Cairn

SSH session token served stale, causing 401 loops

NousResearch/hermes-agent · cluster 102930

Data as of

Nothing open on GitHub. Fix merged in #103614. Check it covers your case.

The short answer

0open issues
0open PRs
7items grouped
Known?
Yes. 7 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #103614. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #103614. That is separate from the fix event.
Still open
Nothing open on GitHub.

Multiple fixes address a bug where the served SSH session token was captured at import time rather than read live, causing repeated 401 errors on API calls in Desktop-over-SSH and headless modes. The fixes late-bind or refresh the token so the current value is always served.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #103614 fix(dashboard): Desktop-over-SSH handshake serves the live session token, ending the 401 loop (#102930, salvage #102948)

    merged to main

    files: contributors/emails/[redacted:email], contributors/emails/[redacted:email], hermes_cli/web_server_dashboard.py, tests/hermes_cli/test_web_server.py

5 PRs closed without merging

From the close comments: done elsewhere 3 · closed without comment 1 · superseded by another PR 1

  • #102948 fix(desktop): serve the current SSH session token · superseded by another PR → #103614, #102930
  • #102954 fix(dashboard): late-bind served SSH session token · done elsewhere → d77a62e, #102930, #102931, #103614, #102948
  • #102985 fix(web): serve the live session token on the headless handshake page · done elsewhere → d77a62e, #102930, #102931, #103614, #102948
  • #103338 fix(dashboard): serve live SSH session token in mount_spa · done elsewhere → d77a62e, #102930, #102931, #103614, #102948
  • #103514 fix(dashboard): serve live session token after SSH credential rotation · closed without comment
Closed issues · 1
  • Closed#102930Desktop SSH mode: 401 on every API call since d3630f8532 — served session token is an import-time snapshot, not the --ssh-session-token-file token
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.29: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#103614
Closed issues
1
Attempts
5 PRs closed without merging
Fix link checked
5 Sep 2026

For your agent

The same facts, typed.

cluster/102930.json
cluster/102930.md