Summary
The LSP subsystem (shipped via #24168) is enabled by default with install_strategy: "auto". Together this means the first .py (or .go, .rs, .ts, etc.) edit inside a git repo triggers a silent npm install pyright@latest (or go install golang.org/x/tools/gopls@latest, etc.) into <HERMES_HOME>/lsp/bin/. Users in audited environments (SOC 2, ISO 27001) typically need explicit consent for any package install — silent installs of language servers fall under the same compliance umbrella that already gates npm/pip installs in CI.
Locations
hermes_cli/config.py:1516 — "enabled": Truehermes_cli/config.py:1530 — "install_strategy": "auto"
Proposed fix
Flip both defaults to opt-in:
enabled: falseinstall_strategy: "manual" (still discovers servers already on PATH; never auto-installs)
Existing-binary discovery in manual mode preserves the value for users who already have pyright / gopls / etc. on PATH — they get LSP diagnostics with zero install. Auto-install becomes an explicit opt-in via lsp.install_strategy: "auto" in config.yaml.
This was verified-real in scubamount's PR #24467 (defect D5) and is one of the three findings from that PR worth pulling out as standalone changes (issues for the other two filed alongside this one).
Credit to @scubamount for the original analysis in #24467.
cc the gateway/subagent code path: gateway processes are the most affected (they're long-lived and edit many files), but CLI sessions also hit this on the first edit in any repo.
Summary
The LSP subsystem (shipped via #24168) is enabled by default with
install_strategy: "auto". Together this means the first.py(or.go,.rs,.ts, etc.) edit inside a git repo triggers a silentnpm install pyright@latest(orgo install golang.org/x/tools/gopls@latest, etc.) into<HERMES_HOME>/lsp/bin/. Users in audited environments (SOC 2, ISO 27001) typically need explicit consent for any package install — silent installs of language servers fall under the same compliance umbrella that already gatesnpm/pipinstalls in CI.Locations
hermes_cli/config.py:1516—"enabled": Truehermes_cli/config.py:1530—"install_strategy": "auto"Proposed fix
Flip both defaults to opt-in:
enabled: falseinstall_strategy: "manual"(still discovers servers already onPATH; never auto-installs)Existing-binary discovery in
manualmode preserves the value for users who already have pyright / gopls / etc. on PATH — they get LSP diagnostics with zero install. Auto-install becomes an explicit opt-in vialsp.install_strategy: "auto"inconfig.yaml.This was verified-real in scubamount's PR #24467 (defect D5) and is one of the three findings from that PR worth pulling out as standalone changes (issues for the other two filed alongside this one).
Credit to @scubamount for the original analysis in #24467.
cc the gateway/subagent code path: gateway processes are the most affected (they're long-lived and edit many files), but CLI sessions also hit this on the first edit in any repo.