feat(dingtalk): add require_mention + allowed_users gating (parity with Slack/Telegram/Discord) by teknium1 · Pull Request #11564 · NousResearch/hermes-agent

teknium1 · 2026-04-17T11:21:11Z

Summary

Salvages #9367 (@yule975 — authorship preserved) + 16 new regression tests.

Closes a long-standing feature-parity gap: DingTalk was the only major messaging adapter without group-mention gating or a per-user allowlist. Slack, Telegram, Discord, WhatsApp, Matrix, and Mattermost all expose these knobs — this change brings DingTalk up to the same surface using the same config.yaml → env var bridge.

Config surface

platforms:
  dingtalk:
    enabled: true
    require_mention: true             # env: DINGTALK_REQUIRE_MENTION
    mention_patterns:                 # env: DINGTALK_MENTION_PATTERNS (JSON array)
      - "^hermes"
      - "^小马"
    free_response_chats:              # env: DINGTALK_FREE_RESPONSE_CHATS (csv)
      - "cidABC=="
    allowed_users:                    # env: DINGTALK_ALLOWED_USERS (csv); "*" = any
      - "staff_1234"

Semantics (mirrors Telegram's model)

DMs always accepted (subject to allowed_users if set).
Group messages accepted only when one of:
- chat is in free_response_chats
- require_mention: false
- bot is @-mentioned (SDK's is_in_at_list)
- text matches one of mention_patterns (case-insensitive regex)

What I added on top of the original PR (16 tests)

TestAllowedUsersGate (6) — empty/wildcard/case-insensitive matching, sender_id vs staff_id, CSV env var
TestMentionPatterns (6) — compilation, case-insensitivity, invalid regex dropped (not raised), JSON env var, newline fallback
TestShouldProcessMessage (6) — DM always accepted, group gating via require_mention/is_in_at_list/wake-word/free_response_chats

While writing tests I noticed the env-var fallback chain in _compile_mention_patterns uses splitlines() first and only falls back to comma-split when splitlines yields nothing — so "^bot,^assistant" in the env var is interpreted as a single pattern, not two. I documented the actually-working behaviour (newline separation) rather than adding scope to change it. Worth a follow-up if CSV parity with other platforms matters.

Tests

tests/gateway/test_dingtalk.py: 47 passed (29 pre-existing + 18 gating — 16 new + 2 existing extract tests).
tests/gateway/test_dingtalk.py + test_config.py: 70 passed.
Cherry-pick applied cleanly on top of fix(dingtalk): support dingtalk-stream 0.24+ SDK (async process, CallbackMessage, oapi webhooks, TextContent) #11471 / fix(dingtalk): close SDK websocket on disconnect (systemd stop-sigterm hang) #11556.

Authorship

Commit 4912aaa2 preserves yule975 <xiewenxuan462@gmail.com> as author. Merge with --rebase to keep attribution. Added yule975 to scripts/release.py AUTHOR_MAP.

Closes

Closes #9367 on merge with credit.

DingTalk was the only messaging platform without group-mention gating or a per-user allowlist. Slack, Telegram, Discord, WhatsApp, Matrix, and Mattermost all support these via config.yaml + matching env vars; this change closes the gap for DingTalk using the same surface: Config: platforms.dingtalk.require_mention: bool (env: DINGTALK_REQUIRE_MENTION) platforms.dingtalk.mention_patterns: list (env: DINGTALK_MENTION_PATTERNS) platforms.dingtalk.free_response_chats: list (env: DINGTALK_FREE_RESPONSE_CHATS) platforms.dingtalk.allowed_users: list (env: DINGTALK_ALLOWED_USERS) Semantics mirror Telegram's implementation: - DMs are always accepted (subject to allowed_users). - Group messages are accepted only when the chat is allowlisted, mention is not required, the bot was @mentioned (dingtalk_stream sets is_in_at_list), or the text matches a configured regex wake-word. - allowed_users matches sender_id / sender_staff_id case-insensitively; a single "*" disables the check. Rationale: without this, any DingTalk user in a group chat can trigger the bot, which makes DingTalk less safe to deploy than the other platforms. A user's config.yaml already accepts require_mention for dingtalk but the value was silently ignored.

Adds 16 regression tests for the gating logic introduced in the salvaged commit: * TestAllowedUsersGate — empty/wildcard/case-insensitive matching, staff_id vs sender_id, env var CSV population * TestMentionPatterns — compilation, case-insensitivity, invalid regex is skipped-not-raised, JSON env var, newline fallback * TestShouldProcessMessage — DM always accepted, group gating via require_mention / is_in_at_list / wake-word pattern / free_response_chats Also adds yule975 to scripts/release.py AUTHOR_MAP (release CI blocks unmapped emails).

