.cj7cUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZmZddlmZmZmZmZddlmZmZejeZdZd Zejd Zd Z ee!e!e!e!fZ"iZ#d e$d <dZ%dGdZ&ee%e&Z'de$d<dHdIdZ(dJdZ)dKd Z*dLd"Z+dMdNd%Z,dOd'Z-dPd)Z.d#d#d*dQd.Z/d#edd#d/d0dd1dRd7Z0dd#ed#d/d0dd8dSd>Z1Gd?d@eZ2dTdCZ3dHdUdEZ4dHdUdFZ5dS)Vu1Password (`op` CLI) secret source. Resolve provider credentials from 1Password ``op://vault/item/field`` references at process startup so they don't have to live in plaintext in ``~/.hermes/.env``. Design summary -------------- * Users map environment-variable names to official 1Password secret references in ``secrets.onepassword.env``:: secrets: onepassword: enabled: true env: OPENAI_API_KEY: "op://Private/OpenAI/api key" ANTHROPIC_API_KEY: "op://Private/Anthropic/credential" * After ``.env`` loads, each reference is resolved with a single ``op read -- `` call and injected into ``os.environ`` (the same point in startup as the Bitwarden source). * Authentication is whatever the user's ``op`` CLI already uses — a service-account token (``OP_SERVICE_ACCOUNT_TOKEN``) for headless boxes, or a desktop/interactive session (``OP_SESSION_*``). Hermes never authenticates on the user's behalf; it shells out to an already-trusted, already-authenticated CLI. * Failures NEVER block startup. A missing ``op`` binary, expired auth, a bad reference, or a permission error each surface a one-line warning and Hermes continues with whatever credentials ``.env`` already had. The atomic-write / ``0600`` / TTL cache mechanics are shared with the other backends via :mod:`agent.secret_sources._cache` — successful, complete pulls are cached in-process and on disk under ``/cache/op_cache.json`` so back-to-back short-lived ``hermes`` invocations don't re-shell ``op`` for every reference. The disk file holds only resolved secret *values*; auth material is fingerprinted, never stored. ) annotationsN)Path)DictListOptionalTuple) CachedFetch DiskCache FetchResultis_valid_env_name) ErrorKind SecretSourceOP_SERVICE_ACCOUNT_TOKENz\x1b\[[0-?]*[ -/]*[@-~])PATHHOME USERPROFILEAPPDATA LOCALAPPDATA SystemRootTMPDIRTMPTEMPXDG_CONFIG_HOMEXDG_RUNTIME_DIR OP_ACCOUNTOP_CONNECT_HOSTOP_CONNECT_TOKENOP_LOAD_DESKTOP_APP_SETTINGSzDict[_CacheKey, CachedFetch]_CACHEz op_cache.json cache_key _CacheKeyreturnstrc$|\}}}}|d|d|S)aSerialize a cache key for on-disk storage, omitting home_path. The disk file is already partitioned by home (it lives under ``/cache/``), so the path provides the home dimension; folding it into the key string too would be redundant. |)r!auth_fpaccount_homerefs_fps B/home/ice/.hermes/hermes-agent/agent/secret_sources/onepassword.py _disk_key_strr-ys.(1$GWeW + + + +' + ++)key_serializerr _DISK_CACHE home_pathOptional[Path]rc6t|S)zAPath to the on-disk cache (exposed for tests and direct callers).)r0pathr1s r,_disk_cache_pathr6s   I & &&r. referencesOptional[Dict[str, str]] Tuple[Dict[str, str], List[str]]ci}g}|piD]\}}t|s|d|d.t|ts|d|d]|}|ds|d|d|d|||<||fS)uReturn ``(valid_refs, warnings)`` from an ``env`` mapping. A reference is kept only if its target env-var name is a valid POSIX name and the value is a stripped ``op://…`` reference string. Everything else produces a warning and is dropped (never fatal). z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsr append isinstancer$strip startswith)r7validwarningsnamerefcleaneds r,_validate_referencesrFsEH &B--//   c &&  OOJJJJ K K K #s##  OOKKKK L L L ))++!!'