.cjMdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZdd lmZdd lmZmZmZmZdd lmZd Zd Zd*dZd+dZd+dZd+dZ d+dZ!d+dZ"d+dZ#d+dZ$d,d Z%d-d#Z&d$d%d.d)Z'dS)/uCLI handlers for ``hermes secrets onepassword ...``. Subcommands: setup — verify the op CLI, set account / token env var, enable status — show config + op binary + auth + configured references set — map an env var to an ``op://…`` reference remove — drop a mapping sync — resolve references now and show what would be applied (dry-run) disable — flip ``secrets.onepassword.enabled`` to False Unlike Bitwarden, the ``op`` binary is NOT auto-installed: 1Password publishes the CLI through OS package managers and signed installers, so Hermes expects an already-installed, already-authenticated ``op`` and never downloads one. ) annotationsN)Path)Optional)Console)Panel)Table) onepassword) get_env_path load_config save_configsave_env_value)masked_secret_promptOP_SERVICE_ACCOUNT_TOKENz5https://developer.1password.com/docs/cli/get-started/ parent_parserargparse.ArgumentParserreturnNonec|d}|dd}|dd|dd td |d d |d d|t |dd}|t |dd}|d d|ddd|t|dd}|dd|dd|t|dd }|dd!|t|d"d#}|d$dd%|t|d&d'}|td(S))z>Attach the ``onepassword`` subcommand tree to a parent parser.secrets_op_command)destsetupz:Verify the op CLI, set account / token env var, and enable)help --accountz=1Password account shorthand or sign-in address (op --account)z --token-envz1Env var holding a service-account token (default )z--tokenz8Service-account token to store in .env non-interactivelyz --binary-pathz2Absolute path to the op binary (skips PATH lookup))funcstatusz$Show config + op binary + referencestokenz?Rotate the service-account token: validate and store it in .envz@Provide the new token non-interactively (default: masked prompt)z --no-verify store_truez7Store without probing 1Password first (not recommended))actionrsetz$Map an env var to an op:// referenceenv_varz.Environment variable name, e.g. OPENAI_API_KEY referencez51Password reference, e.g. op://Private/OpenAI/api keyremoveu'Remove an env-var → reference mappingz"Environment variable name to unmapsyncz.Resolve references now and report what changedz--applyzIActually export resolved values into the current shell (default: dry-run)disablez"Turn off the 1Password integrationN) add_subparsers add_parser add_argument_DEFAULT_TOKEN_ENV set_defaults cmd_setup cmd_status cmd_tokencmd_set cmd_removecmd_sync cmd_disable) rsubrrrset_pr#r$r%s D/home/ice/.hermes/hermes-agent/hermes_cli/onepassword_secrets_cli.py register_clir5/s  & &,@ & A AC NN I   E  L  VAS V V V  G  A I&&& ^^H+Q^ R RF Z((( NN N   E  O  F  I&&& NN5'MN N NE y'WXXX {)`aaa G$$$ ^^H+T^ U UF  (LMMM Z((( >>&'W> X XD X  8$$$nnY-QnRRG k*****argsargparse.Namespaceintcdt}|tjdtddt }|didi}||d|jp|dd pd }tj |}|P|r|d |d n|d |d tdS|d|dt|d|r||d<|j rT|j r;|j |d<|d|dd||d|jp|dpt }||d<|jpd }|rGt#|||t$j|<|dt)d|nt$j|r|d|nYt+||dd }|r|d|dn|d|dd|d<|di|dd |d!dt-|||d"|d#d$S)%Nz[bold]1Password secret source setup[/bold] Hermes resolves [cyan]op://vault/item/field[/cyan] references through your already-installed, already-authenticated 1Password CLI (`op`). Don't have it yet? Install + sign in: [cyan][/cyan]cyan) border_stylesecretsr z&[bold]Step 1[/bold] Locate the op CLI binary_pathu [red]✗ z& is not an executable op binary.[/red]u& [red]✗ op not found on PATH.[/red]z Install the 1Password CLI: u [green]✓[/green] z (raccountz Account: [cyan]z#[bold]Step 2[/bold] Authenticationservice_account_token_envu5 [green]✓[/green] service-account token stored in  as u6 [green]✓[/green] using service-account token from u0 [green]✓[/green] using existing op session (z [yellow]No service-account token and no active op session detected.