Profile export leaking private paths and credentials
NousResearch/hermes-agent · cluster 126114
Data as of
Nothing open on GitHub. Fix merged in #130525. Check it covers your case.
The short answer
- Known?
- Yes. 6 related items grouped here, 1 issue already closed.
- Fix event
- A fix was merged to main in PR #130525. Check it covers your case. No release data is tracked.
- Tracker
- The maintainers' tracker marks this
resolved, deciding PR #130525. That is separate from the fix event. - Still open
- Nothing open on GitHub.
These items address bugs where profile exports incorrectly include credential stores beyond auth.json/.env (such as .op.env, npmrc, and OAuth tokens) and expose private profile paths that should not be shareable.
Open issues0
Open PRs0
Fixes on record
-
#130525 Profile export and distribution install no longer ship or overwrite credential stores (#126114, salvage #126116)
files:
hermes_cli/profile_distribution.py,hermes_cli/profiles.py,tests/hermes_cli/test_profile_export_credentials.py,tests/hermes_cli/test_profile_export_special_files.py,website/docs/reference/profile-commands.md,website/docs/user-guide/profile-distributions.md,website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/profile-distributions.md -
#132201 Profile export no longer ships .ssh/.aws/.gnupg/.kube/.envrc (#126114, salvage #130398)
files:
hermes_cli/profiles.py,tests/hermes_cli/test_profile_export_credentials.py,website/docs/user-guide/profile-distributions.md,website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/profile-distributions.md
3 PRs closed without merging
From the close comments: done elsewhere 1 · merged via another change 1 · other 1
-
#126116 fix(profiles): keep every credential store out of profile exports · done elsewhere →
6e44670,36699ac - #126214 fix(profiles): make private profile paths non-shareable · other
-
#130398 fix(profiles): exclude credential stores and tokens from profile export (#126114) · merged via another change →
2b52acc,0cf0499,#132201
Closed issues · 1
- Closed#126114[Bug]: profile export archives credential stores other than auth.json/.env (.op.env, npmrc, OAuth tokens)
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.33: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the Lab