# NousResearch/hermes-agent · Plugin API routes missing profile secret scope fix

## Open now

- 0 issues, 1 PR open on GitHub.
- PR #120325: fix(hermes_cli): scope plugin API requests to selected profile

A bug where plugin API routes (/api/plugins/<id>/…) ran without the correct profile secret scope caused credential failures in multi-profile hosting. These members track the identification, fix, and follow-on scoping corrections for that oversight.

## TL;DR

- 5 member(s): 0 open issue(s), 1 closed issue(s), 1 open PR(s), 1 merged PR(s), 2 PR(s) closed without merging.
- A fix was merged to main in PR #126165. Verify it addresses your case.
- **Recommended:** read PR #126165 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-126165`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.40`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #120310: \[Bug\]: plugin API routes (/api/plugins/<id>/…) run with no profile secret scope — user plugins reading credentials fail closed under multi-profile hosting (sibling paths #115256 / #113746 were fixed, this one was missed)

## Prior & competing PRs

- **#126165: Off-turn work (curator, deferred reviews, catalog SWR, plugin API routes, ledger replay) runs under the requesting profile; import model_tools no longer creates state.db (#125032 #108537 #120310 #123372 #103778 #123265)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `agent/curator.py`, `agent/review_idle_queue.py`, `gateway/run_notifications.py`, `gateway/run_startup.py`, `hermes_cli/model_catalog.py`, `hermes_cli/web_server_dashboard.py`, `tests/agent/test_curator.py`, `tests/agent/test_review_idle_queue.py`, `tests/fixtures/plugins/example-dashboard/dashboard/plugin_api.py`, `tests/gateway/test_multiplex_unserved_shared_ingress.py`, `tests/hermes_cli/test_model_catalog.py`, `tests/hermes_cli/test_web_server.py`, `tests/plugins/test_kanban_dashboard_plugin.py`, `tests/tools/test_async_delegation.py`, `tests/tools/test_process_registry_lazy_restore.py`, `tests/tui_gateway/test_notification_turn_release.py`, `tools/async_delegation.py`, `tools/process_registry.py`, `tui_gateway/session_notifications.py`
- **#120325: fix(hermes_cli): scope plugin API requests to selected profile**. open
  - maintainer direction: category `silent_close`; implication `active`
  - files: `hermes_cli/web_server.py`, `tests/hermes_cli/test_plugin_api_profile_scope.py`, `website/docs/user-guide/features/extending-the-dashboard.md`
- **#120332: fix(dashboard): run plugin API routes in the profile secret scope (#120310)**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `cdc20ef28823c4d1740ffaad31b7c2fe775d4605`, `0074238e7f669e5de0dc27c13fbf47470d895ef8`, `d0288be5b3330d2442e3907185b8e9d0958297bb`, `f4fbbd4a502b45d76b1468347e1d5a07aea47adb`, `f5dd95bdebbb37751d845a333d6606475bda8cce`, `ce9f5360ac11bee485c6a3cdc3c29495e5ca7a8b`, `#123384`, `#120332`, `#120333`, `#120310`
- **#120333: fix(dashboard): run plugin API routes in the request profile secret scope**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#126165`, `#120310`, `#120332`

## Fix status

- Merged to main in PR #126165 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-09-28`.
- Subsystem: `hermes_cli`