mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
kshitijk4poor
adf564d01b
A session in a non-standard permission mode (unrestricted = YOLO, or bounded) gets a private `cua-driver serve --embedded` daemon. On Linux/Windows it was a plain Popen child. Only _EmbeddedCuaDaemon.stop() (session release / the computer_use atexit handler) ended it, and cua-driver does not exit when its parent dies. A SIGKILLed or OOM-killed Hermes therefore left an approval-bypassing daemon listening on its socket with nothing left to stop it. On POSIX non-macOS the daemon is now started with process_identity.spawn_owned and released in stop(). macOS is unchanged: there the launch goes through `/usr/bin/open` to LaunchServices, so the daemon is launchd's child and never in our tree. Windows keeps the plain Popen (spawn_owned is a plain Popen there; the layer-3 job object covers it). The cua-driver MCP proxy needs nothing: it is an stdio child of the MCP SDK (already start_new_session) and exits on stdin EOF, measured 0/3 alive 0.1 s after the owner's SIGKILL on base. Measured on Linux (real cua-driver 0.21.0 serve --embedded, kill -9 of a real owner process): base: 1/1 cua-driver serve alive 8 s after SIGKILL branch: 0/1 alive after 0.0 s; with the owner still alive, 1/1 untouched after 6 s Tests: the kill -9 + live-owner-control case (red when spawn_owned is reverted); the socket/ack contract test now also pins the register at start / unregister at stop. Three existing tests that hand the daemon a fake Popen stub the supervisor so a fake pid never reaches it.