From 750ef49c07727f76fc60c67ece6c35f50b02e9ad Mon Sep 17 00:00:00 2001
From: Baophan00 <109447498+Baophan00@users.noreply.github.com>
Date: Fri, 31 Jul 2026 22:43:38 +0700
Subject: [PATCH] fix(config): route _SECRET-suffixed keys to .env

_is_env_config_key() already routes _API_KEY and _TOKEN suffixed
keys to .env for safe credential storage. Add _SECRET to the suffix
list so keys like CLIENT_SECRET and ENCRYPTION_SECRET are stored
in .env (excluded from git by default) rather than config.yaml.
---
 hermes_cli/config.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hermes_cli/config.py b/hermes_cli/config.py
index 34ad8ce02718e..14c64481ff2b4 100644
--- a/hermes_cli/config.py
+++ b/hermes_cli/config.py
@@ -1159,7 +1159,7 @@ def _is_env_config_key(key: str) -> bool:
     ]
     return (
         key_upper in api_keys
-        or key_upper.endswith(('_API_KEY', '_TOKEN'))
+        or key_upper.endswith(('_API_KEY', '_TOKEN', '_SECRET'))
         or key_upper.startswith('TERMINAL_SSH')
     )