fix(security): scrub Hermes secrets from voice command subprocess env - #70342

Closed

zapabob wants to merge 1 commit into

NousResearch:mainfrom

zapabob:fix/tts-command-env-scrub

zapabob commented Jul 23, 2026

Contributor

Summary

Salvage of incomplete fix(voice): sanitize command provider subprocess env #56332 (fix(voice): sanitize command provider subprocess env by @necoweb3). That PR correctly routes command TTS/STT through hermes_subprocess_env, but it has not landed on upstream/main, and main currently only applies delegated_child_subprocess_env() (kanban lineage) — which still inherits full Hermes secrets when not in a delegated child.
This PR applies the secret scrub and preserves delegated-child lineage by composing delegated_child_subprocess_env(hermes_subprocess_env(...)).
Also closes a sibling path fix(voice): sanitize command provider subprocess env #56332 did not cover: _transcribe_local_command's subprocess.run (local whisper / HERMES_LOCAL_STT_COMMAND) previously inherited the full process environment.

Prior coverage vs remaining gap

Prior (#56332)	This PR
Scrub command TTS/STT Popen env	Same, plus keep kanban lineage markers
—	Scrub local-whisper `subprocess.run` env
Tests for Popen paths	Tests for Popen + local-whisper sibling

Capability note

Command TTS/STT providers still run; only Hermes credentials and internal secrets are withheld from the child.

Test plan

pytest tests/tools/test_tts_command_providers.py::TestCommandTtsEnv
pytest tests/tools/test_transcription_tools.py::TestTranscribeLocalCommand::test_command_provider_uses_sanitized_child_env
pytest tests/tools/test_transcription_tools.py::TestTranscribeLocalCommand::test_local_whisper_subprocess_uses_sanitized_env


          fix(security): scrub Hermes secrets from voice command subprocess env

e563d7f

Salvage incomplete NousResearch#56332: route command TTS/STT through hermes_subprocess_env
while preserving delegated-child lineage, and close the sibling local-whisper
subprocess.run path that still inherited the full process environment.

Co-authored-by: Cursor <cursoragent@cursor.com>

alt-glitch added type/security tool/tts area/auth P3 sweeper:risk-security-boundary labels

alt-glitch commented Jul 23, 2026

Collaborator

This was generated by AI during triage.

Related to open #56332: this salvage preserves delegated-child lineage and adds the separate local-whisper subprocess path, so it is not a duplicate.

This was referenced Jul 23, 2026

fix(security): stop host_supervisor undoing env scrub #70351

Open

fix(security): scrub credentials from voice playback subprocesses #70357

Closed

fix(desktop): scrub credentials from embedded terminal PTY env #70370

Closed

fix(desktop): scrub credentials from updater and bootstrap children #70373

Closed

teknium1 mentioned this pull request

fix(tools): command TTS/STT provider hardening — idle timeouts, env scrubbing, no-shell, path guards #73514

Merged

teknium1 pushed a commit that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

bd0d36c

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of #70342 / incomplete #56332 (TTS/STT command scrub) on the voice-mode playback path.

teknium1 added a commit that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

acc1ab1

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The #70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

teknium1 pushed a commit that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

3a7c7e1

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of #70342 / incomplete #56332 (TTS/STT command scrub) on the voice-mode playback path.

teknium1 added a commit that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

48fe005

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The #70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

teknium1 pushed a commit that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

616bc3c

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of #70342 / incomplete #56332 (TTS/STT command scrub) on the voice-mode playback path.

teknium1 added a commit that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

b7c8a98

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The #70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

teknium1 pushed a commit that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

6e984ec

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of #70342 / incomplete #56332 (TTS/STT command scrub) on the voice-mode playback path.

teknium1 added a commit that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

618a595

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The #70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

teknium1 pushed a commit that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

3ae25e0

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of #70342 / incomplete #56332 (TTS/STT command scrub) on the voice-mode playback path.

teknium1 added a commit that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

e251e78

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The #70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

teknium1 commented Jul 29, 2026

Contributor

Merged into main via consolidated salvage PR #73514 (merge e807b7106c). Your voice-subprocess secret scrub via hermes_subprocess_env(inherit_credentials=False) was cherry-picked with your authorship, composed with the delegated-child env and an explicit env_passthrough opt-in.

Your contribution is credited to you in git history. Thank you! Closing this PR as merged-via-salvage.

teknium1 closed this

teknium1 mentioned this pull request

fix(voice): sanitize command provider subprocess env #56332

Closed

This was referenced Jul 29, 2026

fix(security): scrub credentials from ffmpeg/ffprobe media helpers #73879

Open

fix(security): scrub credentials from clipboard and thumbnail OS helpers #73958

Open

randlee pushed a commit to randlee/hermes-agent that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

15d5fd0

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of NousResearch#70342 / incomplete NousResearch#56332 (TTS/STT command scrub) on the voice-mode playback path.

randlee pushed a commit to randlee/hermes-agent that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

b16049f

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The NousResearch#70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

zapabob added a commit to zapabob/hermes-agent-windows that referenced this pull request


          fix(security): stop host_supervisor undoing env scrub

8c6bf8b

## Summary
- Remove `env.update(os.environ)` after `hermes_subprocess_env(...)` in the TUI compute-host supervisor.
- That re-merge re-injected gateway tokens / API keys into the child process and undid scrubbing.
- Add a spawn-path regression test asserting messaging tokens stay absent.

## Salvage / credit
Sibling of voice/TTS credential scrub (NousResearch#70342 / incomplete NousResearch#56332) on the TUI host spawn surface.

prmartinow pushed a commit to prmartinow/hermes-agent that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

879222a

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of NousResearch#70342 / incomplete NousResearch#56332 (TTS/STT command scrub) on the voice-mode playback path.

prmartinow pushed a commit to prmartinow/hermes-agent that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

f7b2312

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The NousResearch#70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

melon-xf added a commit to melon-xf/hermes-agent that referenced this pull request


          fix(security): scrub credentials from voice playback subprocesses

50ec152

## Summary
- Spawn system audio players (`ffplay` / `afplay` / `aplay`) with `hermes_subprocess_env(inherit_credentials=False)`.
- Prevent gateway tokens and provider API keys from leaking into OS media helpers.
- Add a regression test asserting scrubbed env on `Popen`.

## Salvage / credit
Sibling of NousResearch#70342 / incomplete NousResearch#56332 (TTS/STT command scrub) on the voice-mode playback path.

melon-xf added a commit to melon-xf/hermes-agent that referenced this pull request


          feat(tools): env_passthrough allowlist for command-provider secret scrub

45ec8a2

Command providers legitimately reference their own API keys in shell
templates (curl one-liners). The NousResearch#70342 scrub removes ALL provider keys,
which would break such setups. Add a per-provider env_passthrough list
(TTS + STT) that copies named variables back from the parent env, plus
docs and tests. Scrub stays the default; passthrough is explicit opt-in.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/auth P3 sweeper:risk-security-boundary tool/tts type/security