hermes - 💡(How to fix) Fix `memory/hindsight`: embedded daemon env drops `HINDSIGHT_API_EMBEDDINGS_*` / provider-auth vars, so non-default embedding providers cannot be configured [2 pull requests]

Summary

The Hindsight memory plugin's _build_embedded_profile_env() in plugins/memory/hindsight/__init__.py writes only LLM-related keys to the embedded daemon's profile env file. It silently drops every HINDSIGHT_API_EMBEDDINGS_* and provider-auth (e.g. AWS_*) variable set in the Hermes profile .env. As a result there is no supported way to configure the embedding/reranker provider for the embedded daemon through Hermes — even though hindsight_api itself supports alternative embedding providers (it reads HINDSIGHT_API_EMBEDDINGS_PROVIDER, supports litellm-sdk, etc.).

Net effect: the daemon falls back to the default embedding provider (Cohere SaaS) and fails with CohereException - no api key supplied for anyone wanting embeddings on a different backend (Bedrock, a local TEI server, etc.). The plugin lets you pick the LLM provider but ignores the embeddings provider.

Expected vs actual

• Expected: setting HINDSIGHT_API_EMBEDDINGS_PROVIDER=litellm-sdk + HINDSIGHT_API_EMBEDDINGS_LITELLM_SDK_MODEL=bedrock/... (+ provider auth) in the Hermes profile .env makes the embedded daemon use that embedding provider.
• Actual: those vars never reach the daemon. _build_embedded_profile_env() builds a dict with only HINDSIGHT_API_LLM_PROVIDER / _API_KEY / _MODEL / _LOG_LEVEL (+ idle timeout) and returns it; the embeddings/auth vars are dropped.

Root cause

_build_embedded_profile_env() is an allowlist that only knows LLM fields. hindsight_api/engine/embeddings.py reads ENV_EMBEDDINGS_PROVIDER and related vars from the daemon environment, but the plugin never propagates them from the Hermes process env.

This looks like the same class of bug as #21809 (local_embedded profile env does not persist HINDSIGHT_EMBED_API_DATABASE_URL override) — the env-builder allowlist drops a field the daemon actually honors. Here it's the whole embeddings/reranker + provider-auth surface rather than a single var.

Proposed fix

After building env_values, pass through any HINDSIGHT_API_* and provider-auth-prefixed env vars not already handled, e.g.:

_PASSTHROUGH_PREFIXES = ("HINDSIGHT_API_", "AWS_")  # extend per supported provider
_PASSTHROUGH_DENY = {  # keep the explicitly-managed LLM fields authoritative
    "HINDSIGHT_API_LLM_PROVIDER", "HINDSIGHT_API_LLM_API_KEY",
    "HINDSIGHT_API_LLM_MODEL", "HINDSIGHT_API_LLM_BASE_URL",
    "HINDSIGHT_API_LOG_LEVEL",
}
for k, v in os.environ.items():
    if k in _PASSTHROUGH_DENY:
        continue
    if any(k.startswith(p) for p in _PASSTHROUGH_PREFIXES):
        env_values.setdefault(k, str(v))

A cleaner alternative would add explicit embeddings_provider / reranker_provider config-schema keys + a wizard step rather than env passthrough — but passthrough is the minimal fix and reuses hindsight_api's existing env contract.

Repro

1. Hermes with memory.provider: hindsight, mode local_embedded.
2. In the profile .env: HINDSIGHT_API_EMBEDDINGS_PROVIDER=litellm-sdk, HINDSIGHT_API_EMBEDDINGS_LITELLM_SDK_MODEL=bedrock/cohere.embed-v4:0, plus the relevant AWS_* auth vars.
3. Start the gateway, trigger an agent turn → daemon spawn.
4. Daemon log shows CohereException - no api key supplied (it used the default Cohere provider, not the configured one).
5. Inspect the daemon profile env file (~/.hindsight/profiles/<name>.env) — the EMBEDDINGS_* / AWS_* vars are absent.

Reproduced on v0.15.1 (2026.5.29).