Cairn

Session token: .env vs injected env var priority

NousResearch/hermes-agent · cluster 18705 · apps/desktop

Data as of

2 open items. Fix attempted, not merged.

The short answer

2open issues
0open PRs
13items grouped
Known?
Yes. 13 related items grouped here, 3 issues already closed.
Fix event
No fix has been merged to main. 8 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
2 issues and 0 PRs.

These items center on how HERMES_DASHBOARD_SESSION_TOKEN is handled when both a ~/.hermes/.env file and a runtime-injected environment variable are present. The recurring concern is that load_hermes_dotenv() uses override=True, causing the .env file to overwrite injected or spawned session tokens and violate 12-factor config precedence.

Open issues2

  • Issue#18705[Feature]: load_hermes_dotenv() uses override=True, breaking 12-factor env precedence and creating a credential-rotation footgun
  • Issue#19201[Feature]: load_hermes_dotenv() overrides systemd / docker / runtime-injected env vars with ~/.hermes/.env (override=True) — breaks 12-factor config precedence and creates a credential-rotation footgun

Open PRs0

No open pull requests.

8 PRs closed without merging

From the close comments: done elsewhere 4 · superseded by another PR 2 · duplicate 1 · partial fix 1

  • #18734 fix(cli): respect 12-factor env precedence in load_hermes_dotenv() · partial fix → #19201, #18705, #19677, #36949
  • #19677 fix(config): respect env vars over .env file for 12-factor precedence · duplicate → #18734
  • #38586 fix(env): preserve desktop session token despite pinned .env value · superseded by another PR → #39652, #38586
  • #38931 fix(desktop): preserve HERMES_DASHBOARD_SESSION_TOKEN from parent process · superseded by another PR → #39652, #38575, #38586
  • #39354 fix(desktop): preserve spawn-injected dashboard session token over ~/.hermes/.env · done elsewhere → e96fe06, #39349
Show 3 more
  • #39543 fix(dashboard): preserve injected session token · done elsewhere → 72290f0, #39349
  • #39652 fix(config): migrate stale HERMES_DASHBOARD_SESSION_TOKEN from .env (v30) · done elsewhere → e96fe06
  • #83688 fix(config): respect env vars over .env file for 12-factor precedence · done elsewhere → 82d94d1, 3ed495e, 721a2e2, e81aeb1, 7eb8457, df087cc
Closed issues · 3
  • Closed#38575[Bug]: Pinned HERMES_DASHBOARD_SESSION_TOKEN in .env breaks Desktop LOCAL mode into SIGTERM boot loop
  • Closed#39349Desktop: ~/.hermes/.env overrides HERMES_DASHBOARD_SESSION_TOKEN and breaks /api/ws
  • Closed#40680Desktop local mode can inherit stale dashboard token after prior remote gateway setup
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.14: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
apps/desktop
Closed issues
3
Attempts
8 PRs closed without merging

For your agent

The same facts, typed.

cluster/18705.json
cluster/18705.md