Skip to content

fix(gateway): scope default-profile adapter construction under multiplex#71108

Open
xrwang8 wants to merge 1 commit into
NousResearch:mainfrom
xrwang8:fix/weixin-default-profile-secret-scope
Open

fix(gateway): scope default-profile adapter construction under multiplex#71108
xrwang8 wants to merge 1 commit into
NousResearch:mainfrom
xrwang8:fix/weixin-default-profile-secret-scope

Conversation

@xrwang8

@xrwang8 xrwang8 commented Jul 25, 2026

Copy link
Copy Markdown

Summary

Fixes #70652 - Weixin default-profile adapter reads secrets unscoped

Changes

  • Wrap default-profile adapter creation in gateway/run.py with _profile_runtime_scope
  • Match the secondary-profile path for consistent secret scoping
  • Add test for default profile adapter secret scope

Testing

  • ✅ Added test_default_profile_adapter_secret_scope.py
  • ✅ Test validates secret scoping behavior
  • ✅ Test suite passed

Related

Fixes #70652

Default/primary-profile adapters were built via a bare _create_adapter
call with no _profile_runtime_scope. Under gateway.multiplex_profiles,
get_secret fails closed on an unscoped read, so any adapter resolving an
optional secret in its constructor (e.g. Weixin's WEIXIN_CDN_BASE_URL)
aborted gateway startup with UnscopedSecretError before opening a network
connection.

Route the two default-profile construction sites (GatewayRunner.start and
the platform reconnect watcher) through a _create_default_profile_adapter
helper that enters the default profile's runtime scope when multiplexing
is on, mirroring the secondary-profile path. When multiplexing is off it
calls _create_adapter directly, leaving legacy os.environ resolution
unchanged.

Fixes NousResearch#70652

Signed-off-by: xrwang8 <xrwang8@gmail.com>
@alt-glitch alt-glitch added type/bug Something isn't working comp/gateway Gateway runner, session dispatch, delivery platform/wecom WeCom / WeChat Work adapter area/auth Authentication, OAuth, credential pools P2 Medium — degraded but workaround exists sweeper:risk-message-delivery Sweeper risk: may drop, duplicate, misroute, or suppress messages sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades labels Jul 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/auth Authentication, OAuth, credential pools comp/gateway Gateway runner, session dispatch, delivery P2 Medium — degraded but workaround exists platform/wecom WeCom / WeChat Work adapter sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:risk-message-delivery Sweeper risk: may drop, duplicate, misroute, or suppress messages sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(gateway): primary Weixin adapter startup lacks multiplex secret scope

2 participants