hermes-passbolt-secret-source 1.0.9

Passbolt secret source plugin for Hermes Agent

hermes-passbolt-secret-source

Passbolt secret source plugin for Hermes Agent.

Resolves provider API keys from Passbolt at process startup instead of storing them in plaintext inside ~/.hermes/.env.

Install

Option 1: pip from GitHub (recommended)

pip install git+https://github.com/AndreasBBS/hermes-passbolt-secret-source.git

Option 2: pip from local clone

git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
pip install -e hermes-passbolt-secret-source/

Option 3: manual plugin

cd ~/.hermes/plugins
git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git

Then enable:

hermes plugins enable hermes-passbolt-secret-source

Prerequisites

• Hermes Agent ≥ v0.18.2 (SecretSource ABC)
• go-passbolt-cli installed and authenticated (passbolt --version)
• Passbolt instance with GPGAuth enabled

Configuration

Add to ~/.hermes/config.yaml:

secrets:
  sources: [passbolt]
  passbolt:
    enabled: true
    server_url: "https://passbolt.example.com"
    private_key_file: "/home/user/.passbolt/private-key.asc"
    env:
      OPENROUTER_API_KEY: "passbolt://<resource_uuid>"
      ANTHROPIC_API_KEY: "passbolt://<resource_uuid>"

Add PASSBOLT_PASSWORD (your GPG passphrase) to ~/.hermes/.env.

How it works

1. Hermes starts up, loads the plugin via hermes_agent.plugins entry point
2. Plugin reads PASSBOLT_PASSWORD from environment
3. For each passbolt://<uuid> reference, calls passbolt get resource --id <uuid> -j
4. Extracts the password field from JSON output → sets env var
5. Agent sees resolved secrets in environment, never touches Passbolt directly

Development

git clone https://github.com/AndreasBBS/hermes-passbolt-secret-source.git
cd hermes-passbolt-secret-source
uv sync --extra test

# Run tests (requires Hermes checkout):
PYTHONPATH=~/.hermes/hermes-agent uv run pytest tests/

Architecture

Component	Shape	Auth
interface_type: cli (current)	mapped	GPGAuth via go-passbolt-cli
interface_type: rest-api (planned)	mapped	JWT / Server-to-Server

See open issues for planned features: bulk mode, REST API interface, lazy CLI install, integration tests.