…ers (#17727) Covers ~60 merged PRs from Apr 15–29 that shipped user-visible behavior without docs coverage. No functional code changes; docs + static manifest regeneration only. Highlights: Stale / incorrect: - configuration.md: auxiliary auto-routing line was wrong since #11900; now correctly states auto routes to the main model, with a note on the cost trade-off and per-task override pattern. - integrations/providers.md + configuration.md compression intro: removed stale 'Gemini Flash via OpenRouter' claim. - website/static/api/model-catalog.json: rebuilt from hermes_cli/models.py so the live manifest picks up tencent/hy3-preview (and remains in sync for future model-catalog PRs). Platform messaging (#17417 #16997 #16193 #14315 #13151 #11794 #10610 #10283 #10246 #11564 #13178): - Signal: native formatting (bodyRanges), reply quotes, reactions. - Telegram: table rendering (bullets + code-block fallback), disable_link_previews, group_allowed_chats. - Slack: strict_mention config. - Discord: slash_commands disable, send_animation GIF, send_message native media attachments. - DingTalk: require_mention + allowed_users. CLI (#16052 #16539 #16566 #15841 #14798 #10043): - New 'hermes fallback' interactive manager. - New 'hermes update --check', '--backup' flag, and pre-update pairing snapshot behavior. - 'hermes gateway start/restart --all' multi-profile flag. - cron.md: 'hermes tools' as a platform, per-job enabled_toolsets, wakeAgent gate, context_from chaining. Config keys / env vars (#17305 #17026 #17000 #15077 #14557 #14227 #14166 #14730 #17008): - terminal.docker_run_as_host_user, display.runtime_metadata_footer, compression.hygiene_hard_message_limit, HINDSIGHT_TIMEOUT, skills.guard_agent_created, TAVILY_BASE_URL, security.allow_private_urls, agent.api_max_retries, gateway hot-reload of compression/context_length config edits. TUI / CLI UX (#17130 #17113 #17175 #17150 #16707 #12312 #12305 #12934 #14810 #14045 #17286 #17126): - HERMES_TUI_RESUME, HERMES_TUI_THEME, LaTeX rendering, busy-indicator styles, ctrl-x queued-message delete, git branch in status bar, per- prompt elapsed stopwatch, external-editor keybind, markdown stripping, TUI voice-mode parity, /agents overlay, /reload + /mouse. Gateway features (#16506 #15027 #13428 #12116): - Native multimodal image routing based on vision capability. - /usage account-limits section. - /steer slash command (added to reference + explanation in CLI). Plugins / hooks (#12929 #12972 #10763 #16364): - transform_tool_result, transform_terminal_output plugin hooks. - PluginContext.dispatch_tool() documented with slash-command example. - google_meet bundled plugin entry under built-in-plugins.md. Other (#16576 #16572 #16383 #15878 #15608 #15606 #14809 #14767 #14231 #14232 #14307 #13683 #12373 #11891 #11291 #10066): - hermes backup exclusions (WAL/SHM/journal + checkpoints/). - security.md hardline blocklist (floor below --yolo). - FHS install layout for root installs. - openssh-client + docker-cli baked into the Docker image. - MEDIA: tag supported extensions table (docs/office/archives/pdf). - Remote-to-host file sync on SSH/Modal/Daytona teardown. - 'hermes model' -> Configure Auxiliary Models interactive picker. - Podman support via HERMES_DOCKER_BINARY. Providers / STT / one-shot (#15045 #14473 #15704): - alibaba-coding-plan first-class provider entry. - xAI Grok STT as a 6th transcription option. - 'hermes -z' scripted one-shot mode + HERMES_INFERENCE_MODEL. Build: 'docusaurus build' succeeds. No new broken links/anchors; pre-existing warnings unchanged.

