߲jm UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlmZddlmZmZmZmZddlmZmZmZmZmZ m!Z!ddl"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z)m*Z*m+Z+m,Z,ejZe.Z/dZ0d e0Z1d e0d Z2d Z3d Z4ee5e5e5fZ6dZ7dZ8dZ9dZ:d>dZ;ee7e;Z/bin/bws`` (one pinned version, SHA-256-verified against the published checksum). The one bootstrap secret is the access token in ``.env``; every other key can live in BSM. One ``bws secret list `` call per fetch, cached in-process and on disk for ``cache_ttl_seconds``. Failures NEVER block startup. Subprocess-driven on purpose: one cross-platform binary beats the ``bitwarden-sdk-secrets`` Rust wheel. ) annotationsN)Path)DictListOptionalTuple) CachedFetch SecretCacheatomic_write_jsonentry_from_payload fingerprintresolve_cache_home) ErrorKind FetchResult SecretSourceclassify_cli_error coerce_floatis_valid_env_nameget_source_environmentrun_clisource_child_envz2.0.0z;https://github.com/bitwarden/sdk-sm/releases/download/bws-vzbws-sha256-checksums-z.txt<zbws_cache.jsonzbws_cache.enc.jsonshermes-bws-encrypted-cache-v1c$dj|S)N|)join) cache_keys C/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/bitwarden.py_cache_key_strr ;s 88I )key_serializerzSecretCache[_CacheKey]_STOREc,t|dz tz S)Ncache)r_ENCRYPTED_CACHE_BASENAME home_paths r_encrypted_disk_cache_pathr)Fs i (7 25N NNr!)z timed out)zbinary not availablezfailed to invoke) unauthorizedz invalid tokenz access token401403invalid_client invalid_grantz400 bad request)network connectionresolvedownloaddnsc"t|tSN)r_BWS_ERROR_RULES)messages r_classify_bws_errorr8Vs g'7 88r!c"ddlm}|dz S)z8Where Hermes stores its managed binaries. Profile-aware.rget_hermes_homebin)hermes_constantsr;r:s r_hermes_bin_dirr>]s0  u $$r!Finstall_if_missingcPttz }|jr&tj|tj r|St jd}|r t|S|r tSy#t$r }tjd|Yd}~yd}~wwxYw)zOManaged ``/bin/bws`` first, then PATH, then optional auto-install.bwszbws auto-install failed: %sN) r>_platform_binary_nameexistsosaccessX_OKshutilwhichr install_bws Exceptionloggerwarning)r@managedsystemexcs rfind_bwsrQds"7"99G~~BIIgrww7 \\% F F| ?=   ? NN8# > >  ?s1 A<< B%B  B%c8tjdk(rdSdS)NWindowszbws.exerB)platformrOr!rrCrCts )Y69AEAr!c tj}tjj}|dvrdnd}|dk(r dtdS|dk(r d|d tdS|d k(rjd } t j d d gdddddt j}d|j|jzjvrd}d|d|dtdStd|d|#tt jf$rYmkdirrCrDrxtempfileTemporaryDirectoryr_BWS_CHECKSUM_NAMErLinfo_BWS_RELEASE_BASE_http_download_expected_sha256 _sha256_filerkrtzipfileZipFile_pick_zip_member_safe_extract_membermkstempstrrEcloserHcopy2chmodr_rl)rybin_dirtarget asset_nametmpdirtmpzip_path checksum_pathexpectedactualzfmember extractedfdstageds rrJrJsG MM$M. ,. .F }}u %'J  $ $M :#f6l#00  $):(;1ZL&IJ+,Aj\:HE+,A.@-ABMR#M:>h' >> v||~ -!7 |;xjX^_e^fgh h __X & >"%b*?