Issue Station
Sign In
Tools hereToolbox

hermes - ✅(Solved) Fix [Bug]: google-workspace can't read oauth file in remote terminals [1 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
NousResearch/hermes-agent#16452•Fetched 2026-04-28 06:53:16
View on GitHub
Comments
1
Participants
1
Timeline
8
Reactions
1
Author
zhaoalexzhaoalex
Participants
zhaoalexzhaoalex
Timeline (top)
labeled ×6commented ×1cross-referenced ×1

Error Message

Additional Logs / Traceback (optional)

Root Cause

Root Cause Analysis (optional)

Fix Action

Fixed

PR fix notes

PR #16470: fix(google-workspace): restore required_credential_files in SKILL.md (#16452)

Description (problem / solution / changelog)

Summary

  • Restores the required_credential_files frontmatter block removed in #9931 from skills/productivity/google-workspace/SKILL.md
  • Adds a regression test that prevents this field from being silently dropped again

The bug

PR #9931 ("feat(google-workspace): add --from flag for custom sender display name") accidentally dropped the required_credential_files YAML header while reformatting the frontmatter. This header is the mechanism by which hermes registers google_token.json and google_client_secret.json for bind-mounting into Docker/Modal remote terminal backends at container creation time.

Without this header, register_credential_files() is never called for the skill, the session-scoped ContextVar is never populated, and get_credential_file_mounts() returns an empty list when DockerEnvironment.__init__ builds the container's -v arguments. The OAuth credential files are therefore never visible inside the sandbox — setup.py fails to find them even though they exist on the host.

The fix

Restores both google_token.json and google_client_secret.json to required_credential_files. The existing register_credential_file() implementation skips files that don't exist on the host (first-time setup, google_token.json absent) without error and adds them to the missing_cred_files list that drives setup_needed = True, so the setup prompt behaviour is correct.

Test plan

  • Before: required_credential_files absent → fm.get("required_credential_files") returns None → test_required_credential_files_present_in_skill_md fails
  • After: all 3 new tests pass; 141/141 existing skills + credential-files tests unchanged
  • Regression guard: manually stripped field from parsed content → confirmed test assertion fires with "required_credential_files missing from google-workspace SKILL.md"

Related

  • Fixes #16452
  • Original feature: #3671 (feat: mount skill credential files into remote terminal backends)
  • Regression introduced by: #9931

🤖 Generated with Claude Code

Changed files

  • skills/productivity/google-workspace/SKILL.md (modified, +6/-1)
  • tests/skills/test_google_workspace_credential_files.py (added, +109/-0)

Code Example

"Binds": [
                "/home/zhaoalex/.hermes/cache/documents:/root/.hermes/cache/documents:ro",
                "/home/zhaoalex/.hermes/image_cache:/root/.hermes/cache/images:ro",
                "/home/zhaoalex/.hermes/audio_cache:/root/.hermes/cache/audio:ro",
                "/home/zhaoalex/.hermes/sandboxes/docker/default/home:/root",
                "/home/zhaoalex/.hermes/sandboxes/docker/default/workspace:/workspace",
                "/home/zhaoalex/.hermes/google_client_secret.json:/root/.hermes/google_client_secret.json:ro",
                "/home/zhaoalex/.hermes/skills:/root/.hermes/skills:ro"
            ],

---

required_credential_files:
  - path: google_token.json
    description: Google OAuth2 token (created by setup script)
  - path: google_client_secret.json
    description: Google OAuth2 client credentials (downloaded from Google Cloud Console)

---

Report       https://paste.rs/vVJSV

---
RAW_BUFFERClick to expand / collapse

Bug Description

Reporting what seems to be a regression of #3665. The google-workspace skill, which uses oauth file-based credentials, does not work with Docker backend; it fails to find google_client_secret.json in ~/.hermes locally.

I saw support for this was added in #3671. However, it looks like the required_credential_files header in skills/productivity/google-workspace/SKILL.md was silently removed in #9931, along with a rollback of the version number, leading me to believe this was unintentional.

However, re-adding the header to the skill locally did not fix the issue; the google_client_secret.json file still cannot be found within the docker terminal. Inspecting the docker container with docker inspect reveals the path was not bind-mounted:

            "Binds": [
                "/home/zhaoalex/.hermes/cache/documents:/root/.hermes/cache/documents:ro",
                "/home/zhaoalex/.hermes/image_cache:/root/.hermes/cache/images:ro",
                "/home/zhaoalex/.hermes/audio_cache:/root/.hermes/cache/audio:ro",
                "/home/zhaoalex/.hermes/sandboxes/docker/default/home:/root",
                "/home/zhaoalex/.hermes/sandboxes/docker/default/workspace:/workspace",
                "/home/zhaoalex/.hermes/google_client_secret.json:/root/.hermes/google_client_secret.json:ro",
                "/home/zhaoalex/.hermes/skills:/root/.hermes/skills:ro"
            ],

So even with the header added back to the SKILL.md, the file is not found.

Steps to Reproduce

With terminal backend set to docker, invoke the google-workspace skill setup. Even with ~/.hermes/google_client_secret.json present and this added back to the SKILL.md header:

required_credential_files:
  - path: google_token.json
    description: Google OAuth2 token (created by setup script)
  - path: google_client_secret.json
    description: Google OAuth2 client credentials (downloaded from Google Cloud Console)

Hermes cannot find the google_client_secret.json file within the docker terminal.

Expected Behavior

Expected:

  1. docker inspect shows the bind mount path for the credential file
  2. Google setup continues as expected

Actual Behavior

  1. docker inspect does not show the bind mount path
  2. Google setup fails, as agent cannot find the oauth file

Affected Component

Skills (skill loading, skill hub, skill guard)

Messaging Platform (if gateway-related)

No response

Debug Report

Report       https://paste.rs/vVJSV

Operating System

Debian 13.4

Python Version

3.13.5

Hermes Version

0.11.0

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

The required_credential_files header in skills/productivity/google-workspace/SKILL.md likely needs to be restored. However, I can't determine why it's not working even after restoring this in the SKILL.md.

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

  • I'd like to fix this myself and submit a PR

extent analysis

TL;DR

The issue can be resolved by ensuring the google_client_secret.json file is properly bind-mounted in the Docker container and the required_credential_files header is correctly configured in the SKILL.md file.

Guidance

  • Verify that the required_credential_files header in skills/productivity/google-workspace/SKILL.md includes the correct path to google_client_secret.json.
  • Check the Docker container configuration to ensure that the google_client_secret.json file is bind-mounted to the correct location, as indicated by the docker inspect output.
  • Confirm that the google_client_secret.json file exists at the specified path on the host machine and has the correct permissions.
  • Review the Docker setup process to ensure that the bind mount for google_client_secret.json is properly configured and applied during container startup.

Example

No code snippet is provided as the issue seems to be related to configuration and Docker setup rather than code.

Notes

The root cause of the issue appears to be related to the removal of the required_credential_files header in the SKILL.md file and the lack of proper bind-mounting of the google_client_secret.json file in the Docker container. However, without more information about the Docker setup and configuration, it's difficult to provide a more specific solution.

Recommendation

Apply workaround: Ensure the google_client_secret.json file is properly bind-mounted and the required_credential_files header is correctly configured, as this seems to be the most direct way to address the issue described.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#database connection#vector store#embedding generation#cache error#pipeline error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - ✅(Solved) Fix [Bug]: google-workspace can't read oauth file in remote terminals [1 pull requests, 1 comments, 1 participants]