Cairn
NousResearch/hermes-agent

Fix unexpanded ${VAR} references in credential pool

Cluster 20310 · agent/secret sources. Data as of

Nothing open on GitHub. Fix attempted, not merged.

The short answer

0open issues
0open PRs
7items grouped
Known?
Yes. 7 related items grouped here, 1 issue already closed.
Fix event
No fix has been merged to main. 6 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and PRs address a bug where literal ${VAR} strings from .env files were being stored and used as API keys instead of their expanded values. The fixes apply variable expansion before seeding the credential pool across auth, agent, and CLI components.

Open issues0

No open issues.

Open PRs0

No open pull requests.

6 PRs closed without merging

From the close comments: superseded by another PR 1 · won't fix / by design 1 · other 4

  • #20319 fix(agent): skip unexpanded ${VAR} references when seeding credential pool · other → #20310
  • #20328 fix(cli): expand ${VAR} references in load_env to match python-dotenv · superseded by another PR → #20319
  • #20541 fix(auth): expand dotenv refs before credential pool seeding · other → #20310, #20757, #20319, #20981
  • #20757 fix(agent): expand ${VAR} references in credential pool · other → #20310
  • #20981 fix(auth): expand dotenv credential references · other → #20310, #20541, #20757, #20319
Show 1 more
  • #33331 fix(auth): expand ${VAR} references in .env before seeding credential pool · won't fix / by design → #20310, #20319, #20541, #20981
Closed issues · 1
  • Closed#20310[Bug]: credential pool stores literal ${VAR} from .env — auxiliary requests send unexpanded variable as API key
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.29: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent/secret sources
Closed issues
1
Attempts
6 PRs closed without merging

For your agent

The same facts, typed.

cluster/20310.json
cluster/20310.md