Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security] Secure Hardcoded API Tokens in ~/.hermes Using Secrets Management #1420

New Issue
Closed
opened 2026-03-24 13:04:36 +00:00 by Timmy · 1 comment
Timmy commented 2026-03-24 13:04:36 +00:00
Owner
Copy Link

Context: API credentials rely on open ~/.hermes/claude_token plaintexts.

Acceptance Criteria:

  • Encrypt loop keys at rest using an environment vault like SOPS or directly wrap via environment injections managed by the Docker infrastructure.
**Context:** API credentials rely on open `~/.hermes/claude_token` plaintexts. **Acceptance Criteria:** - Encrypt loop keys at rest using an environment vault like SOPS or directly wrap via environment injections managed by the Docker infrastructure.
Timmy commented 2026-03-24 14:45:43 +00:00
Author
Owner
Copy Link

Implementation Plan for Secure Token Management

Priority: HIGH - Security vulnerability (plaintext credential storage)

Files to Create/Modify:

  1. src/infrastructure/security/token_manager.py - Centralized token management
  2. src/infrastructure/security/secrets_store.py - Encrypted storage wrapper
  3. scripts/migrate-tokens.sh - Migration script for existing tokens
  4. Update multiple files that currently read tokens directly

Implementation Steps:

  1. Create Token Manager (src/infrastructure/security/token_manager.py):

    class TokenManager:
    def get_token(self, service: str) -> str
    def store_token(self, service: str, token: str) -> None
    def rotate_token(self, service: str, new_token: str) -> None
    def is_token_valid(self, service: str) -> bool

  2. Create Secrets Store (src/infrastructure/security/secrets_store.py):

    • Use cryptography library for AES encryption
    • Store encrypted tokens with MAC for integrity
    • Use system keychain integration where available (macOS Keychain, Linux Secret Service)
    • Fallback to encrypted file storage with master key

  3. Migration Script (scripts/migrate-tokens.sh):

    • Detect existing plaintext tokens in ~/.hermes/
    • Migrate to encrypted storage
    • Secure cleanup of plaintext files
    • Backup existing tokens before migration

  4. Update Token Consumers:

    • Replace direct file reads with TokenManager.get_token()
    • Update: hermes-claim, agent loops, API clients
    • Add fallback error handling for missing/invalid tokens

Key Security Requirements:

  • AES-256-GCM encryption for token storage
  • Secure key derivation (PBKDF2 with salt)
  • MAC validation to prevent tampering
  • Proper file permissions (600 for encrypted files)
  • Memory-safe token handling (clear sensitive data)
  • Audit logging for token access

Files Likely Needing Updates:

  • scripts/hermes-claim
  • scripts/*-loop.sh
  • Any Python modules reading from ~/.hermes/*_token

Testing Requirements:

  • Test encryption/decryption roundtrip
  • Test migration from plaintext
  • Test permission scenarios
  • Test corrupted file handling
  • Verify no plaintext tokens remain after migration

Acceptance Criteria Met When:

  • All tokens stored encrypted at rest
  • Centralized token management system
  • Successful migration from current plaintext storage
  • No regression in agent functionality
  • Comprehensive audit logging
  • Documentation updated with security model

This eliminates a critical security vulnerability where API tokens are stored as plaintext files.

## Implementation Plan for Secure Token Management **Priority**: HIGH - Security vulnerability (plaintext credential storage) **Files to Create/Modify**: 1. `src/infrastructure/security/token_manager.py` - Centralized token management 2. `src/infrastructure/security/secrets_store.py` - Encrypted storage wrapper 3. `scripts/migrate-tokens.sh` - Migration script for existing tokens 4. Update multiple files that currently read tokens directly **Implementation Steps**: 1. **Create Token Manager** (`src/infrastructure/security/token_manager.py`): ```python class TokenManager: def get_token(self, service: str) -> str def store_token(self, service: str, token: str) -> None def rotate_token(self, service: str, new_token: str) -> None def is_token_valid(self, service: str) -> bool ``` 2. **Create Secrets Store** (`src/infrastructure/security/secrets_store.py`): - Use `cryptography` library for AES encryption - Store encrypted tokens with MAC for integrity - Use system keychain integration where available (macOS Keychain, Linux Secret Service) - Fallback to encrypted file storage with master key 3. **Migration Script** (`scripts/migrate-tokens.sh`): - Detect existing plaintext tokens in `~/.hermes/` - Migrate to encrypted storage - Secure cleanup of plaintext files - Backup existing tokens before migration 4. **Update Token Consumers**: - Replace direct file reads with `TokenManager.get_token()` - Update: `hermes-claim`, agent loops, API clients - Add fallback error handling for missing/invalid tokens **Key Security Requirements**: - AES-256-GCM encryption for token storage - Secure key derivation (PBKDF2 with salt) - MAC validation to prevent tampering - Proper file permissions (600 for encrypted files) - Memory-safe token handling (clear sensitive data) - Audit logging for token access **Files Likely Needing Updates**: - `scripts/hermes-claim` - `scripts/*-loop.sh` - Any Python modules reading from `~/.hermes/*_token` **Testing Requirements**: - Test encryption/decryption roundtrip - Test migration from plaintext - Test permission scenarios - Test corrupted file handling - Verify no plaintext tokens remain after migration **Acceptance Criteria Met When**: - All tokens stored encrypted at rest - Centralized token management system - Successful migration from current plaintext storage - No regression in agent functionality - Comprehensive audit logging - Documentation updated with security model This eliminates a critical security vulnerability where API tokens are stored as plaintext files.
kimi was assigned by Timmy 2026-03-24 14:45:44 +00:00
kimi was unassigned by Timmy 2026-03-24 19:32:17 +00:00
Timmy closed this issue 2026-03-24 21:54:07 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok kimi manus perplexity Rockachopa
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#1420
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?