Metadata-Version: 2.4
Name: hermes-passbolt-secret-source
Version: 1.0.14
Summary: Passbolt secret source plugin for Hermes Agent
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Provides-Extra: dev
Requires-Dist: pytest; extra == "dev"

# hermes-passbolt-secret-source

Passbolt secret source plugin for [Hermes Agent](https://github.com/NousResearch/hermes-agent).

Resolves provider API keys from Passbolt at process startup instead of storing
them in plaintext inside `~/.hermes/.env`.

## Install

**Option 1: pip from GitHub (recommended)**

```bash
pip install git+https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
```

**Option 2: pip from local clone**

```bash
git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
pip install -e hermes-passbolt-secret-source/
```

**Option 3: manual plugin**

```bash
cd ~/.hermes/plugins
git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
```

Then enable:

```bash
hermes plugins enable hermes-passbolt-secret-source
```

## Prerequisites

- **Hermes Agent** ≥ v0.18.2 (SecretSource ABC)
- **go-passbolt-cli** installed and authenticated (`passbolt --version`)
- **Passbolt instance** with GPGAuth enabled

## Configuration

Add to `~/.hermes/config.yaml`:

```yaml
secrets:
  sources: [passbolt]
  passbolt:
    enabled: true
    server_url: "https://passbolt.example.com"
    private_key_file: "/home/user/.passbolt/private-key.asc"
    env:
      OPENROUTER_API_KEY: "passbolt://<resource_uuid>"
      ANTHROPIC_API_KEY: "passbolt://<resource_uuid>"
```

Add `PASSBOLT_PASSWORD` (your GPG passphrase) to `~/.hermes/.env`.

## How it works

1. Hermes starts up, loads the plugin via `hermes_agent.plugins` entry point
2. Plugin reads `PASSBOLT_PASSWORD` from environment
3. For each `passbolt://<uuid>` reference, calls `passbolt get resource --id <uuid> -j`
4. Extracts the `password` field from JSON output → sets env var
5. Agent sees resolved secrets in environment, never touches Passbolt directly

## Development

```bash
git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
cd hermes-passbolt-secret-source
uv sync --extra test

# Run tests (requires Hermes checkout):
PYTHONPATH=~/.hermes/hermes-agent uv run pytest tests/
```

## Architecture

| Component | Shape | Auth |
|-----------|-------|------|
| `interface_type: cli` (current) | mapped | GPGAuth via `go-passbolt-cli` |
| `interface_type: rest-api` (planned) | mapped | JWT / Server-to-Server |

See [open issues](https://github.com/AndreasBBS/hermes-passbolt-secret-source/issues)
for planned features: bulk mode, REST API interface, lazy CLI install, integration tests.
