Skip to content

fix(config): route API keys and tokens to .env instead of config.yaml - #469

Merged
teknium1 merged 1 commit into
NousResearch:mainfrom
ygd58:fix-api-key-config-routing
Mar 6, 2026
Merged

fix(config): route API keys and tokens to .env instead of config.yaml#469
teknium1 merged 1 commit into
NousResearch:mainfrom
ygd58:fix-api-key-config-routing

Conversation

@ygd58

@ygd58 ygd58 commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

Fixes #465

Problem

hermes config set OPENAI_API_KEY sk-xxx was saving the key to config.yaml instead of .env, despite docs stating secrets go to .env.

Root Cause

The api_keys allowlist in set_config_value() was missing several common keys (OPENAI_API_KEY, NOUS_API_KEY, WANDB_API_KEY, TINKER_API_KEY) and had no catch-all pattern for future keys.

Fix

  • Added missing keys to the allowlist
  • Added catch-all patterns: any key ending in _API_KEY or _TOKEN now automatically routes to .env
  • This future-proofs the logic for any new API keys added to the project

@ygd58
ygd58 force-pushed the fix-api-key-config-routing branch from 2f84f10 to 6055adb Compare March 6, 2026 07:55
@ygd58 ygd58 mentioned this pull request Mar 6, 2026
Closed
@teknium1
teknium1 merged commit 145f719 into NousResearch:main Mar 6, 2026
1 check passed
teknium1 added a commit that referenced this pull request Mar 6, 2026
@teknium1
test: add 26 tests for set_config_value secret routing
c309678 
Verifies explicit allowlist keys, catch-all _API_KEY/_TOKEN patterns,
case insensitivity, TERMINAL_SSH prefix, and config.yaml routing for
non-secret keys. Covers the fix from PR #469.
@teknium1

teknium1 commented Mar 6, 2026

Copy link
Copy Markdown
Contributor

Merged in commit b89eb29 🎉 Thanks @ygd58!

The catch-all pattern is a great idea — it also covers DAYTONA_API_KEY and ELEVENLABS_API_KEY that were missing from the explicit list.

Added 26 tests for the routing logic in commit c309678 (explicit allowlist, catch-all patterns, case insensitivity, config.yaml fallback).

angelburgosrosado pushed a commit to angelburgosrosado/hermes-agent that referenced this pull request Apr 27, 2026
@teknium1
Merge PR NousResearch#469: fix(config): route API keys and tokens to …
3a0ee36 
….env instead of config.yaml

Authored by ygd58. Fixes NousResearch#465. Adds missing keys to allowlist and
catch-all patterns (_API_KEY, _TOKEN suffixes) for future-proofing.
angelburgosrosado pushed a commit to angelburgosrosado/hermes-agent that referenced this pull request Apr 27, 2026
@teknium1
test: add 26 tests for set_config_value secret routing
3cc7a44 
Verifies explicit allowlist keys, catch-all _API_KEY/_TOKEN patterns,
case insensitivity, TERMINAL_SSH prefix, and config.yaml routing for
non-secret keys. Covers the fix from PR NousResearch#469.
02356abc pushed a commit to 02356abc/hermes-agent that referenced this pull request May 14, 2026
@teknium1
Merge PR NousResearch#469: fix(config): route API keys and tokens to …
97b91fd 
….env instead of config.yaml

Authored by ygd58. Fixes NousResearch#465. Adds missing keys to allowlist and
catch-all patterns (_API_KEY, _TOKEN suffixes) for future-proofing.
02356abc pushed a commit to 02356abc/hermes-agent that referenced this pull request May 14, 2026
@teknium1
test: add 26 tests for set_config_value secret routing
053b2ae 
Verifies explicit allowlist keys, catch-all _API_KEY/_TOKEN patterns,
case insensitivity, TERMINAL_SSH prefix, and config.yaml routing for
non-secret keys. Covers the fix from PR NousResearch#469.
waefrebeorn pushed a commit to waefrebeorn/slermes that referenced this pull request Jul 2, 2026
@teknium1
Merge PR NousResearch#469: fix(config): route API keys and tokens to …
86ff82b 
….env instead of config.yaml

