{"repo":"NousResearch/hermes-agent","public_id":"58724","display_label":"Dashboard file-read credential guard security fixes","summary":"These items address a security concern where dashboard filesystem preview and git diff routes could read files outside the managed root, potentially exposing credentials on locked deployments. The work involves confining file reads to the managed root and widening the credential guard beyond .env files.","subsystem":"dashboard","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":133869,"merged_at":"2026-10-06T15:19:17+00:00"},"resolution":{"state":"resolved","by":"pr-133869"},"freshness":{"state":"verified","last_verified_at":"2026-10-06T15:19:17+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":58724,"pr_number":133869,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-06T15:19:17+00:00"}],"members":[{"kind":"issue","number":58724,"title":"[Bug]: dashboard fs preview and git diff routes read credentials outside the managed root on locked deployments (bypasses #57505)","url":null,"state":"closed"},{"kind":"pr","number":58726,"title":"fix(dashboard): confine fs preview and git diff reads to the managed root","url":null,"state":"closed","close_reason":{"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":125994,"title":"fix(dashboard): apply credential guards to every fs/git file route","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#58724","number":58724}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":133869,"title":"fix(dashboard): confine fs preview and git diff reads to the managed root","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/web_git.py","hermes_cli/web_routers/files.py","hermes_cli/web_routers/git.py","hermes_cli/web_server_files.py","tests/hermes_cli/test_web_read_confinement.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}