nesquena-hermes c888dd6a79 stage #4637 (santastabber): allow toggling installed extensions (extensions phase-2) (#4649) ...

UI enable/disable of installed manifest extensions via a bounded fail-safe
extension-overrides.json state file. Safe boundary: no manifest edits, no asset
fetches, no sidecar proxy, no extension-owned routes. /api/extensions/toggle is
auth+CSRF gated; anchored _EXTENSION_ID_RE (no path traversal); atomic UTF-8 write
under _EXTENSION_STATE_LOCK; 32KiB/512-id DoS bounds; disabled override suppresses
asset/sidecar injection end-to-end. Nathan greenlit the extensions-phase-2 concept.
Code byte-faithful from PR head 8769b4a390. 49 own tests pass.

Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
Co-authored-by: santastabber <santastabber@users.noreply.github.com>

2026-06-21 19:15:54 -07:00

..

architecture

rebase #4411 onto master (v0.51.542) for deep-review — Stable Assistant Turn Anchors capstone

2026-06-20 21:48:55 +00:00

images

docs: add clarify dialog screenshot evidence

2026-05-25 16:25:11 +08:00

pr-assets

fix(ui): restore rail-era app titlebar state (v0.50.226) (#1163)

2026-04-27 11:43:32 -07:00

pr-media

Release v0.51.238 — Release HF (stage-q9) (#3493)

2026-06-03 12:23:46 -07:00

rfcs

fix(anchor): harden registry contract before wiring

2026-06-13 00:44:26 +08:00

ui-ux

chore(#4024): drop docs/ui-ux/review-shots/ trifecta scratch from the release diff

2026-06-13 02:15:01 +00:00

advanced-chat-setup.md

docs(readme): re-sequence IA — pull Features up, consolidate access, extract niche docs

2026-06-01 02:26:18 +00:00

CONTRACTS.md

Release LW stage — v0.51.359 (#3962 assistant turn anchor phase 0 scaffold) (#3977)

2026-06-10 23:14:18 -07:00

docker.md

stage #4491: multi-container gateway URL (#4483) + v0.51.517 CHANGELOG

2026-06-19 19:09:00 +00:00

EXTENSIONS.md

stage #4637 (santastabber): allow toggling installed extensions (extensions phase-2) (#4649)

2026-06-21 19:15:54 -07:00

ISSUES.md

fix(#1195): route sessions to profile dir even when dir doesn't exist yet (#1373)

2026-04-30 23:24:31 +00:00

onboarding-agent-checklist.md

docs: add agent onboarding entrypoint

2026-05-13 16:47:14 +08:00

onboarding.md

docs(onboarding): place AIML setup with custom-provider guidance (#4045)

2026-06-12 12:41:43 -04:00

remote-access.md

docs(readme): re-sequence IA — pull Features up, consolidate access, extract niche docs

2026-06-01 02:26:18 +00:00

supervisor.md

fix: block duplicate webui start when launchd owns 8787

2026-05-31 23:02:23 +00:00

troubleshooting.md

fix(bootstrap): discover agent installed as root (FHS) or behind the bash launcher

2026-06-21 16:55:40 +00:00

UIUX-GUIDE.md

[HELD — independent review pending] Release v0.51.294 — stage-3401 (live-to-final redesign #3401 + 4 deep-review fixes) (#3741)

2026-06-06 12:12:37 -07:00

why-hermes.md

docs: move Hermes overview out of agent context root

2026-05-19 23:55:58 -07:00

workspace-git.md

Release v0.51.311 — Release KA (brick-wave: workspace Git RCE hardening #3769 + stale-snapshot sidebar visibility #3770) (#3776)

2026-06-07 08:05:30 -07:00

wsl-autostart.md

docs: add WSL WebUI autostart helpers

2026-05-05 01:12:07 +00:00