{"record":{"id":"108f0482b45b9596","repo":"NousResearch/hermes-agent","slug":"path-could-not-be-verified-against-the-credential","errorCode":null,"errorMessage":"path could not be verified against the credential deny-list and cannot be attached","messagePattern":"path could not be verified against the credential deny-list and cannot be attached","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/context_references.py","lineNumber":531,"sourceCode":"    # protected automatically whenever that deny-list grows.\n    try:\n        from agent.file_safety import get_read_block_error\n\n        if get_read_block_error(str(path)) is not None:\n            raise ValueError(\n                \"path is a sensitive credential or internal Hermes path and cannot be attached\"\n            )\n    except ValueError:\n        raise\n    except Exception:\n        # Fail CLOSED on the security path. This guard exists specifically to\n        # cover credential stores the narrow list above misses (auth.json,\n        # .anthropic_oauth.json, mcp-tokens/, ...). If the canonical lookup\n        # ever fails, silently falling through would re-open that exact hole —\n        # the gateway feeds untrusted remote text here, so a probe could then\n        # attach the operator's keys. Refuse instead: a spurious block on a\n        # legitimate file is a recoverable annoyance; a leaked credential is not.\n        raise ValueError(\n            \"path could not be verified against the credential deny-list and cannot be attached\"\n        )\n\n\ndef _strip_trailing_punctuation(value: str) -> str:\n    stripped = value.rstrip(TRAILING_PUNCTUATION)\n    while stripped.endswith((\")\", \"]\", \"}\")):\n        closer = stripped[-1]\n        opener = {\")\": \"(\", \"]\": \"[\", \"}\": \"{\"}[closer]\n        if stripped.count(closer) > stripped.count(opener):\n            stripped = stripped[:-1]\n            continue\n        break\n    return stripped\n\n\ndef _strip_reference_wrappers(value: str) -> str:\n    if len(value) >= 2 and value[0] == value[-1] and value[0] in \"`\\\"'\":","sourceCodeStart":513,"sourceCodeEnd":549,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/agent/context_references.py#L513-L549","documentation":"The credential deny-list check itself could not be executed — get_read_block_error raised an unexpected (non-ValueError) exception — so the guard refuses the attachment. This is a deliberate fail-closed design: the gateway feeds untrusted remote text into reference expansion, so if the canonical security lookup fails, allowing the file through could leak operator credentials; a spurious block is recoverable, a leak is not.","triggerScenarios":"Any non-ValueError exception thrown inside the get_read_block_error call (import failure of agent.file_safety, filesystem error during deny-list evaluation, unexpected TypeError). The except Exception branch converts it into this refusal.","commonSituations":"A broken/partial Hermes installation where agent.file_safety cannot be imported; corrupted deny-list state; exotic filesystem errors on the referenced path. Rare in practice — usually indicates an environment problem worth investigating.","solutions":["Treat it as an environment bug: check ~/.hermes/logs/errors.log for the underlying exception.","Verify the installation is intact (reinstall / update Hermes) so agent.file_safety imports cleanly.","Retry once after fixing the environment — a healthy install makes this error disappear.","Report it with the traceback if it persists on a current version."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    attach(path)\nexcept ValueError as e:\n    if \"could not be verified against the credential deny-list\" in str(e):\n        # environment/install problem — check errors.log, fix install, retry once\n        ...","preventionTips":["Keep the Hermes installation intact so agent.file_safety imports cleanly","Check errors.log when this fires — the real exception is logged there","Never treat this as permission to skip the check; it is fail-closed by design"],"tags":["security","fail-closed","references","environment"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}