fix: five HERMES_HOME profile-isolation leaks by teknium1 · Pull Request #10570 · NousResearch/hermes-agent

teknium1 · 2026-04-15T23:34:59Z

Summary

Fixes all five HERMES_HOME / profile-isolation leaks reported in #5947 by @vadimcomanescu.

Bug A — session_title not threaded to honcho memory provider

Added session_title lookup from session_db into _init_kwargs in run_agent.py. The honcho plugin can now use the gateway's per-chat session title for chat-scoped session/peer naming instead of falling back to cwd-based defaults that merge all users into one session.

Bug B — 14 hardcoded `~/.hermes/skills/` paths in skill files

Replaced all 14 references across 10 files with HERMES_HOME-aware alternatives:

Shell: ${HERMES_HOME:-$HOME/.hermes}/skills/...
Python: os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes"))

Bug C — install.sh `--dir` doesn't set HERMES_HOME

HERMES_HOME now respects the environment variable if already set
Added --hermes-home PATH flag for explicit override

Bug D — honcho client.py hardcoded `~/.hermes/honcho.json` fallback

Removed the hardcoded Path.home() / ".hermes" / "honcho.json" fallback from resolve_config_path(). Non-default profiles no longer silently inherit the default profile's honcho config. Falls through to ~/.honcho/config.json (global) instead.

Bug E — skill_manager_tool mutates external_dirs skills

Added _is_local_skill() guard to all five write operations (_edit_skill, _patch_skill, _delete_skill, _write_file, _remove_file). Skills found in external directories are now read-only — the agent gets a clear error asking to copy the skill locally first.

Files changed (15)

run_agent.py — +9 lines (session_title threading)
plugins/memory/honcho/client.py — remove hardcoded fallback
tools/skill_manager_tool.py — +28 lines (external_dirs guard)
scripts/install.sh — respect HERMES_HOME env + --hermes-home flag
10 skill files — HERMES_HOME-aware paths

Test plan

219 targeted tests pass (skill_manager_tool + plugins)
E2E verified Bug E: external skill edit/patch/delete blocked, local skills still work

Closes #5947

The error message for missing provider API keys dynamically built the env var name as PROVIDER_API_KEY (e.g. ALIBABA_API_KEY), but some providers use different names (alibaba uses DASHSCOPE_API_KEY). Users following the error message set the wrong variable. Fix: look up the actual env var from PROVIDER_REGISTRY before building the error. Falls back to the dynamic name if the registry lookup fails. Closes #9506

Bug A: Thread session_title from session_db to memory provider init kwargs so honcho can derive chat-scoped session keys instead of falling back to cwd-based naming that merges all gateway users into one session. Bug B: Replace 14 hardcoded ~/.hermes/skills/ paths across 10 skill files with HERMES_HOME-aware alternatives (${HERMES_HOME:-$HOME/.hermes} in shell, os.environ.get('HERMES_HOME', ...) in Python). Bug C: install.sh now respects HERMES_HOME env var and adds --hermes-home flag. Previously --dir only set INSTALL_DIR while HERMES_HOME was always hardcoded to $HOME/.hermes. Bug D: Remove hardcoded ~/.hermes/honcho.json fallback in resolve_config_path(). Non-default profiles no longer silently inherit the default profile's honcho config. Falls through to ~/.honcho/config.json (global) instead. Bug E: Guard _edit_skill, _patch_skill, _delete_skill, _write_file, and _remove_file against writing to skills found in external_dirs. Skills outside the local SKILLS_DIR are now read-only from the agent's perspective. Closes #5947

github-actions · 2026-04-15T23:35:17Z

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

3028:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/parseltongue.py")).read())
3037:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
3050:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
3063:+exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
3089:+    exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/godmode_race.py")).read())
3115:+    exec(open(os.path.join(os.environ.get("HERMES_HOME", os.path.expanduser("~/.hermes")), "skills/red-teaming/godmode/scripts/parseltongue.py")).read())

⚠️ WARNING: Dependency manifest files modified

Changes to dependency files can introduce new packages or change version pins. Verify all dependency changes are intentional and from trusted sources.

