Will Pfleger debff9f3d8 feat(agent): add hardened MCP toolchain shims with config isolation ...

Add hermit-managed shim scripts for uv/uvx/npx/node that provide
config-isolated toolchain execution for MCP servers, preventing
ambient system toolchains from leaking user config into agent
processes.

Security hardening:
- Private mktemp temp dir with cleanup trap (no predictable paths)
- Lock mutual exclusion via kill-0 + /proc start-time verification
- Atomic bootstrap recovery (staged download + validated mv)
- Desktop fail-loud validation of shim resources before env export

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-07-16 10:32:34 -05:00

..

cutover

Multi-tenant Buzz relay: community_id as a server-resolved key (comprehensive rewrite) (#1321)

2026-06-29 12:39:02 -04:00

maintenance

Bound NIP-RS retention and search indexing (#1771)

2026-07-13 17:58:20 -04:00

_goose-env.sh

refactor(justfile): rename, relay auto-start, bootstrap, DRY cleanup (#1117)

2026-06-18 17:24:05 -04:00

attach-schema-partitions.sql

feat(push): deliver accepted relay events as wakes (#1866)

2026-07-14 16:13:04 -04:00

backfill-d-tag.sql

…

build-sprig.sh

refactor: rename sprout backend to buzz (#958)

2026-06-10 19:29:51 -04:00

bundle-sidecars.sh

refactor(shell): drop bundled PortableGit, add BUZZ_SHELL override + dialect hint (#1536)

2026-07-06 12:54:50 -04:00

check-file-sizes-core.mjs

…

check-pr-image-urls.sh

feat(mobile): harden unread badges and float tabs (#1298)

2026-06-25 17:40:00 -07:00

check-pubkey-truncation-core.mjs

feat(desktop): canonical <PubKey> component — hover to view/copy full keys, owner "you" labels (#1589)

2026-07-07 13:35:15 -07:00

check-px-text-core.mjs

fix(desktop): simplify sign out settings row (#1903)

2026-07-15 15:26:01 +00:00

cleanup-instance-agents.sh

docs: finish Buzz rename cleanup (#974)

2026-06-11 09:28:18 -07:00

dev-reset.sh

mesh: upgrade runtime, enforce membership, add shared compute provider (#1656)

2026-07-15 10:10:29 -04:00

dev-setup.sh

fix(dev): install Lefthook hooks into shared .git/hooks dir (#1751)

2026-07-10 22:06:32 -04:00

e2e-git-perms.sh

Multi-tenant Buzz relay: community_id as a server-resolved key (comprehensive rewrite) (#1321)

2026-06-29 12:39:02 -04:00

ensure-mesh-native-runtime.sh

mesh: Rust-owned coordinator — fix saved-agent reconnect flakiness + DRY the start path (#879)

2026-06-09 10:59:28 -04:00

generate-dev-icon.swift

chore: remove LLM-slop comments across the codebase (#1277)

2026-06-25 11:03:05 -04:00

grab-emoji.sh

chore: add grab-emoji.sh to register Slack emoji in Buzz (#1292)

2026-06-25 16:30:11 -04:00

instance-env.sh

mesh: upgrade runtime, enforce membership, add shared compute provider (#1656)

2026-07-15 10:10:29 -04:00

nostr-tools-test-package.json

…

post-screenshots.sh

feat(mobile): harden unread badges and float tabs (#1298)

2026-06-25 17:40:00 -07:00

reset-desktop-dev-state.sh

mesh: upgrade runtime, enforce membership, add shared compute provider (#1656)

2026-07-15 10:10:29 -04:00

run-tests.sh

feat(agent): add hardened MCP toolchain shims with config isolation

2026-07-16 10:32:34 -05:00

seed-local-community.sh

fix(setup): fix syntax error in seed-local-community.sh (#1547)

2026-07-06 14:24:03 -07:00

setup-desktop-test-data.sh

mesh: upgrade runtime, enforce membership, add shared compute provider (#1656)

2026-07-15 10:10:29 -04:00

start-isolated-test-relay.sh

mesh: upgrade runtime, enforce membership, add shared compute provider (#1656)

2026-07-15 10:10:29 -04:00

start-relay-for-tests.sh

fix(ci): set PGSCHEMA_PLAN_* in start-relay-for-tests.sh to avoid embedded-PG fetch (#1443)

2026-07-01 16:57:56 -04:00

test-video-upload.sh

refactor: rename sprout backend to buzz (#958)

2026-06-10 19:29:51 -04:00