fix: add SSH backend to terminal requirements check#59
Merged
Conversation
The SSH backend was missing from check_terminal_requirements(), causing it to fall through to `return False`. This silently disabled both the terminal and file tools when TERMINAL_ENV=ssh was configured. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
LGTM! |
sudo-yf
pushed a commit
to sudo-yf/hermes-agent
that referenced
this pull request
Apr 5, 2026
…unch profile (NousResearch#59) get_cli_sessions() and get_cli_session_messages() were using HERMES_HOME (the profile the server was launched under) to find state.db. This meant a server launched under the webui profile would read webui's state.db (full of cron runs) instead of the user's actual CLI sessions. Fix: use get_active_hermes_home() which tracks whichever profile the user has selected in the UI. This means: - default profile active -> reads ~/.hermes/state.db (interactive CLI) - camanji profile active -> reads ~/.hermes/profiles/camanji/state.db Falls back to HERMES_HOME env var if profiles module unavailable. Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>
Prompt Guard IncidentSeverity: LOW Note: This is a low-priority security note. No immediate action required. |
|
bruh |
angelburgosrosado
pushed a commit
to angelburgosrosado/hermes-agent
that referenced
this pull request
Apr 27, 2026
fix: add SSH backend to terminal requirements check
olympus-terminal
pushed a commit
to olympus-terminal/hermes-agent
that referenced
this pull request
May 16, 2026
fix: add SSH backend to terminal requirements check
3 tasks
shanewas
added a commit
to shanewas/hermes-agent
that referenced
this pull request
Jun 2, 2026
…ning + profile dir perms (0o700/0o600) - Dockerfile: OCI security labels, HEALTHCHECK, non-root safe - docker-compose: no-new-privileges, healthcheck mirroring - entrypoint.sh: chmod 700 on cron/sessions/memories/home/logs/plans - gateway/session.py: enforce 0o700 sessions dir, 0o600 sessions.json - hermes_cli/profiles.py: _ensure_profile_permissions() helper wired into create_profile Resolves security audit findings P1 NousResearch#33 (image hardening) and P1 NousResearch#59 (profile isolation)
Egavasyug
pushed a commit
to Egavasyug/hermes-agent
that referenced
this pull request
Jun 10, 2026
fix: add SSH backend to terminal requirements check
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
check_terminal_requirements()had noelif env_type == "ssh"branchTERMINAL_ENV=ssh, the check fell through toreturn False, silently disabling both terminal and file toolsssh_hostandssh_userare configuredContext
The terminal and file tools both depend on
check_terminal_requirements()to determine availability. Every other backend (local, docker, singularity, modal) had a check — SSH was the only one missing.With this bug, users who configured
TERMINAL_ENV=sshgot a working hermes session but with no terminal or file tools available — onlyexecute_code(which runs locally, defeating the purpose of SSH isolation).Test plan
check_terminal_requirements()returnsFalsewhen SSH host/user not setcheck_terminal_requirements()returnsTruewhen SSH host/user configuredhermes chat -qwith SSH backend runs commands on remote hostread_fileworks over SSH backend🤖 Generated with Claude Code