**  OONDNNcNNN    d (?r. token_envcxdtj|ddtjdddtjdddtjddg}ttjD]A}|d r*||d tj|Bd |}tj| d  d dS)u)SHA-256 prefix over the auth material `op` would use. Folds in the service-account token, ``OP_ACCOUNT``, the 1Password Connect ``OP_CONNECT_HOST``/``OP_CONNECT_TOKEN``, and *all* ``OP_SESSION_*`` vars (the names `op` actually exports for interactive sessions — ``OP_SESSION_``). Signing out and into a different identity therefore changes the cache key, so a value cached under a previous identity is never served under a new one. Never logged or displayed; the raw token never leaves this hash. ztoken=zaccount=rz connect_host=rzconnect_token=r OP_SESSION_= utf-8N) osenvirongetsortedr@r=joinhashlibsha256encode hexdigest)rGpartskeymaterials r,_auth_fingerprintr[s 1 2..0052:>>,3355? '8"==??A(:B??AA E bj!!55 >>- ( ( 5 LLC33"*S/33 4 4 4yyH >(//'22 3 3 = = ? ? DDr.Dict[str, str]cdfdtD}tj|dddS)u<SHA-256 prefix over the configured name→reference mapping.rLc32K|]}|d|VdS)rKNr').0rCr7s r, z$_refs_fingerprint..s6UU$D55:d#355UUUUUUr.rMNrN)rSrRrTrUrVrW)r7rZs` r,_refs_fingerprintrasbyyUUUU&BTBTUUUUUH >(//'22 3 3 = = ? ? DDr.rI binary_pathc|rFt|}|r!tj|tjr|SdSt jd}|rt|ndS)u[Resolve a usable ``op`` binary, or None. When ``binary_path`` is set it is used verbatim and PATH is NOT consulted — pinning an absolute path is a way to avoid trusting whatever ``op`` shows up first on ``PATH``. A pinned-but-missing path returns None (the caller surfaces a clear error) rather than silently falling back. Nop)rexistsrOaccessX_OKshutilwhich)rbpinnedfounds r,find_oprlslk"" ==?? ry99 Mt L  E )4;;;T)r.textctd|ddS)zCRemove ANSI control sequences and trim, for safe message surfacing.rI) _ANSI_CSI_REsubreplacer?)rms r,_scrubrss4   B % % - -fb 9 9 ? ? A AAr. token_valueci}tD](}tj|}||||<)tjD]\}}|dr|||< |r||d<d|d<|S)zEBuild a minimal allowlisted environment for the ``op`` child process.NrJr1NO_COLOR)_OP_ENV_ALLOWLISTrOrPrQr<r@)rtenvrYvals r, _op_child_envr{sC jnnS!! ?CHJ$$&&S >>- ( ( CH6*5 &'C O Jr.r)rtrd referencer)c t|dg}|r|d|gz }|d|gz } tj|t|ddddt}nR#tj$r }t dtd ||d }~wt$r}t d ||d }~wwxYw|jd krOt|j pd d d}|rt d|d|t d|jd||j pd d}| st d||S)uResolve a single ``op://`` reference to its value. Raises :class:`RuntimeError` on any failure — including a ``returncode 0`` with empty output, which would otherwise silently clobber a good ``.env``/shell credential with ``""``. readz --accountz--TrMrr)rycapture_outputrmencodingerrorstimeoutzop read timed out after zs for Nzfailed to invoke op: rrIzop read failed for r;zop read exited z for z z$op read returned an empty value for )r$ subprocessrunr{_OP_RUN_TIMEOUTTimeoutExpired RuntimeErrorOSError returncodersstderrstdoutrstripr?) rdr}r)rtcmdprocexcerrvalues r, _run_op_readrs"ggv&C& W%%D) CC~ k**#     $ K K Ki K K    CCC838899sBC !T[&B''-  KIYIICIIJJ J Ado A AI A A   [ B & &v . .E ;;==QO)OOPPP Ls#-AB  A;; B BB T,)r)rGbinaryrb use_cachecache_ttl_secondsr1rrboolrfloatct|\}} |si| fStj|d} t ||pd|t |ndt|f} |rt| } | r+| |rt| j | fSt | ||} | | t| <t| j | fS|pt|}|tdi}d}t!