NQj&]UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZmZddlmZmZmZmZddlmZmZejeZdZd Zejd Zd Z ee!e!e!e!fZ"iZ#d e$d <dZ%dFdZ&ee%e&Z'de$d<dGdHdZ(dIdZ)dJd Z*dKd"Z+dLdMd%Z,dNd'Z-dOd)Z.d#d#d*dPd.Z/d#edd#d/d0dd1dQd7Z0dd#ed#d/d0dd8dRd>Z1Gd?d@eZ2dSdCZ3dGdTdEZ4dS)Uu1Password (`op` CLI) secret source. Resolve provider credentials from 1Password ``op://vault/item/field`` references at process startup so they don't have to live in plaintext in ``~/.hermes/.env``. Design summary -------------- * Users map environment-variable names to official 1Password secret references in ``secrets.onepassword.env``:: secrets: onepassword: enabled: true env: OPENAI_API_KEY: "op://Private/OpenAI/api key" ANTHROPIC_API_KEY: "op://Private/Anthropic/credential" * After ``.env`` loads, each reference is resolved with a single ``op read -- `` call and injected into ``os.environ`` (the same point in startup as the Bitwarden source). * Authentication is whatever the user's ``op`` CLI already uses — a service-account token (``OP_SERVICE_ACCOUNT_TOKEN``) for headless boxes, or a desktop/interactive session (``OP_SESSION_*``). Hermes never authenticates on the user's behalf; it shells out to an already-trusted, already-authenticated CLI. * Failures NEVER block startup. A missing ``op`` binary, expired auth, a bad reference, or a permission error each surface a one-line warning and Hermes continues with whatever credentials ``.env`` already had. The atomic-write / ``0600`` / TTL cache mechanics are shared with the other backends via :mod:`agent.secret_sources._cache` — successful, complete pulls are cached in-process and on disk under ``/cache/op_cache.json`` so back-to-back short-lived ``hermes`` invocations don't re-shell ``op`` for every reference. The disk file holds only resolved secret *values*; auth material is fingerprinted, never stored. ) annotationsN)Path)DictListOptionalTuple) CachedFetch DiskCache FetchResultis_valid_env_name) ErrorKind SecretSourceOP_SERVICE_ACCOUNT_TOKENz\x1b\[[0-?]*[ -/]*[@-~])PATHHOME USERPROFILEAPPDATA LOCALAPPDATA SystemRootTMPDIRTMPTEMPXDG_CONFIG_HOMEXDG_RUNTIME_DIR OP_ACCOUNTOP_CONNECT_HOSTOP_CONNECT_TOKENzDict[_CacheKey, CachedFetch]_CACHEz op_cache.json cache_key _CacheKeyreturnstrc$|\}}}}|d|d|S)aSerialize a cache key for on-disk storage, omitting home_path. The disk file is already partitioned by home (it lives under ``/cache/``), so the path provides the home dimension; folding it into the key string too would be redundant. |)r auth_fpaccount_homerefs_fps D/home/alina/.hermes/hermes-agent/agent/secret_sources/onepassword.py _disk_key_strr,vs.(1$GWeW + + + +' + ++)key_serializerr _DISK_CACHE home_pathOptional[Path]rc6t|S)zAPath to the on-disk cache (exposed for tests and direct callers).)r/pathr0s r+_disk_cache_pathr5s   I & &&r- referencesOptional[Dict[str, str]] Tuple[Dict[str, str], List[str]]ci}g}|piD]\}}t|s|d|d.t|ts|d|d]|}|ds|d|d|d|||<||fS)uReturn ``(valid_refs, warnings)`` from an ``env`` mapping. A reference is kept only if its target env-var name is a valid POSIX name and the value is a stripped ``op://…`` reference string. Everything else produces a warning and is dropped (never fatal). z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsr append isinstancer#strip startswith)r6validwarningsnamerefcleaneds r+_validate_referencesrEsEH &B--//   c &&  OOJJJJ K K K #s##  OOKKKK L L L ))++!!'