Stop printing Bitwarden secret names during env load

[andrexibiza]

Summary

Stops Hermes from printing the names of secrets applied from Bitwarden Secrets Manager during env loading.

Before:

Bitwarden Secrets Manager: applied 98 secrets (OPENAI_API_KEY, ... )

After:

Bitwarden Secrets Manager: applied 98 secrets

Why

Secret names can reveal operational configuration and should not be dumped to terminal output or logs during startup.

Tests

• Added regression coverage that applied Bitwarden secret names are not present in stderr.
• python -m pytest tests/test_env_loader_secret_sources.py -q
• python -m py_compile hermes_cli\env_loader.py

[andrexibiza]

Reproduction steps for the current behavior on main before this PR:

1. Configure Hermes to use the built-in Bitwarden Secrets Manager integration, with at least one BWS secret in the configured project.

Example config.yaml under the active HERMES_HOME:

secrets:
  bitwarden:
    enabled: true
    project_id: "<your-bws-project-id>"
    access_token_env: "BWS_ACCESS_TOKEN"
    auto_install: false

2. Export a valid Bitwarden Secrets Manager access token for that project:

$env:HERMES_HOME = "C:\path\to\hermes-home"
$env:BWS_ACCESS_TOKEN = "<valid-bws-access-token>"

3. From a Hermes checkout on main, trigger the normal env loading path:

python -c "from hermes_cli.env_loader import load_hermes_dotenv; load_hermes_dotenv(hermes_home=r'C:\path\to\hermes-home')"

4. Observe stderr.

Current behavior:

Bitwarden Secrets Manager: applied 98 secrets (OPENAI_API_KEY, ANTHROPIC_API_KEY, TELEGRAM_BOT_TOKEN, ...)

Expected behavior:

Bitwarden Secrets Manager: applied 98 secrets

The issue is not that secret values are printed. The issue is that the names of every applied BWS secret are printed during env loading/startup. Those names can still expose operational configuration: which providers, services, tokens, internal systems, and integrations are configured.

This PR keeps the useful status signal, but removes the secret-name dump and adds regression coverage that applied Bitwarden secret names do not appear in stderr.

[teknium1]

Thanks for the focused security fix. Current main still emits the full applied-variable list from src.applied in hermes_cli/env_loader.py:365-368; this includes Bitwarden secret names on startup. The PR removes only that list while retaining the source label and count.

The added regression coverage exercises the normal external-source path with a mocked Bitwarden fetch and asserts both the retained status count and absence of supplied secret names. The same generic formatter is the only repository match for this applied-name formatting, so the change addresses the current startup disclosure site. The target files have not changed since PR base 009b42d008b81c18af39414dded9ecdf06082d93.

Automated hermes-sweeper review.

[teknium1]

Merged via #69054 — clean cherry-pick, your commit and regression test landed as-is. Thanks @andrexibiza!

[andrexibiza]

My pleasure, proud to be part of the crew!!!!!!