unsupportedpastels ce4de3cdc2 fix(tts): a command provider never receives the caller's output path ...

The text_to_speech tool lets the model choose output_path, and the command
provider substituted it into the operator's shell template. Quoting covers
the template's own quote context, but a template that re-parses its
placeholders (sh -c '... {output_path}', or backticks) hands the value to a
second shell parse, where $(...) and backticks in the path ran.

The command now writes a Hermes-named file in its temp directory, which is
moved to the requested path afterwards, so no caller-chosen text reaches the
shell in any template shape.

Reported-by: directorboint-arch

ce4de3cdc2 · 2026-11-15 06:58:39 -05:00

History

..

_category_.json

…

acp.md

…

api-server.md

…

batch-processing.md

refactor: move the Singularity terminal backend out of core into the singularity catalog plugin

2026-10-22 05:26:10 -07:00

bot-screen.md

…

browser.md

…

built-in-plugins.md

…

code-execution.md

fix(execute-code): word the edited-module warning as conditional; pin the last fixes

2026-11-11 18:30:30 -08:00

codex-app-server-runtime.md

…

computer-use.md

…

context-files.md

…

context-references.md

…

credential-pools.md

…

credential-vault.md

…

cron.md

…

curator.md

…

delegation.md

…

deliverable-mode.md

…

document-extraction.md

…

extending-the-dashboard.md

…

fallback-providers.md

…

goals.md

…

heartbeat.md

…

honcho.md

…

hooks.md

…

image-generation.md

…

kanban-multi-gateway.md

…

kanban-tutorial.md

…

kanban-worker-lanes.md

…

kanban.md

…

language-packs.md

…

loops.md

…

lsp.md

…

mcp.md

…

memory-providers.md

fix(redact): URL query mask drops the _value suffix like the JSON rule; pin closed-list names

2026-11-14 21:01:00 +01:00

memory.md

…

mixture-of-agents.md

…

overview.md

…

personality.md

…

pets.md

…

plugin-catalog.md

…

plugins.md

…

provider-routing.md

…

skills.md

…

skins.md

…

spotify.md

…

subscription-proxy.md

…

tool-gateway.md

…

tool-search.md

…

tools.md

…

tts.md

fix(tts): a command provider never receives the caller's output path

2026-11-15 06:58:39 -05:00

vision.md

…

voice-mode.md

…

wake-word.md

…

web-dashboard.md

…

web-search.md

…

x-search.md

…