fix(kanban): prevent worker session routing leaks - #69181
Closed
trymhaak wants to merge 2 commits into
Closed
Conversation
alt-glitch
added
type/bug
teknium1
pushed a commit
that referenced
this pull request
Jul 26, 2026
A long-lived gateway can have platform routing (HERMES_SESSION_* / HERMES_CRON_AUTO_DELIVER_*) mirrored in os.environ from a previous turn. _default_spawn() copied that process environment verbatim into detached kanban workers, so a worker calling kanban_create treated the inherited chat/topic as its origin and auto-subscribed the child task — the task's terminal notification then woke an unrelated chat. Strip every registered session-context routing key from the worker env unconditionally (the dispatcher is detached from every conversation); board, workspace, task, branch, profile, model, and credential propagation are unchanged. Salvaged from PR #69181 (both commits squashed; the PR's second commit fixed the first's engagement-latch assumption).
teknium1
pushed a commit
that referenced
this pull request
Jul 26, 2026
A long-lived gateway can have platform routing (HERMES_SESSION_* / HERMES_CRON_AUTO_DELIVER_*) mirrored in os.environ from a previous turn. _default_spawn() copied that process environment verbatim into detached kanban workers, so a worker calling kanban_create treated the inherited chat/topic as its origin and auto-subscribed the child task — the task's terminal notification then woke an unrelated chat. Strip every registered session-context routing key from the worker env unconditionally (the dispatcher is detached from every conversation); board, workspace, task, branch, profile, model, and credential propagation are unchanged. Salvaged from PR #69181 (both commits squashed; the PR's second commit fixed the first's engagement-latch assumption).
teknium1
pushed a commit
that referenced
this pull request
Jul 26, 2026
A long-lived gateway can have platform routing (HERMES_SESSION_* / HERMES_CRON_AUTO_DELIVER_*) mirrored in os.environ from a previous turn. _default_spawn() copied that process environment verbatim into detached kanban workers, so a worker calling kanban_create treated the inherited chat/topic as its origin and auto-subscribed the child task — the task's terminal notification then woke an unrelated chat. Strip every registered session-context routing key from the worker env unconditionally (the dispatcher is detached from every conversation); board, workspace, task, branch, profile, model, and credential propagation are unchanged. Salvaged from PR #69181 (both commits squashed; the PR's second commit fixed the first's engagement-latch assumption).
Contributor
|
Merged via PR #72241 — applied as one commit re-attributed to your GitHub handle (the original commits were authored under a local placeholder identity). Stripping stale HERMES_SESSION_*/cron routing keys from dispatched worker env closes the cross-profile auto-subscribe leak mechanism. Thanks! |
wernerhp
pushed a commit
to wernerhp/hermes-agent
that referenced
this pull request
Jul 27, 2026
…sion-env Semantic conflict in hermes_cli/kanban_db.py _default_spawn(): upstream main 148497f (salvaged from NousResearch#69181) STRIPS every _VAR_MAP session-routing key from the dispatched worker env, directly superseding this PR's approach of FORWARDING HERMES_SESSION_* via build_session_subprocess_env. A detached worker that inherits routing auto-subscribes child tasks to an unrelated chat, so the strip is the shipped, correct behavior. Resolved by taking main's strip; the PR's _SUBPROCESS_FORWARD_VARS is a subset of _VAR_MAP so nothing new leaks. send_message_tool.py origin-fallback and build_session_subprocess_env remain (merged clean) — harmless when the env vars are absent.
randlee
pushed a commit
to randlee/hermes-agent
that referenced
this pull request
Aug 11, 2026
A long-lived gateway can have platform routing (HERMES_SESSION_* / HERMES_CRON_AUTO_DELIVER_*) mirrored in os.environ from a previous turn. _default_spawn() copied that process environment verbatim into detached kanban workers, so a worker calling kanban_create treated the inherited chat/topic as its origin and auto-subscribed the child task — the task's terminal notification then woke an unrelated chat. Strip every registered session-context routing key from the worker env unconditionally (the dispatcher is detached from every conversation); board, workspace, task, branch, profile, model, and credential propagation are unchanged. Salvaged from PR NousResearch#69181 (both commits squashed; the PR's second commit fixed the first's engagement-latch assumption).
prmartinow
pushed a commit
to prmartinow/hermes-agent
that referenced
this pull request
Aug 26, 2026
A long-lived gateway can have platform routing (HERMES_SESSION_* / HERMES_CRON_AUTO_DELIVER_*) mirrored in os.environ from a previous turn. _default_spawn() copied that process environment verbatim into detached kanban workers, so a worker calling kanban_create treated the inherited chat/topic as its origin and auto-subscribed the child task — the task's terminal notification then woke an unrelated chat. Strip every registered session-context routing key from the worker env unconditionally (the dispatcher is detached from every conversation); board, workspace, task, branch, profile, model, and credential propagation are unchanged. Salvaged from PR NousResearch#69181 (both commits squashed; the PR's second commit fixed the first's engagement-latch assumption).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
HERMES_SESSION_*/ cron delivery-routing key from gateway-dispatched Kanban worker environmentsReproduction
A long-lived gateway had stale Telegram topic routing mirrored in
os.environ._default_spawn()copied that process environment directly into a detached Kanban worker. When that worker calledkanban_create,get_session_env()treated the inherited Telegram context as its origin and auto-subscribed the child task. The task's terminal completion then woke the unrelated topic.The first candidate reused the normal ContextVar bridge, but independent review found that its sanitizer preserves fallback environment values before session-context engagement. The updated regression sets the engagement latch to false, injects every key in the canonical routing registry, and proves the detached worker receives none of them.
Tests
The exact high-severity review reproducer failed before the updated production change and passes afterward. The 16 failures observed only when collecting all Kanban test modules into one non-canonical process were test-order/isolation issues: all 23 affected tests pass when their owning files/subsets run independently.
Also verified:
Risk / rollback
Low risk. Detached Kanban workers have no conversation delivery ownership; explicit Kanban notification subscriptions remain stored in the board DB and are unaffected. The change strips only the existing session/delivery routing registry before reapplying the worker's board/profile/task pins. Revert the two commits to roll back.