feat: credential proxy daemon — zero-knowledge HTTP/HTTPS broker (#4656)

[dsr-restyn]

Summary

• Adds a credential proxy daemon that intercepts outbound HTTP/HTTPS from tool subprocesses and substitutes hermes-proxy://<name> placeholders with real credential values at the transport layer
• The agent process structurally cannot read stored values — there is no read API
• Uses mitmproxy for proxy/TLS/CA and system keyring for credential storage — no custom crypto

Architecture

Agent process          Credential Proxy           Upstream API
    │                      │                          │
    │ Authorization:       │                          │
    │ hermes-proxy://tok1  │                          │
    │─────────────────────>│                          │
    │                      │  Authorization:          │
    │                      │  sk-real-secret-123      │
    │                      │─────────────────────────>│
    │                      │                          │
    │    <response>        │    <response>            │
    │<─────────────────────│<─────────────────────────│

Changes

New files (cred_proxy/)

File	Description
store.py	Keyring-backed credential store. Public API: set/list/delete. Internal _get() for substitutor only. No read API.
server.py	mitmproxy DumpMaster + CredentialProxyAddon — substitutes placeholders in request headers and bodies. ~70 lines.
substitutor.py	Regex-based hermes-proxy://<name> detection and replacement.
daemon.py	Process lifecycle: start/stop/status, PID+port file management, stale cleanup.
cli.py	`hermes cred-proxy start

Modified files

File	Change
tools/environments/local.py	_make_run_env() injects http_proxy/https_proxy + combined CA bundle when proxy is running
hermes_cli/main.py	hermes cred-proxy subcommand group
pyproject.toml	cred-proxy extras + console entry point

Design decisions

• mitmproxy over custom asyncio MITM: delegates TLS termination, CA management, cert issuance, and Content-Length recalculation to a battle-tested library. Keeps server.py to ~70 lines.
• System keyring over custom AES-256-GCM: uses OS-native secret storage (GNOME Keyring, macOS Keychain, Windows Credential Locker) via the keyring library. No key derivation, no passphrase prompt, no custom crypto.
• Profile-aware paths: uses get_hermes_home() so proxy state respects HERMES_HOME / active profile.

Tests

22 tests across 4 files:

• test_store.py — CRUD, sorted listing, overwrite, missing key errors
• test_substitutor.py — header/body/query string substitution, mixed known/unknown, empty string
• test_integration.py — mitmproxy addon end-to-end, no-public-get invariant
• test_fixes.py — stale PID file cleanup

All tests use an in-memory keyring backend (no system keyring access needed).

Related

Refs #4656, addresses #4429, complements #4432

🤖 Generated with Claude Code