fix(tools): command TTS/STT provider hardening — idle timeouts, env scrubbing, no-shell, path guards

[teknium1]

fix: harden command-type TTS/STT providers (idle timeouts, secret scrub, format allowlist, no-shell, path guards)

Consolidated salvage of the cluster-H command-provider hardening backlog: 6 PRs cherry-picked onto current main with contributor authorship preserved, plus class-fix follow-ups.

What's in here

1. Idle timeouts on BOTH command runners (fixes #50081, salvages #50087 — @CleanDev-Fix)

• _run_command_tts now uses a progress-based idle timeout: the deadline resets whenever the command emits stdout/stderr output. A slow-but-alive provider (e.g. long synthesis with progress logs) survives; a silently stalled one is killed after timeout seconds of no output. Reads happen in 64 KiB chunks via daemon reader threads; the deadline is held through process exit; captured output is preserved on TimeoutExpired.
• Class fix (follow-up commit): the same pattern is ported to _run_command_stt — stuck detection is progress-based, never wall-clock, on both runners.

2. Secret scrubbing for voice subprocess env (fixes the class from #56332 — @necoweb3, salvages #70342 + #70357 — @zapabob)

• Command TTS, command STT, and the local-whisper subprocess.run path now build their child env via hermes_subprocess_env(inherit_credentials=False) (gateway tokens, LLM provider keys, AUXILIARY_*/GATEWAY_RELAY_* internals stripped; PATH/HOME/locale kept), composed with delegated_child_subprocess_env() so delegated-child lineage markers still propagate.
• play_audio_file playback subprocesses (ffplay/afplay/...) get the same scrub (fix(security): scrub credentials from voice playback subprocesses #70357).
• Allowlist follow-up (triage caveat): command providers legitimately reference their own API keys in shell templates (curl one-liners). A blanket scrub would break them, so each provider config accepts env_passthrough: [MY_API_KEY, ...] (TTS + STT) — named vars are copied back from the parent env. Scrub is the default; passthrough is explicit opt-in. Documented in the TTS docs.

3. Command-TTS output_format allowlist expansion (fixes #50612, salvages #50617 — @sherman-yang; credit also @alloevil for the same-day #50616)

• COMMAND_TTS_OUTPUT_FORMATS gains m4a, aac, amr, opus — common ffmpeg-producible containers. Honored via explicit config and output-path suffix; unknown values still fall back to mp3. Docs updated.

4. Local STT templates run without a shell (fixes #2743's local-STT half, salvages #70008 — @egilewski; closes earlier attempt #32694 — @ErnestHysa with credit)

• _transcribe_local_command now always executes shlex.split(command) as argv — shell metacharacters in a template (;, |, $( ), backticks) become literal arguments, never interpreted. Trusted templates that genuinely need shell features opt in explicitly with an sh -c '...' _ {input_path} {output_dir} wrapper (documented with an example).
• Command-type TTS/STT providers keep shell=True by design — user templates use pipes; umbrella [Bug]: Command injection risk via shell=True in subprocess calls #2743 stays open for that surface.

5. Protected-path guards (salvages #57950 — @necoweb3 + #58056 — @Frowtek; one shared guard concept)

• Write side: text_to_speech_tool(output_path=...) is checked against agent.file_safety.is_write_denied — synthesized audio can no longer overwrite OAuth stores, mcp-tokens/, or other protected credential paths.
• Read side: transcribe_audio routes inputs through the shared get_read_block_error guard before any validation/dispatch — a .env or credential store can't be shipped as "audio" to an external STT API. Verified the guard does NOT reject gateway temp-dir voice notes (~/.hermes/cache/audio/*.ogg, /tmp/... pass clean).

Tests

• Idle timeout: slow-but-alive command survives / silent-stalled command killed with pre-stall output preserved — real subprocess tests for both runners (TTS existing from fix(tools): use idle timeout for command TTS #50087, STT added in follow-up).
• Env scrub: sanitized-child-env assertions for command TTS, command STT, local whisper, and playback; sabotage-verified (removing the scrub fails the test).
• env_passthrough: named key restored, everything else stays scrubbed; config parsing edge cases.
• Format allowlist: extended set accepted via config and path suffix; unknown value falls back.
• No-shell: metacharacter template becomes literal argv (exact argv + kwargs asserted, including the scrubbed env).
• Path guards: OAuth store & mcp-tokens writes refused; .env read refused with the shared guard message.

pytest -o addopts="" tests/tools/test_tts_command_providers.py tests/tools/test_transcription_tools.py tests/tools/test_tts_path_traversal.py tests/tools/test_voice_mode_playback_env_scrub.py → 181 passed (4 pre-existing TestTranscribeMistral lazy-dep failures also fail on clean main; unrelated).

Attribution / closes

Commit	Author	Salvaged PR
use idle timeout / chunk stream reads / keep deadline	@CleanDev-Fix	#50087 (fixes #50081)
scrub Hermes secrets from voice command subprocess env	@zapabob	#70342
scrub credentials from voice playback subprocesses	@zapabob	#70357
expand command TTS output_format allowlist	@sherman-yang	#50617 (fixes #50612; credit @alloevil #50616)
execute local STT templates without a shell	@egilewski	#70008 (closes #32694, credit @ErnestHysa)
block output to protected paths	@necoweb3	#57950
route transcription inputs through the shared read guard	@Frowtek	#58056

Close as superseded with credit: #56332 (@necoweb3 — earliest env-scrub attempt, superseded by #70342's delegated-env-composing version), #50616 (@alloevil — test-file-only), #32694 (@ErnestHysa — earlier no-shell attempt), #57963 (non-shared path-guard overlap of #58056).

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on ea46ce3}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

1 visual diff.

_{inline evidence upload failed.}

Failed to upload diff-665a0833239e-onboarding-overlay-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-665a0833239e-onboarding-overlay-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)