{"repo":"NousResearch/hermes-agent","public_id":"126389","display_label":"Fix sudo password and RPC token handling in managed modal","summary":"These items address two security and correctness issues: sudo passwords being incorrectly piped rather than sent via stdinData, and RPC tokens leaking into remote process arguments while kernel directories lack access controls.","subsystem":"environments","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":0,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":124262,"merged_at":"2026-09-26T19:26:32+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-26T19:26:32+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":121932,"pr_number":124262,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-26T19:26:32+00:00"}],"members":[{"kind":"issue","number":126389,"title":"[Bug]: managed Modal pipes the sudo password into the first pipeline only (sudo after && fails, caller stdin dropped)","url":null,"state":"open"},{"kind":"pr","number":124262,"title":"fix(code-execution): keep the RPC token out of remote argv and lock down kernel dirs","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/_child_env_fixtures.py","tests/tools/test_code_execution.py","tests/tools/test_code_execution_file_rpc.py","tests/tools/test_code_kernel_remote.py","tests/tools/test_tool_result_storage.py","tools/code_execution_rpc.py","tools/code_execution_tool.py","tools/code_kernel_remote.py","tools/environments/base_session_env.py","tools/tool_result_storage.py"]},{"kind":"pr","number":126390,"title":"fix(managed-modal): send the sudo password in stdinData, not a pipe into the first pipeline (salvage #122440)","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"ed9ee1ed27","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}