NousResearch/hermes-agent · warning · RuntimeError

management.token is missing — re-run `hermes egress setup`,

Error message

management.token is missing — re-run `hermes egress setup`, then `hermes egress restart`.

What it means

The management block in proxy.yaml carries a bearer token (management.token) that reload_proxy() puts in the Authorization header when POSTing to /v1/reload. If the token is absent from the config (or unreadable), reload refuses before making the request. It typically accompanies the same stale-config situation as the missing management block.

Source

Thrown at agent/proxy_sources/iron_proxy.py:943

    or the reload is rejected.
    """

    pid = _read_pid()
    if not pid or not _pid_alive(pid):
        raise RuntimeError(
            "iron-proxy is not running — nothing to reload.  "
            "Run `hermes egress start`."
        )
    mgmt = _read_management_listen_from_config()
    if mgmt is None:
        raise RuntimeError(
            "The generated proxy.yaml has no management listener (written "
            "before reload support).  Re-run `hermes egress setup` and use "
            "`hermes egress restart` this one time."
        )
    token = _read_management_token()
    if not token:
        raise RuntimeError(
            "management.token is missing — re-run `hermes egress setup`, "
            "then `hermes egress restart`."
        )

    import urllib.error
    import urllib.request

    host, port = mgmt
    req = urllib.request.Request(
        f"http://{host}:{port}/v1/reload",
        method="POST",
        headers={"Authorization": f"Bearer {token}"},
        data=b"",
    )
    try:
        with urllib.request.urlopen(req, timeout=_MGMT_RELOAD_TIMEOUT) as resp:
            if resp.status == 200:
                return True

View on GitHub (pinned to c896c09c42)

Solutions

Run `hermes egress setup` to regenerate a complete config including management.token.
Then `hermes egress restart` so the daemon picks up the token.
Avoid hand-editing the generated proxy.yaml for token fields; use the setup command so token and listener stay consistent.

Defensive patterns

Strategy: try-catch

Validate before calling

from agent.proxy_sources.iron_proxy import _read_management_token

def reload_auth_ready() -> bool:
    return bool(_read_management_token())

Try / catch

try:
    reload_proxy()
except RuntimeError as e:
    if "management.token is missing" in str(e):
        # re-run setup + restart to regenerate a complete config
        raise

Prevention

Never hand-strip token fields from generated proxy.yaml; regenerate via `hermes egress setup`.
Validate generated config contains management.listen AND management.token in setup tests.

When it happens

Trigger: reload_proxy() / `hermes egress reload` where _read_management_token() returns falsy: proxy.yaml has a management.listen but no management.token, or the token file/field was manually stripped while hand-editing the config.

Common situations: Hand-edited proxy.yaml where the user removed the token thinking it unused; partial setup where config generation was interrupted; config from an intermediate version that wrote listen but not token.

Related errors

AI-assisted analysis of NousResearch/hermes-agent@c896c09c42 (2026-08-14). Data as JSON: /api/errors/34c9ac486743bb8d. Report an issue: GitHub.