…ers (NousResearch#17727) Covers ~60 merged PRs from Apr 15–29 that shipped user-visible behavior without docs coverage. No functional code changes; docs + static manifest regeneration only. Highlights: Stale / incorrect: - configuration.md: auxiliary auto-routing line was wrong since NousResearch#11900; now correctly states auto routes to the main model, with a note on the cost trade-off and per-task override pattern. - integrations/providers.md + configuration.md compression intro: removed stale 'Gemini Flash via OpenRouter' claim. - website/static/api/model-catalog.json: rebuilt from hermes_cli/models.py so the live manifest picks up tencent/hy3-preview (and remains in sync for future model-catalog PRs). Platform messaging (NousResearch#17417 NousResearch#16997 NousResearch#16193 NousResearch#14315 NousResearch#13151 NousResearch#11794 NousResearch#10610 NousResearch#10283 NousResearch#10246 NousResearch#11564 NousResearch#13178): - Signal: native formatting (bodyRanges), reply quotes, reactions. - Telegram: table rendering (bullets + code-block fallback), disable_link_previews, group_allowed_chats. - Slack: strict_mention config. - Discord: slash_commands disable, send_animation GIF, send_message native media attachments. - DingTalk: require_mention + allowed_users. CLI (NousResearch#16052 NousResearch#16539 NousResearch#16566 NousResearch#15841 NousResearch#14798 NousResearch#10043): - New 'hermes fallback' interactive manager. - New 'hermes update --check', '--backup' flag, and pre-update pairing snapshot behavior. - 'hermes gateway start/restart --all' multi-profile flag. - cron.md: 'hermes tools' as a platform, per-job enabled_toolsets, wakeAgent gate, context_from chaining. Config keys / env vars (NousResearch#17305 NousResearch#17026 NousResearch#17000 NousResearch#15077 NousResearch#14557 NousResearch#14227 NousResearch#14166 NousResearch#14730 NousResearch#17008): - terminal.docker_run_as_host_user, display.runtime_metadata_footer, compression.hygiene_hard_message_limit, HINDSIGHT_TIMEOUT, skills.guard_agent_created, TAVILY_BASE_URL, security.allow_private_urls, agent.api_max_retries, gateway hot-reload of compression/context_length config edits. TUI / CLI UX (NousResearch#17130 NousResearch#17113 NousResearch#17175 NousResearch#17150 NousResearch#16707 NousResearch#12312 NousResearch#12305 NousResearch#12934 NousResearch#14810 NousResearch#14045 NousResearch#17286 NousResearch#17126): - HERMES_TUI_RESUME, HERMES_TUI_THEME, LaTeX rendering, busy-indicator styles, ctrl-x queued-message delete, git branch in status bar, per- prompt elapsed stopwatch, external-editor keybind, markdown stripping, TUI voice-mode parity, /agents overlay, /reload + /mouse. Gateway features (NousResearch#16506 NousResearch#15027 NousResearch#13428 NousResearch#12116): - Native multimodal image routing based on vision capability. - /usage account-limits section. - /steer slash command (added to reference + explanation in CLI). Plugins / hooks (NousResearch#12929 NousResearch#12972 NousResearch#10763 NousResearch#16364): - transform_tool_result, transform_terminal_output plugin hooks. - PluginContext.dispatch_tool() documented with slash-command example. - google_meet bundled plugin entry under built-in-plugins.md. Other (NousResearch#16576 NousResearch#16572 NousResearch#16383 NousResearch#15878 NousResearch#15608 NousResearch#15606 NousResearch#14809 NousResearch#14767 NousResearch#14231 NousResearch#14232 NousResearch#14307 NousResearch#13683 NousResearch#12373 NousResearch#11891 NousResearch#11291 NousResearch#10066): - hermes backup exclusions (WAL/SHM/journal + checkpoints/). - security.md hardline blocklist (floor below --yolo). - FHS install layout for root installs. - openssh-client + docker-cli baked into the Docker image. - MEDIA: tag supported extensions table (docs/office/archives/pdf). - Remote-to-host file sync on SSH/Modal/Daytona teardown. - 'hermes model' -> Configure Auxiliary Models interactive picker. - Podman support via HERMES_DOCKER_BINARY. Providers / STT / one-shot (NousResearch#15045 NousResearch#14473 NousResearch#15704): - alibaba-coding-plan first-class provider entry. - xAI Grok STT as a 6th transcription option. - 'hermes -z' scripted one-shot mode + HERMES_INFERENCE_MODEL. Build: 'docusaurus build' succeeds. No new broken links/anchors; pre-existing warnings unchanged.

yule975 and others added 2 commits April 17, 2026 04:18

teknium1 merged commit aca81ac into main Apr 17, 2026
5 checks passed

teknium1 deleted the hermes/hermes-e52e6172 branch April 17, 2026 11:21

github-actions Bot mentioned this pull request Apr 24, 2026

chore: bump NousResearch/hermes-agent version from v2026.4.16 to v2026.4.23 Docker-Hub-sirmark/docker-hermes-agent#3

Merged

teknium1 mentioned this pull request Apr 30, 2026

docs: two-week gap sweep — platforms, CLI, config, TUI, hooks, providers #17727

Merged

kuk1song mentioned this pull request May 30, 2026

fix(slack): wire up mention_patterns config #35403

Open

19 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(dingtalk): add require_mention + allowed_users gating (parity with Slack/Telegram/Discord)#11564

feat(dingtalk): add require_mention + allowed_users gating (parity with Slack/Telegram/Discord)#11564
teknium1 merged 2 commits into
mainfrom
hermes/hermes-e52e6172

teknium1 commented Apr 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

teknium1 commented Apr 17, 2026

Summary

Config surface

Semantics (mirrors Telegram's model)

What I added on top of the original PR (16 tests)

Tests

Authorship

Closes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants