# NousResearch/hermes-agent · LSP untrusted repo interpreter/SDK execution security fix

## Open now

- Nothing open on GitHub.

A bug was identified where editing files in a cloned repository could cause the LSP to run that repository's own Python interpreter, TypeScript SDK, or plugins without user approval. The cluster covers the bug report and two related fix attempts addressing untrusted workspace execution boundaries.

## TL;DR

- 3 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #126239. Verify it addresses your case.
- **Recommended:** read PR #126239 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-126239`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `1.00`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #125954: \[Bug\]: editing a file in a cloned repository runs that repository's own Python interpreter through the LSP (no approval, on by default)

## Prior & competing PRs

- **#126239: fix(lsp): never run a cloned repo's own interpreter, SDK or plugins; trust the session's workspace (salvage #125955)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `agent/lsp/cli.py`, `agent/lsp/eventlog.py`, `agent/lsp/manager.py`, `agent/lsp/servers.py`, `agent/lsp/workspace.py`, `cli-config.yaml.example`, `hermes_cli/config_defaults.py`, `tests/agent/lsp/test_custom_servers.py`, `tests/agent/lsp/test_install_and_lint_fixes.py`, `tests/agent/lsp/test_manager_locking.py`, `tests/agent/lsp/test_python_discovery.py`, `tests/agent/lsp/test_root_policy.py`, `tests/agent/lsp/test_shell_linter_lsp_skip.py`, `tests/agent/lsp/test_workspace_trust.py`, `tests/pm/test_node_resolution.py`, `tools/file_operations_lint.py`, `website/docs/user-guide/features/lsp.md`, `website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/lsp.md`
- **#125955: fix(lsp): never run a cloned repository's own interpreter or TypeScript SDK in an untrusted workspace**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `1f3b384906`, `482e5a1e54`, `#126239`

## Fix status

- Merged to main in PR #126239 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-09-28`.