{"repo":"NousResearch/hermes-agent","public_id":"128866","display_label":"Secret store path identity matching fixes","summary":"These members address a bug where secret store checks relied on path string comparison rather than file identity, allowing case variants, hardlinks, and symlinks to bypass guards. Related work consolidates secret store lists across read/write, chat delivery, and dashboard file handling.","subsystem":"agent","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":0,"merged_prs":0,"attempt_prs":2},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[],"members":[{"kind":"issue","number":128866,"title":"[Bug]: secret-store checks compare path spelling, so case variants, hardlinks and symlinked store dirs get through","url":null,"state":"open"},{"kind":"pr","number":128813,"title":"fix(file-safety): one secret-store list for the read/write guard, chat delivery and dashboard Files","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"f98a1d0639f41ffecedde1435288e577907f9dcc","number":0},{"kind":"commit","value":"51f532f2b7ef3a1b4dad8c6970a623d2e1689e0e","number":0},{"kind":"pr","value":"#128856","number":128856},{"kind":"pr","value":"#128868","number":128868},{"kind":"pr","value":"#172554","number":172554}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":128868,"title":"fix(file-safety): match secret stores by file identity, not path spelling","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}