The Hermes Agent fails to execute the sudo command, first confirm whether it really needs sudo or if the command is over-authorized. The official tool documentation states that you will be prompted for a password when you need sudo, and you can also set a SUDO_PASSWORD on ~/.hermes/.env, but this should be done with caution.
Decide whether you should use sudo first
Many development tasks do not require sudo: the installation project depends on the available virtual environment, the system directory should not be written to the project file, and the user port can be used to start the service. If the agent sudo frequently, the risk and troubleshooting cost will increase.
If it is really needed
- Enter the password as prompted in the CLI to cache sudo in the current session.
- If you can't enter interactively in the messaging platform, you can configure the
SUDO_PASSWORDas prompted. - Remote/container environments prioritize the least privilege for dedicated users over direct root.
- High-risk orders retain manual approval and should not be mixed with
--yolo.
Before writing the sudo password to the .env, make sure that only trusted users can access the machine. A better scenario is to prepare a one-time maintenance environment or a dedicated low-privilege script that allows Hermes to only invoke fixed commands.
