{"repo":"NousResearch/hermes-agent","public_id":"55878","display_label":"OAuth token handling in spawned subprocesses","summary":"These members concern how CLAUDE_CODE_OAUTH_TOKEN is passed to or stripped from agent-spawned subprocess environments, and whether credential isolation or injection should be the default behavior.","subsystem":"agent","counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":56935,"merged_at":"2026-07-02T09:13:31+00:00"},"resolution":{"state":"resolved","by":"pr-56935"},"freshness":{"state":"verified","last_verified_at":"2026-07-02T09:13:31+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":55878,"pr_number":56935,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-02T09:13:31+00:00"}],"members":[{"kind":"issue","number":55878,"title":"Spawned subscription-authed CLIs (e.g. Claude Code) should get isolated, safe credential handling by default","url":null,"state":"closed"},{"kind":"pr","number":55895,"title":"fix: isolate and token-inject agent-spawned Claude Code","url":null,"state":"closed","close_reason":{"category":"wontfix_bydesign","implication":"wontfix"},"merged":false},{"kind":"pr","number":56935,"title":"fix(terminal): stop stripping CLAUDE_CODE_OAUTH_TOKEN from spawned subprocesses","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_local_env_blocklist.py","tools/environments/local.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}