hermes - 💡(How to fix) Fix [Bug]: Gateway: --replace multi-worker causes Feishu WebSocket failure [1 comments, 2 participants]

Bug Description

Bug Description

When hermes gateway starts with --replace flag (multi-worker mode), Feishu's App ID only permits ONE active WebSocket connection at a time. Only one worker successfully connects; all other workers fail and hang. If the worker holding the Feishu connection is killed, the entire process tree crashes — Gateway goes down completely.

Steps to Reproduce

1. Start hermes gateway (default uses --replace, spawning multiple workers)
2. Check Feishu connection status: only one worker succeeds, others fail
3. Kill any one worker PID → entire Gateway process group collapses

Environment

• Hermes version: v0.12.0
• OS: WSL2 Ubuntu 22.04
• Feishu connection: WebSocket mode

Suggested Fix

Run in single-worker mode by default (remove --replace), which is more stable for Feishu WebSocket connections. If multi-worker is required, each worker should use an isolated Feishu App ID.

CLI: Danger command approval loop causes repeated Gateway crashes

Bug Description

Executing pkill/kill on gateway processes triggers the danger command approval system. User approves → command executes → Gateway crashes. User approves again → same destructive command runs again → Gateway crashes again. This creates an approval loop: the user keeps approving, but each approval further destroys the running system.

Steps to Reproduce

1. Gateway is running normally
2. Execute pkill gateway or kill <gateway_pid>
3. Approval prompt appears → user approves
4. Command executes → entire gateway process group crashes
5. Repeat steps 1-4 → enters infinite crash loop

Environment

• Hermes version: v0.12.0
• OS: WSL2 Ubuntu 22.04

Suggested Fix

Before executing destructive commands, check and warn if the target process is critical to system stability (e.g., the only running gateway instance, or a parent process).

Skills: rglob path injection vulnerability allows reading arbitrary files

Bug Description

The skills rglob function is vulnerable to path injection. An attacker can inject arbitrary file patterns via the rglob parameter, potentially reading sensitive files outside the intended skills directory.

Affected Component

Skills loader using rglob pattern matching

Suggested Fix

Sanitize and validate all rglob input paths before use. Use allowlist for permitted paths.

Steps to Reproduce

1. Start hermes gateway (default uses --replace, spawning multiple workers)

2. Check Feishu connection status: only one worker succeeds, others fail

3. Kill any one worker PID → entire Gateway process group collapses

4. Gateway is running normally

5. Execute pkill gateway or kill <gateway_pid>

6. Approval prompt appears → user approves

7. Command executes → entire gateway process group crashes

8. Repeat steps 1-4 → enters infinite crash loop

9. Inject malicious path pattern via rglob parameter

10. Skills loader processes the pattern without sanitization

11. Attacker reads arbitrary files outside skills directory

Expected Behavior

Gateway should connect to Feishu reliably in single-worker mode. If multi-worker mode is used, each worker should use an isolated Feishu App ID to avoid connection conflicts. Dangerous commands should check if the target process is critical before execution. If a destructive command would kill the only running gateway instance, Hermes should warn the user and require explicit confirmation that they understand the risk — not just approve the command blindly. rglob should only access files within the designated skills directory. Arbitrary path injection should be blocked with path validation and allowlist filtering.

Actual Behavior

Multiple workers start simultaneously. Only one worker successfully holds the Feishu WebSocket connection. All other workers fail with connection errors and hang indefinitely. If the worker holding the connection is killed (even accidentally), the entire process group collapses — Gateway becomes unavailable. When user executes pkill/kill on gateway processes:

• Approval prompt appears, user approves
• Command executes successfully
• Gateway crashes immediately
• User approves again to proceed
• Same destructive command runs again
• Gateway crashes again → Infinite approval loop, Gateway cannot stay alive Malicious path patterns passed to rglob are not sanitized. Attacker can traverse directories outside skills folder and read sensitive files (e.g., configs, credentials, keys).

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

N/A (CLI only)

Debug Report

Debug Report	https://paste.rs/jUZeK
agent.log	https://paste.rs/O0BcK
gateway.log	https://paste.rs/7AnhX

Operating System

windows10/WSL/Ubuntu 24.04

Python Version

Python 3.11.0rc1

Hermes Version

hermes v0.12.0 (2026-04-30)

Additional Logs / Traceback (optional)

Debug Report: https://paste.rs/jUZeK
agent.log:   https://paste.rs/O0BcK  
gateway.log:  https://paste.rs/7AnhX

---
System Info:
- Hermes: v0.12.0 (2026-04-30)
- Python: 3.11.0rc1
- OS: WSL2 Ubuntu 22.04
- Feishu: WebSocket mode

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR