NousResearch/hermes-agent

Fix O(n³) regex stall in dangerous-command detection

Cluster 113535. Data as of 2026-10-24 13:18 UTC

Nothing open on GitHub. Fix merged in #114208 on 17 Sep 2026. Check it covers your case.

open issues

open PRs

items grouped

Known?: Yes. 4 related items grouped here, 1 issue already closed.
Fix event: A fix was merged to main in PR #114208. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this resolved, deciding PR #114208. That is separate from the fix event.
Still open: Nothing open on GitHub.

Next step: read #114208, then check it covers your case.

Read #114208 Pick up a Lab task

These issues and PRs address a performance bug where dangerous-command detection used catastrophic backtracking (O(n³) complexity) on long or multiline terminal commands, stalling the gateway. The fixes anchor lookahead patterns and bound matching to keep detection linear.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#114208 Long heredoc commands no longer stall the gateway in dangerous-command detection (#113535, salvage #104781)

merged to main

files: contributors/emails/[redacted:email], tests/tools/test_approval.py, tests/tools/test_approval_launchctl_performance.py, tools/approval_detection.py

2 PRs closed without merging

From the close comments: duplicate 1 · merged via another change 1

#113536 fix(approval): anchor the launchctl lifecycle lookaheads so detection stays linear · duplicate → #104781
#113943 fix(approval): bound dangerous-command detection on long multiline commands (#113535) · merged via another change → 61e730c, #114208

Closed issues · 1

Closed#113535[Bug]: detect_dangerous_command is O(n³) on long terminal commands and stalls the gateway (launchctl lookahead pattern)

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs: #114208
Closed issues: 1
Attempts: 2 PRs closed without merging
Fix link checked: 17 Sep 2026

For your agent

The same facts, typed.

cluster/113535.json
cluster/113535.md