mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
Two scoping bugs found in audit: 1. Global SSH lost per-profile request scoping. globalRemoteActive() returned true only for mode === remote (or the env URL), not mode === ssh, so a global SSH connection serving multiple desktop profiles routed every profile to the remote DEFAULT profile instead of carrying ?profile=. Treat mode === ssh as a global remote for request scoping (one loopback backend, ?profile= per request — same contract as a global URL remote). 2. Interim ssh -tt terminal could leak into a token/OAuth remote. activeSshTerminalTarget() returned any cached SSH state (primary scope, then GLOBAL scope) without checking what the active profile actually resolves to. With a global SSH connection AND a per-profile token/OAuth override active, the terminal opened ssh -tt on the global SSH host. Rewrite it to mirror resolveRemoteBackend precedence: a per-profile non-SSH override (or env URL) returns null — never falls through to global SSH. |
||
|---|---|---|
| .. | ||
| bootstrap-installer | ||
| desktop | ||
| shared | ||