hermes - 💡(How to fix) Fix feat: support elevated execution for admin operations on Windows [1 participants]

Problem

On Windows, when Hermes Agent is launched with administrator privileges, child processes (terminal/execute_code) still run under a normal user token. Operations requiring elevation (UAC) cannot be performed autonomously — the user must manually copy commands into an elevated cmd window.

This significantly degrades UX: users who have authorized Hermes for admin operations still end up manually executing commands.

Proposed Solution

Add an elevated: bool parameter to execute_code and terminal tools. When elevated=true, use ShellExecuteEx with the runas flag to trigger the standard UAC prompt. After user confirms, the command runs with admin privileges.

Alternatives Considered

• CreateProcessWithLogonW — requires password, not practical
• SCM service API — too complex for this use case
• runas /user:admin subprocess — prompts for password interactively

Additional Context

Windows child processes do not inherit elevated tokens from parent. This is fundamental Windows security design. Hermes needs to intentionally re-elevate when needed via ShellExecuteEx + runas.