RELIABILITY TRACKER · P2 OPEN
STT and TTS Credential-Pool Bypass · Issue #68003
A source-linked review of a reported Hermes Agent credential-resolution inconsistency where STT and TTS tools bypass the auth store and report missing API keys after environment-variable cleanup.
What the report describes
The open report says that after API keys are migrated with hermes auth add and removed from the shell and ~/.hermes/.env, main chat can still resolve them through the auth store. STT and TTS reportedly call get_env_value() directly and do not consult the credential pool, producing a false missing-key failure. The documented workaround is duplicating the key into .env, while the proposed fix is to use the provider and auth-store resolution path consistently.
Scope note: This page summarizes the linked open issue and is not an independent security audit. The described workaround may increase credential duplication and should be evaluated against local security policy.
Verification matrix
| Signal | What to inspect | Safe review response |
|---|---|---|
| Credential migration | Move a test API key into the documented auth store and remove legacy shell and .env copies | Record the exact provider, tool, and credential state before testing. |
| Main chat control | Verify whether a regular chat request resolves the migrated credential | Use this only as a control, not evidence that every tool path is correct. |
| Voice-tool path | Run STT and TTS requests using the same provider and auth-store state | Treat a missing-key response as a resolution-path defect until logs prove otherwise. |
| Secret duplication risk | Whether the workaround requires reintroducing credentials into .env | Document the security and operational trade-off; avoid treating duplication as a durable fix. |
| Resolution consistency | Whether all provider tools use the same credential-resolution contract | Validate the eventual fix across chat, STT, and TTS with revoked legacy environment values. |
Reproduction and monitoring protocol
- Reproduce with a non-production credential under a documented migration state.
- Compare main chat, transcription, and speech output against the same provider configuration.
- Capture only non-secret diagnostics that establish which resolution path was used.
- Verify a fix after removing duplicated environment credentials again.
- Treat the issue as open until the upstream state and cross-tool behavior are confirmed.
Source evidence
NousResearch/hermes-agent · Issue #68003
Verify current issue state, labels, affected versions, and remediation before making a deployment, security, or budgeting decision.