# NousResearch/hermes-agent · Session token: .env vs injected env var priority

## Open now

- 2 issues, 0 PRs open on GitHub.
- #18705: \[Feature\]: load_hermes_dotenv() uses override=True, breaking 12-factor env precedence and creating a credential-rotation footgun
- #19201: \[Feature\]: load_hermes_dotenv() overrides systemd / docker / runtime-injected env vars with ~/.hermes/.env (override=True) — breaks 12-factor config precedence and creates a credential-rotation footgun

These items center on how HERMES_DASHBOARD_SESSION_TOKEN is handled when both a ~/.hermes/.env file and a runtime-injected environment variable are present. The recurring concern is that load_hermes_dotenv() uses override=True, causing the .env file to overwrite injected or spawned session tokens and violate 12-factor config precedence.

## TL;DR

- 13 member(s): 2 open issue(s), 3 closed issue(s), 0 open PR(s), 0 merged PR(s), 8 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.14`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #18705: \[Feature\]: load_hermes_dotenv() uses override=True, breaking 12-factor env precedence and creating a credential-rotation footgun
- #19201: \[Feature\]: load_hermes_dotenv() overrides systemd / docker / runtime-injected env vars with ~/.hermes/.env (override=True) — breaks 12-factor config precedence and creates a credential-rotation footgun

## Closed / duplicate issues

- #38575: \[Bug\]: Pinned HERMES_DASHBOARD_SESSION_TOKEN in .env breaks Desktop LOCAL mode into SIGTERM boot loop
- #39349: Desktop: ~/.hermes/.env overrides HERMES_DASHBOARD_SESSION_TOKEN and breaks /api/ws
- #40680: Desktop local mode can inherit stale dashboard token after prior remote gateway setup

## Prior & competing PRs

- **#18734: fix(cli): respect 12-factor env precedence in load_hermes_dotenv()**. closed without merge · fix tier `suggested`
  - maintainer direction: category `partial_fix`; implication `needs_llm`; refs `#19201`, `#18705`, `#19677`, `#36949`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#38586: fix(env): preserve desktop session token despite pinned .env value**. closed without merge · fix tier `suggested`
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#39652`, `#39652`, `#38586`, `#39652`, `#39652`
- **#39354: fix(desktop): preserve spawn-injected dashboard session token over ~/.hermes/.env**. closed without merge · fix tier `suggested`
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `e96fe06e4968ebaf1c2df0a2a9c9fc9fc730b6cf`, `#39349`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#39543: fix(dashboard): preserve injected session token**. closed without merge · fix tier `suggested`
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `72290f0809ad5dec91a657cd4f4bcd4b999a692d`, `#39349`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#19677: fix(config): respect env vars over .env file for 12-factor precedence**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#18734`, `#18734`, `#18734`
- **#38931: fix(desktop): preserve HERMES_DASHBOARD_SESSION_TOKEN from parent process**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `#39652`, `#38575`, `#38586`
- **#39652: fix(config): migrate stale HERMES_DASHBOARD_SESSION_TOKEN from .env (v30)**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `e96fe06e4968ebaf1c2df0a2a9c9fc9fc730b6cf`
- **#83688: fix(config): respect env vars over .env file for 12-factor precedence**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `82d94d192ffd9762db7d5bfa07b4effd34d28cbe`, `3ed495e9eb089f348c321bc785b4ae8ce5d34c1f`, `721a2e2deedfec6036e7aadb10b9b2c65fca28c0`, `e81aeb13ac03127d7b702d0b459024122a4e75cc`, `7eb8457322b30b6d09f02d6e55327b9f408afec3`, `df087ccced860f4edb0988cf072cf7ded554378b`, `82d94d192ffd9762db7d5bfa07b4effd34d28cbe`, `82d94d192ffd9762db7d5bfa07b4effd34d28cbe`, `82d94d192ffd9762db7d5bfa07b4effd34d28cbe`

## Fix status

- No merged fix on record.
- Subsystem: `apps/desktop`