{"repo":"NousResearch/hermes-agent","public_id":"74311","display_label":"Auth fallback config bypasses secret scope isolation","summary":"A bug was identified where fallback configuration resolves API keys using raw os.getenv(), bypassing secret_scope profile isolation. These members track the problem and proposed fixes to use secret-scope-aware secret resolution instead.","subsystem":"agent","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":74340,"merged_at":"2026-08-01T05:35:27+00:00"},"resolution":{"state":"resolved","by":"pr-74340"},"freshness":{"state":"verified","last_verified_at":"2026-08-01T05:35:27+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":74311,"pr_number":74340,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-08-01T05:35:27+00:00"}],"members":[{"kind":"issue","number":74311,"title":"auth: fallback config resolves API key via raw os.getenv(), bypassing secret_scope profile isolation","url":null,"state":"closed"},{"kind":"pr","number":74340,"title":"fix(auth): restore secret-scope isolation for fallback API key resolution","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["agent/agent_init.py","agent/auxiliary_client.py","agent/chat_completion_helpers.py","hermes_cli/fallback_config.py","tests/hermes_cli/test_fallback_config.py"]},{"kind":"pr","number":74722,"title":"fix(auth): use secret_scope-aware resolution in fallback config (#74311)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"d52a1c25e0","number":0},{"kind":"pr","value":"#74340","number":74340}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":75050,"title":"fix(auth): use secret-scoped get_secret instead of raw os.getenv in fallback (#74311)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"d52a1c25e0","number":0},{"kind":"pr","value":"#74340","number":74340},{"kind":"pr","value":"#74722","number":74722},{"kind":"pr","value":"#76574","number":76574}],"category":"superseded_by_pr","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}