hermes-agent/website
SHL0MS fda771498e docs(acp): warn that Buzz auto-approves Hermes tool permissions
The Buzz Desktop section covered discovery only. The combination that
actually needs stating: the hermes-acp toolset carries terminal and
execute_code, and buzz-acp answers session/request_permission itself with
allow_once instead of surfacing it. A Hermes agent in Buzz runs shell
commands on the host unattended.

Buzz defaults every agent to owner-only and that default holds through to
the spawned process env, so nobody reaches the open state by accident.
But Anyone is one dropdown change away with no warning shown, and it
hands channel-wide shell access to the host.

Also record that the two obvious mitigations do not work: approvals.mode
manual raises the request but Buzz auto-approves it anyway, and
platform_toolsets.acp does not narrow the ACP toolset. Both verified by
running rm -rf through the ACP path under each setting.

Amend the Approvals section too — it promised prompts route back to the
editor, which is only true for hosts that choose to surface them.

en + zh-Hans.

Signed-off-by: SHL0MS <SHL0MS@users.noreply.github.com>
2026-07-28 11:53:12 -07:00
..
docs docs(acp): warn that Buzz auto-approves Hermes tool permissions 2026-07-28 11:53:12 -07:00
i18n/zh-Hans/docusaurus-plugin-content-docs/current docs(acp): warn that Buzz auto-approves Hermes tool permissions 2026-07-28 11:53:12 -07:00
scripts fix(skills): move computer-use skill into the autonomous-ai-agents category 2026-07-23 21:06:39 -07:00
src refactor(cron): rebrand Cron Recipes -> Automation Blueprints 2026-06-11 10:49:47 -07:00
static feat(models): swap Gemini catalog entries to 3.1 Pro + 3.6 Flash; drop retired Qwen models 2026-07-28 10:07:18 -07:00
.gitignore feat(skills-hub): health checks, freshness badge, and a watchdog cron (#32345) 2026-05-25 23:10:45 -07:00
docusaurus.config.ts fix(docs): disable fuzzy matching in docs search (exact word or prefix only) (#65103) 2026-07-15 09:57:46 -07:00
package-lock.json docs(website): redirect old automation-templates URL to automation-blueprints 2026-06-12 09:46:27 -07:00
package.json docs(website): redirect old automation-templates URL to automation-blueprints 2026-06-12 09:46:27 -07:00
README.md docs: replace ASCII diagrams with Mermaid/lists, add linting note 2026-03-21 17:58:30 -07:00
sidebars.ts docs(delegation,api): document stall detection, timeout metadata, /agents live status, runs-stream subagent lifecycle 2026-07-27 11:33:53 -07:00
tsconfig.json change(tooling): typecheck in CI, update ts to 6 2026-06-10 11:59:34 -04:00

Website

This website is built using Docusaurus, a modern static website generator.

Installation

yarn

Local Development

yarn start

This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.

Build

yarn build

This command generates static content into the build directory and can be served using any static contents hosting service.

Deployment

Using SSH:

USE_SSH=true yarn deploy

Not using SSH:

GIT_USER=<Your GitHub username> yarn deploy

If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.

Diagram Linting

CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.