PR #15469: fix: strip leaked state-sync output from terminal (defense-in-depth for #15459)

• Repository: NousResearch/hermes-agent
• Author: aj-nt
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/15469

Description (problem / solution / changelog)

Problem

When the persistent-shell snapshot redirect (export -p > file) fails — permissions, deleted temp dir, race conditions — the full environment dump (declare -x, export, alias lines) leaks into stdout and enters LLM context. No output-side stripping existed anywhere in the pipeline.

Fix

Add _strip_state_sync_leak() as a defense-in-depth filter in BaseEnvironment:

• Strips lines starting at column 0 with declare -x , declare -f , export , alias — the patterns produced by export -p, declare -f, and alias -p
• Preserves legitimate output — embedded occurrences mid-line are NOT stripped
• Called in _update_cwd() before CWD marker extraction, so every execute() call is covered
• Handles None/empty/missing output keys gracefully

Testing

13 new tests in TestStripStateSyncLeak:

• declare -x with and without =
• export VAR=value (zsh/POSIX)
• declare -f function definitions
• alias lines
• Mixed leak + real output
• Empty / missing output
• Embedded declare -x mid-line preserved
• CWD marker preserved after stripping

All 30 environment tests pass.

Closes

Fixes #15459

Changed files

• cli-config.yaml.example (modified, +10/-1)
• run_agent.py (modified, +85/-3)
• tests/run_agent/test_glm_stop_heuristic.py (added, +393/-0)
• tests/run_agent/test_run_agent.py (modified, +22/-2)
• tests/tools/test_base_environment.py (modified, +203/-0)
• tools/environments/base.py (modified, +48/-0)

PR #15472: fix: strip leaked declare-x env dump from terminal output on macOS (#15459)

• Repository: NousResearch/hermes-agent
• Author: vominh1919
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/15472

Description (problem / solution / changelog)

Fixes #15459

When using the terminal tool with TERMINAL_PERSISTENT_SHELL=True on macOS, every command's output is prepended with ~60 lines of declare -x environment variable declarations from the session snapshot. This wastes context tokens and can trigger HTTP 400 errors on providers with smaller context windows.

Root Cause

On macOS (bash 3.2 and certain Homebrew bash builds), source-ing a file containing declare -x VAR="value" lines can emit those declarations to stdout, unlike on Linux where they execute silently.

Fix (2-layer approach)

Layer 1: tools/environments/base.py (root cause)

Wrap the snapshot source command in a group with stdout redirected to /dev/null:

# Before:
source {snapshot} 2>/dev/null || true

# After:
{ source {snapshot} 2>/dev/null || true; } >/dev/null

This prevents any stdout from the snapshot sourcing from leaking into the command output.

Layer 2: tools/terminal_tool.py (defense-in-depth)

Add a regex post-processing step that strips any contiguous block of declare -x lines at the start of output, catching leaks from other code paths.

Testing

• Verified syntax with ast.parse() on both modified files
• The regex only matches declare -x lines at the START of output (using ^ anchor), so it never strips user command output that might legitimately contain declare -x

Fixes NousResearch/hermes-agent#15459

Changed files

• tools/environments/base.py (modified, +11/-2)
• tools/terminal_tool.py (modified, +12/-1)

PR #15474: fix: suppress declare -x stdout leak when sourcing snapshot on macOS

• Repository: NousResearch/hermes-agent
• Author: Sanjays2402
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/15474

Description (problem / solution / changelog)

Summary

The terminal() tool leaks 60+ lines of declare -x environment variable output into the LLM context window on macOS when TERMINAL_PERSISTENT_SHELL=True.

Root Cause

In _wrap_command() (tools/environments/base.py), the session snapshot is sourced before each command:

parts.append(f"source {self._snapshot_path} 2>/dev/null || true")

The snapshot file contains declare -x statements (written by export -p). On macOS, sourcing a file with declare -x prints each declaration to stdout. The 2>/dev/null only redirects stderr — stdout leaks directly into the command output that gets sent back to the LLM.

On Linux, declare -x during source is silent, which is why this was never caught before.

Fix

One-line change:

# Before (only suppresses stderr)
parts.append(f"source {self._snapshot_path} 2>/dev/null || true")

# After (suppresses both stdout and stderr)
parts.append(f"source {self._snapshot_path} > /dev/null 2>&1 || true")

The source builtin still sets all variables in the current shell — only the print output is suppressed. The redirect is harmless on Linux where it's already silent.

Fixes #15459

Changed files

• tools/environments/base.py (modified, +7/-26)