[/yellow] Either run [cyan]op signin[/cyan] (desktop/interactive) or set a service-account token in z, then re-run status.Tenabledenvcache_ttl_seconds,override_existingu6[green]✓ 1Password secret source is enabled.[/green]z Map credentials: [cyan]hermes secrets onepassword set OPENAI_API_KEY "op://Private/OpenAI/api key"[/cyan] Preview: [cyan]hermes secrets onepassword sync[/cyan] Status: [cyan]hermes secrets onepassword status[/cyan]r)rprintrfit _DOCS_URLr setdefaultr?getstripop_srcfind_op _op_versionrB token_envr)rr osenvironr _op_whoamir ) r7consolecfgop_cfgr?binaryrSrwhos r4r+r+usiiG MM  Nr rErBr@rCr?rFF)r) show_headerboxpaddingboldstyleEnabledAccountz[dim]default[/dim]z Token env varz Token in envzOverride existingrITz Cache TTL (s)rGrHz op binaryz (rz[yellow]not found[/yellow] Referencesz1Password secret sourcer<)titler=r^ header_styleEnv var Referencez? Run [cyan]hermes secrets onepassword setup[/cyan] to enable.rz% [green]Active op session:[/green] z$ [yellow]No active op session and uK is unset — Hermes will warn and skip 1Password on next startup.[/yellow]uv [yellow]No references mapped yet.[/yellow] Add one: [cyan]hermes secrets onepassword set ENV_VAR "op://…"[/cyan])rr rNboolstrrOr) isinstancedictrTrUrPrQr add_columnadd_row_ynrRlenrJrsortedrV)r7rWrXrYrErBrSr? references token_setrZtable ref_tablenamer[s r4r,r,s iiG --Cggi  &B + +M : : @bF6::i(())G&**Y++1r2288::G 68JKKIfjj339r::@@BBK&0E1B1BD&I&IQE"""rJRZ^^I..//I ^K ( (F ev > > >E Rv&&& R MM)S\\*** MM)W<(<=== MM/9--- MM.#i..111 MM%s4 ;NPT0U0U+V+V'W'WXXX MM/3vzz2Es'K'K#L#LMMM A kf#F#F F0C0C#F#F#FGGGG k#?@@@ MM,C OO 4 4555 MM%%>VTTTUUU!d@@@ Yf555[))):&& ; ;D   dC 4(8$9$9 : : : : i    XYYYq i))   MMH3HH I I I I MMP PPP       O    1r6c~t}tj|j|ji\}}|j|vr |D]}|d|ddSt }|didi}|d}t|tsi}||d<||j||j<t||d|jd||j|d s|d d S) N[red][/red]rAr>r rFu [green]✓[/green] mapped [cyan]u [/cyan] → rEuy [yellow]Note: the integration is disabled — run [cyan]hermes secrets onepassword setup[/cyan] to turn it on.[/yellow]r) rrP_validate_referencesr!r"rJr rMrNrnror )r7rWvalidwarningswrXrYenv_maps r4r.r.s`iiG14<2PQQOE8 |5   - -A MM+!+++ , , , ,q --C ^^Ir * * 5 5mR H HFjjG gt $ $ u !$,/GDL MM !4< ! !   ! ! ::i    T    1r6ct}t}|didi}|d}t |t r |j|vr |d|jddS||j=t||d|jdd S) Nr>r rFz[yellow]z is not mapped.[/yellow]rAu-[green]✓[/green] removed mapping for [cyan]r;r) rr rMrNrnror!rJr )r7rWrXrYrs r4r/r/ siiG --C ^^Ir * * 5 5mR H HFjjG gt $ $ G(C(C GGGGHHHq  MMW$,WWWXXX 1r6c&t}t}|dpidpi}|dt}t |ddpd}t |ddpd}|jpd}|sotj s| ddS| d td |d }|s| d dS|j stj|}| | dtddS| dt!|||} | | ddS| d| dt#|||t$j|<tj| dt+d|d|ds| ddS)u-Rotate the 1Password service-account token without the full setup flow. Prompts for (or accepts via ``--token``) a new service-account token, verifies it with ``op whoami`` (unless ``--no-verify``), and only then persists it to .env — so a bad paste never bricks the working token. r>r rCrBr@r?u2[red]No TTY — pass the token with --token.[/red]rAucCreate a new service-account token at https://my.1password.com → Developer → Service Accounts. zPaste new token (z): z![red]Empty token, aborting.[/red]Nu&[red]op CLI not found — install it (z3) or re-run with --no-verify to store anyway.[/red]uVerifying with `op whoami`… token_valueuD[red]✗ New token was rejected by op — nothing was changed.