nesquena-hermes dd17a0e9b7 security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354) ...

* security: fix bandit security issues (B310, B324)

- Add usedforsecurity=False to MD5 hash in gateway_watcher.py
- Add URL scheme validation to prevent file:// access in config.py
- Add URL validation to bootstrap.py health check
- Add nosec comments where runtime validation exists

* fix: handle ConnectionResetError gracefully and add debug logging

- Add QuietHTTPServer class to suppress noisy connection reset errors
  caused by clients disconnecting abruptly (fixes log spam from
  'ConnectionResetError: [Errno 54] Connection reset by peer')

- Replace silent 'pass' statements with logger.debug() calls across
  api/auth.py, api/config.py, api/gateway_watcher.py, api/models.py,
  and api/onboarding.py for better observability during troubleshooting

- All tests pass (25 passed in test_regressions.py)

* chore: add debug logging to profiles and routes modules

- Replace silent 'pass' statements with logger.debug() calls in
  api/profiles.py for better error visibility during profile switching
  and module patching

- Add logger initialization to api/routes.py

* security: fix B110 bare except/pass issues (bandit security scan)

- Replace bare except/pass patterns with logger.debug() calls
- Fixes CWE-703 (improper check/handling of exceptional conditions)
- Files affected: routes.py, state_sync.py, streaming.py, workspace.py, server.py
- All tests pass successfully

* security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

- api/gateway_watcher.py: MD5 usedforsecurity=False (B324)
- api/config.py, bootstrap.py: URL scheme validation before urlopen (B310)
- 12 files: replace bare except/pass with logger.debug() (B110)
- server.py: QuietHTTPServer suppresses client disconnect log noise
- server.py: fix sys.exc_info() (was traceback.sys.exc_info(), impl detail)
- tests/test_sprint43.py: 19 new tests covering all security fixes
- CHANGELOG.md: v0.50.14 entry; 841 tests total (up from 822)

---------

Co-authored-by: lawrencel1ng <lawrence.ling@global.ntt>
Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>

2026-04-13 11:11:56 -07:00

..

__init__.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

conftest.py

feat: composer-centric UI refresh + Hermes Control Center (v0.50.0, closes #242)

2026-04-12 11:55:40 -07:00

test_approval_unblock.py

fix: unskip 16 approval tests — remove stale has_pending/pop_pending imports

2026-04-10 10:10:28 -07:00

test_auth_sessions.py

fix(auth): prune expired sessions on every verify to prevent memory leak (#196)

2026-04-09 18:05:23 -07:00

test_cancel_interrupt.py

v0.46.0: security, Docker UID/GID, model discovery, i18n, cancel fix

2026-04-11 10:17:52 -07:00

test_gateway_sync.py

feat: real-time gateway session sync (Phase 1) (#274)

2026-04-11 20:53:12 -07:00

test_issue341.py

fix: add table styles to .msg-body for readable bordered chat tables (fixes #341) (#345)

2026-04-13 00:08:30 -07:00

test_issue342.py

feat: autolink plain URLs in chat messages (fixes #342) (#346)

2026-04-13 00:05:04 -07:00

test_mobile_layout.py

fix: mobile Enter inserts newline (closes #269) (#320)

2026-04-12 12:41:12 -07:00

test_model_resolver.py

v0.47.0: dialogs, session menu, /skills, mobile fixes, mobile QA suite

2026-04-11 12:19:12 -07:00

test_onboarding_mvp.py

feat(onboarding): add one-shot bootstrap and first-run setup wizard (#285)

2026-04-12 00:11:41 -07:00

test_onboarding_static.py

feat(onboarding): add one-shot bootstrap and first-run setup wizard (#285)

2026-04-12 00:11:41 -07:00

test_profile_env_isolation.py

fix: isolate profile .env secrets on switch (#351)

2026-04-13 00:51:55 -07:00

test_provider_mismatch.py

fix: warn on provider/model mismatch, surface auth errors (#266)

2026-04-11 21:25:18 -07:00

test_regressions.py

feat: composer-centric UI refresh + Hermes Control Center (v0.50.0, closes #242)

2026-04-12 11:55:40 -07:00

test_security_redaction.py

v0.46.0: security, Docker UID/GID, model discovery, i18n, cancel fix

2026-04-11 10:17:52 -07:00

test_spanish_locale.py

feat(i18n): add Spanish locale for WebUI (#275)

