NQj@dZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z ddlmZdd lmZdd lmZmZmZmZd Zd Zd%dZd&dZd&dZd&dZd&dZd&dZd&dZ d'dZ!d(d!Z"d)d$Z#dS)*uCLI handlers for ``hermes secrets onepassword ...``. Subcommands: setup — verify the op CLI, set account / token env var, enable status — show config + op binary + auth + configured references set — map an env var to an ``op://…`` reference remove — drop a mapping sync — resolve references now and show what would be applied (dry-run) disable — flip ``secrets.onepassword.enabled`` to False Unlike Bitwarden, the ``op`` binary is NOT auto-installed: 1Password publishes the CLI through OS package managers and signed installers, so Hermes expects an already-installed, already-authenticated ``op`` and never downloads one. ) annotationsN)Path)Optional)Console)Panel)Table) onepassword) get_env_path load_config save_configsave_env_valueOP_SERVICE_ACCOUNT_TOKENz5https://developer.1password.com/docs/cli/get-started/ parent_parserargparse.ArgumentParserreturnNonec|d}|dd}|dd|dd td |d d |d d|t |dd}|t |dd}|dd|dd|t|dd}|dd|t|dd}|ddd |t|d!d"}|td#S)$z>Attach the ``onepassword`` subcommand tree to a parent parser.secrets_op_command)destsetupz:Verify the op CLI, set account / token env var, and enable)help --accountz=1Password account shorthand or sign-in address (op --account)z --token-envz1Env var holding a service-account token (default )z--tokenz8Service-account token to store in .env non-interactivelyz --binary-pathz2Absolute path to the op binary (skips PATH lookup))funcstatusz$Show config + op binary + referencessetz$Map an env var to an op:// referenceenv_varz.Environment variable name, e.g. OPENAI_API_KEY referencez51Password reference, e.g. op://Private/OpenAI/api keyremoveu'Remove an env-var → reference mappingz"Environment variable name to unmapsyncz.Resolve references now and report what changedz--apply store_truezIActually export resolved values into the current shell (default: dry-run))actionrdisablez"Turn off the 1Password integrationN) add_subparsers add_parser add_argument_DEFAULT_TOKEN_ENV set_defaults cmd_setup cmd_statuscmd_set cmd_removecmd_sync cmd_disable)rsubrrset_prr r#s F/home/alina/.hermes/hermes-agent/hermes_cli/onepassword_secrets_cli.py register_clir2-sM  & &,@ & A AC NN I   E  L  VAS V V V  G  A I&&& ^^H+Q^ R RF Z((( NN5'MN N NE y'WXXX {)`aaa G$$$ ^^H+T^ U UF  (LMMM Z((( >>&'W> X XD X  8$$$nnY-QnRRG k*****argsargparse.Namespaceintcdt}|tjdtddt }|didi}||d|jp|dd pd }tj |}|P|r|d |d n|d |d tdS|d|dt|d|r||d<|j rT|j r;|j |d<|d|dd||d|jp|dpt }||d<|jpd }|rGt#|||t$j|<|dt)d|nt$j|r|d|nYt+||dd }|r|d|dn|d|dd|d<|di|dd |d!dt-|||d"|d#d$S)%Nz[bold]1Password secret source setup[/bold] Hermes resolves [cyan]op://vault/item/field[/cyan] references through your already-installed, already-authenticated 1Password CLI (`op`). Don't have it yet? Install + sign in: [cyan][/cyan]cyan) border_stylesecretsr z&[bold]Step 1[/bold] Locate the op CLI binary_pathu [red]✗ z& is not an executable op binary.[/red]u& [red]✗ op not found on PATH.[/red]z Install the 1Password CLI: u [green]✓[/green] z (raccountz Account: [cyan]z#[bold]Step 2[/bold] Authenticationservice_account_token_envu5 [green]✓[/green] service-account token stored in z as u6 [green]✓[/green] using service-account token from u0 [green]✓[/green] using existing op session (z [yellow]No service-account token and no active op session detected.[/yellow] Either run [cyan]op signin[/cyan] (desktop/interactive) or set a service-account token in z, then re-run status.Tenabledenvcache_ttl_seconds,override_existingu6[green]✓ 1Password secret source is enabled.[/green]z Map credentials: [cyan]hermes secrets onepassword set OPENAI_API_KEY "op://Private/OpenAI/api key"[/cyan] Preview: [cyan]hermes secrets onepassword sync[/cyan] Status: [cyan]hermes secrets onepassword status[/cyan]r)rprintrfit _DOCS_URLr setdefaultr<getstripop_srcfind_op _op_versionr? token_envr'tokenr osenvironr _op_whoamir ) r4consolecfgop_cfgr<binaryrOrPwhos r1r)r)dsiiG MM  N > >E Rv&&& R MM)S\\*** MM)W<(<=== MM/9--- MM.