Cairn
NousResearch/hermes-agent

authserv_id default value bug and fix

Cluster 98599 · gateway. Data as of

1 open item. Fix merged in #132255 on 3 Oct 2026. Check it covers your case.

The short answer

1open issue
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 0 issues already closed.
Fix event
A fix was merged to main in PR #132255. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 0 PRs.

The authserv_id configuration option defaults to empty rather than the documented From-domain value, silently disabling header-injection defense. These members track the bug report and subsequent fix attempts to correct the default behavior.

Open issues1

  • Issue#98599`authserv_id` defaults to empty, contradicting the comment above it — header-injection defense is silently off by default

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #132255 Email trusts only the topmost auth header and skips unauthorized bodies (salvage #129772)

    merged to main

    files: plugins/platforms/email/adapter.py, tests/gateway/test_email.py, tests/gateway/test_email_imap_id_protocol.py, tests/gateway/test_email_robustness.py, tests/gateway/test_poller_fd_lifecycle.py, website/docs/user-guide/messaging/email.md

2 PRs closed without merging

From the close comments: done elsewhere 1 · duplicate 1

  • #98611 fix(email): default authserv_id to the agent From-domain as documented · done elsewhere → db45b44, #132255, #88560
  • #98664 fix(email): default authserv_id to the agent From-domain · duplicate → #98611
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Merged PRs
#132255
Closed issues
0
Attempts
2 PRs closed without merging
Fix link checked
3 Oct 2026

For your agent

The same facts, typed.

cluster/98599.json
cluster/98599.md