PR #16631: fix: skip sudo prompt when sudo -n already works

• Repository: NousResearch/hermes-agent
• Author: Mind-Dragon
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/16631

Description (problem / solution / changelog)

Prompt to Recreate

In NousResearch/hermes-agent, fix the terminal sudo handling so an interactive Hermes session does not prompt for a sudo password when the local host already supports passwordless sudo. Reproduce on current origin/main by setting HERMES_INTERACTIVE=1, leaving SUDO_PASSWORD unset, making _sudo_nopasswd_works() / sudo -n true return success, and calling tools.terminal_tool._transform_sudo_command("sudo whoami"). The command should remain sudo whoami with no stdin and _prompt_for_sudo_password() must not be called. Preserve explicit SUDO_PASSWORD behavior and do not use the host sudo probe for non-local terminal backends.

Tracking

This PR is the single tracking surface for the sudo NOPASSWD fix. The separate issue #16630 was closed to avoid split discussion.

Bug Description

Hermes prompts for a sudo password inside interactive CLI/TUI sessions even when the local user already has working NOPASSWD sudo.

Outside Hermes, sudo -n true exits 0. Inside Hermes, a real sudo ... terminal command still enters the password prompt path before execution.

Prior Art / Relationship to #7760

#7760 is the original atomic PR for this same behavior and touches the same two files. I checked it live before opening this current-main replacement:

• #7760 is atomic: one commit, tools/terminal_tool.py + tests/tools/test_terminal_tool.py only.
• #7760 is currently CONFLICTING / merge state DIRTY against main.
• The authenticated account cannot update that branch (viewerCanUpdate=false).

This PR keeps the same atomic scope, rebased on current main, and adds one extra safety boundary: the host sudo -n true probe is local-terminal-only so host sudo state is not applied to Docker/SSH/Modal/etc.

Root Cause

_transform_sudo_command() checks configured/cached sudo passwords, then immediately prompts when HERMES_INTERACTIVE is set. It never first probes whether the local host can already run sudo non-interactively with sudo -n true.

Fix

• Add _sudo_nopasswd_works().
• Probe sudo -n true with stdin/stdout/stderr suppressed and a short timeout.
• Re-probe before each sudo prompt decision instead of process-caching successful probes, so an active sudo timestamp expiring cannot make a later command block without Hermes prompting.
• Use the probe before interactive prompting when no SUDO_PASSWORD or cached password exists.
• Scope the probe to TERMINAL_ENV=local only, so host sudo state is not incorrectly applied to Docker/SSH/Modal/etc.
• Preserve existing explicit SUDO_PASSWORD behavior.

How to Verify

/home/agent/hermes-agent/venv/bin/python -m pytest tests/tools/test_terminal_tool.py -q -o 'addopts=' --tb=short

Expected:

13 passed

Broader terminal regression run used locally:

/home/agent/hermes-agent/venv/bin/python -m pytest \
  tests/tools/test_terminal_tool.py \
  tests/tools/test_terminal_none_command_guard.py \
  tests/tools/test_terminal_tool_requirements.py \
  tests/tools/test_terminal_foreground_timeout_cap.py \
  tests/tools/test_terminal_timeout_output.py \
  tests/tools/test_terminal_output_transform_hook.py \
  tests/tools/test_terminal_requirements.py \
  tests/tools/test_terminal_compound_background.py \
  tests/tools/test_terminal_exit_semantics.py \
  -q -o 'addopts=' --tb=short

Expected:

114 passed

Test Plan

• Watched new regression tests fail on current origin/main.
• Watched the Copilot stale-cache regression fail before removing process-lifetime caching.
• tests/tools/test_terminal_tool.py passes.
• Broader terminal tool regression subset passes.
• tools/terminal_tool.py py_compile passes.
• git diff --check origin/main..HEAD passes.
• Live local smoke: sudo -n true exits 0 and _transform_sudo_command("sudo true") returns ("sudo true", None).

Risk Assessment

Low. The behavior change only affects local terminal execution when no sudo password is configured/cached and local sudo -n true succeeds at the time Hermes is deciding whether to prompt. Non-local backends still avoid the host sudo probe, and configured SUDO_PASSWORD behavior remains unchanged.

Changed files

• tests/tools/test_terminal_tool.py (modified, +49/-0)
• tools/terminal_tool.py (modified, +25/-0)

PR #7760: fix: skip sudo prompt when sudo -n already works

• Repository: NousResearch/hermes-agent
• Author: JustinUssuri
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/7760

Description (problem / solution / changelog)

Summary

• detect when the current user already has passwordless sudo via sudo -n true
• skip the interactive sudo password prompt in that case
• add a regression test covering the NOPASSWD path

Problem

Hermes currently prompts for a sudo password whenever it sees a sudo command in interactive mode unless SUDO_PASSWORD is set. That happens even when the host is already configured with sudo NOPASSWD, so YOLO/approval settings can be off and the user still gets an unnecessary password prompt.

Test Plan

• ./venv/bin/python -m pytest tests/tools/test_terminal_tool.py -q
• local smoke test of _transform_sudo_command('sudo whoami') returning ('sudo whoami', None) when sudo -n works

Changed files

• tests/tools/test_terminal_tool.py (modified, +18/-0)
• tools/terminal_tool.py (modified, +29/-0)