liuhao1024 ec9329ec41 fix(security): require dashboard auth for plugin API routes ...

Remove the blanket /api/plugins/* exemption from auth_middleware so
plugin API routes (e.g. Kanban dashboard) require the same session
token as all other /api/ endpoints.

Fixes #19533

2026-05-10 07:04:18 -07:00

..

__init__.py

…

_parser.py

…

_subprocess_compat.py

…

auth_commands.py

auth: use get_default_hermes_root() for shared nous_auth.json path

2026-05-08 14:27:40 -07:00

auth.py

feat(cross-platform): psutil for PID/process management + Windows footgun checker

2026-05-08 14:27:40 -07:00

azure_detect.py

…

backup.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

banner.py

fix(banner): resolve update-check repo from running code, not profile-scoped path

2026-05-09 04:10:35 -07:00

browser_connect.py

…

callbacks.py

…

checkpoints.py

…

claw.py

…

cli_output.py

…

clipboard.py

…

codex_models.py

docs(codex-spark): document ChatGPT Pro entitlement gating

2026-05-09 23:17:25 -07:00

colors.py

…

commands.py

…

completion.py

fix(completion): use valid zsh _arguments exclusion-group syntax

2026-05-09 13:36:44 -07:00

config.py

fix(terminal): bridge docker_env config to TERMINAL_DOCKER_ENV

2026-05-09 17:53:35 -07:00

copilot_auth.py

…

cron.py

…

curator.py

feat(curator): show rename map in user-visible summary (#22910)

2026-05-09 18:43:40 -07:00

curses_ui.py

…

debug.py

…

default_soul.py

…

dingtalk_auth.py

…

doctor.py

fix(doctor): normalize provider name and aliases before dedicated-skip check

2026-05-09 13:36:33 -07:00

dump.py

…

env_loader.py

feat(cross-platform): psutil for PID/process management + Windows footgun checker

2026-05-08 14:27:40 -07:00

fallback_cmd.py

…

gateway_windows.py

fix(gateway): preserve Ctrl+C for Windows foreground runs

2026-05-09 14:34:18 -07:00

gateway.py

fix(gateway): detect gateway process via /proc in Docker without procps

2026-05-09 17:54:17 -07:00

goals.py

…

hooks.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

kanban_db.py

fix(kanban): make _migrate_add_optional_columns idempotent on concurrent open

2026-05-09 13:36:23 -07:00

kanban_diagnostics.py

…

kanban_specify.py

…

kanban.py

fix(kanban): /kanban slash command emits argparse garbage instead of help

2026-05-09 22:49:29 -07:00

logs.py

…

main.py

feat(curator): show rename map in user-visible summary (#22910)

2026-05-09 18:43:40 -07:00

mcp_config.py

feat(mcp): add codex preset for built-in MCP server discovery

2026-05-09 11:11:28 -07:00

memory_setup.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

model_catalog.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

model_normalize.py

…

model_switch.py

docs(codex-spark): document ChatGPT Pro entitlement gating

2026-05-09 23:17:25 -07:00

models.py

chore(models): refresh OpenRouter + Nous fallback lists (#23001)

2026-05-09 22:47:38 -07:00

nous_subscription.py

…

oneshot.py

fix: make session search initialize session db

2026-05-09 14:36:58 -07:00

pairing.py

…

platforms.py

…

plugins_cmd.py

fix(plugins): resolve Git binary for installs under minimal PATH

2026-05-09 11:10:04 -07:00

plugins.py

feat(plugins): HERMES_PLUGINS_DEBUG=1 surfaces plugin discovery logs (#22684)

2026-05-09 11:07:12 -07:00

profile_distribution.py

…

profiles.py

fix(profiles): exclude infrastructure artifacts when cloning with --clone-all

2026-05-09 04:10:35 -07:00

providers.py

…

pt_input_extras.py

fix(cli): make Ctrl+Enter insert newline on WSL/SSH/Windows Terminal (#22777)

2026-05-09 12:48:14 -07:00

pty_bridge.py

feat(cross-platform): psutil for PID/process management + Windows footgun checker

2026-05-08 14:27:40 -07:00

relaunch.py

…

runtime_provider.py

fix: use credential_pool for custom endpoint model listing probes

2026-05-09 17:54:58 -07:00

setup.py

fix(setup): offer gateway service install on Windows (#22099)

2026-05-08 14:59:59 -07:00

skills_config.py

…

skills_hub.py

codebase: add encoding='utf-8' to all bare open() calls (PLW1514)

2026-05-08 14:27:40 -07:00

skin_engine.py

…

slack_cli.py

fix(slack): enable writable app home DMs in manifest

2026-05-08 17:01:12 -07:00

status.py

…

stdio.py

…

timeouts.py

…

tips.py

feat: Ctrl+Enter inserts newline on Windows Terminal

2026-05-08 14:27:40 -07:00

tools_config.py

fix(tools): install cua-driver when Computer Use is enabled via 'hermes tools' (#22765)

2026-05-09 13:02:25 -07:00

uninstall.py

feat(windows uninstall): clean up User env, PATH, Scheduled Task, and portable tooling

2026-05-08 14:27:40 -07:00

vercel_auth.py

…

voice.py

…

web_server.py

fix(security): require dashboard auth for plugin API routes

2026-05-10 07:04:18 -07:00

webhook.py

…