2026-04-11 20:06:37 -07:00

test_sprint1.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint2.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint3.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint4.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint5.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint6.py

feat: composer-centric UI refresh + Hermes Control Center (v0.50.0, closes #242)

2026-04-12 11:55:40 -07:00

test_sprint7.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint8.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint9.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint10.py

Hermes WebUI v0.1.0 — initial public release

2026-03-30 20:40:19 -07:00

test_sprint11.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint12.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint13.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint14.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

test_sprint15.py

feat: Sprint 15 — session projects, code copy button, tool card toggle

2026-04-02 00:11:49 -07:00

test_sprint16.py

feat: composer-centric UI refresh + Hermes Control Center (v0.50.0, closes #242)

2026-04-12 11:55:40 -07:00

test_sprint17.py

feat: Sprint 17 -- workspace breadcrumbs, slash commands, send key setting

2026-04-03 04:13:38 -07:00

test_sprint19.py

fix(auth): harden password_hash handling in settings API

2026-04-03 06:21:04 -07:00

test_sprint20.py

feat: pluggable i18n with English/Chinese language switcher in Settings

2026-04-08 18:57:50 -07:00

test_sprint20b.py

feat: composer-centric UI refresh + Hermes Control Center (v0.50.0, closes #242)

2026-04-12 11:55:40 -07:00

test_sprint23.py

fix: test hardening for sprint 23 — handle missing cron/skills modules in test env

2026-04-03 19:16:17 -07:00

test_sprint26.py

fix: settings unsaved-changes guard, add Slate theme, improve Light theme

2026-04-05 04:00:24 +00:00

test_sprint27.py

fix: harden bot_name — crash guard, XSS escape, sanitization, tests

2026-04-06 15:06:16 +00:00

test_sprint28.py

fix: personalities from config.yaml + ephemeral_system_prompt (#139) (#148)

2026-04-06 14:10:30 -07:00

test_sprint29.py

fix: broaden session ID validator to support new hermes-agent format (#212)

2026-04-10 00:00:02 -07:00

test_sprint30.py

v0.44.0: approval fix, login CSP, update diagnostics, Lucide icons

2026-04-10 10:02:28 -07:00

test_sprint31.py

feat: custom endpoint fields in new profile form (fixes #170, closes #214)

2026-04-10 11:43:49 -07:00

test_sprint32.py

feat: auto-install missing agent deps on startup (#215)

2026-04-10 00:42:02 -07:00

test_sprint33.py

v0.47.0: dialogs, session menu, /skills, mobile fixes, mobile QA suite

2026-04-11 12:19:12 -07:00

test_sprint34.py

fix: use pathlib in test_sprint34 static file opens (no bare relative paths) (#349)

2026-04-13 00:22:58 -07:00

test_sprint35.py

fix+feat: session title guard + breadcrumb nav + wider panel + responsive msgs (closes #300, #292)

2026-04-12 10:51:48 -07:00

test_sprint36.py

fix: cancel cleanup no longer depends on SSE event (closes #299)

2026-04-12 11:08:59 -07:00

test_sprint37.py

feat: workspace panel state persists across refreshes (#321)

2026-04-12 12:50:32 -07:00

test_sprint38.py

fix: strip think tags when model emits leading whitespace before <think> (#327)

2026-04-12 14:07:00 -07:00

test_sprint39.py

feat: HERMES_WEBUI_SKIP_ONBOARDING env var + synchronous key reload (#330)

2026-04-12 14:26:00 -07:00

test_sprint40.py

feat: OAuth provider onboarding path — Codex/Copilot no longer blocks setup (#331)

2026-04-12 14:28:16 -07:00

test_sprint41.py

fix: title auto-generation + mobile close button (PR #333) + v0.50.10

2026-04-12 21:45:25 -07:00

test_sprint42.py

fix: inject SessionDB into AIAgent for WebUI sessions — enables session_search (#356)

2026-04-13 10:53:58 -07:00

test_sprint43.py

security: bandit fixes B310/B324/B110 + QuietHTTPServer (#354)

2026-04-13 11:11:56 -07:00

test_tls_support.py

feat: optional HTTPS/TLS support via cert and key env vars (#199)

2026-04-09 18:08:29 -07:00

test_update_checker.py

v0.44.0: approval fix, login CSP, update diagnostics, Lucide icons

2026-04-10 10:02:28 -07:00

test_updates.py

fix: improve self-update git pull diagnostics (#287)

2026-04-12 00:19:33 -07:00