#i..111 MM%s4 ;NPT0U0U+V+V'W'WXXX MM/3vzz2Es'K'K#L#LMMM A kf#F#F F0C0C#F#F#FGGGG k#?@@@ MM,C OO 4 4555 MM%%>VTTTUUU!d@@@ Yf555[))):&& ; ;D   dC 4(8$9$9 : : : : i    XYYYq i))   MMH3HH I I I I MMP PPP       O    1r3c~t}tj|j|ji\}}|j|vr |D]}|d|ddSt }|didi}|d}t|tsi}||d<||j||j<t||d|jd||j|d s|d d S) N[red][/red]r>r;r rBu [green]✓[/green] mapped [cyan]u [/cyan] → rAuy [yellow]Note: the integration is disabled — run [cyan]hermes secrets onepassword setup[/cyan] to turn it on.[/yellow]r) rrL_validate_referencesrrrFr rIrJrkrlr )r4rTvalidwarningswrUrVenv_maps r1r+r+s`iiG14<2PQQOE8 |5   - -A MM+!+++ , , , ,q --C ^^Ir * * 5 5mR H HFjjG gt $ $ u !$,/GDL MM !4< ! !   ! ! ::i    T    1r3ct}t}|didi}|d}t |t r |j|vr |d|jddS||j=t||d|jdd S) Nr;r rBz[yellow]z is not mapped.[/yellow]r>u-[green]✓[/green] removed mapping for [cyan]r8r) rr rIrJrkrlrrFr )r4rTrUrVr~s r1r,r,siiG --C ^^Ir * * 5 5mR H HFjjG gt $ $ G(C(C GGGGHHHq  MMW$,WWWXXX 1r3c t}t}|dpidpi}|ds|ddSt |dt r|dni}|s|ddSt |d d pd }|d t}t |d d pd }|j r^tj d ||||t|dd d}|j r |d|j ddStd d} | dd| dt!|jD]} | | dt!|jD]} | | d|| |jD]} |d| |dt+|jddS tj||||d\} } n1#t.$r$}|d|dYd}~dSd}~wwxYwt|dd }td d} | dd| dt!|D]} | |kr| | d| | vr| | d :t0j| r|s| | d!rtt0j| }| | d"|rd#nd z|| | D]} |d| |d$dS)%Nr;r rAzb[yellow]1Password integration is disabled. Run `hermes secrets onepassword setup` first.[/yellow]r>rBus[yellow]No op:// references configured. Add one with `hermes secrets onepassword set ENV_VAR "op://…"`.[/yellow]rr?r=r@r<TrE)rArBr?r@r<rErCrxryr^rergr9r_Actionz[green]exported[/green]z,[dim]skipped (already set / token var)[/dim]z[yellow]warning:[/yellow] z [green]Exported z( secret(s) into current process.[/green]F)rrr?rOr< use_cachezim]skip (token var)[/dim]z$[red]unresolved (see warnings)[/red]z[dim]skip (already set)[/dim]zreen]would export[/green]z (overrides)u This was a dry-run — references resolve automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.)rr rJrFrkrlrjrKr'applyrLapply_onepassword_secretsrierrorrrmrqappliedrnskippedr|rpfetch_onepassword_secrets RuntimeErrorrQrR)r4rTrUrVrrr?rOr<resultrtrvr}r;r|excoverridealreadys r1r-r-siiG --Cggi  &B + +M : : @bF ::i   A   q&0E1B1BD&I&IQE"""rJ   N   q&**Y++1r2288::G 68JKKIfjj339r::@@BBK z1&/#"6::.A4#H#HII    <  MM6&,666 7 7 71$V<<< &111 """6>** ; ;D MM$ 9 : : : :6>** P PD MM$ N O O O O e < > > >  MM$ F G G G G Z^^D ! ! (  MM$ ? @ @ @ @2:>>$//00G MM-71RPRS     MM% 88 61667777 MM * 1s=K L$LLct}t}|didi}d|d<t||ddS)Nr;r FrAu[green]Disabled.[/green] 1Password references will NOT be resolved on the next Hermes invocation. Your reference mappings are left in config.yaml — remove them with [cyan]hermes secrets onepassword remove ENV_VAR[/cyan] if you no longer need them.r)rr rIr rF)r4rTrUrVs r1r.r.|sqiiG --C ^^Ir * * 5 5mR H HFF9 MM  1r3brirjc|rdndS)Nz[green]yes[/green]z [dim]no[/dim])rs r1roros#$ 9  /9r3rWrc tjt|dgddd}|jdkr8|jp|jdSn#ttj f$rYnwxYwdS)Nz --versionTcapture_outputtexttimeoutrzversion unknown) subprocessrunrj returncodestdoutstderrrK splitlinesOSErrorTimeoutExpired)rWress r1rNrNs  n [[+ &     >Q  J,#*3355@@BB1E E  Z. /      sA)A--BBr? Optional[str]c4t|dg}|r|d|gz } tj|ddd}n#ttjf$rYdSwxYw|jdkrdS|jpd}|d d dd pd S) zAReturn a short identity string if op is authenticated, else None.whoamirT rNrr=  x authenticated) rjrrrrrrrKreplace)rWr?cmdrouts r1rSrSs v;; !C& W%%nSD"MMM Z. /tt ~t :  " " $ $C ;;tS ! !$3$ ' :?:s5AA)rrrr)r4r5rr6)rrirrj)rWrrrj)rWrr?rjrr)$__doc__ __future__rargparserQrpathlibrtypingr rich.consoler rich.panelr rich.tableragent.secret_sourcesr rLhermes_cli.configr r r r r'rHr2r)r*r+r,r-r.rorNrSrr3r1rs  #"""""  6666660 C /+/+/+/+nN N N N b8 8 8 8 v    >     \ \ \ \ ~     *::::     ; ; ; ; ; ;r3