Spaces:
Running
Running
Commit History
Yesterday
-
fix(sync): never restore the live uv interpreter; keep backups alive
Verified signature- load_from_repo(): per-file try/except so one un-copyable file cannot abort the whole restore (ETXTBSY on /opt/data/.local/share/uv/python/... made every boot restore a partial /opt/data); skip uv interpreter, skills index cache, SQLite -shm and cache dirs; report restored/skipped/failed counts. - save_to_repo(): ignore .local/share/uv/** (~5.2k files/149 MB of the payload), .npm/**, skills/.hub/index-cache/**, *.db-shm (transient file that aborted commits with FileNotFoundError/ValueError); retry the upload once. - SYNC_INTERVAL default 60s -> 900s (the 60s full-tree upload kept the Space under critical memory pressure, which blocked kanban worker dispatch).18a6131
2 days ago
-
fix: dashboard never bound, and dataset uploads were failing
Tom GrayTwo bugs surfaced on the first v2026.9.24 boot: 1. Nothing was listening on 7861 (proxy logged connect ECONNREFUSED on every request, so the dashboard was dead). Routing to the machine dashboard (profile 'linus-torvalds' preselected). Use --isolated for a dedicated per-profile server. BACKEND_PORT_IN_USE port=9119 (non-headless) rebuilds the web UI at startup when it does not recognise an existing dist, and sys.exit(1)s if that build does not succeed. vite writes to hermes_cli/web_dist, which the image build does produce, but the runtime never trusted it. Pin it with ENV HERMES_WEB_DIST, and assert the dist exists at build time so a missing one fails loudly instead of at request time. 2. Every dataset upload failed: Invalid path_in_repo ... cannot update files under a '.cache/' folder (path: 'hermes_data/home/.cache/uv/.gitignore') fnmatch matches against the path relative to folder_path, so the root-anchored '.cache/**' never covered the NESTED home/…6746996 -
update: Hermes Agent v2026.6.19 -> v2026.9.24 (v0.22.5)
Tom Gray- Dockerfile: bump pinned Hermes tag to v2026.9.24 - Dockerfile: node source stage 22 -> 26 (repo .nvmrc=26; engines ^22.22 || ^24.11 || >=26) - Dockerfile: install FULL Playwright chromium (drop --only-shell) and bake /etc/hermes/chromium-executable-path so Hermes' browser tool can find it - sync_hf.py: bind the dashboard to 127.0.0.1 instead of 0.0.0.0. Since the June 2026 hardening --insecure is a no-op and a non-loopback bind FAILS CLOSED without a registered dashboard auth provider, so the old invocation would have exited at startup. Loopback keeps proxy.js as the single gate. - README: drop dead democra-ai/HermesFace links CACHE_BUST bumped so the clone layer is rebuilt.8849a45
5 days ago
-
security: throttle login guesses without ever throttling the credential
tkgrayCheck the password before consulting the failure counter, so a stranger cannot lock the owner out of their own dashboard with junk POSTs. Wrong passwords are still delayed and 429'd; a correct password always gets through. Verified against the live Space that this flaw existed: 10 failed attempts locked the client out for the whole window.91b9750 -
security: gate /v1 at the proxy, throttle login, harden gate response
tkgray- proxy.js: remove the published fallback password; gate the dashboard on HERMES_WEBUI_PASSWORD being present, and gate /v1/* on HERMES_API_KEY (defaults to the dashboard password) with a constant-time compare. Accepted /v1 requests are rewritten to INTERNAL_API_KEY, so the key the gateway itself trusts is generated per boot and is never a caller credential. Fails closed: with no key configured /v1 rejects everything rather than forwarding to an internally-keyed gateway for free. - proxy.js: rate-limit POST /_login and /v1 key failures (per client IP + a global counter), keyed on the LAST X-Forwarded-For entry because the HF edge appends the real IP and a caller-supplied value lands first. Measured before this change: 20 wrong passwords in 4.5s were all accepted. - proxy.js: add Secure + HttpOnly to the session cookie; add CSP, HSTS, nosniff and Referrer-Policy to the gate page, which previously carried no security headers at all because the proxy serves it. - syn…e4a6de6
-
Update scripts/sync_hf.py
Verified signaturee43ca8e
-
feat: reverse proxy with password auth (login gate + /v1 API routing)
Verified signature844042d -
fix: cache ignore patterns + proxy architecture (dashboard:7861, gateway:8642, proxy:7860)
Verified signaturefbd3404 -
Fresh HermesFace from tao-shen template
Verified signature577b1ee