[Bug] BWS override_existing: true silently overwrites profile-specific secrets (e.g., FEISHU_APP_SECRET) across all profiles

[wyl1988]

Bug Description

When bws.override_existing: true is configured, BWS (Bitwarden Secrets Manager) injection overwrites all .env variables with the same key name across all profiles — even when different profiles need different values.

In a multi-profile deployment where each profile has its own Feishu bot (different FEISHU_APP_ID + FEISHU_APP_SECRET), BWS has a single FEISHU_APP_SECRET entry. With override_existing: true, this single value overwrites every profile's .env, causing all profiles to use the same Feishu app secret — which mismatches their different app IDs.

Impact

• Feishu authentication fails silently (app_id or app_secret is invalid)
• Gateway enters restart loop (WSS connection rejected)
• Multiple Feishu bots go offline simultaneously
• Diagnosis is difficult because .env files contain the correct values on disk — the override happens in-memory at startup

In our deployment: 18 business agents each have their own Feishu bot. BWS override silently replaced all 18 different FEISHU_APP_SECRET values with a single value from BWS, breaking all Feishu connections.

Steps to Reproduce

1. Create 2+ profiles, each with different FEISHU_APP_ID and FEISHU_APP_SECRET in their .env
2. Configure BWS with override_existing: true and a single FEISHU_APP_SECRET secret
3. Restart gateways
4. Observe Feishu authentication failures for all profiles except the one whose secret matches BWS

Expected Behavior

BWS override should be aware of profile boundaries. Options:

1. Support per-profile BWS secrets (e.g., FEISHU_APP_SECRET__commander)
2. Or provide an exclusion list (keys that should not be overridden)
3. Or warn at startup when override would change a value that differs from BWS

Workaround Applied

Removed FEISHU_APP_SECRET from BWS and let each profile use its own .env value. But this means the secret is stored in plaintext .env files instead of BWS.

Environment

• Hermes Agent: 0.18.0
• 20 profiles (18 business agents + commander + ops_expert), each with its own Feishu bot
• BWS project: 88d65e47
• bws.override_existing: true