agent-core-credentials 0.8.2__tar.gz

agent_core_credentials-0.8.2/.gitignore

@@ -0,0 +1,245 @@
+# Memory compiler runtime state
+memory-compiler/daily/
+memory-compiler/reports/
+memory-compiler/scripts/state.json
+memory-compiler/scripts/last-flush.json
+memory-compiler/scripts/flush.log
+memory-compiler/scripts/compile.log
+memory-compiler/scripts/session-flush-*.md
+memory-compiler/scripts/flush-context-*.md
+
+# Handoff writer state (placed alongside handoff files)
+**/handoff-state.json
+
+# Git worktrees (superpowers / parallel feature work)
+.worktrees/
+# Native (harness) worktrees
+.claude/worktrees/
+
+# Superpowers brainstorm mockups / scratch
+.superpowers/
+
+# Agent-core runtime state (handoffs, bus.sqlite, transcripts, etc.)
+.agent-core/
+
+# Local scratch / smoke-test artifacts
+.tmp/
+
+# Claude Code per-machine local overrides
+.claude/settings.local.json
+.claude/*.lock
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+#poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+#pdm.lock
+#pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+#pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Abstra
+# Abstra is an AI-powered process automation framework.
+# Ignore directories containing user credentials, local state, and settings.
+# Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor
+#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+.gstack/
+
+# macOS Finder metadata (occasionally sneaks in via vendored sources)
+.DS_Store
+
+# Operational docs that must not live in source control
+pepper-vault-plan.txt

agent_core_credentials-0.8.2/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## [0.8.1](https://github.com/jeffrichley/agent_core/compare/v0.8.0...agent-core-credentials-v0.8.1) (2026-07-22)
+
+
+### Bug Fixes
+
+* republish package family to complete rate-limited first publish ([#477](https://github.com/jeffrichley/agent_core/issues/477)) ([32977ac](https://github.com/jeffrichley/agent_core/commit/32977ac78da4a15553329bb4e1fdaa9e894834ad))
+
+## [0.8.0](https://github.com/jeffrichley/agent_core/compare/v0.7.0...agent-core-credentials-v0.8.0) (2026-07-21)
+
+
+### Features
+
+* **credentials:** add keyring master-password store with encrypted-file fallback ([#413](https://github.com/jeffrichley/agent_core/issues/413)) ([b5b8dd6](https://github.com/jeffrichley/agent_core/commit/b5b8dd6c671b9015ba5935540a6ded33dba13f91))
+* **credentials:** make creds get metadata-only, remove stdout secret emission ([#411](https://github.com/jeffrichley/agent_core/issues/411)) ([8aae1e5](https://github.com/jeffrichley/agent_core/commit/8aae1e575f3791998b95a7dbe1e787353d7c0788))
+* **hatchery:** ungendered templates + .mcp.json generation ([#81](https://github.com/jeffrichley/agent_core/issues/81)/[#82](https://github.com/jeffrichley/agent_core/issues/82)) ([#357](https://github.com/jeffrichley/agent_core/issues/357)) ([f48762d](https://github.com/jeffrichley/agent_core/commit/f48762df78eb12cfa9524e9b5a277741534ea8a7)), closes [#311](https://github.com/jeffrichley/agent_core/issues/311)
+* **release:** configure release-please for 12-package synchronized version train ([#428](https://github.com/jeffrichley/agent_core/issues/428)) ([c1b4097](https://github.com/jeffrichley/agent_core/commit/c1b409765c61d09a6657b0e8b5e43a27cb235b3e))
+* **secrets:** add vault-API accessor and scrub subprocess env ([#399](https://github.com/jeffrichley/agent_core/issues/399)) ([adb404b](https://github.com/jeffrichley/agent_core/commit/adb404b046bd224b56d64188b2cb56eb134d99b7))
+
+
+### Bug Fixes
+
+* 6 HIGH findings from the adversarial review (leaks, fragility, footguns) ([#469](https://github.com/jeffrichley/agent_core/issues/469)) ([f546c54](https://github.com/jeffrichley/agent_core/commit/f546c548d2da6455e611c5b5820a21fa8c86211e))
+
+## Changelog
+
+All notable changes to `agent-core-credentials` are documented in this
+file. The format is generated by towncrier from fragments in
+`changelog.d/` at release time.
+
+<!-- towncrier release notes start -->

