hermes - 💡(How to fix) Fix [Bug/Practice]: Mem0 setup writes API key inline in mem0.json on some install paths [1 participants]

Problem

The Mem0 plugin config (~/.hermes/mem0.json) supports an api_key field inline in JSON. On some install paths the key ends up there instead of in ~/.hermes/.env, breaking the conventional secret-storage boundary.

Repro on a fresh VPS install: after running hermes memory setup and selecting Mem0, observe:

{
  "api_key": "m0-...",
  "user_id": "matvey",
  "agent_id": "echo",
  "rerank": true
}

instead of the cleaner:

~/.hermes/.env:

MEM0_API_KEY=m0-...

~/.hermes/mem0.json:

{
  "user_id": "matvey",
  "agent_id": "echo",
  "rerank": true
}

(The exact install path that produces inline-key vs env-key is unclear — I observed env-key on Mac and inline-key on VPS for the same Hermes version. Possibly tied to which wizard branch fires, or to whether .env exists at setup time.)

Why this matters

Config files are routinely:

• Committed to git when users version their ~/.hermes for cross-machine sync
• Shared in screenshots when asking for help
• Bundled in tarballs / backups without secret-scrubbing
• Tab-completed and cat'd in pair-programming sessions

.env carries a much stronger "this contains secrets" signal in convention and tooling (gitignore patterns, IDE secret detection, etc.).

Proposed solution

1. Wizard: hermes memory setup always writes MEM0_API_KEY=... to ~/.hermes/.env (creating with chmod 600 if absent), never inline to mem0.json.
2. Plugin loader: read os.environ["MEM0_API_KEY"] first, fall back to mem0.json[api_key] for back-compat, log a deprecation warning if key found in JSON.
3. hermes doctor: detect inline api_key in any plugin config, surface as a warning with migration command (mv instructions or an automated hermes config migrate-secrets).

Backward compat

Existing inline-key configs keep working but trigger a one-line warning on every doctor run and every plugin load. After one minor version, support is removed.

Severity

Low-to-moderate. Not a "remote code execution" issue, but a real practice gap. Easy to fix, easy to regress without a doctor check.

Same shape applies to other plugin configs

honcho.json, supermemory.json, etc. — any plugin that takes an API key. Worth applying the env-first convention generically.