hive-system.secrets.pass — io.github.hive-agi/hive-system 0.2.7

GNU pass (password-store) ISecretBackend implementation.

Resolves entries from the user's pass store into opaque Secret values. Never logs the resolved content. Stderr is captured but sanitized in error returns.

API

• ->PassBackend — defrecord constructor (preferred via DIP)
• pass-show — convenience: full output as one Secret
• pass-show-line — convenience: first non-empty line only
• pass-available? — convenience: Result<bool> backend health

Backend errors

• :pass/not-found — entry does not exist
• :pass/empty — entry exists but resolved to blank
• :pass/exec-fail — pass binary failed (binary missing, gpg lock, etc.)
• :pass/timeout — pass invocation exceeded deadline

Errors include the lookup :key (NOT the resolved value) for diagnostics.

make-pass-backend clj

(make-pass-backend)

(make-pass-backend {:keys [shell]})

Construct a PassBackend.

opts (all optional): :shell — exec function with the same shape as hive-system.shell.core/exec! (cmd, opts) → Result. Used for testing with a mock shell.

pass-available? clj

(pass-available?)

Result<bool>: true if pass binary is on PATH AND the password store directory exists and is non-empty.

pass-show clj

(pass-show key)

(pass-show key opts)

Resolve key from the default pass backend, returning Result<Secret>.

Errors: :pass/not-found, :pass/empty, :pass/exec-fail, :pass/timeout.

pass-show-line clj

(pass-show-line key)

(pass-show-line key opts)

Like pass-show, but returns only the first non-empty line as the Secret. Use for single-line credentials (IPs, short tokens) where pass may include trailing notes/comments on subsequent lines.