{"repo":"NousResearch/hermes-agent","public_id":"119539","display_label":"Secret scope and env var preservation fixes","summary":"These items address bugs and fixes related to environment variable handling in scoped secrets and operator allowlist env vars, specifically preventing silent deletion of operator env vars and ensuring scoped secrets do not leak or incorrectly borrow from os.environ.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":120128,"merged_at":"2026-09-23T13:46:03+00:00"},"resolution":{"state":"resolved","by":"pr-120128"},"freshness":{"state":"verified","last_verified_at":"2026-09-23T13:46:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":118214,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119217,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119279,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119458,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119485,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119521,"pr_number":120128,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119539,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119638,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"}],"members":[{"kind":"issue","number":119539,"title":"[Bug] `strip_profile_gate_env` deletes operator env vars by name *shape* (`_ALLOWED_`), silently breaking routed-profile `no_agent` cron scripts","url":null,"state":"closed"},{"kind":"pr","number":119547,"title":"fix(profiles): preserve operator allowlist env","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#120128","number":120128},{"kind":"pr","value":"#119539","number":119539}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":120128,"title":"fix(secret-scope): bound scopes carry their home; foreign-home misses fail closed, setup raises release tokens, readers never borrow os.environ","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/auxiliary_client.py","agent/secret_scope.py","cron/scheduler.py","gateway/kanban_watchers_dispatcher.py","gateway/pairing.py","gateway/run.py","gateway/run_turn.py","gateway/session.py","hermes_cli/config.py","hermes_cli/kanban_db_dispatch.py","hermes_cli/nous_auth_keepalive.py","hermes_cli/web_routers/audio.py","hermes_cli/web_server_mcp.py","hermes_cli/web_server_profiles.py","tests/agent/test_secret_scope.py","tests/agent/test_secret_scope_tier1_migration.py","tests/gateway/test_multiplex_pairing_stores.py","tests/gateway/test_proxy_mode.py","tests/gateway/test_session.py","tests/hermes_cli/test_audio_router_scope.py","tests/hermes_cli/test_nous_auth_keepalive.py","tests/tools/test_connectors_mcp.py","tests/tools/test_mcp_multiplex_connection_keys.py","tests/tools/test_profile_gate_env_shape.py","tests/tui_gateway/test_compute_host_routed_secret_hydration.py","tools/browser_tool_lifecycle.py","tools/connectors/mcp.py","tools/connectors/mcp_oauth.py","tools/environments/local_env_policy.py","tools/managed_tool_gateway.py","tools/mcp_tool_discovery.py","tools/mcp_tool_lifecycle.py","tools/openrouter_client.py","tui_gateway/compute_host.py","tui_gateway/launch_profile_policy.py","tui_gateway/model_switch.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}