Authored by ygd58. Fixes NousResearch#465. Adds missing keys to allowlist and
catch-all patterns (_API_KEY, _TOKEN suffixes) for future-proofing.
waefrebeorn pushed a commit to waefrebeorn/slermes that referenced this pull request Jul 2, 2026
@teknium1
test: add 26 tests for set_config_value secret routing
16b8cb0 
Verifies explicit allowlist keys, catch-all _API_KEY/_TOKEN patterns,
case insensitivity, TERMINAL_SSH prefix, and config.yaml routing for
non-secret keys. Covers the fix from PR NousResearch#469.
@nlachica nlachica mentioned this pull request Jul 9, 2026
Merged
nlachica added a commit to Ahlnos-Inc/hermes-agent that referenced this pull request Jul 9, 2026
@nlachica @claude
fix(kanban): circuit breaker halts saga after repeated identical fail…
62993f2 
…ure signature (BUILD-261) (#9)

Incident: on 2026-07-09 a releaser kanban card merged 8 PRs across two
batches (NousResearch#465-468, NousResearch#469-472), each remediation reviewed/verified/merged,
yet the post-merge "Master Release" workflow failed with the byte-identical
error signature every time. The existing consecutive_failures breaker never
tripped because every attempt "succeeded" from the worker's point of view
(it resets on completion); check_respawn_guard only rate-limits how often a
respawn is attempted (it fired 761x/24h), it never inspects whether repeated
attempts are converging.

Adds a second, content-aware circuit breaker:
- normalize_failure_signature(): reduces a failure log to a stable signature
  (first ##[error] line, or final line; strips timestamps/run-ids/SHAs,
  collapses whitespace).
- block_task()'s worker-self-report path (kind=needs_input/capability/
  transient) now records a `failure_signature` task_event from the block
  reason. Deliberately NOT hooked into the crash/timeout/spawn-failure
  funnel (_record_task_failure) — that path already has its own
  independently-configurable failure_limit breaker, and layering a second,
  lower-default-threshold breaker on the identical event stream would
  silently override an operator's more lenient failure_limit for any task
  whose infra errors happen to repeat verbatim (very common).
- check_failure_signature_breaker(): compares the last N (default 2,
  configurable via kanban.failure_signature_threshold config or
  HERMES_KANBAN_FAILURE_SIGNATURE_THRESHOLD env) recorded signatures for a
  task and its linked remediation children (task_links); if identical,
  dispatch_once refuses to respawn and instead blocks the task
  (kind=needs_input) with a comment describing the trip (both signatures +
  run refs). Distinct signatures never trip it.
- Blocking reuses block_task's existing `blocked` task_event, which the
  gateway's _kanban_notifier_watcher already delivers to subscribers
  (Telegram included) — no new notify channel added.

Tests: signature normalization (incl. the incident's literal sample),
trip-at-2-identical, no-trip-on-distinct, threshold config, only-most-
recent-window, remediation-children inclusion, and full dispatch_once
integration (blocked status + comment + no respawn). A regression guard
test pins that _record_task_failure does NOT emit signatures, documenting
why that path is excluded.


Claude-Session: https://claude.ai/code/session_01FoCncveCNmgqD39G2geeF2

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 13, 2026
Merged
Closed
Merged
cermm added a commit to cermm/hermes-agent that referenced this pull request Aug 16, 2026
@cermm Hermes Agent
fix: integrate issue 401 ownership repairs (NousResearch#401 NousRese…
df9408c 
…arch#469 NousResearch#475 NousResearch#477)
cermm added a commit to cermm/hermes-agent that referenced this pull request Aug 16, 2026
@cermm
fix: integrate issue 401 ownership repairs (NousResearch#401 NousRese…
e0c3e1b 
…arch#469 NousResearch#475 NousResearch#477)
@cermm cermm mentioned this pull request Aug 16, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: API Keys saving to config.yaml instead of .env as stated in doc

2 participants

@ygd58 @teknium1