{"record":{"id":"e425c37735065e53","repo":"NousResearch/hermes-agent","slug":"iron-proxy-config-not-found-at-cfg-run-hermes","errorCode":null,"errorMessage":"iron-proxy config not found at {cfg}. Run `hermes egress setup` first.","messagePattern":"iron-proxy config not found at (.+?)\\. Run `hermes egress setup` first\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"agent/proxy_sources/iron_proxy.py","lineNumber":1795,"sourceCode":"    Without this flag (or with ``bitwarden_config=None``) the proxy still\n    starts but uses whatever the host process env happens to contain.\n    \"\"\"\n\n    global _proxy_nonce\n\n    existing = _read_pid()\n    if existing and _pid_alive(existing):\n        return get_status()\n\n    bin_path = binary or find_iron_proxy(install_if_missing=install_if_missing)\n    if bin_path is None:\n        raise RuntimeError(\n            \"iron-proxy binary not available — run `hermes egress install`.\"\n        )\n\n    cfg = config_path or (_proxy_state_dir() / \"proxy.yaml\")\n    if not cfg.exists():\n        raise RuntimeError(\n            f\"iron-proxy config not found at {cfg}. \"\n            \"Run `hermes egress setup` first.\"\n        )\n\n    # Build a minimal subprocess env.  os.environ.copy() would ship every\n    # secret in the operator's shell to the proxy — /proc/<pid>/environ\n    # would then expose OPENAI_API_KEY, AWS keys, etc. to any same-uid\n    # local process.  Defeats the threat model the proxy exists to\n    # mitigate.\n    env = _build_proxy_subprocess_env(\n        extra_env=extra_env,\n        refresh_from_bitwarden=refresh_secrets_from_bitwarden,\n        bitwarden_config=bitwarden_config,\n    )\n\n    # If the generated config enables the management API, the daemon\n    # validates at startup that the api_key_env is non-empty.  Inject the\n    # persisted key (minting it if this is a config written by a newer","sourceCodeStart":1777,"sourceCodeEnd":1813,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/agent/proxy_sources/iron_proxy.py#L1777-L1813","documentation":"start_proxy() requires proxy.yaml to exist (defaulting to <proxy state dir>/proxy.yaml, or the config_path argument) because it never launches the daemon with an implicit config. The message names the exact path checked and the setup command that generates it. It fires only after the binary was successfully resolved, so it's purely the 'setup not run on this machine/profile' precondition.","triggerScenarios":"start_proxy() / `hermes egress start` when `hermes egress setup` was never run on this HERMES_HOME, the proxy state dir was wiped, or a custom config_path was passed that doesn't exist (typo, wrong profile).","commonSituations":"Fresh installs; switching to a new Hermes profile (each profile has its own state dir); passing a stale config_path from automation after the file moved.","solutions":["Run `hermes egress setup` to generate proxy.yaml (plus CA cert) for this profile.","If passing config_path explicitly, verify the path exists and is readable before starting.","Remember state is per-profile under HERMES_HOME — setup must be re-run per profile."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from pathlib import Path\nfrom agent.proxy_sources.iron_proxy import _proxy_state_dir\n\ndef proxy_config_exists() -> bool:\n    return (_proxy_state_dir() / \"proxy.yaml\").exists()","typeGuard":null,"tryCatchPattern":"try:\n    start_proxy()\nexcept RuntimeError as e:\n    if \"config not found\" in str(e):\n        # run hermes egress setup, then retry\n        raise","preventionTips":["Run `hermes egress setup` once per profile (state dirs are per-HERMES_HOME).","When passing config_path explicitly, assert it exists before starting."],"tags":["config","lifecycle","setup","iron-proxy"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}