mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-05-29 06:31:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

fix: avoid persisting borrowed credential secrets (#31416)

Browse source
This commit is contained in:
Hasan Ali 2026-05-25 03:32:08 -04:00 • committed by GitHub
parent 2b768535c9
commit d7c5d5dee5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 590 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hermes_cli/env_loader.py
View file

@ -36,7 +36,9 @@ def get_secret_source(env_var: str) -> str | None:
Returns ``"bitwarden"`` for keys pulled from Bitwarden Secrets Manager
during the current process's ``load_hermes_dotenv()`` call. Returns
``None`` for keys that came from ``.env``, the shell environment, or
aren't tracked.
aren't tracked. The returned label is metadata only: credential-pool
persistence may store it to explain the origin of a borrowed secret, but
must never treat it as authorization to persist the raw value.
"""
return _SECRET_SOURCES.get(env_var)