Cairn
NousResearch/hermes-agent

HERMES_DESKTOP flag bypasses host-backend attach guard

Cluster 119210. Data as of

Nothing open on GitHub. Fix merged in #120080 on 23 Sep 2026. Check it covers your case.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #120080. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #120080. That is separate from the fix event.
Still open
Nothing open on GitHub.

A bug where an inherited HERMES_DESKTOP environment variable could silently trigger a second machine-level backend attach, and related fixes tightening the credential/token gate on the desktop attach bypass path.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #120080 Supervised 0.0.0.0 dashboard no longer crash-loops behind a Desktop pool backend; inherited HERMES_DESKTOP no longer binds a second backend (#119824, #119210, salvage #119832 #119214)

    merged to main

    files: gateway/host_rendezvous.py, hermes_cli/_startup_fast.py, hermes_cli/dashboard_procs.py, hermes_cli/main.py, hermes_cli/main_dashboard.py, hermes_cli/plugins_activation.py, hermes_cli/process_identity.py, hermes_cli/web_routers/status.py, hermes_cli/web_server.py, tests/hermes_cli/test_dashboard_admin_endpoints.py, tests/hermes_cli/test_dashboard_unified_launch.py, tests/hermes_cli/test_process_identity.py, tests/hermes_cli/test_serve_host_attach.py, tests/hermes_cli/test_web_server.py, website/docs/user-guide/features/web-dashboard.md

2 PRs closed without merging

From the close comments: done elsewhere 1 · merged via another change 1

  • #119214 fix(dashboard): require Desktop spawn credential for host attach · merged via another change → #120080
  • #119221 fix(dashboard): gate desktop attach bypass on session token, not bare HERMES_DESKTOP flag · done elsewhere → #119214, #120080
Closed issues · 1
  • Closed#119210[Bug]: an inherited HERMES_DESKTOP=1 bypasses host-backend attach — `hermes dashboard` from a shell spawned by the Desktop app silently starts a second machine-level backend
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#120080
Closed issues
1
Attempts
2 PRs closed without merging
Fix link checked
23 Sep 2026

For your agent

The same facts, typed.

cluster/119210.json
cluster/119210.md