PR #14107: fix(ssh): forward skill env vars into SSH snapshots

• Repository: NousResearch/hermes-agent
• Author: liuhao1024
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14107

Description (problem / solution / changelog)

Summary

• forward skill-registered passthrough vars with SendEnv during SSH login-shell bootstrap
• keep forwarding scoped to init_session() so later SSH commands reuse the captured snapshot
• add regression tests covering registered vs unregistered env vars

Root cause

• the SSH backend captured its login-shell snapshot without any SendEnv options
• skill passthrough vars existed in the Hermes process, but OpenSSH was never told to forward them into the remote login shell

Fix

• build SendEnv args from the registered passthrough allowlist for env vars that are actually present locally
• attach those args only to login-shell SSH invocations so the snapshot persists them for later terminal / execute_code calls

Regression coverage

• added tests/tools/test_ssh_env_passthrough.py to assert registered vars are forwarded during login-shell bootstrap
• added a negative test proving unregistered vars are not forwarded

Testing

• scripts/run_tests.sh tests/tools/test_ssh_env_passthrough.py
• scripts/run_tests.sh tests/tools/test_sync_back_backends.py tests/tools/test_skill_env_passthrough.py

Closes #14091

Changed files

• tests/tools/test_ssh_env_passthrough.py (added, +68/-0)
• tools/environments/ssh.py (modified, +20/-1)

PR #14126: fix(ssh): pass through skill env vars to remote shells

• Repository: NousResearch/hermes-agent
• Author: LeonSGP43
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14126

Description (problem / solution / changelog)

Summary

• inject allowlisted env passthrough variables into SSH-backed shell sessions before the remote bash command runs
• load passthrough values from the live process env first, then fall back to ~/.hermes/.env for persisted skill secrets
• keep Hermes-managed provider credentials blocked so SSH passthrough matches the existing sandbox safety rules

Testing

• pytest -o addopts= tests/tools/test_ssh_environment.py -k "passthrough_env_vars or test_base_flags or test_user_host_suffix"
• pytest -o addopts= tests/tools/test_ssh_environment.py

Closes #14091

Changed files

• tests/tools/test_ssh_environment.py (modified, +31/-0)
• tools/environments/ssh.py (modified, +39/-0)

PR #14354: fix(ssh): forward skill-allowlisted env vars over SSH via SendEnv

• Repository: NousResearch/hermes-agent
• Author: Sanjays2402
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14354

Description (problem / solution / changelog)

Fixes #14091

The bug

tools/env_passthrough.py already builds an allowlist of env vars that should reach sandboxed environments — populated from skill required_environment_variables frontmatter and terminal.env_passthrough config. The local and code_execution backends consult is_env_passthrough() / get_all_passthrough(), but SSHEnvironment never did.

Result: when terminal_backend: ssh, every ssh ... bash -c subprocess inherits a stripped child environment that excludes the allowlist, and the remote bash session sees no skill-declared variables — even with AcceptEnv * configured on the remote sshd.

The reporter's diagnosis is correct: the SSH command was missing -o SendEnv=NAME.

Fix

In _build_ssh_command():

• Append -o SendEnv=<NAME> for every var in get_all_passthrough() that is actually present in os.environ.
• Names are sorted for deterministic command construction (so ControlMaster connection reuse stays stable).

In _run_bash():

• -o SendEnv only forwards names; the OpenSSH client reads values from its own process environment. Pass them explicitly via a new _build_subprocess_env() so allowlisted vars are guaranteed to be present even if a future caller scrubs the parent env.

Failure to import or call get_all_passthrough() is non-fatal — SSH still works, just without forwarding (matches the existing best-effort posture in skills_tool.py).