[/red]u#[green]✓ Token accepted[/green] (z).u[green]✓[/green] stored in rDz.. Takes effect on the next Hermes invocation.rEu[yellow]Note: the 1Password integration is currently disabled — run `hermes secrets onepassword setup` to turn it on.[/yellow]r)rr rNr)rmrOrsysstdinisattyrJr no_verifyrPrQrLrVr rTrU clear_cachesr ) r7rWrXrYrSrBr?rrZr[s r4r-r-.siiG --Cggi  &B + +M : : @bF 68JKKI&**Y++1r2288::Gfjj339r::@@BBK Z 2 $ $ & &E Qy!!  MMN O O O1  M   %%G%G%G%GHHNNPP  9:::q >E ,, > MMAAAA   1 5666e<<< ; MMV   1 CCCCCDDD9e$$$!BJy  MM 6  6 6I 6 6 6 ::i    M    1r6c t}t}|dpidpi}|ds|ddSt |dt r|dni}|s|ddSt |d d pd }|d t}t |d d pd }|j r^tj d ||||t|dd d}|j r |d|j ddStd d} | dd| dt!|jD]} | | dt!|jD]} | | d|| |jD]} |d| |dt+|jddS tj||||d\} } n1#t.$r$}|d|dYd}~dSd}~wwxYwt|dd }td d} | dd| dt!|D]} | |kr| | d| | vr| | d :t0j| r|s| | d!rtt0j| }| | d"|rd#nd z|| | D]} |d| |d$dS)%Nr>r rEzb[yellow]1Password integration is disabled. Run `hermes secrets onepassword setup` first.[/yellow]rArFus[yellow]No op:// references configured. Add one with `hermes secrets onepassword set ENV_VAR "op://…"`.[/yellow]rrBr@rCr?TrI)rErFrBrCr?rIrGr{r|rarhrjr<rbActionz[green]exported[/green]z,[dim]skipped (already set / token var)[/dim]z[yellow]warning:[/yellow] z [green]Exported z( secret(s) into current process.[/green]F)rurBrSr? use_cachezim]skip (token var)[/dim]z$[red]unresolved (see warnings)[/red]z[dim]skip (already set)[/dim]zreen]would export[/green]z (overrides)u This was a dry-run — references resolve automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.)rr rNrJrnrormrOr)applyrPapply_onepassword_secretsrlerrorrrprtappliedrqskippedrrsfetch_onepassword_secrets RuntimeErrorrTrU)r7rWrXrYrurBrSr?resultrwryrr>rexcoverridealreadys r4r0r0lsiiG --Cggi  &B + +M : : @bF ::i   A   q&0E1B1BD&I&IQE"""rJ   N   q&**Y++1r2288::G 68JKKIfjj339r::@@BBK z1&/#"6::.A4#H#HII    <  MM6&,666 7 7 71$V<<< &111 """6>** ; ;D MM$ 9 : : : :6>** P PD MM$ N O O O O e < > > >  MM$ F G G G G Z^^D ! ! (  MM$ ? @ @ @ @2:>>$//00G MM-71RPRS     MM% 88 61667777 MM * 1s=K L$LLct}t}|didi}d|d<t||ddS)Nr>r FrEu[green]Disabled.[/green] 1Password references will NOT be resolved on the next Hermes invocation. Your reference mappings are left in config.yaml — remove them with [cyan]hermes secrets onepassword remove ENV_VAR[/cyan] if you no longer need them.r)rr rMr rJ)r7rWrXrYs r4r1r1sqiiG --C ^^Ir * * 5 5mR H HFF9 MM  1r6brlrmc|rdndS)Nz[green]yes[/green]z [dim]no[/dim])rs r4rrrrs#$ 9  /9r6rZrc tjt|dgddd}|jdkr8|jp|jdSn#ttj f$rYnwxYwdS)Nz --versionT)capture_outputtexttimeoutrzversion unknown) subprocessrunrm returncodestdoutstderrrO splitlinesOSErrorTimeoutExpired)rZress r4rRrRs  n [[+ &     >Q  J,#*3355@@BB1E E  Z. /      sA)A--BBr@rrBr Optional[str]ct|dg}|r|d|gz }tj}|dd|r||d< t j||ddd}n#tt jf$rYd SwxYw|j d krd S|j pd }| d d d dpdS)zReturn a short identity string if op is authenticated, else None. ``token_value``, when given, is passed to the child as ``OP_SERVICE_ACCOUNT_TOKEN`` so a candidate token can be probed without touching the caller's environment. whoamirNO_COLOR1rT )rFrrrNrr@  x authenticated) rmrTrUcopyrMrrrrrrrOreplace)rZrBrcmdrFrouts r4rVrVs v;; !C& W%% *//  CNN:s###6*5 &'n SD"    Z. /tt ~t :  " " $ $C ;;tS ! !$3$ ' :?:sA11B  B )rrrr)r7r8rr9)rrlrrm)rZrrrm)rZrrBrmrrmrr)(__doc__ __future__rargparserTrrpathlibrtypingr rich.consoler rich.panelr rich.tableragent.secret_sourcesr rPhermes_cli.configr r r r hermes_cli.secret_promptrr)rLr5r+r,r.r/r-r0r1rrrRrVrr6r4rs  #"""""   666666 :99999/ C >+>+>+>+LN N N N b8 8 8 8 v    >     ; ; ; ; |\ \ \ \ ~     *::::     79;;;;;;;;r6