AlexFucuson9 fccc222bd7 fix(slack): warn when slack_tokens.json is group/world-readable ...

The OAuth multi-workspace token file contains plaintext bot tokens for
all saved Slack workspaces. Unlike the Google Chat adapter which sets
0o600 when writing credentials, the Slack token file has no permission
enforcement — a default umask 022 makes it world-readable.

Fix: check file permissions on read and emit a warning log with remediation
instructions if the file is group- or world-readable.

2026-07-23 11:44:43 -07:00

..

browser

fix: guard int(os.getenv()) casts against malformed env vars (#40598)

2026-06-07 06:14:24 -07:00

context_engine

feat(context-engine): host contract for external context engines

2026-05-28 01:45:30 -07:00

cron_providers

fix(cron): harden execution attempt ledger

2026-07-17 04:58:35 -07:00

dashboard_auth

feat(dashboard_auth): support confidential clients (client_secret) in self-hosted OIDC (#55344)

2026-06-30 13:32:51 +10:00

disk-cleanup

docs(disk-cleanup): clarify cron output-root protection is exact-match

2026-07-01 15:42:04 +05:30

google_meet

refactor(setup): route dependency installs through the canonical uv→pip→ensurepip ladder

2026-07-07 04:09:35 -07:00

hermes-achievements

fix(achievements): stop card hover click loop

2026-07-16 04:34:57 -07:00

image_gen

fix(deepinfra): harden multimodal provider routing

2026-07-14 02:59:39 +05:30

kanban

feat(kanban): per-task model dropdown — set/override worker model+provider from the board (#69876)

2026-07-22 22:23:24 -07:00

memory

fix(memory): preserve genuine pre-delimiter content in merged compaction rows

2026-07-22 06:59:14 -07:00

model-providers

feat(nous): send top-level session_id for provider sticky routing (#69253)

2026-07-22 04:39:20 -07:00

observability

fix(nemo-relay): align dynamic plugin configuration

2026-07-13 17:01:08 -06:00

platforms

fix(slack): warn when slack_tokens.json is group/world-readable

2026-07-23 11:44:43 -07:00

security-guidance

plugins: add security-guidance — pattern-matched warnings on dangerous code writes (#33131)

2026-05-27 02:07:21 -07:00

spotify

chore: prune unused imports and duplicate import redefinitions

2026-05-28 22:26:25 -07:00

teams_pipeline

fix(teams-pipeline): reject dot-only recording display_name

2026-07-01 02:03:48 -07:00

video_gen

fix(video-gen): omit duration for range-based FAL families when unspecified

2026-07-16 04:24:10 -07:00

web

fix: sanitize subprocess env for DDGS worker

2026-07-21 11:51:01 +05:30

__init__.py

feat(memory): pluggable memory provider interface with profile isolation, review fixes, and honcho CLI restoration (#4623)

2026-04-02 15:33:51 -07:00

plugin_utils.py

fix(plugins): thread-safe lazy-singleton helpers; fix honcho TOCTOU (#24759) (#42150)

2026-06-08 09:35:22 -07:00