ZhuLinsen/daily_stock_analysis · error · ValueError

Hermes BASE_URL must not include userinfo

Error message

Hermes BASE_URL must not include userinfo

What it means

Security check in canonicalize_hermes_base_url: the URL must not carry userinfo (user:password@ before the host). Credentials in the URL would leak into logs and are meaningless for a loopback-only bridge, so their presence is treated as a hard misconfiguration rather than ignored.

Source

Thrown at src/llm/hermes.py:173

        raise ValueError("Hermes only supports PROTOCOL=openai")
    return HERMES_DEFAULT_PROTOCOL


def canonicalize_hermes_base_url(base_url: str) -> str:
    """Return canonical Hermes base URL or raise ValueError.

    Allowed forms are loopback HTTP(S) URLs whose path is exactly /v1 or /v1/.
    localhost is canonicalized to 127.0.0.1 to avoid DNS/hosts ambiguity.
    """

    raw = (base_url or HERMES_DEFAULT_BASE_URL).strip() or HERMES_DEFAULT_BASE_URL
    parsed = urlparse(raw)
    if parsed.scheme.lower() not in {"http", "https"}:
        raise ValueError("Hermes BASE_URL must use http or https")
    if not parsed.netloc or not parsed.hostname:
        raise ValueError("Hermes BASE_URL must include a loopback host")
    if parsed.username or parsed.password:
        raise ValueError("Hermes BASE_URL must not include userinfo")
    if parsed.params or parsed.query or parsed.fragment:
        raise ValueError("Hermes BASE_URL must not include params, query, or fragment")

    raw_path = parsed.path or ""
    decoded_path = unquote(raw_path)
    if decoded_path not in {"/v1", "/v1/"}:
        raise ValueError("Hermes BASE_URL path must be /v1")
    if quote(decoded_path, safe="/") != raw_path.rstrip("/") and raw_path not in {"/v1", "/v1/"}:
        raise ValueError("Hermes BASE_URL path must not contain encoded segments")

    hostname = parsed.hostname.strip().lower()
    if hostname == "localhost":
        hostname = "127.0.0.1"
    elif hostname not in {"127.0.0.1", "::1"}:
        raise ValueError("Hermes BASE_URL must point to 127.0.0.1, localhost, or [::1]")

    try:
        port = parsed.port

View on GitHub (pinned to 5159bd72e8)

Solutions

  1. Remove userinfo from the URL; supply credentials through the dedicated key/config channel instead (devkey/registry), never in the URL.
  2. Use plain 'http://127.0.0.1:8642/v1'.

Example fix

# before
BASE_URL=http://sk-secret@127.0.0.1:8642/v1

# after
BASE_URL=http://127.0.0.1:8642/v1
Defensive patterns

Strategy: validation

Validate before calling

parsed = urlparse(base_url)
assert not (parsed.username or parsed.password), "remove userinfo from BASE_URL"

Type guard

def url_without_userinfo(value: str) -> bool:
    p = urlparse(value)
    return p.username is None and p.password is None

Try / catch

try:
    url = canonicalize_hermes_base_url(cfg.base_url)
except ValueError as exc:
    raise ConfigError(str(exc)) from exc

Prevention

When it happens

Trigger: BASE_URL like 'http://user:pass@127.0.0.1:8642/v1' or 'http://token@localhost:8642/v1' — urlparse.username/password are non-None and the guard fires.

Common situations: Pasting a cloud-provider endpoint style (common for OpenAI-compatible gateways that accept key@host) into Hermes config; habit from configuring other LLM base URLs that embed API keys.

Related errors

AI-assisted analysis of ZhuLinsen/daily_stock_analysis@5159bd72e8 (2026-08-15). Data as JSON: /api/errors/ee77498886088faa. Report an issue: GitHub.