mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-15 14:22:43 +00:00
2d16ec7fb7
Introduces a first-class secret-source contract so password managers (Bitwarden today, 1Password next, third-party vaults as plugins) plug into one orchestrated startup path instead of each hardcoding into env_loader. - agent/secret_sources/base.py: SecretSource ABC (fetch-only contract: never raises, never prompts, sync with orchestrator-enforced timeout), shared ErrorKind taxonomy, FetchResult, run_secret_cli() minimal-env subprocess helper, API versioning for plugin compatibility. - agent/secret_sources/registry.py: registration gating (name/scheme uniqueness, api_version, shape), apply_all() orchestrator owning precedence (mapped-beats-bulk, first-claim-wins, override_existing never crosses sources, protected bootstrap tokens), conflict warnings, per-var provenance, per-source wall-clock timeout. - Bitwarden converted to a registered BitwardenSource (bulk shape); behavior unchanged, apply_bitwarden_secrets kept as legacy shim. - env_loader._apply_external_secret_sources now drives the orchestrator; provenance labels resolve through registry (e.g. '(from 1Password)'). - PluginContext.register_secret_source() for external backends. - secrets.sources optional ordering key in DEFAULT_CONFIG + example. - tests/secret_sources/: 47 new tests incl. reusable conformance kit (SecretSourceConformance) that plugin authors run against their source.
37 lines
1.4 KiB
Python
37 lines
1.4 KiB
Python
"""External secret source integrations.
|
|
|
|
A secret source is anything that can supply environment-variable-shaped
|
|
credentials at process startup, _after_ ~/.hermes/.env has loaded.
|
|
|
|
The contract every source implements is
|
|
:class:`agent.secret_sources.base.SecretSource`; the orchestrator that
|
|
runs the enabled sources (ordering, mapped-beats-bulk precedence,
|
|
first-claim-wins conflicts, ``override_existing`` semantics, provenance)
|
|
is :func:`agent.secret_sources.registry.apply_all`. Multiple sources
|
|
can be enabled at once — see the registry module docstring for the
|
|
precedence ladder.
|
|
|
|
Currently bundled:
|
|
|
|
- ``bitwarden`` — Bitwarden Secrets Manager (`bws` CLI). See
|
|
``agent.secret_sources.bitwarden`` for the integration and
|
|
``hermes_cli.secrets_cli`` for the user-facing setup wizard.
|
|
|
|
The bundled set is deliberately closed (policy mirrors memory
|
|
providers): new third-party secret managers ship as standalone plugin
|
|
repos that subclass ``SecretSource`` and register through
|
|
``PluginContext.register_secret_source()`` — they are NOT added to this
|
|
package. Exceptions (planned): 1Password, and possibly a generic
|
|
``command`` source; OS keystores (Keychain/DPAPI/libsecret) are under
|
|
discussion.
|
|
"""
|
|
|
|
from agent.secret_sources.base import ( # noqa: F401
|
|
SECRET_SOURCE_API_VERSION,
|
|
ErrorKind,
|
|
FetchResult,
|
|
SecretSource,
|
|
is_valid_env_name,
|
|
run_secret_cli,
|
|
scrub_ansi,
|
|
)
|