*ABF,R=I > %%#g,wG F   Y'  66"/#2 KK(,? M > >##s&CG<'"G0 BG<0G9 5G<<Hctjj|ddi} tjj|t5}t |d5}t j||ddddddy#1swYxYw#1swYyxYw#tjj$r}td|d||d}~wwxYw)Nz User-Agentz hermes-agent)headers)rewbzFailed to download : ) urllibrequestRequesturlopen_BWS_DOWNLOAD_TIMEOUTopenrH copyfileobjerrorURLErrorrt)urldestreqrespfrPs rrrs .. |^.L MCH ^^ # #C1F # G (4QUVZ\`Qa (ef   tQ ' ( ( ( ( ( ( << H0Ru=>CGHsM%B B A?.B 6B?B B  BBBC 4CC c|jddjD]>}|jj}t |dk\s0|d|k(s9|dcSt d|d|j ) zEParse standard ``sha256sum`` output (`` `` per line).r^r_)rcrdr`rzNo checksum entry for z in ) read_text splitlinesstripsplitlenrtname) checksum_filerlinepartss rrrs'''KVVX ""$ u:?uRyJ68O / |4 @R@R?ST UUr!ctj}t|d5tfddD]}|j | ddd|j S#1swY|j SxYw)Nrbc&jdS)Ni)read)rsrz_sha256_file..s!&&-r!r!)hashlibsha256riterupdate hexdigest)pathhchunkrs @rrrsiA dD Q/5 E HHUO  ;;= ;;=s &A!!A9c|jDcgc]}|jdd|k(s|}}|s#td|d|jdddt|tScc}w) zOFind the binary in the zip; tolerate a top-level dir, prefer the shortest path.r~rzCould not find z% inside downloaded archive (members: Nz...))key)namelistrrtminr)r binary_namen candidatess rrrsz[[]Naggcl2.>+.M!NJN _[M:((* bq(9':$@A A zs ## Os A,A,ctjj|}tjjtjj||} tjj ||g|k(xr||k7}|st d|d|j||t|S#t $rd}Y;wxYw)zExtract one member, refusing zip-slip: ``ZipFile.extract`` never verifies the joined path stays inside ``dest_dir``, so containment is checked here first.Fz*Refusing to extract unsafe archive member z%: it escapes the extraction directory) rErrealpathr commonpath ValueErrorrtextractr)rrdest_dir dest_rootr containeds rrrs  *I WW  bggll9f= >FGG&& 6':;yH`VW`M`  GzRABC CJJvy! <  s+B77 CCcJtj|jdS)Nascii)base64 b64encodedecode)raws r_b64ers   C ' ' 00r!cddlm}ddlm}||j d|t j |jdS)zHKDF the local cache key from the bootstrap BWS token. cryptography is imported lazily: eagerly mapping ``_rust.pyd`` on Windows blocks the updater replacing it.r)hashes)HKDF ) algorithmlengthsaltrr^)cryptography.hazmat.primitivesr'cryptography.hazmat.primitives.kdf.hkdfrSHA256_ENCRYPTED_CACHE_INFOderiveencode) access_tokenrrrs r_derive_encrypted_cache_keyrs< 6< &--/"4* ,,2F<3F3Fw3O,PQr!r'c2 ddlm}tjd}tjd}t |}t ||}t j|j|jddjd} ||j|| |jd} t|t|t|t| d } tt|| t j"j%|y #t&$rYy wxYw) zPersist an AES-GCM encrypted last-good entry atomically (best-effort). The raw token only derives the key; a successful write removes the legacy plaintext cache.rAESGCM secrets fetched_at),:) separatorsr^)versionrrnonce ciphertextN)+cryptography.hazmat.primitives.ciphers.aeadrrEurandomr rjsondumpsrrrencrypt_ENCRYPTED_CACHE_VERSIONrr r)r#diskclearrK) rrentryr(rrrserialized_keyr plaintextrpayloads r_write_encrypted_disk_cacher sFzz"~ 2' 2),=JJ U5E5E FS] &/ C[(( >;P;PQX;YZ 6~ ;uUS]M^`4Y?I )$ sDD DDc h |dkry ddlm}tjt |j d t |}t tr, jdtk7s jd|k7ry fdd D\}}}t||} ttj|| j|||jdjd} | yt!j | j"z } | dks| |kDrdS| S#t$$rYywxYw) zMDecrypted encrypted-cache entry if it matches ``cache_key`` and is in-window.rNrr^)rcrrc 3K|]C}tjtj|dj ddEyw)rT)validateN)r b64decodergetr).0kr s r z-_read_encrypted_disk_cache..