Skip to content

fix(docs): update Telegram docs after .env hardening for allowed users (#70879) - #71038

Open
webtecnica wants to merge 2 commits into
NousResearch:mainfrom
webtecnica:fix/docs-telegram-env
Open

fix(docs): update Telegram docs after .env hardening for allowed users (#70879)#71038
webtecnica wants to merge 2 commits into
NousResearch:mainfrom
webtecnica:fix/docs-telegram-env

Conversation

@webtecnica

@webtecnica webtecnica commented Jul 24, 2026

Copy link
Copy Markdown

Updates Telegram documentation across 12 files to reflect .env hardening in v0.19. Non-secret settings moved from .env to config.yaml. Secrets (bot token) remain in .env.

Fixes #70879

@alt-glitch alt-glitch mentioned this pull request Jul 24, 2026
Closed
@alt-glitch alt-glitch added type/docs Documentation improvements comp/cli CLI entry point, hermes_cli/, setup wizard comp/plugins Plugin system and bundled plugins comp/tui Terminal UI (ui-tui/ + tui_gateway/) platform/telegram Telegram bot adapter provider/kimi Kimi / Moonshot area/auth Authentication, OAuth, credential pools P3 Low — cosmetic, nice to have labels Jul 24, 2026
@webtecnica
feat(dashboard): add proper access-control boundary for --isolated mo…
ce2ea38 
…de (NousResearch#70867)

When the dashboard is launched with --isolated, the API must reject
?profile= requests targeting any profile other than the one the server
is scoped to. Without this guard, a user on an isolated dashboard could
read/write another profile's config, sessions, skills, and env vars
simply by passing ?profile=<other>.

Changes:
- Add _check_isolated_profile_access() helper that compares the
  requested profile directory against the server's own HERMES_HOME
- Wire the check into _profile_scope(), _config_profile_scope(), and
  _open_session_db_for_profile() — the three gateways through which all
  profile-scoped API requests pass
- Add 'isolated' parameter to start_server() and store it on app.state
- Forward the CLI --isolated flag from cmd_dashboard to start_server()

Closes: NousResearch#70867
@webtecnica
fix(docs): update Telegram docs after .env hardening for allowed users (
6852da6 
NousResearch#70879)
@webtecnica
webtecnica force-pushed the fix/docs-telegram-env branch from 3698de4 to 6852da6 Compare July 26, 2026 23:35
@GottZ GottZ mentioned this pull request Jul 30, 2026
Open
1 task
@teknium1

teknium1 commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Thanks for addressing the .env hardening documentation gap.

Problems

  • The report links the English team Telegram guide, but current main still tells readers to put TELEGRAM_ALLOWED_USERS in .env at website/docs/guides/team-telegram-assistant.md:96-103 and :199-200. This PR changes only the Chinese translation and the environment-variable reference, so it does not fix the reported page.
  • The documentation commit 6852da6a93cb also includes unrelated Kanban, dashboard-isolation, Kimi OAuth, and TUI changes. Those files are outside [Feature]: Update documentation about Telegram and other components that used /env #70879 and should not travel with a docs correction.

Suggested changes

  • Narrow the salvage to documentation for [Feature]: Update documentation about Telegram and other components that used /env #70879 and update the English team guide to use gateway.platforms.telegram.extra.allow_from; current main supports this path in gateway/config.py:1513-1529, and the adapter consumes config.extra["allow_from"] at plugins/platforms/telegram/adapter.py:1045-1054.
  • Keep environment variables documented as compatible alternatives, then audit the remaining English Telegram/security examples that still direct allowlists to .env.

Automated hermes-sweeper review.

@teknium1 teknium1 added sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform area/install-update Installer, updater, packaging, wheels, doctor labels Jul 30, 2026
@ang-fleet-workers ang-fleet-workers Bot mentioned this pull request Sep 28, 2026
Merged

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/auth Authentication, OAuth, credential pools area/install-update Installer, updater, packaging, wheels, doctor comp/cli CLI entry point, hermes_cli/, setup wizard comp/plugins Plugin system and bundled plugins comp/tui Terminal UI (ui-tui/ + tui_gateway/) P3 Low — cosmetic, nice to have platform/telegram Telegram bot adapter provider/kimi Kimi / Moonshot sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data type/docs Documentation improvements

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature]: Update documentation about Telegram and other components that used /env

3 participants

@webtecnica @teknium1 @alt-glitch