{"repo":"NousResearch/hermes-agent","public_id":"102041","display_label":"Secret-source re-pull losing credentials after cron","summary":"These issues and fixes address a bug where secret-source values are dropped from the multiplex scope after re-pulls or cron job runs, causing credentials to be lost process-wide. The fixes adjust how applied state is tracked to prevent empty or incorrect credential snapshots.","subsystem":null,"counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":107629,"merged_at":"2026-09-11T01:13:17+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-11T01:13:17+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":102041,"pr_number":107629,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-11T01:13:17+00:00"}],"members":[{"kind":"issue","number":102041,"title":"Secret-source values are lost from the multiplex scope after any cron job runs (env-shadowed re-apply), breaking credentials process-wide","url":null,"state":"closed"},{"kind":"pr","number":102045,"title":"fix(secrets): count value-equivalent env vars as applied so re-pulls keep the snapshot","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"08830efd964","number":0},{"kind":"pr","value":"#107629","number":107629},{"kind":"pr","value":"#102041","number":102041}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":102145,"title":"fix(env): only mark secret-source home as applied when keys actually applied (fixes #102041)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"08830efd964","number":0},{"kind":"pr","value":"#107629","number":107629},{"kind":"pr","value":"#102045","number":102045}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":107629,"title":"fix(secrets): multiplex secret-source re-pull no longer empties the default profile's credentials (#102041)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["cron/scheduler.py","hermes_cli/env_loader.py","hermes_cli/plugins.py","tests/cron/test_scheduler.py","tests/hermes_cli/test_secret_source_bootstrap.py","tests/test_env_loader_secret_sources.py","website/docs/developer-guide/secret-source-plugin.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}