Hermes Desktop .env Manager Plugin

A native-looking Hermes Desktop plugin for managing the active Hermes profile's .env credentials without opening the raw file.

Values stay masked until you explicitly reveal, copy, or edit them. The list API never returns plaintext values.

Features

• Add, edit, reveal, hide, copy, search, and delete environment variables.
• Uses the active Hermes profile automatically:
  • Default profile: ~/.hermes/.env
  • Named profiles: their profile-specific .env
• Preserves comments and unrelated entries in the file.
• Uses Hermes' credential lifecycle helpers for:
  • key validation
  • protected-variable blocking
  • atomic file updates
  • process-environment refresh
  • provider credential reconciliation
• Fits Hermes Desktop's existing sidebar, command palette, dialogs, buttons, and theme system.
• Stores no secret values in Desktop plugin storage or browser local storage.

Screenshot

Requirements

• A current version of Hermes Agent
• Hermes Desktop with runtime plugin support
• Python 3.10 or newer

Install

Install the repository through Hermes' plugin manager:

hermes plugins install djedi/hermes-desktop-env-manager-plugin
hermes plugins enable env-manager --no-allow-tool-override
hermes plugins doctor env-manager

Then:

1. Restart the Hermes gateway from a shell outside the running gateway, or restart it from Hermes Desktop.
2. In Hermes Desktop, press ⌘K and run Reload desktop plugins if the plugin does not appear automatically.
3. Open .env from the sidebar or run Open .env Manager from the command palette.

The plugin has two paired halves:

• desktop/plugin.js — native Desktop UI
• dashboard/plugin_api.py — profile-aware backend API

The backend half must be enabled in Hermes configuration before its routes are mounted.

Install with your Hermes agent

Paste this prompt into Hermes:

Install the Hermes Desktop .env Manager Plugin from:
https://github.com/djedi/hermes-desktop-env-manager-plugin

Use Hermes' built-in plugin installer rather than manually editing core files:
1. Run `hermes plugins install djedi/hermes-desktop-env-manager-plugin`.
2. Enable it with `hermes plugins enable env-manager --no-allow-tool-override`.
3. Validate it with `hermes plugins doctor env-manager`.
4. Confirm the package exists under the active profile's Hermes plugins directory and includes both `desktop/plugin.js` and `dashboard/plugin_api.py`.
5. Do not print, inspect, or expose any values already stored in my `.env` file.
6. If you are running inside the Hermes gateway, do not attempt to restart that same gateway process from within itself. Tell me to restart it from Hermes Desktop or an outside terminal.
7. After restart, tell me to run “Reload desktop plugins” from the Desktop command palette if the `.env` sidebar entry is not visible.
8. Report the validation result and any remaining manual step.

Usage

Open .env in the Hermes Desktop sidebar.

• Add variable creates a new key/value entry.
• The eye button reveals or hides one value.
• The copy button copies one value without permanently revealing it.
• Edit changes the value while preserving the original key.
• Delete requires confirmation.
• Search filters by key name only.

Changes apply to the active profile. Newly added credentials are refreshed into the current process where Hermes supports it; starting a new chat is still recommended when changing model-provider credentials that may already have been resolved.

Security model

This plugin manages secrets, so the boring details are the important details:

• The list endpoint returns keys, masks, and metadata—not plaintext values.
• Plaintext is returned only by an explicit reveal/copy/edit request.
• Secret values are not persisted in plugin storage, local storage, query keys, or URLs.
• Keys are validated before writing.
• Dangerous process-control variables such as PATH, PYTHONPATH, LD_PRELOAD, and HERMES_HOME are blocked by Hermes' credential helpers.
• File writes use Hermes' existing atomic credential update path.
• The plugin does not register model tools, hooks, telemetry, or external network integrations.

The .env file itself remains the source of truth. Protect it with normal filesystem permissions and never commit it to Git.

Troubleshooting

“.env backend is unavailable”

This means the Desktop UI loaded but the gateway did not mount the paired Python API.

hermes plugins enable env-manager --no-allow-tool-override
hermes plugins doctor env-manager

Restart the gateway from outside the gateway process, then reload Desktop plugins.

The sidebar entry is missing

Press ⌘K and run Reload desktop plugins. Also check Settings → Plugins and ensure .env Manager is enabled.

Updating

hermes plugins update env-manager

Restart the gateway after updating if the Python backend changed.

Removing

hermes plugins remove env-manager

This removes the plugin. It does not delete your .env file.

Development

Run the backend tests:

python -m unittest discover -s tests -p 'test_*.py' -v

Check the runtime JavaScript syntax:

node --check desktop/plugin.js

Validate the complete plugin package:

hermes plugins doctor env-manager

License

MIT — see LICENSE.