Shannon Sands
8fd434037e
Phase 1 of the wallet architecture — a general-purpose encrypted secret store that replaces plaintext .env for sensitive values. Core components: - keystore/store.py: Encrypted SQLite store (Argon2id KDF + XChaCha20-Poly1305 AEAD) - keystore/credential_store.py: Cross-platform passphrase caching (macOS Keychain, Windows Credential Locker, Linux kernel keyctl, encrypted file fallback — runtime detection, no hard OS dependency) - keystore/client.py: High-level API with unlock flow, env injection, migration - keystore/categories.py: Secret access categories (injectable/gated/sealed/user_only) - keystore/cli.py: Full CLI (hermes keystore init/list/set/show/delete/migrate/remember/forget/audit) Integration: - hermes_cli/main.py: Auto-inject keystore secrets before CLI startup - pyproject.toml: keystore/wallet/wallet-solana optional dependency groups - AGENTS.md: Updated project structure docs Security model: - Master key derived from passphrase via Argon2id (64MB memory-hard) - Per-secret encryption with XChaCha20-Poly1305 (random nonce per write) - Category-based access control (sealed secrets never exposed to agent) - Full access audit log - Backward compatible — graceful fallback to .env when keystore not initialized Tests: 72 passing (store, client, credential_store, categories)
16 lines
742 B
Python
16 lines
742 B
Python
"""hermes-keystore — encrypted secret store for Hermes Agent.
|
|
|
|
Provides an encrypted SQLite-backed secret store with per-secret
|
|
AEAD encryption (XChaCha20-Poly1305), a master key derived from
|
|
a user passphrase via Argon2id, cross-platform credential caching,
|
|
and secret categorisation (injectable / gated / sealed / user_only).
|
|
|
|
Architecture:
|
|
keystore/store.py — core encrypted store
|
|
keystore/credential_store.py — cross-platform passphrase caching
|
|
keystore/client.py — high-level API (unlock, inject, get)
|
|
keystore/categories.py — secret category definitions
|
|
keystore/migrations.py — DB schema migrations
|
|
keystore/cli.py — `hermes keystore` subcommands
|
|
"""
|