Files:

pyproject.toml

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

* fix: show correct env var name in provider API key error (NousResearch#9506) The error message for missing provider API keys dynamically built the env var name as PROVIDER_API_KEY (e.g. ALIBABA_API_KEY), but some providers use different names (alibaba uses DASHSCOPE_API_KEY). Users following the error message set the wrong variable. Fix: look up the actual env var from PROVIDER_REGISTRY before building the error. Falls back to the dynamic name if the registry lookup fails. Closes NousResearch#9506 * fix: five HERMES_HOME profile-isolation leaks (NousResearch#5947) Bug A: Thread session_title from session_db to memory provider init kwargs so honcho can derive chat-scoped session keys instead of falling back to cwd-based naming that merges all gateway users into one session. Bug B: Replace 14 hardcoded ~/.hermes/skills/ paths across 10 skill files with HERMES_HOME-aware alternatives (${HERMES_HOME:-$HOME/.hermes} in shell, os.environ.get('HERMES_HOME', ...) in Python). Bug C: install.sh now respects HERMES_HOME env var and adds --hermes-home flag. Previously --dir only set INSTALL_DIR while HERMES_HOME was always hardcoded to $HOME/.hermes. Bug D: Remove hardcoded ~/.hermes/honcho.json fallback in resolve_config_path(). Non-default profiles no longer silently inherit the default profile's honcho config. Falls through to ~/.honcho/config.json (global) instead. Bug E: Guard _edit_skill, _patch_skill, _delete_skill, _write_file, and _remove_file against writing to skills found in external_dirs. Skills outside the local SKILLS_DIR are now read-only from the agent's perspective. Closes NousResearch#5947

teknium1 added 2 commits April 15, 2026 16:12

teknium1 merged commit e402906 into main Apr 16, 2026
6 of 7 checks passed

teknium1 deleted the hermes/hermes-0a715090 branch April 16, 2026 00:09

This was referenced Apr 16, 2026

fix(honcho): respect HERMES_HOME in resolve_config_path fallback #6025

Closed

fix(skills): block mutations in external skill dirs #6338

Closed

fix(install): honor --dir for HERMES_HOME state #6527

Closed

teknium1 mentioned this pull request Apr 27, 2026

fix(plugins/honcho): honor active HERMES_HOME during config path resolution #7831

Closed

teknium1 mentioned this pull request May 2, 2026

Bug: profile Telegram gateways register only core command set instead of full skill menu #8108

Open

EduardKov mentioned this pull request Jun 1, 2026

feat(honcho): isolate Honcho session per profile when multiple profiles share one external chat (sessionPeerPrefix + ai_peer for gateway_session_key) #36160

Open

TumCucTom mentioned this pull request Jun 1, 2026

fix(memory): prefix Honcho gateway session key with ai_peer (#36160) #36820

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: five HERMES_HOME profile-isolation leaks#10570

fix: five HERMES_HOME profile-isolation leaks#10570
teknium1 merged 2 commits into
mainfrom
hermes/hermes-0a715090

teknium1 commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

teknium1 commented Apr 15, 2026

Summary

Bug A — session_title not threaded to honcho memory provider

Bug B — 14 hardcoded ~/.hermes/skills/ paths in skill files

Bug C — install.sh --dir doesn't set HERMES_HOME

Bug D — honcho client.py hardcoded ~/.hermes/honcho.json fallback

Bug E — skill_manager_tool mutates external_dirs skills

Files changed (15)

Test plan

Uh oh!

github-actions Bot commented Apr 15, 2026

⚠️ Supply Chain Risk Detected

⚠️ WARNING: exec() or eval() usage

⚠️ WARNING: Dependency manifest files modified

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bug B — 14 hardcoded `~/.hermes/skills/` paths in skill files

Bug C — install.sh `--dir` doesn't set HERMES_HOME

Bug D — honcho client.py hardcoded `~/.hermes/honcho.json` fallback