hermes-agent/contributors/emails/theone139344@users.noreply.github.com at 689b51bef68f9ec95b638121bb9c7fefa3703fb2 - mirrors/hermes-agent - Cosmolan Git

mirrors/hermes-agent

mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-25 17:18:11 +00:00

theone139344 062d261955 fix(desktop): prevent cross-session leak in background queue drain

A background queue drain (fromQueue: true) whose runtime binding was
reaped by the gateway fires with sessionId=null. The expression

  options?.sessionId ?? activeSessionIdRef.current

falls back to whichever runtime id the foreground happens to hold,
landing the queued prompt in the session the user is currently viewing
instead of the session that owns the queue entry — a cross-session
message leak.

Guard the fallback: only inherit the foreground runtime when the drain
targets the current view (no storedSessionId, or it matches the
foreground). A background drain (storedSessionId differs) is left with
sessionId=null so the existing session.resume path rebinds the correct
runtime before prompt.submit fires.

Includes a regression test: "a fromQueue drain with null runtime id
does NOT land in the foreground session (cross-session leak guard)".
All 53 existing tests pass.

2026-07-24 23:22:04 -07:00

1 line

13 B

Text

Raw Blame History

theone139344