{"repo":"NousResearch/hermes-agent","public_id":"126300","display_label":"Cron provider key origin binding security fix","summary":"A bug where cron jobs matched stored provider keys against hostname only, allowing keys to be sent over HTTP, to different ports, or subdomains. The fix restricts key transmission to the provider's exact configured origin.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":130611,"merged_at":"2026-10-03T11:01:10+00:00"},"resolution":{"state":"resolved","by":"pr-130611"},"freshness":{"state":"verified","last_verified_at":"2026-10-03T11:01:10+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":126300,"pr_number":130611,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-03T11:01:10+00:00"}],"members":[{"kind":"issue","number":126300,"title":"[Bug]: cron base_url check matches the provider's hostname, not its origin (stored key can go over HTTP, to another port, or to a subdomain)","url":null,"state":"closed"},{"kind":"pr","number":126306,"title":"fix(cron): bind a stored provider key to its configured origin, not its hostname","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"fb5cbcb25a","number":0},{"kind":"pr","value":"#130611","number":130611}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":130611,"title":"Cron jobs send a stored provider key only to that provider's configured origin, not over HTTP, another port or a subdomain (#126300, salvage #126306)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/config_providers.py","tests/tools/test_cronjob_tools.py","tools/cronjob_job_args.py","website/docs/user-guide/features/cron.md","website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/cron.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}