# NousResearch/hermes-agent · Session key path-safety handling for chat integrations

## Open now

- Nothing open on GitHub.

These issues and PRs concern how session keys containing slashes or other path-unsafe characters (notably from DingTalk DM and Google Chat) are handled, with proposals ranging from encoding those characters to relaxing or removing the filesystem path traversal guard.

## TL;DR

- 8 member(s): 0 open issue(s), 2 closed issue(s), 0 open PR(s), 1 merged PR(s), 5 PR(s) closed without merging.
- A fix was merged to main in PR #59533. Verify it addresses your case.
- **Recommended:** read PR #59533 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `partially_resolved` · deciding PR(s): `pr-59533`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.26`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #55617: DingTalk DM session_key rejected as directory traversal due to slash in chat_id
- #59322: session_key traversal guard rejects all Google Chat sessions on load (v0.18.0)

## Prior & competing PRs

- **#55628: fix(gateway): encode path-unsafe chars in session key for DingTalk DMs**. closed without merge · fix tier `suggested`
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `83f14b2f2`, `#55617`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#59533: fix(gateway): relax session_key traversal guard to allow interior '/' (#59322)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `gateway/session.py`, `tests/gateway/test_session.py`
- **#55668: fix(gateway): allow slash in session_key for DingTalk DM sessions**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `83f14b2f2`, `#59533`
- **#55693: fix(gateway): encode unsafe session key components**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `83f14b2f2`, `#59533`
- **#55740: fix(gateway): percent-encode path separators in session key IDs (fixes DingTalk DM session loss on restart)**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `83f14b2f2`, `#59533`
- **#59458: fix: stop validating session_key as filesystem path (#59322)**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `83f14b2f2`, `#59431`, `#59533`

## Fix status

- Merged to main in PR #59533 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-07-06`.
- Subsystem: `gateway`