{"repo":"NousResearch/hermes-agent","public_id":"120310","display_label":"Plugin API routes missing profile secret scope fix","summary":"A bug where plugin API routes (/api/plugins/<id>/…) ran without the correct profile secret scope caused credential failures in multi-profile hosting. These members track the identification, fix, and follow-on scoping corrections for that oversight.","subsystem":"hermes_cli","counts":{"members":5,"open_issues":0,"open_issues_distinct":0,"open_prs":1,"closed_issues":1,"merged_prs":1,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":126165,"merged_at":"2026-09-28T12:37:56+00:00"},"resolution":{"state":"resolved","by":"pr-126165"},"freshness":{"state":"verified","last_verified_at":"2026-09-28T12:37:56+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.4},"fix_edges":[{"issue_number":103778,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"},{"issue_number":108537,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"},{"issue_number":120310,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"},{"issue_number":123265,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"},{"issue_number":123372,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"},{"issue_number":125032,"pr_number":126165,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-28T12:37:56+00:00"}],"members":[{"kind":"issue","number":120310,"title":"[Bug]: plugin API routes (/api/plugins/<id>/…) run with no profile secret scope — user plugins reading credentials fail closed under multi-profile hosting (sibling paths #115256 / #113746 were fixed, this one was missed)","url":null,"state":"closed"},{"kind":"pr","number":120325,"title":"fix(hermes_cli): scope plugin API requests to selected profile","url":null,"state":"open","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":120332,"title":"fix(dashboard): run plugin API routes in the profile secret scope (#120310)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"cdc20ef28823c4d1740ffaad31b7c2fe775d4605","number":0},{"kind":"commit","value":"0074238e7f669e5de0dc27c13fbf47470d895ef8","number":0},{"kind":"commit","value":"d0288be5b3330d2442e3907185b8e9d0958297bb","number":0},{"kind":"commit","value":"f4fbbd4a502b45d76b1468347e1d5a07aea47adb","number":0},{"kind":"commit","value":"f5dd95bdebbb37751d845a333d6606475bda8cce","number":0},{"kind":"commit","value":"ce9f5360ac11bee485c6a3cdc3c29495e5ca7a8b","number":0},{"kind":"pr","value":"#123384","number":123384},{"kind":"pr","value":"#120332","number":120332},{"kind":"pr","value":"#120333","number":120333},{"kind":"pr","value":"#120310","number":120310}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":120333,"title":"fix(dashboard): run plugin API routes in the request profile secret scope","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#126165","number":126165},{"kind":"pr","value":"#120310","number":120310},{"kind":"pr","value":"#120332","number":120332}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":126165,"title":"Off-turn work (curator, deferred reviews, catalog SWR, plugin API routes, ledger replay) runs under the requesting profile; import model_tools no longer creates state.db (#125032 #108537 #120310 #123372 #103778 #123265)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/curator.py","agent/review_idle_queue.py","gateway/run_notifications.py","gateway/run_startup.py","hermes_cli/model_catalog.py","hermes_cli/web_server_dashboard.py","tests/agent/test_curator.py","tests/agent/test_review_idle_queue.py","tests/fixtures/plugins/example-dashboard/dashboard/plugin_api.py","tests/gateway/test_multiplex_unserved_shared_ingress.py","tests/hermes_cli/test_model_catalog.py","tests/hermes_cli/test_web_server.py","tests/plugins/test_kanban_dashboard_plugin.py","tests/tools/test_async_delegation.py","tests/tools/test_process_registry_lazy_restore.py","tests/tui_gateway/test_notification_turn_release.py","tools/async_delegation.py","tools/process_registry.py","tui_gateway/session_notifications.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}