Bug Report

Summary

The image_generate tool always returns {"success": false, "image": null} even when FAL_KEY is correctly set in the gateway process environment via systemd. The fal.ai API returns "invalid key credentials" because the tool execution context does not inherit the FAL_KEY environment variable from the gateway process.

Environment

• OS: Raspberry Pi, aarch64, Debian (kernel 6.12.62)
• Hermes: Latest (installed via hermes-agent repo)
• Python: 3.11
• fal-client: 0.13.2
• Gateway: Running as systemd user service

Steps to Reproduce

1. Set FAL_KEY in the hermes-gateway systemd service file:

   Environment="FAL_KEY=<valid-fal-key>"
   

2. Reload and restart the gateway: systemctl --user daemon-reload && systemctl --user restart hermes-gateway
3. Confirm the gateway process has the key: cat /proc/<PID>/environ | tr '\0' '\n' | grep FAL — shows the correct key
4. Use the image_generate tool from a chat session
5. Tool returns {"success": false, "image": null}
6. Error log shows: fal_client.client.FalClientHTTPError: invalid key credentials

Evidence That the Key Works

The exact same tool code succeeds when called via execute_code with the env var explicitly set:

import os
os.environ["FAL_KEY"] = "<key>"
from tools.image_generation_tool import image_generate_tool
result = image_generate_tool(prompt="A cute robot", aspect_ratio="square")
# Returns {"success": true, "image": "https://..."}

Direct API calls with urllib.request and fal_client.submit() also succeed with the same key. Only the native image_generate tool invocation fails.

Root Cause Analysis

The image_generate_tool in tools/image_generation_tool.py calls os.getenv("FAL_KEY") at line 283, and fal_client reads it via fetch_auth_credentials() at import time (module-level SyncClient() singleton in fal_client/__init__.py line 58).

The gateway process PID has the correct FAL_KEY in its environment, but when the tool is invoked during a chat session, the execution context does not appear to inherit this variable. This suggests the tool runs in a subprocess or sandbox that does not receive the gateway's full environment.

Expected Behavior

FAL_KEY (and other provider API keys) set in the gateway systemd service should be available to all tools during execution.

Workaround

Use execute_code to call the tool directly with os.environ["FAL_KEY"] set explicitly before import.