mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-05-13 03:52:00 +00:00
31224b9b5c
Extends the Windows-gating work to the optional-skills/ tree. Every
SKILL.md that previously omitted the platforms: field now carries an
explicit declaration, which Hermes's loader (agent.skill_utils.
skill_matches_platform) honors to skip-load on incompatible OSes.
58 skills declared cross-platform (platforms: [linux, macos, windows]):
autonomous-ai-agents/blackbox, autonomous-ai-agents/honcho
blockchain/base, blockchain/solana
communication/one-three-one-rule
creative/blender-mcp, creative/concept-diagrams, creative/hyperframes,
creative/kanban-video-orchestrator, creative/meme-generation
devops/cli (inference-sh-cli), devops/docker-management
dogfood/adversarial-ux-test
email/agentmail
finance/3-statement-model, finance/comps-analysis, finance/dcf-model,
finance/excel-author, finance/lbo-model, finance/merger-model,
finance/pptx-author
health/fitness-nutrition, health/neuroskill-bci
mcp/fastmcp, mcp/mcporter
migration/openclaw-migration
mlops/accelerate, mlops/chroma, mlops/clip, mlops/guidance,
mlops/hermes-atropos-environments, mlops/huggingface-tokenizers,
mlops/instructor, mlops/lambda-labs, mlops/llava, mlops/modal,
mlops/peft, mlops/pinecone, mlops/pytorch-lightning, mlops/qdrant,
mlops/saelens, mlops/simpo, mlops/stable-diffusion
productivity/canvas, productivity/shop-app, productivity/shopify,
productivity/siyuan, productivity/telephony
research/domain-intel, research/drug-discovery, research/duckduckgo-search,
research/gitnexus-explorer, research/parallel-cli, research/scrapling
security/1password, security/oss-forensics, security/sherlock
web-development/page-agent
5 skills gated from Windows (platforms: [linux, macos]):
mlops/flash-attention - Flash Attention wheels are Linux-first; Windows
install requires building from source with CUDA
mlops/faiss - faiss-gpu has no Windows wheel; gate rather than
leak partial (faiss-cpu) support
mlops/nemo-curator - NVIDIA NeMo ecosystem has no first-class Windows path
mlops/slime - Megatron+SGLang RL stack is Linux-only in practice
mlops/whisper - openai-whisper + ffmpeg setup on Windows is
non-trivial; gate until Windows install stanza lands
Methodology: scanned every SKILL.md for Windows-hostile signals
(apt-get, brew, systemd, osascript, ptrace, X11 binaries, POSIX-only
Python APIs, Docker POSIX $(pwd) bind-mounts, explicit 'linux-only' /
'macos-only' text). 3 skills flagged as having hard signals on review:
docker-management and qdrant only had POSIX $(pwd) docker examples and
the tools themselves (Docker Desktop, Qdrant) run fine on Windows —
declared ALL. whisper had an apt/brew ffmpeg install path and nothing
else but the openai-whisper Windows install story is rough enough to
warrant gating.
Strict-over-lenient policy: when in doubt, gate. Easier to un-gate after
verified Windows support lands than to leak partial support that
manifests as mid-task failures for Windows users.
163 lines
4.6 KiB
Markdown
163 lines
4.6 KiB
Markdown
---
|
|
name: 1password
|
|
description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.
|
|
version: 1.0.0
|
|
author: arceus77-7, enhanced by Hermes Agent
|
|
license: MIT
|
|
platforms: [linux, macos, windows]
|
|
metadata:
|
|
hermes:
|
|
tags: [security, secrets, 1password, op, cli]
|
|
category: security
|
|
setup:
|
|
help: "Create a service account at https://my.1password.com → Settings → Service Accounts"
|
|
collect_secrets:
|
|
- env_var: OP_SERVICE_ACCOUNT_TOKEN
|
|
prompt: "1Password Service Account Token"
|
|
provider_url: "https://developer.1password.com/docs/service-accounts/"
|
|
secret: true
|
|
---
|
|
|
|
# 1Password CLI
|
|
|
|
Use this skill when the user wants secrets managed through 1Password instead of plaintext env vars or files.
|
|
|
|
## Requirements
|
|
|
|
- 1Password account
|
|
- 1Password CLI (`op`) installed
|
|
- One of: desktop app integration, service account token (`OP_SERVICE_ACCOUNT_TOKEN`), or Connect server
|
|
- `tmux` available for stable authenticated sessions during Hermes terminal calls (desktop app flow only)
|
|
|
|
## When to Use
|
|
|
|
- Install or configure 1Password CLI
|
|
- Sign in with `op signin`
|
|
- Read secret references like `op://Vault/Item/field`
|
|
- Inject secrets into config/templates using `op inject`
|
|
- Run commands with secret env vars via `op run`
|
|
|
|
## Authentication Methods
|
|
|
|
### Service Account (recommended for Hermes)
|
|
|
|
Set `OP_SERVICE_ACCOUNT_TOKEN` in `~/.hermes/.env` (the skill will prompt for this on first load).
