hermes-agent

Files

T

Teknium fae0c4f5f4 fix(hindsight): create embedded profile env file owner-only (0600)

The embedded Hindsight daemon's profile env file carries the plaintext
HINDSIGHT_API_LLM_API_KEY but was written via bare write_text(), leaving
it with umask-derived (typically world-readable) permissions.

- Create/truncate the file via os.open(..., 0o600); chmod a pre-existing
  file to 0600 BEFORE writing new secret bytes.
- Post-write validation on POSIX: verify 0600, retry chmod, and raise if
  the file still isn't owner-only.
- If validation fails, unlink the secret file so a plaintext key is never
  left behind with unverified permissions.
- Regression tests under tests/plugins/ for fresh-write mode, tightening a
  pre-existing 0644 file, and cleanup on validation failure.

Narrowed reimplementation of #74236 confined to plugins/memory/hindsight/;
the core utils.py atomic-replace opt-out from the PR was dropped.

Co-authored-by: carrion256 <carrion256@proton.me>

2026-07-31 22:39:34 -07:00

byterover

fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428 )

2026-07-24 11:45:57 -07:00

hindsight

fix(hindsight): create embedded profile env file owner-only (0600)

2026-07-31 22:39:34 -07:00

holographic

refactor: canonical config loaders for behavioral reads + guarded raw-read primitive (kills the managed-scope/env-expansion drift class)

2026-07-29 10:53:29 -07:00

honcho

fix(honcho): network-hermetic unit tests + lazy async writer start