From 795fa618ebab2dc8059b3ecc93632fe328a3e3a3 Mon Sep 17 00:00:00 2001
From: David Young <david@federated.computer>
Date: Tue, 27 Oct 2026 09:55:09 -0600
Subject: [PATCH] fix access to sockets

---
 README.md                  |  2 +-
 packages.conf              |  3 +++
 sandbox/config/hermes.json | 15 ++++++++++++++-
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 38f1fd1..9d5b505 100644
--- a/README.md
+++ b/README.md
@@ -250,7 +250,7 @@ CoreDesktop installs the AI coding agents opencode, Hermes Agent and Claude Code
 - can't read your SSH keys, password stores, browser profiles, Flatpak apps' data (browsers, Signal, Telegram and the rest), your Nextcloud password, cloud and Git credentials, or the other agents' logins
 - can reach only AI providers and common developer sites: GitHub, Gitea, npm, PyPI, crates.io, RubyGems, the Go module proxy and archlinux.org
 
-Typing `opencode`, `hermes` or `hermes-agent` runs it in the sandbox. To run one without it, type `unsandboxed opencode`. Hermes' gateway, the background service that lets you talk to Hermes through Matrix and other messaging apps, runs in the sandbox too, and can reach the Matrix server in Hermes' settings. For other messaging services, add their domains as shown below. Claude Code uses its own built-in sandbox for every command it runs (see `/sandbox` inside Claude).
+Typing `opencode`, `hermes` or `hermes-agent` runs it in the sandbox. To run one without it, type `unsandboxed opencode`. Hermes' gateway, the background service that lets you talk to Hermes through Matrix and other messaging apps, runs in the sandbox too, and can reach the Matrix server in Hermes' settings. For other messaging services, add their domains as shown below. Hermes talks to its gateway through a local socket, so its sandbox allows local sockets but hides the ones that would let it act outside the sandbox: your session's D-Bus and SSH agent, Docker, Tailscale, X11, tmux and browsers. Claude Code uses its own built-in sandbox for every command it runs (see `/sandbox` inside Claude).
 
 Before using an agent the first time, sign in and choose a model provider with `configure` (see below).
 
diff --git a/packages.conf b/packages.conf
index 92c3af4..014e710 100644
--- a/packages.conf
+++ b/packages.conf
@@ -70,6 +70,9 @@ DEV_TOOLS=(
   asdf-vm
   base-devel
   bat
+  # Hermes' Matrix support builds python-olm, which needs clang++ and cmake
+  clang
+  cmake
   dart-sass
   docker
   docker-compose
diff --git a/sandbox/config/hermes.json b/sandbox/config/hermes.json
index 4a09a1d..b541e2a 100644
--- a/sandbox/config/hermes.json
+++ b/sandbox/config/hermes.json
@@ -1,8 +1,21 @@
 {
   "network": {
-    "allowedDomains": []
+    "allowedDomains": [],
+    "allowAllUnixSockets": true
   },
   "filesystem": {
+    "denyRead": [
+      "/run/user",
+      "/run/dbus",
+      "/run/docker.sock",
+      "/run/podman",
+      "/run/tailscale",
+      "/run/ssh-unix-local",
+      "/tmp/.X11-unix",
+      "/tmp/tmux-*",
+      "/tmp/ssh-*",
+      "/tmp/*/SingletonSocket"
+    ],
     "allowRead": [
       "~/.hermes"
     ],