mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-28 18:19:28 +00:00
6437701228
Inspired by Claude Code 2.1.214, which added permission prompts for container-CLI commands (including the Podman shim) carrying daemon-redirect flags (--url, --connection, --identity, remote mode) that previously ran without one. A daemon redirect makes a local-looking command operate on a different (often remote) daemon, silently acting on production infrastructure. Any container-CLI invocation carrying a redirect now requires approval regardless of subcommand: - -H/--host and --context global flags (value required, global-flag position only — bare -h help and run-level -h <hostname> stay allowed) - context use (persistently switches the default daemon) - podman --url/--connection/--identity and -r/--remote - DOCKER_HOST=/DOCKER_CONTEXT=/CONTAINER_HOST=/CONTAINER_CONNECTION= environment prefixes Sibling-site widening: the existing container lifecycle rules matched only the verb directly adjacent to the binary name, so a global flag or a compose -f file flag slipped past the guard, and the legacy hyphenated compose binary was never covered. They now tolerate global flags — the same treatment the 'hermes ... gateway' rule already has — and match the hyphenated compose binary. Validation: 33 new tests; 339 pass in test_approval.py + new file; 442 pass across the adjacent guard suites; E2E battery of 12 dangerous + 17 safe commands via real imports, hot path ~330us/call. |
||
|---|---|---|
| .. | ||
| egress | ||
| features | ||
| messaging | ||
| secrets | ||
| skills | ||
| _category_.json | ||
| checkpoints-and-rollback.md | ||
| cli.md | ||
| configuration.md | ||
| configuring-models.md | ||
| desktop.md | ||
| docker.md | ||
| git-worktrees.md | ||
| import-from-other-agents.md | ||
| managed-scope.md | ||
| multi-profile-gateways.md | ||
| profile-distributions.md | ||
| profiles.md | ||
| security.md | ||
| sessions.md | ||
| tui.md | ||
| windows-native.md | ||
| windows-wsl-quickstart.md | ||