Cairn
NousResearch/hermes-agent

False-positive blocks on $() substitutions in strings

Cluster 70838 · agent. Data as of

2 open items. Fix merged in #110990 on 14 Sep 2026. Check it covers your case.

The short answer

1open issue
1open PR
4items grouped
Known?
Yes. 4 related items grouped here, 0 issues already closed.
Fix event
A fix was merged to main in PR #110990. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 1 PR.

These items address a parsing issue where command substitutions like $() inside double-quoted strings were incorrectly flagged as malformed or dangerous payloads. Fixes target the approval and hardline guard logic responsible for the misparsing.

Open issues1

  • Issue#70838[Bug]: hardline guard false-positives on $(grep/rg/sort ...) inside double quotes — benign commands blocked as 'malformed executable payload'

Open PRs1

  • PR#70880fix(hardline): prevent false-positive on substitution inside double quotes (#70838)

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #110990 fix(approval): escaped quotes in grep patterns no longer hardline-blocked, and no longer hide a following hardline command (#96776, salvage #85922)

    merged to main

    files: tests/tools/test_hardline_escaped_quote_state.py, tools/approval_detection.py, website/docs/user-guide/security.md

1 PR closed without merging

From the close comments: done elsewhere 1

  • #70839 fix(approval): stop misparsing $() substitutions as malformed payloads · done elsewhere → e383c28, #110990
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#110990
Closed issues
0
Attempts
1 PR closed without merging
Fix link checked
14 Sep 2026

For your agent

The same facts, typed.

cluster/70838.json
cluster/70838.md