mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-31 19:16:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(batch): set HERMES_CRON_SESSION to enforce approval guards

Browse source 
When batch_runner.py processes dataset prompts, it creates AIAgent
instances without setting any of the interactive environment variables
(HERMES_INTERACTIVE, HERMES_GATEWAY_SESSION, HERMES_EXEC_ASK). This
causes the dangerous command approval system to auto-approve all
flagged commands, allowing prompt injection payloads in untrusted
datasets to achieve arbitrary command execution.

Fix: set HERMES_CRON_SESSION=1 via os.environ.setdefault() before
creating AIAgent instances, so the approval system enforces the
cron-style deny-by-default policy.

Fixes #35164
This commit is contained in:
liuhao1024 2026-05-30 13:12:58 +08:00 • committed by teknium1
parent 19b2624404
commit f3b79200ff
No known key found for this signature in database
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
batch_runner.py
View file

@ -314,6 +314,15 @@ def _process_single_prompt(
print(f" Prompt {prompt_index}: Using container image {container_image}")
try:
# Mark this process as a non-interactive batch session so the
# dangerous-command approval system (tools/approval.py) enforces
# the cron-style deny-by-default policy instead of auto-approving
# every command. Without this, batch_runner.py would bypass all
# safety checks because none of HERMES_INTERACTIVE,
# HERMES_GATEWAY_SESSION, or HERMES_EXEC_ASK are set.
# See: https://github.com/NousResearch/hermes-agent/issues/35164
os.environ.setdefault("HERMES_CRON_SESSION", "1")
# Sample toolsets from distribution for this prompt
selected_toolsets = sample_toolsets_from_distribution(config["distribution"])