mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
45da4b2363
Follow-up to the #30179 security review (maxpetrusenko). P0s 1-3 are being handled separately (kuangmi-bit); this covers the three P1s + the P2. P1 #4 — secrets replace rules now emit `require: true`. Verified replaceConfig.Require EXISTS in the pinned iron-proxy v0.39.0 secrets transform (KnownFields(true) strict decode would otherwise reject it) and is enforced in TransformRequest: a request to an allowlisted upstream that arrives WITHOUT the proxy token in a matched location is rejected (ActionReject) rather than forwarded with whatever credential it carried. Closes the leak where a real provider key sent directly to an allowed host passed the proxy boundary. P1 #5 — NODE_OPTIONS append-merge now resolves CA-mode conflicts. A docker_env `--use-bundled-ca` would previously survive alongside the egress-required `--use-openssl-ca`, leaving Node's trust behavior dependent on option order. Egress flag now wins deterministically (conflicting CA-mode flags stripped + warning); unrelated operator tuning preserved. P1 #6 — install now GPG-verifies the release. checksums.txt is verified against checksums.txt.asc using the bundled public-key.asc in an ephemeral keyring. Best-effort: degrades with a warning when gpg/sig assets are unavailable (SHA-256 still enforced); a PRESENT-but-invalid signature is a tamper signal and hard-fails the install. P2 #7 — threat-model wording scoped to the 'configured trusted proxy boundary' across the module docstring, config.py, and the egress docs, with a new security-model bullet on CA-key / endpoint-integrity loss (MITRE T1588.004 AiTM). Tests: +2 NODE_OPTIONS conflict/preserve, +5 GPG verify (skip/missing/bad/ good/install-abort), +1 require assertion. iron_proxy 94 + docker 74 green; ruff clean. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| base.py | ||
| daytona.py | ||
| docker.py | ||
| file_sync.py | ||
| local.py | ||
| managed_modal.py | ||
| modal.py | ||
| modal_utils.py | ||
| singularity.py | ||
| ssh.py | ||