nesquena-hermes 96ca83bf53 fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error ...

Opus stage-339 review SHOULD-FIX items:

1. server.py: drop 'unsafe-eval' from CSP report-only policy.
   Verified by grepping all production JS — zero matches for eval(),
   new Function(), or string-form setTimeout/setInterval. Keeping it
   was a gratuitous privilege.

2. server.py: add https://cdn.jsdelivr.net to script-src + style-src.
   index.html loads Prism/xterm/katex from this CDN with SRI hashes —
   without the allowance every page load fires known-good CSP violations
   that drown out real signal once a collector is wired.

3. api/commands.py: sanitize plugin command error. Previously returned
   f'Plugin command error: {exc}' which would leak paths/env from
   FileNotFoundError('/etc/something/secret.key') etc. Now returns only
   the exception type name; full traceback goes to server log.

Test asserts updated to match the new policy shape.

Co-authored-by: Opus advisor <opus-advisor@hermes.local>

2026-05-11 17:53:02 +00:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

agent_health.py

Mute stale stopped gateway heartbeat

2026-05-09 14:53:42 +08:00

agent_sessions.py

fix: align fork lineage projection paths

2026-05-11 17:15:22 +08:00

auth.py

fix(stage-326): preserve SESSION_TTL constant + reconcile #1957 tests

2026-05-09 18:33:28 +00:00

background.py

feat(commands): /background, /btw slash commands + undo button + reasoning chip

2026-04-24 01:24:51 +00:00

clarify.py

feat(clarify): SSE long-connection for real-time clarify notifications (#1355)

2026-04-30 21:32:51 +00:00

commands.py

fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error

2026-05-11 17:53:02 +00:00

compression_anchor.py

Refactor compression anchor visibility helpers

2026-05-11 20:56:30 +08:00

config.py

Fix custom provider name slugs with ports

2026-05-11 17:24:53 +08:00

dashboard_probe.py

feat: link official Hermes dashboard

2026-05-05 01:23:55 +00:00

extensions.py

Opus pre-release follow-ups for PR #1445

2026-05-02 03:49:40 +00:00

gateway_watcher.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

goals.py

fix(i18n): localize /goal runtime status strings

2026-05-10 15:21:24 +08:00

helpers.py

fix: add cdn.jsdelivr.net to CSP connect-src to allow xterm source map fetches

2026-05-07 20:42:55 +00:00

kanban_bridge.py

stage-315 absorb: document handle_kanban_* three-valued return contract

2026-05-07 18:52:01 +00:00

metering.py

fix: show TPS in assistant message headers

2026-05-04 21:26:43 +00:00

models.py

Add worktree-backed session creation

2026-05-11 12:12:40 +08:00

oauth.py

fix(oauth): serialize Anthropic env fallback reads

2026-05-07 02:47:19 +00:00

onboarding.py

Fix Xiaomi API key env detection

2026-05-11 07:33:52 +08:00

profiles.py

Fix HERMES_HOME skill cache patching

2026-05-11 19:12:02 +08:00

providers.py

fix(providers): log warning when custom provider entry yields empty slug

2026-05-11 17:30:56 +00:00

request_diagnostics.py

fix: add request wedge diagnostics

2026-05-08 15:37:08 +00:00

rollback.py

v0.50.255: Opus follow-ups (4 fixes) + CHANGELOG

2026-05-01 17:19:53 +00:00

routes.py

Merge PR #2059 into stage-339

2026-05-11 17:43:58 +00:00

session_ops.py

Show profile home in /status command (refs #463) (#1380)

2026-05-01 04:46:37 +00:00

session_recovery.py

Merge PR #2059 into stage-339

2026-05-11 17:43:58 +00:00

startup.py

fix: P0 hotfixes — API regression, code block parser, chmod override

2026-05-01 12:10:48 +00:00

state_sync.py

security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

2026-04-13 11:11:56 -07:00

streaming.py

Merge PR #2062 into stage-339

2026-05-11 17:43:58 +00:00

system_health.py

feat: add VPS resource health panel

2026-05-05 17:30:56 +00:00

terminal.py

absorb: address Opus review findings (security + correctness)

2026-04-29 05:06:34 +00:00

turn_journal.py

fix: address turn journal lifecycle review

2026-05-11 17:16:43 +02:00

updates.py

fix: normalize update banner repository URLs

2026-05-05 08:29:00 -07:00

upload.py

Merge remote-tracking branch 'refs/remotes/pr/1229' into stage/batch-v0.50.238

2026-04-29 15:17:57 +00:00

workspace.py

fix: preserve inaccessible workspace entries

2026-05-07 16:56:48 +00:00

worktrees.py

Add worktree-backed session creation

2026-05-11 12:12:40 +08:00