feat(hermes): bump to v0.16 (calver 2026.6.5) + upgrade follow-ups - #5217
Closed
tyeth-ai-assisted wants to merge 10 commits into
Closed
feat(hermes): bump to v0.16 (calver 2026.6.5) + upgrade follow-ups#5217tyeth-ai-assisted wants to merge 10 commits into
tyeth-ai-assisted wants to merge 10 commits into
Conversation
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Bump the Hermes Agent image to expected_version 2026.6.5 (Dockerfile, Dockerfile.base, manifest.yaml) and add scripts/update-hermes-agent.sh to automate future version bumps.
…arts Hermes v0.16.0+ guards its OpenAI-compatible API server with a bearer token read from API_SERVER_KEY. Without it the gateway refuses to start, so the install health check fails. - Generate a per-sandbox API_SERVER_KEY into the Hermes .env. - Allow that single raw key past the secret-boundary validator (env-file and runtime-env), mirroring OPENCLAW_GATEWAY_TOKEN: it is a self-minted, loopback-only token, not an egress credential, so it legitimately lives raw in .env rather than as an openshell:resolve placeholder. - Accept HTTP 401 (not just 200) as "gateway alive" in the in-sandbox health wait, since the probe is unauthenticated and v0.16 may 401 it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The v0.16 gateway's bearer token was minted but not retrievable, so users
had no way to call the OpenAI-compatible API.
- Add an agent web-auth model (AgentWebAuth { method, env }) read from the
manifest; Hermes is bearer_token/API_SERVER_KEY, OpenClaw stays none.
- Make `gateway-token` agent-aware: it now returns a bearer_token agent's
web-auth key (Hermes' API_SERVER_KEY) as well as OpenClaw's gateway token,
reading it group-readably from the sandbox .env without ever logging it.
- Onboard prints the OpenAI-compatible API endpoint and the retrieval
command for bearer_token agents.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Three independent v0.16 install/runtime regressions: - Vendor python-multipart (pinned + hash-verified to the release's uv.lock) so the bundled kanban dashboard plugin's file-upload route mounts. It is not a dependency of hermes core or the `web` extra (only of mcp/daytona), so a slim extras install omits it; FastAPI then fails the Form/File route. Vendored directly rather than pulling the MCP client or the Daytona SDK. - Grant /dev/pts in both Hermes sandbox policies. The TUI, the dashboard chat pty bridge, and terminal.backend: local allocate a pty via openpty(); without the grant landlock denies /dev/ptmx with EACCES, surfaced as "out of pty devices". Mirrors the existing OpenClaw grant (NVIDIA#4513). - Fix the bump script's post-rebuild verify to use `exec` not `connect`: connect is a strict interactive shell that ignores a trailing `-- <cmd>` and just prints its usage, so the version check always failed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The model picker (CLI `hermes model` and the dashboard Models page via /api/model/options) showed zero models even though inference worked: it enumerates providers through get_compatible_custom_providers(), which only reads custom_providers/providers — never the inline `model:` block NemoClaw writes for routing. Emit a custom_providers entry mirroring the proxied endpoint (inference.local/v1) with discover_models: true, so the picker live-lists /v1/models (already served by the proxy and allowlisted in policy). Verified live: the picker then lists the routed models with is_current set. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…routed model The Hermes dashboard runs as the sandbox user under its own isolated HERMES_HOME (/tmp/hermes-dashboard-home) for privilege separation from the gateway user, so it never sees the model/custom_providers block NemoClaw writes to the gateway's /sandbox/.hermes/config.yaml. Its load_config() reads a Hermes-default config with model: '' and no providers, so the dashboard Models page (/api/model/options -> inventory.build_models_payload) listed zero models and the kanban specifier/dispatcher (get_text_auxiliary_client) resolved no client — even though the TUI/CLI on the gateway home worked. Verified live. Add seed-dashboard-config.py, invoked from start.sh::seed_hermes_dashboard_config before the dashboard launches, mirroring model/custom_providers/_nemoclaw_upstream into the dashboard home config while preserving its other keys. custom_providers carries discover_models: true so the model list stays live-discovered from /v1/models rather than pinned. Idempotent, symlink-guarded, best-effort (a seed failure never blocks startup). Confirmed end-to-end in a live sandbox: the dashboard then lists the 3 routed models and kanban resolves nvidia-routed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
generate-hermes-config.test.ts's findRawSecretEnvEntries flagged the raw API_SERVER_KEY messaging-config.ts writes to .env, but the production validator (validate-env-secret-boundary.py) already exempts it via ENV_FILE_ALLOWED_RAW_SECRET_KEYS — it is Hermes' self-generated api_server bearer token (v0.16.0+) that never transits the OpenShell proxy, so it has no resolver placeholder. Mirror that allowlist in the test helper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Seed the Hermes dashboard's config so the Models page and kanban see the routed model, mirror the routed provider, and align Dockerfile.base/start.sh with the v0.16 dashboard launch path.
