Hermes Agent
Hermes closes a relative-path credential write bypass
A Hermes Agent patch reports that relative credential writes were checked against the Python process directory while execution resolved them against the terminal session directory. The proposed fix anchors write, delete and move checks to the same effective working directory.
NousResearch/hermes-agent PR #75745 is the inspected primary source: “fix(tools): anchor credential write-deny to terminal session cwd.” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- NousResearch/hermes-agent PR #75745 was created 2026-08-01T00:22:54Z and was open at inspection; its title is “fix(tools): anchor credential write-deny to terminal session cwd.” - NousResearch/hermes-agent issue #72776 was created 2026-07-27T17:20:42Z and was open at inspection; its title is “Bug: Session workspace hijacked to unrelated git repo when non-git workspace touches any git directory.” - NousResearch/hermes-agent PR #75753 was created 2026-08-01T00:34:18Z and was open at inspection; its title is “fix(terminal): report real failure when a background spawn never starts.” - The repository reported 223418 stars, 26319 open issues, default branch main, and last push 2026-08-01T00:08:09Z. - The latest tagged-release baseline checked was v2026.7.30 published 2026-07-30T23:45:37Z.
What changed
NousResearch/hermes-agent PR #75745 reports: What does this PR do? Fixes a credential write-deny bypass: get_write_denied_error resolved relative paths against the Python process cwd while writes executed against the terminal session's live cwd — so a prompt-injected write of '.ssh/authorized_keys' escaped the deny list and landed in $HOME/.ssh (SSH key injection). The deny check is now anchored to the same effective cwd the shell uses, at all three sites (write_file, delete, move). Related Issue No direct issue — discovered via code review and reproduced live (see below). Related PRs reviewed during the duplicate check (none covers this change): #18318 [open] feat(file-safety): add hermes file-safety check diagnostic command #70403 [open] fix(security):
NousResearch/hermes-agent issue #72776 reports: Bug Report: Session workspace hijacked to unrelated git repo after any tool-call enters a git directory Environment **Hermes build**: d71033a40 (2026-07-27 update, post 0158569ee) **OS**: Windows 10 **Surface**: CLI + TUI **Terminal backend**: local **Config**: terminal.cwd = ".", workspace directory NOT inside a git repo (e.g. C:\Users\ASUS) Summary After hermes update on 2026-07-27, sessions that start in a non-git workspace (C:\Users\ASUS, or directories without.git) get permanently reassigned to a different workspace whenever the agent performs a tool call that enters a git-checkout directory. The session's cwd and git_repo_root in state.db flip to that git repo's path, and subsequent tool calls operate from the wrong
NousResearch/hermes-agent PR #75753 reports: What does this PR do? terminal(background=true) always returned a fake success payload even when the non-local spawn path (spawn_via_env) produced a dead-on-arrival session (exited=True, no usable PID). The failed session was also dropped from the process registry, so later process(list/poll) came back empty — matching the silent-failure symptom in the issue. This PR returns an explicit error/exit/output payload when the spawn is already exited, and registers dead-on-arrival sessions into _finished so they remain discoverable. Related Issue Fixes #75675 Type of Change [x] Bug fix (non-breaking change that fixes an issue) [x] Tests (adding or improving test coverage) Changes Made tools/terminal_tool.py — detect proc_session.exited after background
Why it matters
A path guard and the operation it protects must canonicalize against one authority. Split working-directory semantics can turn a deny list into decoration and make prompt-injected relative paths land under a user home. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was open when captured on 2026-08-01. The release baseline was v2026.7.30 published 2026-07-30T23:45:37Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/NousResearch/hermes-agent/pull/75745. Supporting records are https://github.com/NousResearch/hermes-agent/issues/72776 and https://github.com/NousResearch/hermes-agent/pull/75753. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Verify relative and absolute credential paths across session cwd changes, retain legitimate workspace writes, and review cross-platform case folding and symlink boundaries separately. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.