#sH#M'($*#3#3C Ar8J4K4R4RSZ4[fj#k#k#MsA A )rrr)rrrloadsr)rr isinstancedictrrrr decryptrrtimerrK) rrmax_age_secondsr(rrrrrrr entry_ager s @r_read_encrypted_disk_cachers%!F**7 BLLV]L^_' 27D);;y)-EE;;u%7#M,K#MeZ),="4:: 3K  z>3H3H3Q R Y YZa b$   =IIK%"2"22  1} O(CtNN s%A;D%A0D%6,D%#D%% D10D1,Tr )binarycache_ttl_seconds use_cache server_urlr(encrypted_cache_enabled!encrypted_cache_max_stale_secondsc  s td|s tdt||xsdfdfd |r6dkDr1tj|rfdnd} | | jgfS|xs t d } | td  t | ||\} } t)| t!j }|rOdkDr|tj$<|rt+|| | fStjj-|| | fS#t$r} |rtt| tjtjfvrdx}}|r |}d }n1dkDr,tjjtd }d}|etdt!j |j"z }|tj$<|jd| d|dt'|dgfcYd} ~ Sd} ~ wwxYw)uqPull the secrets for ``project_id`` from BSM → ``(secrets, warnings)``. ``server_url``: region / self-hosted instance (empty = US Cloud). With ``encrypted_cache_enabled`` fresh entries are written AES-GCM encrypted and a last-good entry may be served after NETWORK/TIMEOUT failures for up to ``encrypted_cache_max_stale_seconds`` — independent of the fresh TTL, so ``cache_ttl_seconds: 0`` can coexist with a break-glass offline cache. Raises ``RuntimeError`` on fatal conditions (missing binary, auth failure, unparseable output); env_loader catches, the setup wizard lets it propagate. zBitwarden access token is emptyzBitwarden project_id is emptyr c"t|S)N)rrrr()r)max_agerrr(s r_read_encryptedz0fetch_bitwarden_secrets.._read_encryptedKs)IL:AYX Xr!rcSr5rU)r&rsrrz)fetch_bitwarden_secrets..Ss /@Ar!N) read_diskTr?ubws binary not available — auto-install failed and `bws` is not on PATH. Install manually from https://github.com/bitwarden/sdk-sm/releases or re-run `hermes secrets bitwarden setup`.zstale ENCRYPTED disk cacheinfzstale disk cachezbws live fetch failed (z); falling back to z (zs old)r)rrrr()r%floatreturnOptional[_CachedFetch])rt_token_fingerprintr#lookuprrQ _run_bws_listr8rrNETWORKTIMEOUTrrr+maxrrmemoryint _CachedFetchr write)r project_idrrrr r(r!r"cachedrBrwarningsrPstalelabelagerr&rs` ` ` @@rfetch_bitwarden_secretsr>4s( <== :;;#L1:z?ORPIX&* ()F]Acg   >>2% %  5H5C {?@ @ )#|ZT, TYY[ AE q ',FMM) $ " '),.3y J H  KK  i0A9 M H =  ,SX69;L;LiN_N_:`` EE&'(IJ4"Q& ((E%L)L* #tyy{U-=-==>+0 i(}}-cU2EeWBsSVxjX^_' )s%D HCG>7H=G>>Hc@|jddj}g}|jD]U}|j}|jdrn2|dvs+t j dd|x}sE|j |W|rdj|S|S)zReduce a bws (color-eyre) error dump to its numbered cause lines joined with ``; `` (dropping ``Location:``/``Backtrace`` on); raw text if unrecognized.r )z Location:zBacktrace omittedz Run with )r zError:z^\d+:\s*z; )r_rr startswithresubappendr)rrbcausesrstrippedcauses r_summarize_bws_stderrrHs ;;vr " ( ( *DF!!::<   N O  > ){BPX8Y/Yu/Y MM% ! !'499V 0D0r!c t|dd|ddg}t}||d<|jdd|r||d<t||td d td  }|j d k7rEt |jxs|jxsd}td|j d|dd|jj}|sidgfS tj|} t| ts!tdt!