Local Sessions Can Reuse a Previous Remote Terminal/File Backend
Bug tracker — July 11, 2026. Hermes bug #62720 exposes a session-state isolation failure: ordinary sessions can collapse to cache key default and reuse an active environment from an earlier session without checking backend or profile compatibility. A local session may execute terminal/file operations on a stale SSH host, and subagents inherit the same environment.
The Failure in One Sentence
Hermes treats distinct sessions as interchangeable when their cache key resolves to default. If a prior session left an SSH or remote terminal/file backend active, a later local session can silently inherit it. Commands then run on the wrong host or against the wrong filesystem, turning session reuse into a potential isolation breach.
How Backend Reuse Goes Wrong
| Expected Session | Observed Risk | Required Guard |
|---|---|---|
| New local session | Reuses stale SSH/remote environment | Include backend, host, profile, and session identity in cache key |
| Terminal/file tools | Commands target a prior host or path | Validate backend compatibility before every reuse |
| Subagent execution | Inherited environment amplifies the wrong-host scope | Propagate explicit backend identity and reject mismatch |
Why This Is More Than a Convenience Bug
Wrong-host execution is a correctness and security concern. A user may believe a command inspected local files while it actually touched a remote machine. The resulting path confusion can leak data, modify the wrong environment, or make a destructive action appear to have happened somewhere else. Long-lived processes make the stale state harder to see because the failure depends on session history.
Recommended Fix Path
- Replace the generic
defaultcache key with a key containing session identity and backend/profile compatibility. - Validate host, filesystem root, transport, and tool capability before reusing an environment.
- Fail closed when a local request resolves to a remote backend or when profile metadata is missing.
- Add regression tests covering sequential local/remote sessions and subagent inheritance in one long-lived process.
Why This Matters for Review-Site Readers
Local-versus-managed comparisons often focus on speed and features, but isolation is a first-order trust property. Buyers should ask whether a platform can prove where a terminal or file operation ran, especially after multiple sessions and when subagents are involved.
Case Summary
- Source: GitHub issue
- Opened / updated: July 11, 2026
- Labels: P2, area/config, comp/tools, sweeper:risk-session-state, tool/file, tool/terminal
Source URL: https://github.com/NousResearch/hermes-agent/issues/62720