feat: execute_code runs on remote terminal backends by teknium1 · Pull Request #5088 · NousResearch/hermes-agent

teknium1 · 2026-04-04T18:48:36Z

Summary

When TERMINAL_ENV is not local, execute_code now ships the script to the remote environment and executes it there — the same container/sandbox/SSH session that terminal() and file tools use.

Previously, execute_code always ran scripts locally via subprocess.Popen, even when the user had a Docker/SSH/Modal/Daytona/Singularity backend configured. This meant the Python script ran on the host while terminal() calls from within it went to the remote — an inconsistent split.

Architecture

Local backend (unchanged): UDS RPC + subprocess.Popen. Zero regression.

Remote backends (new): File-based RPC via the terminal environment:

Parent generates hermes_tools.py with file-based RPC stubs
Ships both files to the remote via execute_oneshot() + base64/stdin
Script runs inside the terminal backend via env.execute()
Tool calls written as request files; a polling thread on the parent reads them via execute_oneshot(), dispatches through handle_function_call, writes response files atomically (tmp + rename)
Script polls for response files and continues

Concurrency: execute_oneshot() added to BaseEnvironment — bypasses the persistent shell lock on SSH/Local persistent mode so the RPC polling thread runs concurrently with the script execution thread. All other backends (Docker, Modal, Daytona, Singularity) already support concurrent execute() calls natively.

Files changed

tools/environments/base.py — Add execute_oneshot() method (default delegates to execute())
tools/environments/persistent_shell.py — Override execute_oneshot() to route through _execute_oneshot(), bypassing _shell_lock
tools/code_execution_tool.py — File-based transport in generate_hermes_tools_module(), _execute_remote() with env get-or-create, file shipping, RPC poll loop, output post-processing

Supported backends

Backend	Transport	Callback mechanism
local	UDS (unchanged)	Unix domain socket
docker	file-based RPC	Concurrent `docker exec`
ssh	file-based RPC	`execute_oneshot()` bypasses persistent shell
modal	file-based RPC	Concurrent `sandbox.exec()`
daytona	file-based RPC	Concurrent SDK calls
singularity	file-based RPC	Concurrent `singularity exec`

Test plan

All 61 existing test_code_execution.py tests pass (local UDS path unchanged)
Terminal requirement tests pass (12/12)

…/Daytona/Singularity) When TERMINAL_ENV is not 'local', execute_code now ships the script to the remote environment and runs it there via the terminal backend -- the same container/sandbox/SSH session used by terminal() and file tools. Architecture: - Local backend: unchanged (UDS RPC, subprocess.Popen) - Remote backends: file-based RPC via execute_oneshot() polling - Script writes request files, parent polls and dispatches tool calls - Responses written atomically (tmp + rename) via base64/stdin - execute_oneshot() bypasses persistent shell lock for concurrency Changes: - tools/environments/base.py: add execute_oneshot() (delegates to execute()) - tools/environments/persistent_shell.py: override execute_oneshot() to bypass _shell_lock via _execute_oneshot(), enabling concurrent polling - tools/code_execution_tool.py: add file-based transport to generate_hermes_tools_module(), _execute_remote() with full env get-or-create, file shipping, RPC poll loop, output post-processing

github-actions · 2026-04-04T18:48:50Z

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

280:+    encoded = base64.b64encode(content.encode("utf-8")).decode("ascii")
405:+                encoded_result = base64.b64encode(

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

Read terminal backend type through the canonical config resolution path (terminal_tool._get_env_config) instead of os.getenv directly.

github-actions · 2026-04-04T18:51:33Z

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

275:+    encoded = base64.b64encode(content.encode("utf-8")).decode("ascii")
400:+                encoded_result = base64.b64encode(

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

Modal doesn't reliably deliver stdin_data to chained commands (base64 -d > file && mv), producing 0-byte files. Switch to echo 'base64' | base64 -d which works on all backends. Verified E2E on both Docker and Modal.

github-actions · 2026-04-04T19:23:21Z

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

277:+    encoded = base64.b64encode(content.encode("utf-8")).decode("ascii")
403:+                encoded_result = base64.b64encode(

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

* feat: execute_code runs on remote terminal backends (Docker/SSH/Modal/Daytona/Singularity) When TERMINAL_ENV is not 'local', execute_code now ships the script to the remote environment and runs it there via the terminal backend -- the same container/sandbox/SSH session used by terminal() and file tools. Architecture: - Local backend: unchanged (UDS RPC, subprocess.Popen) - Remote backends: file-based RPC via execute_oneshot() polling - Script writes request files, parent polls and dispatches tool calls - Responses written atomically (tmp + rename) via base64/stdin - execute_oneshot() bypasses persistent shell lock for concurrency Changes: - tools/environments/base.py: add execute_oneshot() (delegates to execute()) - tools/environments/persistent_shell.py: override execute_oneshot() to bypass _shell_lock via _execute_oneshot(), enabling concurrent polling - tools/code_execution_tool.py: add file-based transport to generate_hermes_tools_module(), _execute_remote() with full env get-or-create, file shipping, RPC poll loop, output post-processing * fix: use _get_env_config() instead of raw TERMINAL_ENV env var Read terminal backend type through the canonical config resolution path (terminal_tool._get_env_config) instead of os.getenv directly. * fix: use echo piping instead of stdin_data for base64 writes Modal doesn't reliably deliver stdin_data to chained commands (base64 -d > file && mv), producing 0-byte files. Switch to echo 'base64' | base64 -d which works on all backends. Verified E2E on both Docker and Modal.

fix: use _get_env_config() instead of raw TERMINAL_ENV env var

7c9883a

Read terminal backend type through the canonical config resolution path (terminal_tool._get_env_config) instead of os.getenv directly.

fix: use echo piping instead of stdin_data for base64 writes

ec86553

Modal doesn't reliably deliver stdin_data to chained commands (base64 -d > file && mv), producing 0-byte files. Switch to echo 'base64' | base64 -d which works on all backends. Verified E2E on both Docker and Modal.

teknium1 merged commit 569e9f9 into main Apr 4, 2026
3 of 4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: execute_code runs on remote terminal backends#5088

feat: execute_code runs on remote terminal backends#5088
teknium1 merged 3 commits into
mainfrom
hermes/hermes-0971565e

teknium1 commented Apr 4, 2026

Uh oh!

github-actions Bot commented Apr 4, 2026

Uh oh!

github-actions Bot commented Apr 4, 2026

Uh oh!

github-actions Bot commented Apr 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

teknium1 commented Apr 4, 2026

Summary

Architecture

Files changed

Supported backends

Test plan

Uh oh!

github-actions Bot commented Apr 4, 2026

⚠️ Supply Chain Risk Detected

⚠️ WARNING: base64 encoding/decoding detected

Uh oh!

github-actions Bot commented Apr 4, 2026

⚠️ Supply Chain Risk Detected

⚠️ WARNING: base64 encoding/decoding detected

Uh oh!

github-actions Bot commented Apr 4, 2026

⚠️ Supply Chain Risk Detected

⚠️ WARNING: base64 encoding/decoding detected

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant