lucas-nicolas

Proton Pass secret source: resolves pass://vault/item/field references (mapped source "protonpass") or every env-var-titled item of one vault (bulk source "protonpass_vault") into environment variables at startup through the user's own pass-cli, beside the built-in Bitwarden and 1Password sources, with a hermes protonpass setup/status/token/set/remove/sync/disable CLI. Stdlib-only, no Python deps. Disclosure — when enabled, runs the user-installed pass-cli (argv only, allowlisted env, 30 s per call), which talks to Proton's API; a personal access token or AI-agent token is read from Hermes' env and passed only to the pass-cli login child's environment (never argv); writes a 0700 session dir under cache/protonpass and a 0600 value cache (cache_ttl_seconds: 0 disables); no self-update, no downloaded binaries, no telemetry, no background process.