{"repo":"NousResearch/hermes-agent","public_id":"116878","display_label":"Bang shell env leak fix when sanitizer fails","summary":"These issues and PRs concern a bug where the bang shell fallback exposes the full process environment, including API keys, when the sanitizer module cannot be imported. The work focuses on making the failure mode safe by closing rather than leaking secrets.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":117585,"merged_at":"2026-09-21T01:20:44+00:00"},"resolution":{"state":"resolved","by":"pr-117585"},"freshness":{"state":"verified","last_verified_at":"2026-09-21T01:20:44+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":116878,"pr_number":117585,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-21T01:20:44+00:00"}],"members":[{"kind":"issue","number":116878,"title":"[Bug]: bang_shell fallback leaks full process env (all API keys) when sanitizer unimportable","url":null,"state":"closed"},{"kind":"pr","number":116955,"title":"fix(cli): prevent secret leaks when bang shell sanitization fails","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"7df20a670da5","number":0},{"kind":"pr","value":"#117585","number":117585}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":117585,"title":"fix(cli): bang shell fails closed instead of leaking the full env when the sanitizer is unimportable (#116878, salvage #116955)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/bang_shell.py","tests/hermes_cli/test_bang_shell_mode.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}