Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix feat(lsp): make npm command configurable for supply-chain security [1 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Fix Action

Fixed

Code Example

# ~/.hermes/config.yaml
terminal:
  npmCommand: pnpm   # or "npm" (default)
RAW_BUFFERClick to expand / collapse

Problem Description

agent/lsp/install.py::_install_npm() hardcodes shutil.which("npm") (line 223) as the sole package manager for installing LSP servers. This bypasses all five supply-chain security layers Hermes ships elsewhere (Skills Guard, Security Advisories, OSV audit, Tirith, Lazy Deps allowlist).

Users who standardize on pnpm 11+ for its supply-chain defaults (minimumReleaseAge, blockExoticSubdeps, allowBuilds) cannot extend that protection to the LSP install path.

The HERMES_NODE_PACKAGE_MANAGER env var proposed in #17735 covers scripts/install.sh but does not reach agent/lsp/install.py.

Proposed Solution

  1. Add a terminal.npmCommand config key (or reuse HERMES_NODE_PACKAGE_MANAGER):
# ~/.hermes/config.yaml
terminal:
  npmCommand: pnpm   # or "npm" (default)

  1. Update _install_npm() to resolve the binary from config/env, falling back to npm when unset.

  2. When the resolved binary is pnpm, use pnpm add --save-exact instead of npm install --silent --no-fund --no-audit.

  3. Pin versions in INSTALL_RECIPES (addresses #25017 simultaneously).

Affected Area

agent/lsp/install.py (LSP server installation), hermes_cli/config.py (new config key)

Alternatives Considered

  • Wrapping npm with a shell alias. Fragile, breaks subprocess detection.
  • Using pnpm only when lockfile detected. Doesn't help with fresh installs.

Additional Context

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix feat(lsp): make npm command configurable for supply-chain security [1 pull requests]