hermes - 💡(How to fix) Fix gateway.session_context empty context values fall back to stale HERMES_SESSION_* env vars [1 comments, 2 participants]

Summary

get_session_env() treats an explicitly empty context value as “unset” and falls back to os.environ. In gateway code, missing per-message fields are intentionally written as empty strings, so stale process-level HERMES_SESSION_* values can leak into unrelated message handling.

Affected code

• gateway/session_context.py:110-128
• gateway/run.py:6975-6983

Why this is a bug

GatewayRunner._set_session_env() deliberately normalizes absent fields like thread_id, user_id, and user_name to "" before storing them in contextvars.

But get_session_env() does:

value = var.get()
if value:
    return value
return os.getenv(name, default)

Because the check is truthiness-based instead of is not None, an explicit empty string does not shadow os.environ. That makes task-local session context non-authoritative whenever the process environment still contains an older HERMES_SESSION_* value.

Minimal reproduction

import os
from gateway.session_context import set_session_vars, clear_session_vars, get_session_env

os.environ['HERMES_SESSION_THREAD_ID'] = '42'
tokens = set_session_vars(thread_id='')
try:
    print(get_session_env('HERMES_SESSION_THREAD_ID', ''))
finally:
    clear_session_vars(tokens)
    os.environ.pop('HERMES_SESSION_THREAD_ID', None)

Observed output:

42

Expected behavior

An explicit empty contextvar value should override stale os.environ state, so the call above should return "".

Actual behavior

get_session_env() falls back to os.environ and returns the stale value ("42").

Suggested investigation

• Treat contextvar values as authoritative whenever the variable has been set, even if the value is "".
• Add a regression test covering empty-string overrides for thread_id, user_id, and user_name.