common/hermes
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(security): protect .docker, .azure, and .config/gh from read and write

Browse Source
This commit is contained in:
maymuneth
2026-03-31 21:08:06 +03:00
committed by Teknium
parent c94a5fa1b2
commit 655eea2db8
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/context_references.py
View File

@@ -17,7 +17,7 @@ REFERENCE_PATTERN = re.compile(
r"(?<![\w/])@(?:(?P<simple>diff|staged)\b|(?P<kind>file|folder|git|url):(?P<value>\S+))" r"(?<![\w/])@(?:(?P<simple>diff|staged)\b|(?P<kind>file|folder|git|url):(?P<value>\S+))"
) )
TRAILING_PUNCTUATION = ",.;!?" TRAILING_PUNCTUATION = ",.;!?"
_SENSITIVE_HOME_DIRS = (".ssh", ".aws", ".gnupg", ".kube") _SENSITIVE_HOME_DIRS = (".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure")
_SENSITIVE_HERMES_DIRS = (Path("skills") / ".hub",) _SENSITIVE_HERMES_DIRS = (Path("skills") / ".hub",)
_SENSITIVE_HOME_FILES = ( _SENSITIVE_HOME_FILES = (
Path(".ssh") / "authorized_keys", Path(".ssh") / "authorized_keys",

3
tools/file_operations.py
View File

@@ -71,6 +71,9 @@ WRITE_DENIED_PREFIXES = [
os.path.join(_HOME, ".kube"), os.path.join(_HOME, ".kube"),
"/etc/sudoers.d", "/etc/sudoers.d",
"/etc/systemd", "/etc/systemd",
os.path.join(_HOME, ".docker"),
os.path.join(_HOME, ".azure"),
os.path.join(_HOME, ".config", "gh"),
] ]
] ]