The env override never reached /api/sessions because the route kept a
separate hard-coded cap of 20. Resolve the window in api.config before
profile init, clamp it at 200, and refuse a profile .env override.
- README env table + .env.example gain the new setting (default 20, fallback
semantics), pinned by test_setting_is_documented.
- tests/test_visible_session_limit_env.py no longer importlib.reload()s
api.models in the shared pytest process (which recreated its module-level
locks/caches/classes behind other modules' backs); each case now imports
api.models in a fresh interpreter with a scrubbed env, matching
test_issue3283_profiles_config_import_order.
* feat(#3351): add trusted-header auth core
* fix(#3351): reconcile trusted sessions per request
* fix(#3351): preserve valid trusted group mappings
* fix(#3351): defer trusted logout reconciliation until after csrf
* fix(auth): clear _pending_set_cookies in reset_trusted_auth_request_state (keep-alive cookie cross-request leak)
Codex gate CORE finding: a Set-Cookie queued in request N but not flushed
survived onto the reused HTTP/1.1 handler and could be emitted by request N+1
— after trusted-identity rotation on logout this could overwrite a valid login
cookie and 401 the user. Reset the queue at the per-request boundary + add a
keep-alive regression test.
* docs(.env.example): document trusted-header auth / reverse-proxy SSO env vars
HERMES_WEBUI_TRUSTED_AUTH_HEADER + TRUSTED_PROXY_CIDRS (with exact-proxy-IP
security warning) + optional groups-header/JSON group-profile-map/logout-url.
* Release exp-v0.52.43: trusted-header auth / reverse-proxy SSO (#5568, #3351) + keep-alive cookie fix + docs
---------
Co-authored-by: Rod Boev <rod.boev@gmail.com>
Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
Greptile caught two example values that disagreed with the code defaults in
api/streaming.py: PREFILL_MESSAGES_SCRIPT_TIMEOUT is 5s (not 10) and
PREFILL_CONTEXT_MAX_CHARS is 12000 (not 20000). An operator uncommenting
either line verbatim would have silently diverged from the real default.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
carlotestor