mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-06-09 08:21:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

fix(dashboard): strip session token from subprocess env

Browse source 
Add HERMES_DASHBOARD_SESSION_TOKEN to the Hermes-managed subprocess environment blocklist so dashboard authorization material does not propagate into shell, PTY, or background process launches.

Extend the local environment blocklist regression coverage to prove the dashboard session token is stripped like other Hermes-managed secrets.
This commit is contained in:
Coy Geek 2026-06-02 22:22:40 -07:00 • committed by Teknium
parent 9ab9c923da
commit 3278b423d5
2 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/tools/test_local_env_blocklist.py
View file

@ -176,6 +176,7 @@ class TestProviderEnvBlocklist:
"HASS_TOKEN": "ha-secret",
"EMAIL_PASSWORD": "email-secret",
"FIRECRAWL_API_KEY": "fc-secret",
"HERMES_DASHBOARD_SESSION_TOKEN": "dashboard-session-secret",
"BROWSERBASE_PROJECT_ID": "bb-project",
"ELEVENLABS_API_KEY": "el-secret",
"GITHUB_TOKEN": "ghp_secret",
@ -362,6 +363,7 @@ class TestBlocklistCoverage:
"EMAIL_SMTP_HOST",
"EMAIL_HOME_ADDRESS",
"EMAIL_HOME_ADDRESS_NAME",
"HERMES_DASHBOARD_SESSION_TOKEN",
"GATEWAY_ALLOWED_USERS",
"GH_TOKEN",
"GITHUB_APP_ID",

1
tools/environments/local.py
View file

@ -175,6 +175,7 @@ def _build_provider_env_blocklist() -> frozenset:
"EMAIL_SMTP_HOST",
"EMAIL_HOME_ADDRESS",
"EMAIL_HOME_ADDRESS_NAME",
"HERMES_DASHBOARD_SESSION_TOKEN",
"GATEWAY_ALLOWED_USERS",
"GH_TOKEN",
"GITHUB_APP_ID",