Mural Skill for Hermes AI Agent - Auth Fix & New Helper Script

What Changed

The Mural skill for Hermes AI Agent just got a significant update, thanks to Hermes fixing its own bugs after real-world usage.

The Bug: Token Refresh Was Broken

The original implementation put client_id and client_secret in the request body when refreshing OAuth tokens. Mural's API rejects this with 400 invalid_client.

The fix: Mural requires HTTP Basic authentication for token refresh - credentials go in the Authorization header, not the body.

`python
import base64, urllib.request, urllib.parse

creds = base64.b64encode(f"{CLIENT_ID}:{CLIENT_SECRET}".encode()).decode()

req = urllib.request.Request(
"https://app.mural.co/api/public/v1/authorization/oauth2/token",
data=urllib.parse.urlencode({
"grant_type": "refresh_token",
"refresh_token": REFRESH_TOKEN,
}).encode(),
headers={
"Authorization": f"Basic {creds}",
"Content-Type": "application/x-www-form-urlencoded",
}
)
`

New: mural_api.py Helper Script

Hermes also wrote a ready-to-use client script (~/.hermes/scripts/mural_api.py) that:

Auto-refreshes the token when it expires (every 15 min)
Rewrites tokens back to .env automatically (refresh tokens are rotated)
Avoids credential leakage via shell inline commands

ash python3 ~/.hermes/scripts/mural_api.py refresh # force refresh python3 ~/.hermes/scripts/mural_api.py get /workspaces # authenticated GET python3 ~/.hermes/scripts/mural_api.py get /workspaces/<id>/murals

What Hermes Can Do with Mural Now

Create full workshop boards from a document (we built a 40-widget training day board from a DOCX)
Add stickies, shapes, connectors programmatically
List and search murals across workspaces and rooms
Duplicate murals from templates