Cairn
NousResearch/hermes-agent

Profile secret isolation fixes in desktop cron

Cluster 107692 · agent. Data as of

1 open item. Fix merged in #111187 on 15 Sep 2026. Check it covers your case.

The short answer

0open issues
1open PR
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #111187. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #111187. That is separate from the fix event.
Still open
0 issues and 1 PR.

These issues and PRs address credential leakage between profiles in the desktop cron/ticker environment, where one profile's secrets could incorrectly bleed into another profile's process environment. Fixes span OCR API key resolution and cron launch-profile secret scoping.

Open issues0

No open issues.

Open PRs1

  • PR#107777fix(tools): hosted OCR resolves FIRECRAWL_API_KEY through the profile secret scope

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #111187 Routed cron fires in the desktop backend run under multiplex semantics, so launch-profile secrets never reach another profile's child (#107692, salvage #107695)

    merged to main

    files: agent/secret_scope.py, cron/scheduler.py, cron/scheduler_provider.py, cron/scheduler_script.py, hermes_cli/env_loader.py, hermes_cli/plugins.py, tests/cron/test_cron_multiplex_desktop_ticker_scope.py, tests/cron/test_cron_no_agent.py, tests/cron/test_restart_safe_worker.py, tools/environments/local.py

1 PR closed without merging

From the close comments: done elsewhere 1

  • #107695 fix(cron): desktop ticker no longer copies a secondary profile's .env into the shared process env · done elsewhere → f5f88d5, b9271bc
Closed issues · 1
  • Closed#107692Desktop cron ticker copies a secondary profile's .env into the shared process environment (credential variant of #102769)
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#111187
Closed issues
1
Attempts
1 PR closed without merging
Fix link checked
15 Sep 2026

For your agent

The same facts, typed.

cluster/107692.json
cluster/107692.md