tyeth-ai-assisted
force-pushed
the
feat/hermes-0.16-upstream
branch
from
June 11, 2026 12:44
3d79eef to
3fef7f8
Compare
start.sh invoked seed-dashboard-config.py with bare `python3`, which at
container boot is the base-image interpreter without PyYAML (an interactive
login shell activates the venv, masking this). The seeder then hit its
"PyYAML unavailable; skipping model seed" branch and returned 0, so the
gateway's model routing was silently never mirrored into the dashboard
HERMES_HOME — leaving model:'' / providers:{} and an empty Models page after
a rebuild. Resolve the Hermes venv interpreter explicitly
(/opt/hermes/.venv/bin/python, fallback python3) and run the seeder with it.
That binary is already an allowlisted blueprint binary and the prefer-venv
fallback idiom is used elsewhere in the repo.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
wscurran
added
feature
Contributor
|
✨ Thanks for bumping Hermes to v0.16 (calver 2026.6.5) and adding the API_SERVER_KEY handling for the new gateway auth. This proposes a way to upgrade the Hermes integration with the required token generation and secret-boundary allowances for the v0.16 gateway, dashboard, and model picker to function inside the NemoClaw sandbox. |
… add hermes doctor --fix Agent-Logs-Url: https://github.com/tyeth-ai-assisted/NemoClaw/sessions/cc04407b-b2a0-4a6b-8625-2512fab13384 Co-authored-by: tyeth-ai-assisted <259968460+tyeth-ai-assisted@users.noreply.github.com>
This was referenced Jul 3, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the Hermes Agent to v0.16.0 (calver 2026.6.5) and lands the follow-up fixes needed to make the v0.16 gateway, dashboard, and model picker work inside a NemoClaw sandbox. Rebased onto current
main; mergeable.Commits
expected_version2026.5.16 → 2026.6.5 across Dockerfile / Dockerfile.base / manifest.yaml, plusscripts/update-hermes-agent.sh.API_SERVER_KEYso the v0.16 gateway starts — v0.16 guards its OpenAI-compatible API server with a bearer token. Generate one into the sandbox.env(viabuildHermesEnvLines), allow that single raw key past the secret-boundary validator (mirroringOPENCLAW_GATEWAY_TOKEN— a self-minted loopback token, not an egress credential), and treat HTTP 401 as "gateway alive" in the unauthenticated in-sandbox health wait.API_SERVER_KEYauth token —AgentWebAuthmodel; agent-awaregateway-token; onboard prints the OpenAI-compatible API endpoint + retrieval command.python-multipart(hash-pinned); grant/dev/pts; fix the bump script's post-rebuild verify to useexec.custom_providers— emit acustom_providers/providersentry mirroring the proxied endpoint withdiscover_models: trueso the picker lists the routed models. Also aligns the minimal Hermes YAML serializer's block-sequence indentation with the messaging build applier so the new top-level array round-trips.API_SERVER_KEYin env-boundary test helperTesting
npm run typecheck:cli, plugintsc --noEmit, and the fullcli+pluginVitest suite pass under Node 22 (7812 passed / 47 skipped; the lone failure is an unrelated hardware GPU-detection test on the dev box).hermes-env.ts/hermes-config.ts.🤖 Generated with Claude Code