{"repo":"NousResearch/hermes-agent","public_id":"119485","display_label":"Profile and secret scope token binding fixes","summary":"These items address bugs where HERMES_HOME overrides and secret tokens could leak out of their intended scope when setup raised before the reset path was reached. Fixes move bindings inside the protective try blocks and tighten foreign-home and borrow behavior to fail closed.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":120128,"merged_at":"2026-09-23T13:46:03+00:00"},"resolution":{"state":"resolved","by":"pr-120128"},"freshness":{"state":"verified","last_verified_at":"2026-09-23T13:46:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":118214,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119217,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119279,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119458,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119485,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119521,"pr_number":120128,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119539,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119638,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"}],"members":[{"kind":"issue","number":119485,"title":"[Bug]: Profile-scope binders leak HERMES_HOME override when scope setup raises before the try that resets it","url":null,"state":"closed"},{"kind":"pr","number":119486,"title":"fix(profile-scope): bind home and secret tokens inside the try that resets them","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"b88b3de6e3","number":0},{"kind":"pr","value":"#120128","number":120128}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":120128,"title":"fix(secret-scope): bound scopes carry their home; foreign-home misses fail closed, setup raises release tokens, readers never borrow os.environ","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/auxiliary_client.py","agent/secret_scope.py","cron/scheduler.py","gateway/kanban_watchers_dispatcher.py","gateway/pairing.py","gateway/run.py","gateway/run_turn.py","gateway/session.py","hermes_cli/config.py","hermes_cli/kanban_db_dispatch.py","hermes_cli/nous_auth_keepalive.py","hermes_cli/web_routers/audio.py","hermes_cli/web_server_mcp.py","hermes_cli/web_server_profiles.py","tests/agent/test_secret_scope.py","tests/agent/test_secret_scope_tier1_migration.py","tests/gateway/test_multiplex_pairing_stores.py","tests/gateway/test_proxy_mode.py","tests/gateway/test_session.py","tests/hermes_cli/test_audio_router_scope.py","tests/hermes_cli/test_nous_auth_keepalive.py","tests/tools/test_connectors_mcp.py","tests/tools/test_mcp_multiplex_connection_keys.py","tests/tools/test_profile_gate_env_shape.py","tests/tui_gateway/test_compute_host_routed_secret_hydration.py","tools/browser_tool_lifecycle.py","tools/connectors/mcp.py","tools/connectors/mcp_oauth.py","tools/environments/local_env_policy.py","tools/managed_tool_gateway.py","tools/mcp_tool_discovery.py","tools/mcp_tool_lifecycle.py","tools/openrouter_client.py","tui_gateway/compute_host.py","tui_gateway/launch_profile_policy.py","tui_gateway/model_switch.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}