Cairn

SSH tar extraction corrupting remote directory permissions

NousResearch/hermes-agent · cluster 17767

Data as of

Nothing open on GitHub. Fix merged in #17867. Check it covers your case.

The short answer

0open issues
0open PRs
5items grouped
Known?
Yes. 5 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #17867. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #17867. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and PRs concern a bug where tar extraction during SSH bulk sync overwrites remote home directory permissions, potentially breaking sshd StrictModes. Proposed fixes involve passing --no-overwrite-dir and scoping extraction to the .hermes directory.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #17867 fix(ssh): prevent tar from overwriting remote home dir permissions (#17767)

    merged to main

    files: tools/environments/ssh.py

  • #17898 fix(ssh): prevent tar from overwriting remote home dir permissions (#17767)

    merged to main

    files: tests/tools/test_ssh_bulk_upload.py, tools/environments/ssh.py

2 PRs closed without merging

From the close comments: duplicate 1 · merged via another change 1

  • #10205 harden(ssh): scope bulk sync tar extraction to .hermes · merged via another change → eb51fb6, #30172
  • #17776 fix(ssh): pass --no-overwrite-dir to tar extract to prevent clobbering directory modes · duplicate → #10205
Closed issues · 1
  • Closed#17767SSH backend: `tar xf - -C /` corrupts remote home directory mode, breaks sshd StrictModes
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#17867, #17898
Closed issues
1
Attempts
2 PRs closed without merging
Fix link checked
30 Apr 2026

For your agent

The same facts, typed.

cluster/17767.json
cluster/17767.md