hermes-agent/website/docs/developer-guide
Teknium d3b0e61429
feat(secrets): one-command token rotation + actionable startup errors for all secret sources (#68605)
* feat(secrets): one-command token rotation + actionable startup errors for all secret sources

When a Bitwarden machine-account token expired, users saw a raw Rust
error dump (invalid_client + Location: + backtrace hints) and the only
fix was manually editing .env or re-running the whole setup wizard.

- New `hermes secrets bitwarden token` / `hermes secrets onepassword
  token`: paste a new token (masked prompt or flag), the command probes
  the backend BEFORE persisting — a rejected token changes nothing; a
  good one is written to .env and the fetch caches are cleared.
- New optional SecretSource.remediation(kind, cfg) hook: startup
  warnings now print a '→ Run `hermes secrets <name> token`…' fix-it
  line after any fetch error, for bundled AND plugin sources (generic
  per-ErrorKind defaults in the ABC).
- bws stderr is summarized to its cause line (Location:/backtrace noise
  dropped) and invalid_client/invalid_grant/400 identity rejects are
  now classified AUTH_FAILED (was INTERNAL) with a plain-English
  explanation naming the token env var.
- op whoami probe accepts a candidate token so rotation validates the
  NEW credential, not the ambient one.

Additive hook with defaults — no SECRET_SOURCE_API_VERSION bump.

* docs: fix MDX parse error in secret-source-plugin hook table

Escaped backticks around a <name> placeholder made MDX parse it as an
unclosed JSX tag, breaking the docs-site build.  Use a plain code span
instead.
2026-07-21 06:41:04 -07:00
..
plugins
_category_.json
acp-internals.md
adding-platform-adapters.md
adding-providers.md
adding-tools.md
agent-loop.md
architecture.md
browser-provider-plugin.md
browser-supervisor.md
context-compression-and-caching.md
context-engine-plugin.md
contributing.md
creating-skills.md
cron-internals.md
desktop-plugin-sdk.md
extending-the-cli.md
gateway-internals.md
image-gen-provider-plugin.md
memory-provider-plugin.md
model-provider-plugin.md
plugin-llm-access.md
programmatic-integration.md
prompt-assembly.md
provider-runtime.md
secret-source-plugin.md feat(secrets): one-command token rotation + actionable startup errors for all secret sources (#68605) 2026-07-21 06:41:04 -07:00
session-storage.md
tools-runtime.md
trajectory-format.md
video-gen-provider-plugin.md
web-search-provider-plugin.md
worktree-ui-dev.md