**  OONDNNcNNN    d (?r- token_envcdtj|ddtjddg}ttjD]A}|dr*||dtj|Bd|}tj| d d d S) uSHA-256 prefix over the auth material `op` would use. Folds in the service-account token, ``OP_ACCOUNT``, and *all* ``OP_SESSION_*`` vars (the names `op` actually exports for interactive sessions — ``OP_SESSION_``). Signing out and into a different identity therefore changes the cache key, so a value cached under a previous identity is never served under a new one. Never logged or displayed; the raw token never leaves this hash. ztoken=zaccount=r OP_SESSION_= utf-8N) osenvirongetsortedr?r<joinhashlibsha256encode hexdigest)rFpartskeymaterials r+_auth_fingerprintrZs 1 2..0052:>>,3355Ebj!!55 >>- ( ( 5 LLC33"*S/33 4 4 4yyH >(//'22 3 3 = = ? ? DDr-Dict[str, str]cdfdtD}tj|dddS)u<SHA-256 prefix over the configured name→reference mapping.rKc32K|]}|d|VdS)rJNr&).0rBr6s r+ z$_refs_fingerprint..s6UU$D55:d#355UUUUUUr-rLNrM)rRrQrSrTrUrV)r6rYs` r+_refs_fingerprintr`sbyyUUUU&BTBTUUUUUH >(//'22 3 3 = = ? ? DDr-rH binary_pathc|rFt|}|r!tj|tjr|SdSt jd}|rt|ndS)u[Resolve a usable ``op`` binary, or None. When ``binary_path`` is set it is used verbatim and PATH is NOT consulted — pinning an absolute path is a way to avoid trusting whatever ``op`` shows up first on ``PATH``. A pinned-but-missing path returns None (the caller surfaces a clear error) rather than silently falling back. Nop)rexistsrNaccessX_OKshutilwhich)rapinnedfounds r+find_oprkslk"" ==?? ry99 Mt L  E )4;;;T)r-textctd|ddS)zCRemove ANSI control sequences and trim, for safe message surfacing.rH) _ANSI_CSI_REsubreplacer>)rls r+_scrubrrs4   B % % - -fb 9 9 ? ? A AAr- token_valueci}tD](}tj|}||||<)tjD]\}}|dr|||< |r||d<d|d<|S)zEBuild a minimal allowlisted environment for the ``op`` child process.NrIr1NO_COLOR)_OP_ENV_ALLOWLISTrNrOrPr;r?)rsenvrXvals r+ _op_child_envrzsC jnnS!! ?CHJ$$&&S >>- ( ( CH6*5 &'C O Jr-r(rsrc referencer(c t|dg}|r|d|gz }|d|gz } tj|t|ddddt}nR#tj$r }t dtd ||d }~wt$r}t d ||d }~wwxYw|jd krOt|j pd d d}|rt d|d|t d|jd||j pd d}| st d||S)uResolve a single ``op://`` reference to its value. Raises :class:`RuntimeError` on any failure — including a ``returncode 0`` with empty output, which would otherwise silently clobber a good ``.env``/shell credential with ``""``. readz --accountz--TrLrq)rxcapture_outputrlencodingerrorstimeoutzop read timed out after zs for Nzfailed to invoke op: rrHzop read failed for r:zop read exited z for z z$op read returned an empty value for )r# subprocessrunrz_OP_RUN_TIMEOUTTimeoutExpired RuntimeErrorOSError returncoderrstderrstdoutrstripr>) rcr|r(rscmdprocexcerrvalues r+ _run_op_readrs"ggv&C& W%%D) CC~ k**#     $ K K Ki K K    CCC838899sBC !T[&B''-  KIYIICIIJJ J Ado A AI A A   [ B & &v . .E ;;==QO)OOPPP Ls#-AB  A;; B BB T,)r(rFbinaryra use_cachecache_ttl_secondsr0rrboolrfloatct|\}} |si| fStj|d} t ||pd|t |ndt|f} |rt| } | r+| |rt| j | fSt | ||} | | t| <t| j | fS|pt|}|tdi}d}t!|D]]} t#||||| ||< #t$r1}| t ||dz }Yd}~Vd}~wwxYw|rZ|sX|rVt't|t)j}|t| <t| ||||| fS)uResolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises :class:`RuntimeError` only when no ``op`` binary is available — a fatal "can't fetch anything" condition. Per-reference failures (expired auth, bad reference, empty value) are collected as warnings and the reference is dropped, so one bad entry never sinks the rest. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rHNzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.rr{)secrets fetched_at)rErNrOrPr>rZr#r`ris_freshdictrr/r~rkrrQrr<r timewrite)r6r(rFrrarrr0r@rArsr cached disk_cachedrcr read_errorsrBrentrys r+fetch_onepassword_secretsr6s:*+:66OE8 8|*..B//5577K)$$ 2#/IR%  I7I&&  2foo&788 2''1 1!&&y2CYOO  " +F9  +,,h6 6  '7;''B z H   !GKu  (E$KkGDMM    OOCHH % % % 1 KKKKKK JJJDMMdikkJJJ!y)U,=yIII H s=E F$'FF)rxr(service_account_token_envraoverride_existingrr0enabledrxrrr ct}|s|St|\} } |j| i} | D]g\} } | |kr|j| &|s:tj | r|j| b| | | <h| s|St|}||_ ||r d|d|_ nd|_ |S t| |||||\}}n-#t$r }t||_ |cYd}~Sd}~wwxYw||_|j||D]\} }| |kr$| |jvr|j| /|sCtj | r$| |jvr|j| t|tj| <|j| |S)u^Resolve configured ``op://`` references and set them on ``os.environ``. Called by ``load_hermes_dotenv()`` after the .env files have loaded. Intentionally defensive — any failure returns a :class:`FetchResult` with ``error`` set (or surfaces warnings); it never raises. Parameters mirror the ``secrets.onepassword.