shoaibyazdani

GitHub profile1 plugin in the catalog

Plugins by shoaibyazdani

1 plugins by shoaibyazdani in the catalog, most-starred first.

shoaibyazdanikeychainKeep Hermes provider credentials in the macOS login keychain instead of plaintext .env. Registers a SecretSource (secrets.keychain), so startup resolution runs through Hermes's own orchestrator, after ~/.hermes/.env loads and before credentials are read — the same path the bundled Bitwarden and 1Password sources use. Bindings are explicit (secrets.keychain.env: ENV_VAR: keychain-account) or discovered from an index the plugin keeps inside the keychain, so `hermes keychain put NAME` is the whole setup. Adds keychain_status (vault-backed vs still-plaintext inventory; names, lengths and outcomes only), keychain_migration_plan (report-only: lists candidates and returns the exact `hermes keychain migrate ...` command; writes nothing) and keychain_audit (fetch/migrate trail), plus a `hermes keychain put|ls|rm|test|migrate|status|audit` CLI. Migration is operator-only in that CLI: it stores each value, verifies it by readback, backs up .env (0600), then removes the variable through hermes_cli.config.remove_env_value() — the `hermes config unset` path, so core's .env lock and its refusals for package-managed installs and admin-managed keys still apply. Disclosure — reads and writes generic-password items in the user's login keychain through /usr/bin/security called by absolute path (service `hermes` by default); no network calls and no third-party service, nothing leaves the machine; the index of stored names lives in a keychain item (`hermes!index`) and the audit log in <hermes home>/plugin-data/keychain/audit.jsonl; the only .env write is the operator-run `hermes keychain migrate` described above; the agent-facing tools write nothing; a locked keychain or denied ACL is a warning, never a startup block; a stored value is passed on argv for the single `security add-generic-password` call (visible to same-user processes for that moment) while reads, the once-per-process hot path, never put a value on argv. macOS-only, no Python dependencies, no env vars.Communitytools