{"repo":"NousResearch/hermes-agent","public_id":"90699","display_label":"TUI gateway profile param path traversal fix","summary":"A bug report and two related fixes addressing missing validation of the RPC profile parameter in the TUI gateway, which allowed the value to escape the profiles root directory via path traversal.","subsystem":"gateway","counts":{"members":5,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":110212,"merged_at":"2026-09-13T22:45:58+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-13T22:45:58+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.4},"fix_edges":[{"issue_number":90699,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":107829,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":108346,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":109016,"pr_number":110212,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-13T22:45:58+00:00"}],"members":[{"kind":"issue","number":90699,"title":"[Bug]: TUI gateway RPC profile param escapes profiles root — no validate_profile_name on the _profile_home path","url":null,"state":"closed"},{"kind":"pr","number":90715,"title":"fix(tui): validate the RPC profile param before any path resolution","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a7254e2d4c17","number":0},{"kind":"commit","value":"2770f93064aa","number":0},{"kind":"commit","value":"105e27f962d0","number":0},{"kind":"commit","value":"4ad60ac475d8","number":0},{"kind":"pr","value":"#110212","number":110212},{"kind":"pr","value":"#89959","number":89959}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":91488,"title":"fix(tui_gateway): validate profile parameter in _profile_home against traversal","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"44650a6626f3e5b3c9b8be4ab788e4976715c6a8","number":0},{"kind":"commit","value":"d798755a54b7f23ab2a939f51935c2231c8c05a6","number":0},{"kind":"pr","value":"#90715","number":90715},{"kind":"pr","value":"#90699","number":90699},{"kind":"pr","value":"#91488","number":91488}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":108348,"title":"fix(profiles): reject traversal-shaped profile names in get_profile_dir","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a7254e2d4c17","number":0},{"kind":"commit","value":"2770f93064aa","number":0},{"kind":"commit","value":"4ad60ac475d8","number":0},{"kind":"pr","value":"#110212","number":110212},{"kind":"pr","value":"#89959","number":89959},{"kind":"pr","value":"#108346","number":108346},{"kind":"pr","value":"#90699","number":90699}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":110212,"title":"Multiplexed profile lifecycle: webhook routes bind to a profile, RPC profile params fail closed, deleted profile is a typed RPC error (#109016 #107829 #108346)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/profiles.py","hermes_cli/subcommands/webhook.py","hermes_cli/webhook.py","tests/hermes_cli/test_profiles.py","tests/hermes_cli/test_webhook_cli.py","tests/tui_gateway/test_profile_target_unavailable.py","tui_gateway/mcp_rpc_helpers.py","tui_gateway/methods_profiles.py","tui_gateway/methods_tools.py","tui_gateway/server.py","website/docs/reference/cli-commands.md","website/docs/user-guide/messaging/webhooks.md","website/docs/user-guide/multi-profile-gateways.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}