{"repo":"NousResearch/hermes-agent","public_id":"69379","display_label":"Gateway secret scoping and env var regression fixes","summary":"These issues and PRs address bugs in gateway/secret scoping logic where environment variables (especially API_SERVER_* and platform env vars) were incorrectly handled, silently dropped, or not falling through to os.environ. A regression in v2026.7.20 broke Docker multiplex deployments by reloading config in the wrong secret scope.","subsystem":"agent/secret_sources","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":76663,"merged_at":"2026-08-02T16:59:53+00:00"},"resolution":{"state":"resolved","by":"pr-76663"},"freshness":{"state":"verified","last_verified_at":"2026-08-02T16:59:53+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":69379,"pr_number":76663,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-08-02T16:59:53+00:00"}],"members":[{"kind":"issue","number":69379,"title":"v2026.7.20 regression for Docker multiplex deployments: load_gateway_config_for_runner reloads config in the default profile's secret scope, silently dropping platform env vars set via container environment — api_server no longer starts","url":null,"state":"closed"},{"kind":"pr","number":69524,"title":"fix(gateway): make _getenv fall through to os.environ when var not in secret scope (#69379)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#76663","number":76663},{"kind":"pr","value":"#69379","number":69379}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":69610,"title":"fix(gateway): treat API_SERVER_* as global env, not profile secrets","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#76663","number":76663},{"kind":"pr","value":"#69379","number":69379}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":76663,"title":"fix(secrets): Weixin Slack-pattern scoping, API_SERVER_* global allowlist, xai_http fail-closed (corrects #66073/#68854/#69524; salvages #56982)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/secret_scope.py","gateway/platforms/weixin.py","tests/agent/test_secret_scope.py","tests/gateway/test_64674_multiplex_primary_token_scope.py","tests/gateway/test_weixin_secret_scope.py","tests/tools/test_xai_http_credentials.py","tools/xai_http.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}