fix(tui-gateway): install the selected profile's secret scope (Desktop/dashboard) - #72293
Merged
Merged
Conversation
…le (#67605) The dashboard/desktop profile switch was partial — switching to profile X ran the launch profile's resources in two ways: 1. MCP discovery was gated on the launch profile's config having mcp_servers. If the launch profile had none, the background thread never started and zero MCP servers existed for every profile. Fix: always start discovery and let discover_mcp_tools() handle the empty-config case. 2. The profile secret scope (.env credentials) was never installed on the tui_gateway path. get_secret() fell through to os.environ, resolving secrets from the launch profile instead of the selected one. Fix: install set_secret_scope(build_profile_secret_scope(...)) alongside every set_hermes_home_override() call site: - compute_host.py:_ensure_server_session (build-time) - server.py:_build (lazy resume) - server.py:_handle_resume_session (_make_agent scope) - server.py:_handle_resume_session (_init_session scope) - server.py:_handle_submit_or_edit (per-turn handler)
…cope Sabotage-verified: fails when the set_secret_scope call in _start_agent_build is removed.
Contributor
૮ >ﻌ< ა ci reviewran on f5a69ef ℹ️ InfoDesktop E2E visual evidence · View test artifacts · View job1 visual diff. inline evidence upload failed. Failed to upload diff-665a0833239e-onboarding-overlay-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-665a0833239e-onboarding-overlay-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso) |
alt-glitch
added
type/bug
Contributor
19 tasks
Open
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Credentials in Desktop/dashboard sessions now resolve from the selected profile's
.envinstead of falling through to the launch profile's process environment. Fixes item 2 of #67605 (secret scope never installed on the tui_gateway path); salvage of #67623 by @kyssta-exe.Root cause:
gateway/run.pyandhermes_cli/web_server.pyinstall the profile secret scope around profile-bound work, but nothing intui_gateway/did — soget_secret()fell through toos.environ, which holds the launch profile's.env(loaded withoverride=Trueat module import).Changes
tui_gateway/server.py: installset_secret_scope(build_profile_secret_scope(profile_home))alongside the existingHERMES_HOMEoverride at all three bind sites — agent build (_start_agent_build), session resume (_reuse_live_payload, both init paths), and per-turn prompt (run) — with paired resets infinally(contributor).tui_gateway/compute_host.py: same pairing in_ensure_server_session(contributor).tests/test_tui_gateway_server.py: regression test proving agent build installs the selected profile's scope (follow-up; the PR shipped without tests).Dropped from the original branch: the
hermes_cli/mcp_startup.pygate removal — superseded by #72219, which fixed the discovery gate properly by propagating the profile override into the discovery thread.Validation
tests/test_tui_gateway_server.py(468)tests/tui_gateway/+tests/agent/test_secret_scope.py(988 total)_start_agent_build)Infographic