mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-11 13:41:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

feat(docker): re-seed a terminally-dead Nous bootstrap session on boot (#59983)

Browse source 
The stage2-hook auth.json seed is first-boot-only ([ ! -f auth.json ]) to avoid
clobbering rotated refresh tokens on restart. That guard means a container whose
Nous bootstrap session took a terminal invalid_grant (tokens cleared,
providers.nous.last_auth_error.relogin_required stamped) cannot recover from a
restart — it stays unauthenticated until the credential is replaced.

Add a self-heal path: an orchestrator that manages the container supplies a
freshly-issued session via HERMES_AUTH_JSON_REBOOTSTRAP (distinct from the
create-only *_BOOTSTRAP var). On boot, scripts/docker_rebootstrap_nous_session.py
swaps ONLY the providers.nous entry, and ONLY when the on-disk entry is provably
terminal (quarantine marker + no usable tokens). Healthy/rotating/absent/
unparseable auth.json is always a no-op, so the env is safe to leave set across
restarts and never clobbers a good token. Pure stdlib, runs as its own
subprocess, always exits 0 so a re-seed error never fails the boot.

Reuses the same terminal predicate as get_nous_session_validity() so we re-seed
only a session that is genuinely dead.
This commit is contained in:
Ben Barclay 2026-07-07 16:57:23 +10:00 • committed by GitHub
parent 586aae4bf1
commit 536ffedbf4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docker/stage2-hook.sh
View file

@ -443,6 +443,31 @@ if [ ! -f "$HERMES_HOME/auth.json" ] && [ -n "${HERMES_AUTH_JSON_BOOTSTRAP:-}" ]
fi
fi
# auth.json: re-seed a TERMINALLY-DEAD Nous bootstrap session (self-heal).
#
# The [ ! -f ] guard above deliberately refuses to clobber an existing
# auth.json, so a container whose Nous bootstrap session took a terminal
# invalid_grant (tokens cleared, providers.nous.last_auth_error.relogin_required
# stamped) can NOT recover from a plain restart — it stays unauthenticated until
# the credential is replaced. An orchestrator that manages the container can
# supply a freshly-issued session via HERMES_AUTH_JSON_REBOOTSTRAP (distinct
# from the create-only *_BOOTSTRAP var); this helper swaps ONLY the
# providers.nous entry, and ONLY when the on-disk entry is provably terminal.
# Every other case (healthy, rotating, absent, or unparseable auth.json) is a
# no-op, so it is safe to leave the env set across restarts and never risks
# clobbering a good/rotated token. Runs as its own stdlib-only subprocess (no
# app imports) and always exits 0.
if [ -f "$HERMES_HOME/auth.json" ] && [ -n "${HERMES_AUTH_JSON_REBOOTSTRAP:-}" ]; then
if refuse_symlinked_path "reseed" "$HERMES_HOME/auth.json"; then
:
else
s6-setuidgid hermes "$INSTALL_DIR/.venv/bin/python" \
"$INSTALL_DIR/scripts/docker_rebootstrap_nous_session.py" \
"$HERMES_HOME/auth.json" \
|| echo "[stage2] Warning: docker_rebootstrap_nous_session.py failed; continuing"
fi
fi
# gateway_state.json: declare the gateway's INITIAL supervised state on a
# fresh volume. Same first-boot-only env-seed pattern as auth.json above.
#