Local-backend WebUI sessions can execute tools on a previous remote terminal backend

Summary

Hermes WebUI runs multi-profile agent turns in one long-lived process and applies each selected profile's terminal settings through process environment variables for the duration of a turn. However, WebUI does not ensure per-profile/per-backend isolation of Hermes Agent terminal/file environment caches.

In combination with Hermes Agent's collapsed "default" terminal environment cache, this allows a later local-backend profile session to reuse a remote/SSH environment created by an earlier remote-backend profile session in the same WebUI process.

Upstream agent bug (primary):
https://github.com/NousResearch/hermes-agent/issues/62720
[Bug]: Local sessions can execute tools on a previous remote terminal backend

This WebUI issue tracks the multi-profile defense-in-depth gap that makes #62720 reachable in normal WebUI use. Agent owns the core cache correctness fix; WebUI still needs isolation/invalidation so profile switches cannot inherit another profile's backend.

Impact

• A WebUI session for a local-backend profile can execute shell/file tools on a remote host previously used by another profile.
• Profile switching appears correct at the identity/config layer while tool execution runs on the wrong backend.
• Users observe missing local paths, unexpected remote paths, and remote file-sync failures despite correct profile terminal configuration.
• The failure is intermittent and process-lifetime dependent, so it is easy to misattribute to workspace selection or profile config drift.

Expected behavior

When WebUI starts an agent turn for a selected profile:

1. The turn should use that profile's terminal backend configuration.
2. Tool execution should not reuse another profile's remote terminal/file environment.
3. Profile switches that change backend (for example remote/SSH → local) should force isolation or cache invalidation so the new turn cannot inherit the previous backend.

Actual behavior

1. Profile A (remote/SSH backend) runs a WebUI turn and creates a remote terminal environment in the shared agent process.
2. Profile B (local backend) runs a later WebUI turn in the same process.
3. WebUI applies Profile B's terminal env vars for the turn.
4. Hermes Agent still reuses the previously cached remote environment under the collapsed task key "default" because ordinary session task IDs are not treated as isolation keys.
5. Profile B tools execute on Profile A's remote backend.

Why this is a WebUI issue as well as an agent issue

Hermes Agent owns the environment cache and is the primary correctness boundary (see #62720). WebUI still needs defense-in-depth because:

• WebUI intentionally hosts multiple profiles in one process.
• WebUI applies profile terminal settings via process-global environment mutation for each turn.
• WebUI passes session IDs into agent runs, but does not register isolation overrides that would prevent collapse to the shared "default" environment slot.
• WebUI currently has no forced invalidation of terminal/file environment caches on profile/backend change.

In short: WebUI creates the multi-profile concurrency surface that makes the agent cache hazard reachable in normal use.

Evidence from code

Profile terminal settings are mapped into process env for each turn

WebUI builds profile runtime env from the selected profile's terminal config (backend → TERMINAL_ENV, SSH fields → TERMINAL_SSH_*, etc.) and applies a filtered env update around the agent run.

This correctly points new environment creation at the selected profile's backend. It does not by itself guarantee that an already-cached incompatible environment will be discarded.

Session task IDs are passed through, but not isolated for backend

WebUI agent runs pass a session-scoped task id into run_conversation(). In Hermes Agent, ordinary task IDs collapse to the shared "default" terminal/file environment key unless a task override includes isolation keys such as env_type (documented in #62720).

WebUI does not currently register such isolation overrides for normal profile sessions.

No cache invalidation on backend/profile switch

On profile/backend change, WebUI does not explicitly clear Hermes Agent terminal/file environment caches (_active_environments, _file_ops_cache). Combined with collapsed keys, stale remote environments can survive into later local-backend turns.

Reproduction sketch

In one WebUI process:

1. Select a profile configured with terminal backend = SSH/remote.
2. Run any terminal or file tool (creates remote environment in-process).
3. Without restarting WebUI, switch to a profile configured with terminal backend = local.
4. Run a host probe (uname, existence checks for expected local vs remote paths).
5. Observe remote-host execution despite the local-backend profile configuration.

Intermittency note: if the remote environment expires/is cleaned up before step 3, the bug may not appear.

Suggested fix

WebUI-side defense in depth:

1. Register per-session isolation overrides

   • When starting a turn, register task env overrides that include env_type (and remote target identity when applicable) so the agent does not collapse all sessions into one environment slot.

2. Invalidate stale environments on profile/backend change

   • If selected profile backend/target differs from the previously used backend/target in this process, clear terminal/file environment caches before the turn starts.

3. Include terminal backend identity in any session/agent runtime cache signatures

   • Ensure cached agent/runtime objects cannot silently outlive a backend switch.

4. Optional hard guard

   • At turn start for local-backend profiles, run a cheap host/backend probe and fail closed if remote semantics are detected.

Hermes Agent still needs the primary fix tracked in #62720 (compatibility checks / stronger cache keys). WebUI should not rely solely on that.

Acceptance criteria

• After a remote-backend profile turn, a subsequent local-backend profile turn in the same WebUI process executes locally.
• Profile switch from remote → local never reuses the previous remote terminal/file environment.
• Terminal and file tools agree on backend after profile switches.
• Regression coverage for multi-profile backend switching in one WebUI process.
• Clear logs when WebUI forces isolation or cache invalidation due to backend/profile change.

Component

Hermes WebUI multi-profile streaming/runtime path (api/streaming.py, api/profiles.py, related session/agent orchestration).