Files

kshitijk4poor ee942a7bbf fix(terminal-env): adapter secrets are the declared ones, not any platform-named variable

The shape rule (a platform prefix plus _TOKEN/_SECRET/_PASSWORD/_KEY) also
matched variables Hermes never reads: the platform list holds plain words
(LOCAL, GATEWAY, WEBHOOK, SLACK), so a user's SLACK_USER_TOKEN,
LOCAL_LLM_API_KEY or GATEWAY_API_KEY vanished from the terminal and
terminal.env_passthrough could not bring them back. The prefix census it
leaned on also failed open (an unreadable plugins dir cached an empty set).

Adapter secrets now come from what adapters declare: password entries of
the messaging OPTIONAL_ENV_VARS (built-ins plus every platform plugin
manifest) and secret-named keys of the gateway env-override table, both
Tier 1 and refused by passthrough; plus the secret-named required_env of
adapters registered in the current profile scope, read per spawn without
loading deferred adapters, Tier 2 only because required_env is an
unchecked setup list. Secrets nothing declared get a manifest entry
(TELEGRAM_WEBHOOK_SECRET, PHOTON_SIDECAR_TOKEN, A2A_PUSH_SECRET,
TEAMS_GRAPH_ACCESS_TOKEN, TEAMS_INCOMING_WEBHOOK_URL) or join the
policy's read-in-code list (QQ_STT_API_KEY, the two MSGRAPH names).

2026-09-29 02:06:58 +05:30

__init__.py

fix(a2a): scope the client-tools A2A_PORT gate and prove A→B→A under multiplex (#122126 , salvage #122128 )

2026-09-28 05:24:26 -07:00

adapter.py

fix(a2a): recover the streamed reply text instead of resolving empty

2026-09-20 18:45:42 -07:00

DESIGN.md

…

plugin.yaml

fix(terminal-env): adapter secrets are the declared ones, not any platform-named variable

2026-09-29 02:06:58 +05:30

protocol.py

Old pre-decomposition import paths are gone: plugin compat layer removed on schedule (#126164 )

2026-09-28 10:21:41 -07:00

README.md

docs(a2a): say the orphan sweep follows A2A_REPLY_TIMEOUT and live waiters

2026-09-13 14:43:35 -07:00

security.py

Old pre-decomposition import paths are gone: plugin compat layer removed on schedule (#126164 )

2026-09-28 10:21:41 -07:00

tools.py

Old pre-decomposition import paths are gone: plugin compat layer removed on schedule (#126164 )

2026-09-28 10:21:41 -07:00

README.md

A2A — Agent-to-Agent protocol for Hermes

Talk to other agents, and let other agents talk to you, over the open A2A protocol v1.0. Works with any A2A-compliant peer (another Hermes, LangChain, CrewAI, Google ADK, OpenClaw, …). Stdlib only — no a2a-sdk dependency.

Enable

hermes gateway setup      # pick A2A, or:

# ~/.hermes/config.yaml
gateway:
  platforms:
    a2a:
      enabled: true
      extra:
        port: 9900

# peers you want to call (outbound):
a2a_agents:
  researcher:
    url: "http://localhost:9999"
    auth: { type: bearer, token: "sk-..." }
    timeout: 120
    capabilities: [web_search, research]

Outbound — call other agents

The agent gets five tools:

a2a_discover(url) — what can this agent do?
a2a_call(agent, message, context_id?) — send it a task, get the reply.
a2a_list() — configured peers, saved conversations, metrics.
a2a_history(context_id) — recall a saved A2A conversation.
a2a_orchestrate(capability, message, mode?) — fan-out a task to every peer advertising a capability (all / first / best).

Inbound — be callable

When the a2a platform is enabled, Hermes serves a v1.0 Agent Card at http://<host>:<port>/.well-known/agent-card.json (the legacy /.well-known/agent.json path is also answered for pre-1.0 clients) and accepts JSON-RPC message/send, message/stream (SSE), tasks/get|list|cancel|subscribe, and push notification configs (inline or via tasks/pushNotificationConfig/create). Incoming tasks are injected into your live agent session — the same agent that's talking to you, with full memory — and the reply is returned over A2A. Completed tasks stay queryable via tasks/get.

Security

No token ⇒ localhost only. The server binds 127.0.0.1 and refuses to widen unless you configure a token and set A2A_HOST.
Per-peer tokens: A2A_PEER_TOKENS="alice:tok1,bob:tok2" gives each remote agent its own credential; that authenticated name (never anything in the request body) drives rate limiting, trust, and audit.
Inbound text — including /-prefixed text — is run through prompt-injection filters and framed as untrusted peer input; remote peers cannot invoke operator slash commands.
Outbound text is scrubbed of credential-shaped strings.
Push callbacks are SSRF-guarded and HMAC-SHA256 signed (X-A2A-Signature).
Every exchange is logged to ~/.hermes/a2a_audit.jsonl.
Conversations persist to ~/.hermes/a2a_conversations/ — they survive context compaction and restarts (a2a_history recalls them).

Env vars

Var	Default	Meaning
`A2A_PEER_TOKENS`	(unset)	Per-peer credentials `name:token,…` (preferred).
`A2A_BEARER_TOKEN`	(unset)	Shared token; identity falls back to caller IP.
`A2A_HOST`	`127.0.0.1`	Bind host. Only widens with a token set.
`A2A_PORT`	`9900`	Inbound port.
`A2A_AGENT_NAME`	hostname-derived	Name on the Agent Card.
`A2A_PUBLIC_URL`	(unset)	Routable URL advertised on the card (reverse proxies).
`A2A_TRUSTED_PEERS`	(unset)	Allow-list of authenticated identities.
`A2A_ALLOW_ALL_USERS`	`false`	Allow any authed peer (dev only).
`A2A_RATE_LIMIT`	`60`	Requests/minute per identity.
`A2A_MAX_PINGPONG_TURNS`	`5`	Anti-loop turn cap per context (max 20).
`A2A_REPLY_TIMEOUT`	`300`	Seconds to wait for the agent's reply; the orphan sweep never fails a task before this window (floor 300s) or while a request still waits on it.
`A2A_PUSH_SECRET`	bearer token	HMAC secret for push signing.
`A2A_ADVERTISED_TOOLSETS`	all registered	Restrict skills on the Agent Card.

See DESIGN.md for architecture and the requirement-tracing table.