🔒 Fix Command Injection in ACP Runner terminal creation#12
Conversation
Wire hermes (hermes-agent) as a worker/orchestrator provider alongside claude and codex. Hermes speaks the same ACP JSON-RPC over stdio protocol as claude-agent-acp/codex-acp, so the integration is minimal: - providers.py: add 'hermes' to ProviderName, ORCHESTRATOR_PROVIDER_NAMES, WORKER_PROVIDER_NAMES, and PROVIDERS dict with default_worker_acp_command 'hermes acp', config_format mcp_json, acp_runtime_mode None. - acp_runner.py: _augment_acp_command and _acp_subprocess_env: hermes is a no-op (codex gets sandbox/approval overrides; hermes passes through). Use with: zenith init --agent hermes --workspace-dir /path/to/repo Or with a profile: zenith init --agent hermes --worker-acp-command 'hermes --profile myprofile acp' --workspace-dir /path/to/repo
- New: bundled/prompts/orchestrator/hermes_addendum.md with session_search, memory tool, skill loading, compression awareness - cli.py: appends addendum to .hermes/orchestrator_prompt.md for Hermes provider - assets.py: adds bundled_prompts_dir() helper
🎯 **What:** The vulnerability fixed is a Command Injection vulnerability in `create_subprocess_shell`.⚠️ **Risk:** The potential impact if left unfixed is the execution of arbitrary commands by an attacker passing malicious payload into `cmd` or `args`. 🛡️ **Solution:** By switching to `asyncio.create_subprocess_exec(cmd, *args, ...)`, the execution bypasses the shell entirely, eliminating the command injection risk.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Closing as stale — this PR was filed against a |
1 participant
🎯 What: The vulnerability fixed is a Command Injection vulnerability in
⚠️ Risk: The potential impact if left unfixed is the execution of arbitrary commands by an attacker passing malicious payload into
create_subprocess_shell.cmdorargs.🛡️ Solution: By switching to
asyncio.create_subprocess_exec(cmd, *args, ...), the execution bypasses the shell entirely, eliminating the command injection risk.PR created automatically by Jules for task 2341909328118024253 started by @jnorthrup