env_loader_secret_sources.py

fix(secrets): only apply external secrets once per HERMES_HOME per process (#32271)

2026-05-25 15:18:55 -07:00

test_evidence_store.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_gateway_streaming_nested_config.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_get_tool_definitions_cache_isolation.py

…

test_hermes_bootstrap.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_hermes_constants.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_hermes_home_profile_warning.py

…

test_hermes_logging.py

fix(logging): recover gateway.log handler from external rotation (#34349)

2026-05-28 22:26:00 -07:00

test_hermes_state_compression_locks.py

fix(compression): prevent session-id fork from concurrent compressions (#34351)

2026-05-28 21:40:39 -07:00

test_hermes_state_wal_fallback.py

fix(kanban): skip redundant WAL pragma on already-WAL connections

2026-05-27 14:31:55 -07:00

test_hermes_state.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_honcho_client_config.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_honcho_session_context.py

fix(honcho): align user context peer perspective

2026-05-27 10:49:33 -07:00

test_install_sh_browser_install.py

fix(install): support non-sudo service-user installs on apt distros (#25814)

2026-05-14 09:05:31 -07:00

test_install_sh_pythonpath_sanitization.py

fix: harden install.sh against inherited Python env leakage

2026-05-06 04:02:02 -07:00

test_install_sh_root_fhs_uv_python_path.py

test(install): harden uv-python-path regression test against future drift

2026-05-27 13:55:51 -07:00

test_install_sh_setup_wizard_tty_probe.py

…

test_install_sh_symlink_stomp.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_install_sh_termux_network_prereqs.py

…

test_ipv4_preference.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_lazy_session_regressions.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_lint_config.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_live_system_guard_self_test.py

chore: ruff auto-fix PLR6201 resweep — tuple → set in membership tests (#27355)

2026-05-17 02:29:41 -07:00

test_mcp_serve.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_mini_swe_runner.py

…

test_minimax_model_validation.py

…

test_minimax_oauth.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_minisweagent_path.py

…

test_model_picker_scroll.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_model_tools_async_bridge.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_model_tools.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_ollama_num_ctx.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_package_json_lazy_deps.py

fix(update): make Camofox lazy-installed instead of eager (#27055)

2026-05-16 12:15:45 -07:00

test_packaging_metadata.py

fix(packaging): ship bundled plugin.yaml manifests in wheel and sdist

2026-05-29 01:23:28 -07:00

test_plugin_skills.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_process_loop_event_loop_warning.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_project_metadata.py

remove Vercel AI Gateway and Vercel Sandbox (#33067)

2026-05-27 00:43:32 -07:00

test_retry_utils.py

…

test_run_tests_parallel.py

test: use subprocesses for each test file (#29016)

2026-05-21 16:40:04 +05:30

test_sanitize_tool_error.py

security: sanitize tool error strings before injecting into model context (#26823)

2026-05-16 00:57:39 -07:00

test_sql_injection.py

…

test_subprocess_home_isolation.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_termux_all_extra_compat.py

…

test_timezone.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_toolset_distributions.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_toolsets.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_trajectory_compressor_async.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_trajectory_compressor.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_transform_llm_output_hook.py

…

test_transform_tool_result_hook.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_tui_gateway_server.py

feat: add TUI session orchestrator

2026-05-26 20:51:59 -07:00

test_utils_truthy_values.py

…

test_yuanbao_integration.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_yuanbao_markdown.py

…

test_yuanbao_pipeline.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

test_yuanbao_proto.py

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00