{"repo":"NousResearch/hermes-agent","public_id":"111724","display_label":"Named profiles silently inheriting root credentials","summary":"A bug where named profiles with no credentials silently fall back to and mutate the root profile's keys and tokens. The cluster covers the bug report and two related fix attempts addressing credential isolation and fallback behavior for named profiles.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":113425,"merged_at":"2026-09-16T21:34:59+00:00"},"resolution":{"state":"resolved","by":"pr-113425"},"freshness":{"state":"verified","last_verified_at":"2026-09-16T21:34:59+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":111724,"pr_number":113425,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-16T21:34:59+00:00"}],"members":[{"kind":"issue","number":111724,"title":"[Bug]: a named profile with no credentials silently inherits the root profile's keys and OAuth tokens (and writes refreshed tokens back to root) — there is no way to make a profile fail closed","url":null,"state":"closed"},{"kind":"pr","number":109043,"title":"fix(auth): let profiles disable global credential fallback (salvage #72816)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"8c8003f80b","number":0},{"kind":"pr","value":"#113425","number":113425},{"kind":"pr","value":"#72816","number":72816}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":113425,"title":"fix(auth): named profiles no longer inherit the root profile's credentials (#111724, supersedes #109043)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/agent_init.py","agent/anthropic_credentials.py","agent/credential_pool.py","agent/credential_pool_admin.py","apps/desktop/src/components/onboarding-chat/setup-profile.ts","apps/desktop/src/plugins/hermes-bots/create-dialog.tsx","apps/shared/src/gateway-contract.generated.ts","apps/shared/src/gateway-contract.openrpc.json","hermes_cli/AGENTS.md","hermes_cli/anon_auth.py","hermes_cli/auth.py","hermes_cli/auth_codex.py","hermes_cli/auth_commands.py","hermes_cli/auth_oauth_grants.py","hermes_cli/auth_xai.py","hermes_cli/profile_credential_audit.py","hermes_cli/profiles.py","hermes_cli/update_cmd_maint.py","tests/agent/test_anthropic_oauth_stress.py","tests/agent/test_credential_pool_oauth_writethrough.py","tests/agent/test_credential_pool_profile_oauth_fork.py","tests/hermes_cli/test_auth_profile_fallback.py","tests/hermes_cli/test_auth_profile_isolation.py","tests/hermes_cli/test_codex_token_writethrough.py","tests/hermes_cli/test_global_auth_store_memo.py","tests/hermes_cli/test_xai_oauth_profile_auth.py","tests/hermes_cli/test_xai_oauth_writethrough.py","tests/test_hermes_constants.py","tests/tools/test_managed_tool_gateway.py","tools/managed_tool_gateway.py","tui_gateway/contracts/profiles_vault_complete_foreign_subagents.py","tui_gateway/methods_profiles.py","website/docs/user-guide/multi-profile-gateways.md","website/docs/user-guide/profiles.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}