mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-27 17:58:07 +00:00
6437701228
Inspired by Claude Code 2.1.214, which added permission prompts for container-CLI commands (including the Podman shim) carrying daemon-redirect flags (--url, --connection, --identity, remote mode) that previously ran without one. A daemon redirect makes a local-looking command operate on a different (often remote) daemon, silently acting on production infrastructure. Any container-CLI invocation carrying a redirect now requires approval regardless of subcommand: - -H/--host and --context global flags (value required, global-flag position only — bare -h help and run-level -h <hostname> stay allowed) - context use (persistently switches the default daemon) - podman --url/--connection/--identity and -r/--remote - DOCKER_HOST=/DOCKER_CONTEXT=/CONTAINER_HOST=/CONTAINER_CONNECTION= environment prefixes Sibling-site widening: the existing container lifecycle rules matched only the verb directly adjacent to the binary name, so a global flag or a compose -f file flag slipped past the guard, and the legacy hyphenated compose binary was never covered. They now tolerate global flags — the same treatment the 'hermes ... gateway' rule already has — and match the hyphenated compose binary. Validation: 33 new tests; 339 pass in test_approval.py + new file; 442 pass across the adjacent guard suites; E2E battery of 12 dangerous + 17 safe commands via real imports, hot path ~330us/call. |
||
|---|---|---|
| .. | ||
| developer-guide | ||
| getting-started | ||
| guides | ||
| integrations | ||
| reference | ||
| user-guide | ||
| index.mdx | ||
| user-stories.mdx | ||