|D]]} t#||||| ||< #t$r1}| t ||dz }Yd}~Vd}~wwxYw|rZ|sX|rVt't|t)j}|t| <t| ||||| fS)uResolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises :class:`RuntimeError` only when no ``op`` binary is available — a fatal "can't fetch anything" condition. Per-reference failures (expired auth, bad reference, empty value) are collected as warnings and the reference is dropped, so one bad entry never sinks the rest. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rINzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.rr|)secrets fetched_at)rFrOrPrQr?r[r$rar is_freshdictrr0rrlrrRrr=r timewrite)r7r)rGrrbrrr1rArBrtr!cached disk_cachedrdr read_errorsrCrentrys r,fetch_onepassword_secretsr<s:*+:66OE8 8|*..B//5577K)$$ 2#/IR%  I7I&&  2foo&788 2''1 1!&&y2CYOO  " +F9  +,,h6 6  '7;''B z H   !GKu  (E$KkGDMM    OOCHH % % % 1 KKKKKK JJJDMMdikkJJJ!y)U,=yIII H s=E F$'FF)ryr)service_account_token_envrboverride_existingrr1enabledryrrr ct}|s|St|\} } |j| i} | D]g\} } | |kr|j| &|s:tj | r|j| b| | | <h| s|St|}||_ ||r d|d|_ nd|_ |S t| |||||\}}n-#t$r }t||_ |cYd}~Sd}~wwxYw||_|j||D]\} }| |kr$| |jvr|j| /|sCtj | r$| |jvr|j| t|tj| <|j| |S)u^Resolve configured ``op://`` references and set them on ``os.environ``. Called by ``load_hermes_dotenv()`` after the .env files have loaded. Intentionally defensive — any failure returns a :class:`FetchResult` with ``error`` set (or surfaces warnings); it never raises. Parameters mirror the ``secrets.onepassword.*`` config keys so the caller can splat the dict in. References that are already satisfied by the current environment (when ``override_existing`` is false) are skipped *before* fetching, so ``op`` is never invoked for a value that would be discarded. N!secrets.onepassword.binary_path (!) is not an executable op binary.secrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r7r)rGrrr1)r rFrBextendr<skippedr=rOrPrQrlrberrorrrr$rapplied)rryr)rrbrrr1resultrArB refs_to_fetchrCrDrrfetch_warningsrrs r,apply_onepassword_secretsrsv.]]F  *3//OE8 O8$$$%'M[[]]"" c , , , N ! !$ ' ' '   RZ^^D%9%9  N ! !$ ' ' ' ! d  [ ! !FF ~  (K((( LL 3 L   ";$// # # #  3xx  FN O>***}} $ $ e , , ,6>))%%d+++   RZ^^D%9%9 6>))%%d+++   4d#### Ms1D D4D/)D4/D4cTeZdZdZdZdZdZdZdd Zdd Z dd Z ddZ dfd Z xZ S)OnePasswordSourceu1Password as a registered secret source. Thin adapter over the module's fetch machinery. ``fetch()`` only *fetches* — precedence, override semantics, conflict warnings, and the ``os.environ`` writes are the orchestrator's job (see ``agent.secret_sources.registry.apply_all``). 1Password is a **mapped** source: the user explicitly binds each env var to an ``op://`` reference under ``secrets.onepassword.env``, so its claims outrank bulk sources (e.g. a Bitwarden project dump) on contested vars. onepassword 1Passwordmappedrdcfgrr#rcrtt|to|ddS)NrT)rr>rrQ)selfrs r,rz#OnePasswordSource.override_existings0 JsD))Pcgg6I4.P.PQQQr.ct}t|tr$t|dp|}t |hS)Nr)_DEFAULT_TOKEN_ENVr>rr$rQ frozenset)rrrGs r,protected_env_varsz$OnePasswordSource.protected_env_varssI& c4  OCGG$?