Why this is the right layer

• Same allowlist source as local / code_execution — single source of truth (get_all_passthrough()), so security guarantees stay consistent (Hermes provider credentials are still blocked from skill registration per GHSA-rhgp-j443-p4rf).
• Doesn't bypass remote sshd policy — admins still need AcceptEnv on the remote (the issue notes AcceptEnv *); we just stop silently dropping the names client-side.
• Zero behavior change when no skill/config registers anything — empty allowlist ⇒ no SendEnv flags, no env override.

Verification

uv run --frozen --python 3.11 --extra dev pytest -o addopts='' \
  tests/tools/test_ssh_environment.py \
  tests/tools/test_ssh_bulk_upload.py \
  tests/tools/test_sync_back_backends.py -q
52 passed, 11 skipped

7 new targeted tests in TestBuildSSHCommand:

• test_no_send_env_when_no_passthrough_registered — zero behavior change when allowlist empty
• test_send_env_added_for_registered_passthrough_var — the actual #14091 case
• test_send_env_skips_unset_vars — allowlisted-but-unset vars don't leak as empty SendEnv lines
• test_send_env_is_deterministic — sorted order for ControlMaster reuse stability
• test_passthrough_failure_is_non_fatal — SSH keeps working if env_passthrough breaks
• test_subprocess_env_includes_passthrough_values — values propagated to ssh client process env
• test_subprocess_env_is_none_when_no_passthrough — don't override default child-env semantics unnecessarily

Notes

• Minimal, focused diff. Uses the existing env_passthrough infrastructure rather than introducing a parallel mechanism.
• Doesn't touch skills_tool.py's setup_needed reporting — that's accurate for the registration side; the bug was purely on the SSH consumer side.
• No new dependencies.

Changed files

• tests/tools/test_ssh_environment.py (modified, +83/-0)
• tools/environments/ssh.py (modified, +47/-1)

PR #14414: fix(ssh): send skill env passthrough variables

• Repository: NousResearch/hermes-agent
• Author: sgaofen
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14414

Description (problem / solution / changelog)

Summary

Fixes #14091.

This makes the SSH terminal backend forward skill/config allowlisted environment variables into remote SSH sessions via OpenSSH SendEnv.

Root cause

Skill readiness can register required_environment_variables through tools.env_passthrough, and local/Docker/code-execution paths already consult that allowlist. The SSH backend, however, only launched ssh ... bash -c ... and never asked OpenSSH to send the allowlisted variables, so remote terminal / execute_code sessions could not see them even when the local Hermes process or ~/.hermes/.env had the values.

Fix

• Resolve the current passthrough allowlist for each SSH shell invocation.
• Filter out Hermes provider credentials using the existing provider credential blocklist.
• Populate the child ssh process environment from os.environ, falling back to Hermes .env values.
• Add -o SendEnv=<KEY> only for allowlisted keys that have values.
• Add regressions for explicit SendEnv flags, provider-key filtering, and .env fallback values.

This intentionally uses SendEnv instead of embedding secret values into the remote shell command string; SSH servers still need the corresponding AcceptEnv configuration, matching the issue reproduction.

Validation

• /Users/stephenyu/Documents/hermes-agent/.venv/bin/python -m pytest tests/tools/test_ssh_environment.py::TestBuildSSHCommand::test_send_env_flags_are_added_when_requested tests/tools/test_ssh_environment.py::TestBuildSSHCommand::test_run_bash_forwards_allowed_env_without_provider_keys tests/tools/test_ssh_environment.py::TestBuildSSHCommand::test_run_bash_uses_hermes_env_file_values_for_send_env -q --tb=short
• /Users/stephenyu/Documents/hermes-agent/.venv/bin/python -m pytest tests/tools/test_ssh_environment.py tests/tools/test_env_passthrough.py -q --tb=short
• git diff --check

Note: the full SSH test file still emits pre-existing PytestUnhandledThreadExceptionWarning warnings from its mocked stdout object in unrelated constructor tests; the new targeted tests avoid that warning and pass cleanly.

Changed files

• tests/tools/test_ssh_environment.py (modified, +75/-0)
• tools/environments/ssh.py (modified, +50/-3)