security: configurable sudo prompt timeout + SSH config metadata redaction

[win4r]

What does this PR do?

Two independent security hardenings surfaced by a user-authorised local security audit of v0.8.0 (13/15 attack vectors blocked; full defense-in-depth review passed).

1. fix(terminal): configurable sudo prompt timeout

_prompt_for_sudo_password hardcoded a 45s timeout. In cron / gateway sessions an accidental sudo invocation would block the whole run for 45s before failing. This adds HERMES_SUDO_TIMEOUT as an integer env var:

Value	Behaviour
unset (default)	45s prompt — unchanged
HERMES_SUDO_TIMEOUT=10	10s prompt
HERMES_SUDO_TIMEOUT=0	skip immediately, return empty (cron/gateway path)
HERMES_SUDO_TIMEOUT=abc	warn, fall back to 45s (typos cannot silently disable)
negative values	clamp to 0

The callback path (prompt_toolkit UI) is also guarded — when timeout is 0 the UI callback is NOT invoked, so a HERMES_SUDO_TIMEOUT=0 gateway session cannot accidentally prompt the user via the UI path either.

2. fix(redact): mask sensitive SSH config directives on file read

Reading ~/.ssh/config via read_file previously echoed the entire file verbatim. That leaks:

• IdentityFile → exact paths to the user's private keys (single most valuable enumeration target)
• ProxyJump / ProxyCommand → internal bastion hosts and the commands needed to reach protected networks
• IdentityAgent / CertificateFile → similar metadata

PR #4168 (open) adds an approval-prompt pattern for cat/head/tail on .ssh/, which covers the terminal-tool path. This patch is complementary: it adds the read_file path by extending the existing redact_sensitive_text pipeline, which is the same layer that already masks API keys, tokens, DB connection strings, and private-key blocks.

Redaction is intentionally surgical — Host, HostName, User, Port stay visible because they are frequently needed for legitimate debugging, and leaking them without the identity-file path doesn't materially help an attacker. Matching is case-insensitive per sshd_config(5).

Before (today):

Host github.com
  IdentityFile ~/.ssh/id_ed25519
  ProxyJump bastion.corp:2222

After:

Host github.com
  IdentityFile ***
  ProxyJump ***

Related Issue

No open issue — findings come from an authorised local audit. Reproduction steps are in the "How to Test" section below.

Fixes #

Type of Change

• 🔒 Security fix

Changes Made

• tools/terminal_tool.py: add _DEFAULT_SUDO_TIMEOUT, _get_sudo_timeout(), make _prompt_for_sudo_password honour HERMES_SUDO_TIMEOUT
• agent/redact.py: add _SSH_CONFIG_SENSITIVE_RE and apply it inside redact_sensitive_text
• tests/tools/test_terminal_sudo_timeout.py: 12 new tests
• tests/agent/test_redact.py: 10 new tests in TestSSHConfigRedaction

How to Test

Fix #1 — sudo timeout reproduction:

# Before this PR: blocks for 45s
hermes chat -q "run sudo cat /etc/sudoers"

# After this PR:
HERMES_SUDO_TIMEOUT=0 hermes chat -q "run sudo cat /etc/sudoers"
# → sudo fails immediately, no 45s wait

Fix #2 — SSH config redaction reproduction:

# Before this PR
hermes chat -q "read ~/.ssh/config"
# → IdentityFile / ProxyJump values visible

# After this PR
hermes chat -q "read ~/.ssh/config"
# → IdentityFile *** / ProxyJump ***
# Host / HostName / User still visible

Test suite:

pytest tests/agent/test_redact.py tests/tools/test_terminal_sudo_timeout.py -v
# 22 new tests pass

pytest tests/agent/test_redact.py tests/tools/test_terminal_*.py -q
# 113 passed (all existing + new)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(terminal):, fix(redact):)
• I searched for existing PRs to make sure this isn't a duplicate (noted overlap with security: harden subprocess isolation, add exfiltration detection, fix YOLO bypass #4168 — deliberately scoped around it)
• My PR contains only changes related to this fix/feature
• I've run pytest tests/agent/test_redact.py tests/tools/test_terminal_*.py -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: macOS 26.3.1 (Apple Silicon), Python 3.11.9

Documentation & Housekeeping

• Docstrings updated — _prompt_for_sudo_password, _transform_sudo_command note the new env var; _SSH_CONFIG_SENSITIVE_RE has a full design-rationale comment
• No new config keys added (env var only) — cli-config.yaml.example unchanged, N/A
• No architecture changes — CONTRIBUTING.md/AGENTS.md unchanged, N/A
• Cross-platform considered: HERMES_SUDO_TIMEOUT parsing is stdlib-only; the regex in redact.py uses no platform-specific features
• No tool schema changes, N/A

Relationship to other open PRs

• security: harden subprocess isolation, add exfiltration detection, fix YOLO bypass #4168 (open) adds curl --data / cat .ssh/ patterns to approval.py. This PR is deliberately scoped to the orthogonal fixes (read-path masking + sudo timeout) so the two PRs do not conflict and can land in either order.

[teknium1]

Thanks for identifying two concrete hardening opportunities. The SSH-read premise remains live: current read_file output is redacted through tools/file_tools.py:1250 and tools/file_tools.py:1382-1385, but current agent/redact.py has no SSH-directive rule.

Problems

• The timeout implementation introduces HERMES_SUDO_TIMEOUT at tools/terminal_tool.py:129 in the PR. AGENTS.md explicitly requires non-secret behavioral settings such as timeouts to use config.yaml, not new user-facing HERMES_* environment variables.
• The terminal half is stale and conflicts with current architecture. Main now uses thread-local callback accessors and session-scoped password caching (tools/terminal_tool.py:152-250), and prompts when either interactive mode or a callback is present (tools/terminal_tool.py:928-935). The PR test still patches the removed global callback at tests/tools/test_terminal_sudo_timeout.py:112.
• The SSH tests call the redactor directly; please cover the actual read_file boundary as well.

Suggested changes

• Salvage the SSH redaction as a focused, rebased change with a read_file regression test.
• Rework any timeout configuration through terminal.* config plumbing and the current callback/session-cache flow.

This is an automated hermes-sweeper review.

[teknium1]

This makes a timeout a new user-facing HERMES_* setting. The repository policy requires non-secret behavioral configuration to live in config.yaml; please rework this through the terminal config path instead.

[teknium1]

Current main no longer has this module-global callback: callbacks are thread-local and registered through set_sudo_password_callback(). Rebase this test onto that public setter so it verifies the current callback path.