{"repo":"NousResearch/hermes-agent","public_id":"119638","display_label":"MCP OAuth scope isolation by profile","summary":"These items address a bug where late MCP OAuth attempts were not properly scoped to their originating profile, and introduce fixes to ensure scopes carry their home context, failing closed on mismatches and preventing environment variable leakage.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":120128,"merged_at":"2026-09-23T13:46:03+00:00"},"resolution":{"state":"resolved","by":"pr-120128"},"freshness":{"state":"verified","last_verified_at":"2026-09-23T13:46:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":118214,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119217,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119279,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119458,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119485,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119521,"pr_number":120128,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119539,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"},{"issue_number":119638,"pr_number":120128,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-23T13:46:03+00:00"}],"members":[{"kind":"issue","number":119638,"title":"Late MCP OAuth attempts are not scoped by profile","url":null,"state":"closed"},{"kind":"pr","number":119639,"title":"fix(mcp): scope late OAuth attempts by profile","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"b88b3de6e3","number":0},{"kind":"pr","value":"#120128","number":120128}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":120128,"title":"fix(secret-scope): bound scopes carry their home; foreign-home misses fail closed, setup raises release tokens, readers never borrow os.environ","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/auxiliary_client.py","agent/secret_scope.py","cron/scheduler.py","gateway/kanban_watchers_dispatcher.py","gateway/pairing.py","gateway/run.py","gateway/run_turn.py","gateway/session.py","hermes_cli/config.py","hermes_cli/kanban_db_dispatch.py","hermes_cli/nous_auth_keepalive.py","hermes_cli/web_routers/audio.py","hermes_cli/web_server_mcp.py","hermes_cli/web_server_profiles.py","tests/agent/test_secret_scope.py","tests/agent/test_secret_scope_tier1_migration.py","tests/gateway/test_multiplex_pairing_stores.py","tests/gateway/test_proxy_mode.py","tests/gateway/test_session.py","tests/hermes_cli/test_audio_router_scope.py","tests/hermes_cli/test_nous_auth_keepalive.py","tests/tools/test_connectors_mcp.py","tests/tools/test_mcp_multiplex_connection_keys.py","tests/tools/test_profile_gate_env_shape.py","tests/tui_gateway/test_compute_host_routed_secret_hydration.py","tools/browser_tool_lifecycle.py","tools/connectors/mcp.py","tools/connectors/mcp_oauth.py","tools/environments/local_env_policy.py","tools/managed_tool_gateway.py","tools/mcp_tool_discovery.py","tools/mcp_tool_lifecycle.py","tools/openrouter_client.py","tui_gateway/compute_host.py","tui_gateway/launch_profile_policy.py","tui_gateway/model_switch.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}