+ lHj\Rt^RIHt]!4t]Pt]P t]!R4]RRl44t]!R4]RRl44t]!R4]R R l44t]!R 4]R R l44t]!R4]RRl44t]!R4]RRl44t]!R4]RRl44tRRltR#)u Credential-vault JSON-RPC handlers — the Desktop's door to the local vault. The Desktop's Settings → Credential Vault panel manages the encrypted, model-blind vault (``agent/vault_store.py``) over the same localhost WS JSON-RPC channel every other Settings surface uses. Contracts: - ``vault.list`` → metadata only ({id, kind, label, origin, created_at, and for logins identifier/identifier_type — identifiers are visible metadata by design}); passwords NEVER appear in any response. - ``vault.add`` → validates via ``VaultStore.add_item``; the secret payload arrives over the local RPC channel, goes straight into the encrypted store, and is never logged. Error strings are defensively scrubbed with ``scrub_secret_from_text`` before they leave the handler. - ``vault.remove`` → {removed: bool}. - ``vault.sources`` / ``vault.source.set`` → external password-manager status and enable toggle. - ``vault.unlock`` / ``vault.lock`` → per-session unlock of a manager from Settings; the master password is consumed by the manager CLI through its non-interactive channel and never stored or logged. Every handler honours ``params.profile`` (app-global remote mode serves several profiles from one backend): the requested profile's HERMES_HOME and secret scope are bound around the body, so the vault file, manager config and manager tokens all resolve to that profile. Handlers are rebound onto server.py's globals at install time (see method_ctx.py) and may reference server module globals (``_ok``, ``_err``). )HandlerRegistryz vault.listc0V^8dQhR\R\/#paramsreturndict)formats">/home/ubuntu/.hermes/hermes-agent/tui_gateway/methods_vault.py __annotate__r , ' '4 'D 'cPa^RIHp.pV!4FVoSP'dSP4'gK-VP V3RlSP 444KX \ VRV/4# \d!p\TR\T44uRp?#Rp?ii;i)zMetadata-only listing across every enabled backend (local + unlocked password managers). Each item carries ``backend``; locked managers contribute nothing (see vault.sources).enabled_backendsc3d<"TF%p/VP4CRSP/CxK' R#5i)backendN)to_dictname).0metars& r _..6s*fQeDDLLNDIw||DQes-0itemsN) agent.vault_backendsr needs_unlock is_unlockedextend list_items_ok Exception_errstr)ridrrrers&& @r _r'*s '9')G###G,?,?,A,A LLfQXQcQcQef f*3%()) 'Cs1v&&'s"9A:r rc^RIHp^RIHpHpV!4Uu/uFqUP VbK ppRRRRRRR R R RR R/.pV!4FpVP VP 4p TPRVP RVPRV R JR RR \T ;'dV P44R V!VP 4/4K \VRV/4#uupi)z_Status of every login source: {name, display_name, enabled, needs_unlock, unlocked, installed}.r)external_backend_classes is_installedrlocal display_namez Hermes vaultenabledTrFunlocked installedNsources) rragent.vault_backends.baser*r+rgetappendr-boolrr!) r%rrr*r+br.rowsclslives && r r'r'<s6P"2"45"4Qvvqy"4G5 Wnni~_d {D 2 3D'){{388$ VSXX~s7G7GTX`dTd#T:tD.enabled`` and locks it when disabling.)r*lock) _ensure_dict load_config save_configrrzunknown vault source: r.vaultNF)r2r*agent.vault_backends.unlockr=hermes_cli.configr>r?r@r$r3rr#r5popr!) r%rr*r=r>r?r@rr8r.cfgsections && r r'r'NsC0HH vzz&!''R (D (@(BC(BHH(BCCC!7v>??6::i()G -C<W5trps6(     **  ' '  ' ' 88,66( && GG> ' 'r