fix(irc): scope server/port/nickname/channel/use_tls reads to the active profile under multiplexing

[nftpoetrist]

Summary

• IRCAdapter.__init__, check_requirements, validate_config, is_connected, _env_enablement, and _standalone_send all read IRC_SERVER/IRC_PORT/IRC_NICKNAME/IRC_CHANNEL/IRC_USE_TLS via raw os.getenv() — only IRC_SERVER_PASSWORD/IRC_NICKSERV_PASSWORD were already routed through the module's _get_scoped_secret() helper.
• Under gateway.multiplex_profiles, env_enablement_fn/check_fn/is_connected all run inside the same registry-enablement loop in load_gateway_config() (gateway/config.py, ~lines 2704-2820) which runs inside _profile_runtime_scope for secondary profiles, and adapter construction runs scoped the same way — so os.environ there still holds the DEFAULT profile's env-bridge output.
• Notably a stronger variant than the sibling fixes in this series: __init__'s original os.getenv("IRC_SERVER") or extra.get(...) ordering let a raw env read override even an explicitly configured config.yaml extra. A secondary profile that set its own server/channel via extra would still silently connect to the default profile's IRC server/channel/nick, because the default profile's config is always bridged to os.environ under multiplex and env was checked first. (The LINE/DingTalk/Teams/SMS/WeCom/ntfy fixes in this series didn't have this extra layer of severity — those used extra.get(...) or os.getenv(...), so extra already won.)

Fix

Switch every raw IRC_* read (except the two secret-material fields already scoped) to the module's existing _get_scoped_secret() helper — same fallback semantics as the rest of the series (scoped miss returns the default, never cross-profile-borrows os.environ; the DEFAULT profile's own unscoped construction still falls back to os.environ). Also collapses a double os.getenv("IRC_USE_TLS") call in __init__ into a single _get_scoped_secret() lookup (identical behavior, one scope read instead of two).

Tests

Added TestMultiplexProfileScope (6 tests) to tests/gateway/test_irc_adapter.py, mirroring the fixture/assertion style already established in tests/gateway/test_line_plugin.py's class of the same name.

Mutation-verified: stashed the production fix and confirmed 5 of 6 new tests fail against pre-fix code — including the "extra wins" test, since IRC's original env-first ordering meant even an explicit extra config wasn't a safe boundary before the fix. The 1 passing test (test_default_profile_unscoped_keeps_env_precedence) is a non-differentiating regression guard that correctly passes either way. Restored the fix; all 23 tests in the file pass, plus the file's 5 parametrized _get_scoped_secret tests in tests/gateway/test_adapter_startup_secret_scope.py.

Competitor check

Searched IRC_SERVER, irc multiplex, irc scope. Three open PRs touch plugins/platforms/irc/adapter.py:

• fix: scoped-lock guard dead code in buzz/irc/line adapters (tuple truthiness) #74978 ("scoped-lock guard dead code... tuple truthiness") — touches connect()'s lock-acquisition logic only, no overlap with the env-read lines here.
• fix(irc): close 7 long-running-adapter gaps (lock, auth/join escalation, send confirmation, channel routing, edit support) #35643 ("close 7 long-running-adapter gaps") — adds new fields/properties immediately after __init__'s existing body ends, no overlap with the env-read lines this PR changes.
• feat(irc): IRCv3 capability negotiation, message tags, reactions & typing notifications #46130 ("IRCv3 capability negotiation...") — a large, visibly stale feature PR (its diff still shows the pre-fix(secrets): Slack-pattern scoped reads for 13 platform adapters + api_server init (class closure, adapter tier) #76664 unscoped IRC_SERVER_PASSWORD/IRC_NICKSERV_PASSWORD reads as unchanged context, so it needs a rebase against main regardless of this PR). It touches the same 3-line use_tls expression in both __init__ and _standalone_send, but only the extra.get("use_tls", True) → _coerce_bool(extra.get("use_tls"), True) half — a different sub-concern (YAML string coercion) from the os.getenv(...) → _get_scoped_secret(...) half this PR changes. Pure textual adjacency, trivially reconcilable on rebase; flagging transparently rather than dropping the use_tls scoping from scope.

No open or merged PR touches the actual scope-leak fixed here.

Checklist

• Read current adapter code directly (not from a stale scan summary)
• Minimal, precedent-matching fix (reuses existing _get_scoped_secret helper)
• New regression tests, mutation-verified against the pre-fix code
• Full existing IRC test suite passes
• Fresh competitor PR search immediately before opening this PR

[Enough1122]

AI code review — automated review for reference; please use your judgment.

Consistent scope-aware fix for the IRC adapter: all IRC_* reads now route through _get_scoped_secret, closing the multiplex leak where a secondary profile would connect to the default profile's server/channel (and inherit its cron home_channel). Unscoped behavior is unchanged.

• Good refactor: IRC_USE_TLS is read once into _use_tls_raw (adapter.py:139) instead of calling os.getenv twice, avoiding a subtle split where the two calls could differ.
• In __init__, the TLS ternary is guarded by truthiness (adapter.py:141), so None/empty falls through to extra — correct.
• check_requirements reads scoped env only (no config path), which matches its pre-existing semantics; just confirm the requirements-check callers run unscoped or accept the fail-closed result for scoped profiles.
• _env_enablement correctly returns None when a scoped profile lacks its own server/channel, preventing auto-enable from the default profile's env.
• Tests cover extra-wins, fail-closed defaults (port 6697, nickname hermes-bot, tls True), and unscoped precedence.

[teknium1]

Thanks @nftpoetrist — Merged via #101252 (2e25b47) on current main.

Your commits from this PR were cherry-picked onto the salvage branch with your git authorship preserved, so the credit is yours in git log.

Closing this PR since the work is now on main.