agent_core_credentials-0.8.2/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: agent-core-credentials
+Version: 0.8.2
+Summary: KeePass-backed credential vault for agent-core agents
+License-Expression: MIT
+Requires-Python: >=3.12
+Requires-Dist: cryptography>=41.0
+Requires-Dist: keyring>=24.0
+Requires-Dist: pykeepass>=4.1.1.post1
+Requires-Dist: rich>=13.0
+Requires-Dist: typer>=0.12

agent_core_credentials-0.8.2/VERSION

@@ -0,0 +1 @@
+0.8.1

agent_core_credentials-0.8.2/pyproject.toml

@@ -0,0 +1,32 @@
+[project]
+name = "agent-core-credentials"
+dynamic = ["version"]
+description = "KeePass-backed credential vault for agent-core agents"
+license = "MIT"
+requires-python = ">=3.12"
+dependencies = [
+    "pykeepass>=4.1.1.post1",
+    "typer>=0.12",
+    "rich>=13.0",
+    "keyring>=24.0",
+    "cryptography>=41.0",
+]
+
+[project.scripts]
+agent-core-creds = "agent_core_credentials.cli:creds_app"
+
+[build-system]
+requires = ["hatchling", "uv-dynamic-versioning"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_core_credentials"]
+
+[tool.hatch.version]
+source = "uv-dynamic-versioning"
+
+[tool.uv-dynamic-versioning]
+fallback-version = "0.0.0"
+
+[tool.uv]
+cache-keys = [{ file = "pyproject.toml" }, { git = { commit = true, tags = true } }]

agent_core_credentials-0.8.2/src/agent_core_credentials/__init__.py

@@ -0,0 +1,67 @@
+"""agent_core_credentials — KeePass-backed credential vault.
+
+Public API for credential operations. Used by the CLI and available
+for direct import elsewhere.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from agent_core_credentials.master_password import get_master_password, set_master_password
+from agent_core_credentials.models import Credential, CredentialSummary
+from agent_core_credentials.secrets import SecretNotFoundError, get
+from agent_core_credentials.store import CredentialStore
+
+__all__ = [
+    "Credential",
+    "CredentialSummary",
+    "SecretNotFoundError",
+    "default_vault_path",
+    "delete_credential",
+    "get",
+    "get_credential",
+    "get_master_password",
+    "list_credentials",
+    "set_credential",
+    "set_master_password",
+]
+
+
+def default_vault_path() -> Path:
+    """Resolve the default vault path.
+
+    Honours the AGENT_CORE_VAULT_PATH env var if set; otherwise falls
+    back to ~/.agent-core/credentials.kdbx.
+    """
+    override = os.environ.get("AGENT_CORE_VAULT_PATH")
+    if override:
+        return Path(override)
+    return Path.home() / ".agent-core" / "credentials.kdbx"
+
+
+def get_credential(service: str) -> Credential | None:
+    """Retrieve a credential by service name."""
+    return CredentialStore(default_vault_path()).get(service)
+
+
+def set_credential(
+    service: str,
+    username: str,
+    password: str,
+    url: str = "",
+    notes: str = "",
+) -> None:
+    """Store or overwrite a credential."""
+    CredentialStore(default_vault_path()).set(service, username, password, url, notes)
+
+
+def list_credentials() -> list[CredentialSummary]:
+    """List all stored credentials without passwords."""
+    return CredentialStore(default_vault_path()).list()
+
+
+def delete_credential(service: str) -> bool:
+    """Delete a credential. Returns True if found and deleted."""
+    return CredentialStore(default_vault_path()).delete(service)

