{"repo":"NousResearch/hermes-agent","public_id":"4669","display_label":"Sanitize and validate terminal workdir before Docker exec","summary":"These issues and PRs address a bug where an invalid or unsafe working directory value could be passed through to Docker's exec or run commands, bypassing configured terminal CWD settings. The work focuses on input validation and sanitization of the workdir parameter in terminal tool backends.","subsystem":"environments","counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":0,"attempt_prs":2},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[],"members":[{"kind":"issue","number":4669,"title":"[Bug]: terminal tool passes invalid workdir to Docker exec and overrides configured terminal.cwd","url":null,"state":"closed"},{"kind":"pr","number":4731,"title":"fix(tools): validate per-call workdir and preserve resolved TERMINAL_CWD","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#4672","number":4672},{"kind":"pr","value":"#11029","number":11029},{"kind":"pr","value":"#4669","number":4669},{"kind":"pr","value":"#5620","number":5620}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":4978,"title":"fix: validate per-call workdir before passing to docker exec","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#5629","number":5629}],"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true}],"trust":{"default_tier":"verified","includes_suggested":false}}