NousResearch/hermes-agent

Gateway allowlist '@' localpart matching bug

Cluster 119446. Data as of 2026-10-24 13:18 UTC

Nothing open on GitHub. Fix merged in #120082 on 23 Sep 2026. Check it covers your case.

open issues

open PRs

items grouped

Known?: Yes. 4 related items grouped here, 1 issue already closed.
Fix event: A fix was merged to main in PR #120082. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this resolved, deciding PR #120082. That is separate from the fix event.
Still open: Nothing open on GitHub.

Next step: read #120082, then check it covers your case.

Read #120082 Pick up a Lab task

These issues and pull requests concern a bug where gateway allowlist entries incorrectly admitted any user ID sharing a '@' localpart. The members describe the problem and attempts to fix the matching behavior.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#120082 fix(gateway): bare allowlist entries no longer admit any sender sharing the '@' localpart (#119446, salvage #119447)

merged to main

files: gateway/authz_mixin.py, tests/gateway/test_allowlist_qualified_ids.py

2 PRs closed without merging

From the close comments: done elsewhere 2

#119447 fix(gateway): allowlist no longer admits any user_id sharing a '@' localpart · done elsewhere → 3e2d5b6, 8c7913b, 8dfae71, #120082
#119926 fix(gateway): stop allowlist matching on the '@' localpart (#119446) · done elsewhere → 8dfae71, 8c7913b, #119446, #120082, #119447

Closed issues · 1

Closed#119446Allowlist admits any user_id sharing a '@' localpart

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs: #120082
Closed issues: 1
Attempts: 2 PRs closed without merging
Fix link checked: 23 Sep 2026

For your agent

The same facts, typed.

cluster/119446.json
cluster/119446.md