*`` config keys so the caller can splat the dict in. References that are already satisfied by the current environment (when ``override_existing`` is false) are skipped *before* fetching, so ``op`` is never invoked for a value that would be discarded. N!secrets.onepassword.binary_path (!) is not an executable op binary.secrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r6r(rFrrr0)r rErAextendr;skippedr<rNrOrPrkraerrorrrr#rapplied)rrxr(rrarrr0resultr@rA refs_to_fetchrBrCrrfetch_warningsrrs r+apply_onepassword_secretsrsv.]]F  *3//OE8 O8$$$%'M[[]]"" c , , , N ! !$ ' ' '   RZ^^D%9%9  N ! !$ ' ' ' ! d  [ ! !FF ~  (K((( LL 3 L   ";$// # # #  3xx  FN O>***}} $ $ e , , ,6>))%%d+++   RZ^^D%9%9 6>))%%d+++   4d#### Ms1D D4D/)D4/D4cBeZdZdZdZdZdZdZdd Zdd Z dd Z ddZ dS)OnePasswordSourceu1Password as a registered secret source. Thin adapter over the module's fetch machinery. ``fetch()`` only *fetches* — precedence, override semantics, conflict warnings, and the ``os.environ`` writes are the orchestrator's job (see ``agent.secret_sources.registry.apply_all``). 1Password is a **mapped** source: the user explicitly binds each env var to an ``op://`` reference under ``secrets.onepassword.env``, so its claims outrank bulk sources (e.g. a Bitwarden project dump) on contested vars. onepassword 1Passwordmappedrccfgrr"rcrtt|to|ddS)NrT)rr=rrP)selfrs r+rz#OnePasswordSource.override_existings0 JsD))Pcgg6I4.P.PQQQr-ct}t|tr$t|dp|}t |hS)Nr)_DEFAULT_TOKEN_ENVr=rr#rP frozenset)rrrFs r+protected_env_varsz$OnePasswordSource.protected_env_varssI& c4  OCGG$?@@MINNI)%%%r-c Jddddidddddtddddd d dd d dd S)Nz Master switchF) descriptiondefaultz1Map of ENV_VAR -> op://vault/item/field referencez0op --account shorthand (empty = default account)rHzOEnv var holding the service-account token (unset = desktop/interactive session)z,Pin the op binary (empty = resolve via PATH)z!Disk+memory cache TTL; 0 disablesrz+Resolved values overwrite .env/shell valuesT)rrxr(rrarr)r)rs r+ config_schemazOnePasswordSource.config_schemas'65IIR R  G-** N C"" M""/   r-r0rr c (t|tr|ni}t}|d}t t|tr|nd\}}|j||s|sd|_tj |_ |St|dpd}t|}||_ |(|r d|d|_nd|_tj|_ |S t|dd } n#t t"f$rd } YnwxYw t%|t|d pdt|d pt&|| | \} } nN#t($rA} t| |_t+t| |_ |cYd} ~ Sd} ~ wwxYw| |_|j| |S)Nrxzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.rarHrrrrrgr@r(rr)r=rr rPrErArrr NOT_CONFIGURED error_kindr#rkraBINARY_MISSINGr TypeError ValueErrorrrr_classify_op_errorr) rrr0renv_mapr@rArarttlrrrs r+fetchzOnePasswordSource.fetch$sOT**2cc''%...!'400 :GGd  x x(((  =J %.$<!M#''-006B77 %%# > 3 333 > !* 8F M  3S99::CC:&   CCC  &? CGGI..4"55GG788N.ks7 5 5c3'> 5 5 5 5 5 5r-) unauthorizedz not signed inzsession expiredauthentication401403z empty valuec3 K|]}|vV dSrr&rs r+r_z%_classify_op_error..qs7 . .c3'> . . . . . .r-)network connectionz resolve hostdns) lowerr TIMEOUTrany AUTH_FAILED EMPTY_VALUENETWORKINTERNAL)rrs @r+rrcsmmooGg  g%%)<)G)G!W,,''  5 5 5 5&4 5 5 555%$$$$  . . . .&- . . ...!   r-Nonecltt|dS)zClear in-process AND disk caches. Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir. Without it we fall back to the same default resolution as the writer. N)rclearr/r4s r+_reset_cache_for_testsr|s+  LLNNNi     r-)r r!r"r#r)r0r1r"r)r6r7r"r8)rFr#r"r#)r6r[r"r#)rH)rar#r"r1)rlr#r"r#)rsr#r"r[) rcrr|r#r(r#rsr#r"r#)r6r[r(r#rFr#rr1rar#rrrrr0r1r"r8)rrrxr7r(r#rr#rar#rrrrr0r1r"r )rr#r"r )r0r1r"r)5r __future__rrSloggingrNrergrrpathlibrtypingrrrragent.secret_sources._cacher r r r agent.secret_sources.baser r getLoggerrloggerrrcompilerorwr#r!r__annotations___DISK_CACHE_BASENAMEr,r/r5rErZr`rkrrrzrrrrrrr&r-r+rsP%%%N#"""""  ............ >=======  8 $ $ 0 rz455 4 #sC$ % ')))))&,,,,#  '''''8EEEE*EEEE*****,BBBB . 444444~'!" $CCCCCC\%)%7"" $]]]]]]Jzzzzz zzzz2!!!!!!!r-