|
|
No desktop app needed. Supports `op read`, `op inject`, `op run`.
|
|
|
|
```bash
|
|
export OP_SERVICE_ACCOUNT_TOKEN="your-token-here"
|
|
op whoami # verify — should show Type: SERVICE_ACCOUNT
|
|
```
|
|
|
|
### Desktop App Integration (interactive)
|
|
|
|
1. Enable in 1Password desktop app: Settings → Developer → Integrate with 1Password CLI
|
|
2. Ensure app is unlocked
|
|
3. Run `op signin` and approve the biometric prompt
|
|
|
|
### Connect Server (self-hosted)
|
|
|
|
```bash
|
|
export OP_CONNECT_HOST="http://localhost:8080"
|
|
export OP_CONNECT_TOKEN="your-connect-token"
|
|
```
|
|
|
|
## Setup
|
|
|
|
1. Install CLI:
|
|
|
|
```bash
|
|
# macOS
|
|
brew install 1password-cli
|
|
|
|
# Linux (official package/install docs)
|
|
# See references/get-started.md for distro-specific links.
|
|
|
|
# Windows (winget)
|
|
winget install AgileBits.1Password.CLI
|
|
```
|
|
|
|
2. Verify:
|
|
|
|
```bash
|
|
op --version
|
|
```
|
|
|
|
3. Choose an auth method above and configure it.
|
|
|
|
## Hermes Execution Pattern (desktop app flow)
|
|
|
|
Hermes terminal commands are non-interactive by default and can lose auth context between calls.
|
|
For reliable `op` use with desktop app integration, run sign-in and secret operations inside a dedicated tmux session.
|
|
|
|
Note: This is NOT needed when using `OP_SERVICE_ACCOUNT_TOKEN` — the token persists across terminal calls automatically.
|
|
|
|
```bash
|
|
SOCKET_DIR="${TMPDIR:-/tmp}/hermes-tmux-sockets"
|
|
mkdir -p "$SOCKET_DIR"
|
|
SOCKET="$SOCKET_DIR/hermes-op.sock"
|
|
SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"
|
|
|
|
tmux -S "$SOCKET" new -d -s "$SESSION" -n shell
|
|
|
|
# Sign in (approve in desktop app when prompted)
|
|
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "eval \"\$(op signin --account my.1password.com)\"" Enter
|
|
|
|
# Verify auth
|
|
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter
|
|
|
|
# Example read
|
|
tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op read 'op://Private/Npmjs/one-time password?attribute=otp'" Enter
|
|
|
|
# Capture output when needed
|
|
tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200
|
|
|
|
# Cleanup
|
|
tmux -S "$SOCKET" kill-session -t "$SESSION"
|
|
```
|
|
|
|
## Common Operations
|
|
|
|
### Read a secret
|
|
|
|
```bash
|
|
op read "op://app-prod/db/password"
|
|
```
|
|
|
|
### Get OTP
|
|
|
|
```bash
|
|
op read "op://app-prod/npm/one-time password?attribute=otp"
|
|
```
|
|
|
|
### Inject into template
|
|
|
|
```bash
|
|
echo "db_password: {{ op://app-prod/db/password }}" | op inject
|
|
```
|
|
|
|
### Run a command with secret env var
|
|
|
|
```bash
|
|
export DB_PASSWORD="op://app-prod/db/password"
|
|
op run -- sh -c '[ -n "$DB_PASSWORD" ] && echo "DB_PASSWORD is set" || echo "DB_PASSWORD missing"'
|
|
```
|
|
|
|
## Guardrails
|
|
|
|
- Never print raw secrets back to user unless they explicitly request the value.
|
|
- Prefer `op run` / `op inject` instead of writing secrets into files.
|
|
- If command fails with "account is not signed in", run `op signin` again in the same tmux session.
|
|
- If desktop app integration is unavailable (headless/CI), use service account token flow.
|
|
|
|
## CI / Headless note
|
|
|
|
For non-interactive use, authenticate with `OP_SERVICE_ACCOUNT_TOKEN` and avoid interactive `op signin`.
|
|
Service accounts require CLI v2.18.0+.
|
|
|
|
## References
|
|
|
|
- `references/get-started.md`
|
|
- `references/cli-examples.md`
|
|
- https://developer.1password.com/docs/cli/
|
|
- https://developer.1password.com/docs/service-accounts/
|