agent_core_credentials-0.8.2/src/agent_core_credentials/cli.py

@@ -0,0 +1,156 @@
+"""agent-core creds CLI — manage stored credentials."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+import typer
+from pykeepass import create_database  # type: ignore[import-untyped]
+from rich import print as rprint
+
+from agent_core_credentials import default_vault_path
+from agent_core_credentials.master_password import set_master_password
+from agent_core_credentials.store import CredentialStore
+
+creds_app = typer.Typer(
+    name="creds",
+    help="Manage stored credentials.",
+    no_args_is_help=True,
+)
+
+# Default paths — overridden in tests via monkeypatch
+_vault_path = default_vault_path()
+_env_path = Path.home() / ".agent-core" / ".env"
+
+
+def _load_env() -> None:
+    """Load .env into the process environment if not already set."""
+    if os.environ.get("AGENT_CORE_VAULT_PASSWORD"):
+        return
+    if _env_path.exists():
+        for line in _env_path.read_text().splitlines():
+            if "=" in line and not line.startswith("#"):
+                key, _, value = line.partition("=")
+                os.environ.setdefault(key.strip(), value.strip())
+
+
+def _store() -> CredentialStore:
+    """Create a CredentialStore for the current vault path."""
+    _load_env()
+    return CredentialStore(_vault_path)
+
+
+@creds_app.command("init")
+def init_vault() -> None:
+    """Initialize the credential vault with a master password."""
+    if _vault_path.exists():
+        rprint(f"[red]Credential vault already exists at {_vault_path}[/red]")
+        raise typer.Exit(1)
+
+    password = typer.prompt("Master password", hide_input=True)
+    confirm = typer.prompt("Confirm password", hide_input=True)
+
+    if password != confirm:
+        rprint("[red]Passwords do not match.[/red]")
+        raise typer.Exit(1)
+
+    _vault_path.parent.mkdir(parents=True, exist_ok=True)
+    create_database(str(_vault_path), password=password)
+
+    set_master_password(_vault_path, password)
+
+    rprint(f"[green]Created credential vault at {_vault_path}[/green]")
+
+
+@creds_app.command("set")
+def set_credential(
+    service: str = typer.Argument(help="Service name (e.g. apex, etsy)"),
+) -> None:
+    """Store a credential with secure password input."""
+    username = typer.prompt("Username")
+    password = typer.prompt("Password", hide_input=True)
+    url = typer.prompt("URL (optional)", default="")
+    notes = typer.prompt("Notes (optional)", default="")
+
+    try:
+        _store().set(service, username, password, url, notes)
+    except ValueError as e:
+        rprint(f"[red]{e}[/red]")
+        raise typer.Exit(1) from None
+
+    rprint(f"[green]Saved {service}[/green]")
+
+
+@creds_app.command("get")
+def get_credential(
+    service: str = typer.Argument(help="Service name to retrieve"),
+    as_json: bool = typer.Option(False, "--json", help="Output as JSON (metadata only, no secret)"),
+) -> None:
+    """Retrieve a stored credential."""
+    try:
+        cred = _store().get(service)
+    except ValueError as e:
+        rprint(f"[red]{e}[/red]")
+        raise typer.Exit(1) from None
+
+    if cred is None:
+        rprint(f"[red]No credential found for {service}[/red]")
+        raise typer.Exit(1)
+
+    if as_json:
+        print(json.dumps({"name": cred.service, "exists": True, "length": len(cred.password)}))
+    else:
+        rprint(f"[bold]Service:[/bold]   {cred.service}")
+        rprint(f"[bold]Length:[/bold]    {len(cred.password)} chars")
+        if cred.mtime is not None:
+            rprint(f"[bold]Modified:[/bold]  {cred.mtime.strftime('%Y-%m-%d %H:%M UTC')}")
+        else:
+            rprint("[bold]Modified:[/bold]  (unknown)")
+
+
+@creds_app.command("list")
+def list_credentials(
+    as_json: bool = typer.Option(False, "--json", help="Output as JSON"),
+) -> None:
+    """List all stored credentials."""
+    try:
+        summaries = _store().list()
+    except ValueError as e:
+        rprint(f"[red]{e}[/red]")
+        raise typer.Exit(1) from None
+
+    if as_json:
+        print(
+            json.dumps(
+                [
+                    {"service": s.service, "username": s.username, "url": s.url}
+                    for s in summaries
+                ]
+            )
+        )
+    else:
+        if not summaries:
+            rprint("[yellow]No credentials stored.[/yellow]")
+            return
+        for s in summaries:
+            rprint(s.service)
+
+
+@creds_app.command("delete")
+def delete_credential(
+    service: str = typer.Argument(help="Service name to delete"),
+) -> None:
+    """Delete a stored credential."""
+    try:
+        deleted = _store().delete(service)
+    except ValueError as e:
+        rprint(f"[red]{e}[/red]")
+        raise typer.Exit(1) from None
+
+    if not deleted:
+        rprint(f"[red]No credential found for {service}[/red]")
+        raise typer.Exit(1)
+
+    rprint(f"[green]Deleted {service}[/green]")