mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-31 19:16:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

feat(dev-sandbox): support fake installer / fake main / git clones

Browse source 
allow you to simulate the whole official curl | bash installer,
and subsequent hermes updates.

Run development commands in a bubblewrap filesystem and network sandbox
with a local HTTPS MITM fixture server and a fake github
git-upload-pack transport.
Package the sandbox command and expose it from the nix devShell.

Stage the local installer at its canonical fake HTTPS URL and add a
persistent installation/update test path. Route root installs through
sandbox-owned filesystem locations and snapshot dirty source worktrees
into temporary fake commits so update tests can fast-forward without
changing the real checkout.

Add an explicit --from-main installer mode that fetches the official
upstream main outside the sealed sandbox, installs from that snapshot,
and then promotes the fake remote to the current worktree so update
flows can be exercised with a fast-forward.
This commit is contained in:
ethernet 2026-07-28 13:17:59 -04:00
parent c7dd9e5670
commit db87ddca9f
5 changed files with 710 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hermes_cli/main.py
View file

@ -6446,10 +6446,14 @@ def _desktop_linux_needs_no_sandbox() -> bool:
unprivileged desktop user on an AppArmor-restricted host. The root case
should remain an explicit user choice.
"""
if os.environ.get("ELECTRON_DISABLE_SANDBOX", 0) == "1":
return True
if sys.platform != "linux":
return False
if hasattr(os, "geteuid") and os.geteuid() == 0:
return False
try:
with open("/proc/sys/kernel/apparmor_restrict_unprivileged_userns", encoding="utf-8") as f:
return f.read().strip() == "1"