@@MINNI)%%%r.c Jddddidddddtddddd d dd d dd S)Nz Master switchF) descriptiondefaultz1Map of ENV_VAR -> op://vault/item/field referencez0op --account shorthand (empty = default account)rIzOEnv var holding the service-account token (unset = desktop/interactive session)z,Pin the op binary (empty = resolve via PATH)z!Disk+memory cache TTL; 0 disablesrz+Resolved values overwrite .env/shell valuesT)rryr)rrbrr)r)rs r, config_schemazOnePasswordSource.config_schema s'65IIR R  G-** N C"" M""/   r.r1rr c (t|tr|ni}t}|d}t t|tr|nd\}}|j||s|sd|_tj |_ |St|dpd}t|}||_ |(|r d|d|_nd|_tj|_ |S t|dd } n#t t"f$rd } YnwxYw t%|t|d pdt|d pt&|| | \} } nN#t($rA} t| |_t+t| |_ |cYd} ~ Sd} ~ wwxYw| |_|j| |S)Nryzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.rbrIrrrrrgr@r)rr)r>rr rQrFrBrrr NOT_CONFIGURED error_kindr$rlrbBINARY_MISSINGr TypeError ValueErrorrrr_classify_op_errorr) rrr1renv_maprArBrbrttlrrrs r,fetchzOnePasswordSource.fetch*sOT**2cc''%...!'400 :GGd  x x(((  =J %.$<!M#''-006B77 %%# > 3 333 > !* 8F M  3S99::CC:&   CCC  &? CGGI..4"55GG788Nrr$rQrsuper remediation)rkindrrG __class__s r,rzOnePasswordSource.remediationhs I)9+AB B B*I#t$$ S(C D D Q RR '*3'''  9+ + +7   ww""4---r.)rrr#r)rr)r#r)rrr1rr#r )rrr#r$)__name__ __module__ __qualname____doc__rClabelshapeschemerrrrr __classcell__)rs@r,rrs   D E E FRRRR&&&&     <<<<<|..........r.rmessager cP|dvr tjSdvsdvsdvr tjSt fddDr tjSdvr tjSt fdd Dr tjStjS) z@Best-effort mapping of op failure text onto the shared taxonomy.z timed outznot found on pathznot an executablezfailed to invokec3 K|]}|vV dSNr'r_toklowereds r,r`z%_classify_op_error..s7 5 5c3'> 5 5 5 5 5 5r.) unauthorizedz not signed inzsession expiredauthentication401403z empty valuec3 K|]}|vV dSrr'rs r,r`z%_classify_op_error..s7 . .c3'> . . . . . .r.)network connectionz resolve hostdns) lowerr TIMEOUTranyr EMPTY_VALUENETWORKINTERNAL)rrs @r,rr{smmooGg  g%%)<)G)G!W,,''  5 5 5 5&4 5 5 555%$$$$  . . . .&- . . ...!   r.Nonecltt|dS)zDrop in-process AND disk caches. Used after a token rotation (`hermes secrets onepassword token`) so the next startup resolves fresh with the new credential instead of serving values cached under the old token's fingerprint. N)r clearr0r5s r, clear_cachesrs+ LLNNNi     r.c$t|dS)zClear in-process AND disk caches. Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir. Without it we fall back to the same default resolution as the writer. N)rr5s r,_reset_cache_for_testsrs r.)r!r"r#r$r)r1r2r#r)r7r8r#r9)rGr$r#r$)r7r\r#r$)rI)rbr$r#r2)rmr$r#r$)rtr$r#r\) rdrr}r$r)r$rtr$r#r$)r7r\r)r$rGr$rr2rbr$rrrrr1r2r#r9)rrryr8r)r$rr$rbr$rrrrr1r2r#r )rr$r#r )r1r2r#r)6r __future__rrTloggingrOrerhrrpathlibrtypingrrrragent.secret_sources._cacher r r r agent.secret_sources.baser r getLoggerrloggerrrcompilerprxr$r"r __annotations___DISK_CACHE_BASENAMEr-r0r6rFr[rarlrsr{rrrrrrrr'r.r,rsi%%%N#"""""  ............ >=======  8 $ $ 0 rz455 : #sC$ % ')))))&,,,,#  '''''8EEEE0EEEE*****,BBBB . 444444~'!" $CCCCCC\%)%7"" $]]]]]]JL.L.L.L.L. L.L.L.^2!!!!!r.