RELIABILITY TRACKER · P1 OPEN
Cron Workdir Leakage into Gateway Sessions · Issue #69396
A source-linked review of a reported Hermes Agent session-state defect where a cron job changes the gateway process working directory and interactive sessions inherit unrequested AGENTS.md instructions.
What the report describes
The open report describes a cron job with a workdir changing the gateway process cwd. Interactive Signal, Telegram, and other sessions created while the job runs reportedly inherit that directory and auto-load its AGENTS.md into the system prompt. The report documents an unrequested duplicate email, a shared-file race, and arbitrary repository instructions becoming binding in a user session.
Scope note: This page summarizes a linked open issue and is not an independent reproduction. The P1 label and reported impact should be evaluated against the affected version, operating system, local workflow, and current upstream issue state.
Failure-chain matrix
| Signal | What to inspect | Safe review response |
|---|---|---|
| Process working directory | Whether a scheduled job mutates the long-lived gateway cwd | Keep scheduled execution context isolated from interactive gateway state and verify cwd per session. |
| AGENTS.md discovery | Which instruction files are loaded into a user-created session | Trace discovery roots and reject inherited instructions outside the user-approved session scope. |
| Cross-session contamination | Whether cron state affects Signal, Telegram, or other interactive channels | Run concurrent scheduled and interactive trials and compare prompts, tools, and side effects. |
| Unrequested side effects | Duplicate email or shared-file writes caused by inherited instructions | Audit outbound actions and shared resources for provenance, authorization, and idempotency. |
| Session-state recovery | How to detect and contain a contaminated gateway session | Capture non-sensitive session context, stop unsafe work, and restart from a clean process boundary. |
Reproduction and recovery protocol
- Use a disposable gateway and synthetic AGENTS.md files in separate cron and interactive working directories.
- Run the scheduled job while creating interactive sessions across each supported channel.
- Compare loaded instructions, current working directory, tool availability, and outbound-action traces against a clean control.
- Attempt duplicate-email and shared-file scenarios only with synthetic targets and explicit safety gates.
- Retest after remediation and confirm that scheduled cwd changes cannot alter interactive prompt construction.
Source evidence
NousResearch/hermes-agent · Issue #69396
Reported labels include P1 and component-specific risk markers. Verify current status, affected versions, linked remediation, and local reproduction before publishing a resolution claim.