| j"i} g} | D]} t| t$r"| j'd| j'dfnd\}}t|trt|ts[t)|r|| |<l| j+d|d| | fS#tj$r} td| | d} ~ wwxYw)Nsecretlistz--outputrBWS_ACCESS_TOKENNO_COLOR1BWS_SERVER_URLrBzbws timed out after zs fetching secrets)envrer<timeout_messagerr z bws exited rz'bws returned no output (empty project?)zbws returned non-JSON output: zbws returned unexpected shape: rvalue)NNzSkipping secret z: not a valid env-var name)rr setdefaultr_BWS_RUN_TIMEOUT returncoderHrqrprtrrrJSONDecodeErrorrrKtype__name__rr_is_valid_env_namerD)rBrr8r cmdrPprocerrrr rPrr:itemrrSs rr0r0s s8Xvz:v FC  C*CNN:s# *  3C)9%9:J9KK]#^ `D !#DKK$D4;;$D"E[(9CI;GHH ++   C =>>>L**S/ gt $!@*<L1l-0"2/g7rrtr8 error_kind AUTH_FAILEDrrr:extend) rlcfgr(resultrcrr8r encrypted_cfgrr:rPs rfetchzBitwardenSource.fetchs3T*c>>#.-/334DbIOOQ ;;!GHXGYZQ QR[RjRjl l.4"5 ;;n(779 9T#''.$2O-PQ# >;; RS\SkSkm m 12 )3M4)H b   7)j".sww7JC/PRW"Xsww|R8>B?EEGS\(,]->->y%-P(Q2>}?P?PQdfg?hjm2n ! GX!x(   KKC"5c#h"? @  I$9$99!$$4#56CCI<<.PQ!S M  s 2BG$$ I-A#IIIN)r,r)r~rr(rr,r)rY __module__ __qualname____doc__rr<shapescheme token_env_keydefault_token_envoverride_existing_default _AUTH_HINTrr| AUTH_EXPIREDremediation_hintsrmrrUr!rr`r`sdG D 'E E F&M*!% D #.. Irtrrr:r}itemsskippedrDapplied)rgrcr8rjrrkr r(r!r"rrrrr:rPrrSs rapply_bitwarden_secretsrs4]F  ::>>"2B7==?L 45E4FG> >    4    6FF ~ ?    3%!/!$;.O  FN OO8$mmo # U " " NN ! !# &  RZZ^^C%8 NN ! !# &  3c" # M) 3x  s6E E9E4.E94E9 DiskCache)zagent.secret_sources._cacherctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncer) _PLUGIN_COMPAT_LAZYrAttributeErrorrY importlibhermes_cli.plugin_compatrgetattr import_module)rrrrs r __getattr__rwse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AAr!)r _CacheKeyr,rr5)r(Optional[Path]r,r)r7rr,r)r,r)r@rxr,r)r,r)ryrxr,r)rrrrr,None)rrrrr,r)rrr,r)rzipfile.ZipFilerrr,r)rrrrrrr,r)rbytesr,r)rrrrr,r) rrrrrr6r(rr,r) rrrrrr+r(rr,r-)rrr8rrrrr+rrxr rr(rr!rxr"r+r, Tuple[Dict[str, str], List[str]])rrr,r)r ) rBrrrr8rr rr,r)r(rr,r)rgrxrcrr8rrjrxrr+rkrxr rr(rr!rxr"r+r,r)cr __future__rrrrloggingrErTrBrHrmrr urllib.errorrurllib.requestrpathlibrtypingrrrragent.secret_sources._cacher r6r r r r r.ragent.secret_sources.baserrrrrrrZrrr getLoggerrYrLrlrrrrUrr_DISK_CACHE_BASENAMEr&rrr r#__annotations__r4_CACHEr _DISK_CACHEr_disk_cache_pathr)r2rzr|r1r6r8r>rQrCrxrJrrrrrrrr rr>rHr0r`r_reset_cache_for_testsstatrrrrUr!rrs: #     ..   8 $ QR^Q_`,\N$? #sC- '08"--AR`!aa kk ##O'KLSTOP 9%,1  BY2"'$NHV$ &1 Q=A+9EI0<@*8DZ@EI"db $e/0 KK&)K3AKK/3KHKKK@DK(- K & K\ 1%PLlL^ & /#" $$)/0V VV V  V  VVVV"V(-VVt= Br!