{"repo":"NousResearch/hermes-agent","public_id":"126114","display_label":"Profile export leaking private paths and credentials","summary":"These items address bugs where profile exports incorrectly include credential stores beyond auth.json/.env (such as .op.env, npmrc, and OAuth tokens) and expose private profile paths that should not be shareable.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":2,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":130525},"resolution":{"state":"resolved","by":"pr-130525"},"freshness":{"state":"verified","last_verified_at":"2026-10-03T13:32:13+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":126114,"pr_number":130525,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":126114,"pr_number":132201,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false}],"members":[{"kind":"issue","number":126114,"title":"[Bug]: profile export archives credential stores other than auth.json/.env (.op.env, npmrc, OAuth tokens)","url":null,"state":"closed"},{"kind":"pr","number":126116,"title":"fix(profiles): keep every credential store out of profile exports","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"6e44670c62c077521c90cb270c1ace3dacef6651","number":0},{"kind":"commit","value":"36699ac97a037b9c04c1e7331e0783c7f58a2450","number":0},{"kind":"commit","value":"6e44670c62c077521c90cb270c1ace3dacef6651","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":126214,"title":"fix(profiles): make private profile paths non-shareable","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":130398,"title":"fix(profiles): exclude credential stores and tokens from profile export (#126114)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"2b52acc2d8","number":0},{"kind":"commit","value":"0cf0499d80","number":0},{"kind":"pr","value":"#132201","number":132201}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":130525,"title":"Profile export and distribution install no longer ship or overwrite credential stores (#126114, salvage #126116)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/profile_distribution.py","hermes_cli/profiles.py","tests/hermes_cli/test_profile_export_credentials.py","tests/hermes_cli/test_profile_export_special_files.py","website/docs/reference/profile-commands.md","website/docs/user-guide/profile-distributions.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/profile-distributions.md"]},{"kind":"pr","number":132201,"title":"Profile export no longer ships .ssh/.aws/.gnupg/.kube/.envrc (#126114, salvage #130398)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/profiles.py","tests/hermes_cli/test_profile_export_credentials.py","website/docs/user-guide/profile-distributions.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/profile-distributions.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}