߲j=UdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z m Z mZddlmZmZmZddlmZmZmZmZmZmZmZmZej:eZdZ d Z!d Z"ee#e#e#e#fZ$d Z%d-d Z&ee%e& Z'de(d<e'jRZ*dZ+ejXdfejZdfej\dfej^dfej`dffZ1d.dZ2d/dZ3d0dZ4d1dZ5d2d3dZ6d4dZ7d5dZ8dddd6dZ9de!ddd d!dd" d7d#Z:d8d$Z;dde!dd d!dd% d9d&Z<Gd'd(eZ=d:d;d)Z>e>Z?ddl@Z@d*d+iZAd,ZBy)`` call using whatever auth the user's ``op`` already has (``OP_SERVICE_ACCOUNT_TOKEN`` headless, ``OP_SESSION_*`` interactive) — Hermes never authenticates on the user's behalf, and failures never block startup. Complete pulls are cached in-process and under ``/cache/op_cache.json`` (values only; auth material is fingerprinted, never stored). ) annotationsN)Path)DictListOptionalTuple) CachedFetch SecretCache fingerprint) ErrorKind FetchResult SecretSourceclassify_cli_error coerce_floatget_source_environmentis_valid_env_namerun_cliOP_SERVICE_ACCOUNT_TOKEN)PATHHOME USERPROFILEAPPDATA LOCALAPPDATA SystemRootTMPDIRTMPTEMPXDG_CONFIG_HOMEXDG_RUNTIME_DIR OP_CONFIG_DIR OP_ACCOUNTOP_CONNECT_HOSTOP_CONNECT_TOKENOP_LOAD_DESKTOP_APP_SETTINGSz op_cache.jsonc$|\}}}}|d|d|S)N|) cache_keyauth_fpaccount_homerefs_fps E/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/onepassword.py _disk_key_strr/7s''0$GWeWYay' ++)key_serializerzSecretCache[_CacheKey]_STOREzyInstall the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.)z timed out)znot found on pathznot an executablezfailed to invoke) unauthorizedz not signed inzsession expiredauthentication401403)z empty value)network connectionz resolve hostdnsc"t|tSN)r_OP_ERROR_RULES)messages r._classify_op_errorr>Os g 77r0cni}g}|xsijD]\}}t|s|jd|d't|ts|jd|dM|j j ds|jd|d|d|j ||<||fS)zU``(valid_refs, warnings)``: keep valid env names bound to stripped ``op://`` strings.z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsrappend isinstancestrstrip startswith) referencesvalidwarningsnamerefs r._validate_referencesrLSsEH &B--/& c & OOix/IJ KC% OOix/JK L''0 OOixr#8YZ [))+E$K& (?r0c *t}d|fdddfDcgc]\}}|d|j|d}}}|t|Dcgc]}|jds|d|| c}z }t dj |Scc}}wcc}w) zSHA-256 prefix over everything `op` would authenticate with (token, account, Connect host/token, ``OP_SESSION_*``), so a new identity never sees old cached values.token)r+r") connect_hostr#) connect_tokenr$= OP_SESSION_ )rgetsortedrF _fingerprintjoin) token_env source_envlabelvarpartskeys r._auth_fingerprintr_cs()J )7+-RPTU5':>>#r#:";<UEU F:4F hS#..YfJgQz#'( hhE  %( )) Uis!B B Bc\tdjfdtDS)NrTc32K|]}|d|yw)rQNr().0rJrGs r. z$_refs_fingerprint..os"!^4TF!Jt,<+=">!^s)rWrXrV)rGs`r._refs_fingerprintrdns#  !^6R\K]!^^ __r0rRc|xstjd}|r&|r%tj|tjsyt |S)uResolve a usable ``op`` binary, or None. A pinned ``binary_path`` is used verbatim — pinned-but-missing returns None rather than falling back to PATH.opN)shutilwhichosaccessX_OKr) binary_pathfounds r.find_oprnrs:  -6<<-E [;)H ;r0cZddlm}||jddjS)z`Full ECMA-48 ANSI strip (so a control sequence can't hide text after a redaction marker) + trim.r) strip_ansirR)tools.ansi_striprpreplacerE)textrps r._scrubru{s&+ d  # #FB / 5 5 77r0ct}tDcic] }||vs|||}}|jd|jD|r||d<d|d<|Scc}w)Nc3NK|]\}}|jds||fyw)rSN)rF)rbkvs r.rcz _op_child_env..s#T$!Q ]8S1vTs% %r1NO_COLOR)r_OP_ENV_ALLOWLISTupdaterA) token_valuerZrxenvs r. _op_child_envrsi')J%6 J!z/1jm  JC JJJT*"2"2"4TT*5 &'C O J Ks AAr+r~c t|dg}|r|d|gz }|d|gz }t|t|tddtd|d}|jd k7rJt |j xsd dd }|rtd |d |td|jd||jxsd jd}|jstd||S)zResolve one ``op://`` reference; raises ``RuntimeError`` on any failure, including an exit-0 empty value (applying it would clobber a good credential with ``""``).readz --accountz--rfzop read timed out after zs for N)rtimeoutr[timeout_messagestdinrrRzop read failed for r@zop read exited z for z z$op read returned an empty value for ) rDrr_OP_RUN_TIMEOUT returncoderustderr RuntimeErrorstdoutrstriprE)rf referencer+r~cmdprocerrvalues r. _run_op_readrs"gv&C W%%D) C 3M+6W[%=o=NfU^Ta#bjn pD !T[[&B'- !4YMC5IJ J_T__,=U9-PQQ[[ B & &v .E ;;=A)OPP Lr0T,)r+rYbinaryrl use_cachecache_ttl_seconds home_pathct|\}} |si| fStj|dj} t ||xsd| t |ndt |f} |r0tj| ||} | t| j| fS|xs t|} | tdi}d}t|D]} t| |||| ||<|rB|s@|r>tj!| t#t|t%j$|||| fS#t$r)}| jt ||dz }Yd}~d}~wwxYw)u1Resolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises ``RuntimeError`` only when no ``op`` binary is available; per-ref failures become warnings. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rRNzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.rr)secrets fetched_at)rLrrUrEr_rDrdr2lookupdictrrnrrVrrBstorer time)rGr+rYrrlrrrrHrIr~r)cachedrfr read_errorsrJexcs r.fetch_onepassword_secretsrsj+:6OE8 8|(*..y"=CCEK-i8'-R.7.CC NM^_dMegIy*;YG  '1 1  '7;'B zWX X!GKu  (U4['WbcGDM Y DMdiik Z&  3 H   OOCH % 1 K sD&& E/EEc|rd|dSy)Nz!secrets.onepassword.binary_path (z!) is not an executable op binary.zsecrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r()rls r._missing_binary_errorrs2;/Abcc nr0)rr+service_account_token_envrloverride_existingrrc6t}|s|St|\} } |jj| dfd |jjfd| D| j D cic]\} } | r| | } } } | s|St |}||_|t||_ |S t| ||||\}}||_ |jj||j D]e\}}|r*||jvr|jj|8|tj |<|j"j|g|Scc} } w#t$r}t||_ |cYd}~Sd}~wwxYw)a4Resolve configured ``op://`` references and set them on ``os.environ`` (``hermes secrets onepassword sync --apply``). Never raises. Refs already satisfied by the env (when ``override_existing`` is false) and the token var are skipped *before* fetching, so ``op`` never runs for a discarded value.cl|k(xs- xr(ttjj|S)zFTrue when ``name`` must not be applied (token var or env already set).)boolrienvironrU)rJrrs r._guardedz+apply_onepassword_secrets.._guardeds500j9J5J5itTVT^T^TbTbcgThOijr0c34K|]}|s |ywr;r()rbnrs r.rcz,apply_onepassword_secrets..s:hqk!:s NrGr+rYrrr)rJrDreturnr)r rLrIextendskippedrArnrlrerrorrrrDrrBrirapplied)enabledrr+rrlrrrresultrHrIrrK refs_to_fetchrrfetch_warningsrrJrrs ` ` @r.apply_onepassword_secretsrs{]F  *3/OE8 OO8$k NN:U::*/++-K3x{QVKMK  [ !FF ~,[9  ";$gAZ->)#UFN OO>*}}$ e D>6>>)%%d+   4d# $ M7L 3x  s*9E- E-=E33 F<F FFceZdZdZdZdZdZdZdZe Z dZ dZ e je e je e j eiZd d Zd d Zy )OnePasswordSourcez1Password as a registered **mapped** source (explicit per-var bindings, so its claims outrank bulk sources on contested vars). onepassword 1PasswordmappedrfrTzRun `hermes secrets onepassword token` to paste a fresh service-account token ({token_env}), or `op signin` for an interactive session.c Hddddidddddtddddd d dd d dd S)Nz Master switchF) descriptiondefaultz1Map of ENV_VAR -> op://vault/item/field referencez0op --account shorthand (empty = default account)rRzOEnv var holding the service-account token (unset = desktop/interactive session)z,Pin the op binary (empty = resolve via PATH)z!Disk+memory cache TTL; 0 disablesrz+Resolved values overwrite .env/shell valuesT)rrr+rrlrr)_DEFAULT_TOKEN_ENV)selfs r. config_schemazOnePasswordSource.config_schemasS'65I#Vcef'Yfhi:a5G*I,Zfhi1Tad!e1^ko!p  r0c Zt|tr|ni}t}|jd}t t|tr|nd\}}|j j ||s$|s |jdtj|St|jdxsd}t|}||_ |)|jt|tjS t|t|jdxsd|j!||t#|jddd| \} } | |_|j j | |S#t$$r7} |jt| t't| cYd} ~ Sd} ~ wwxYw) Nrzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.rlrRr+rrgr@r)rCrr rUrLrIrfailr NOT_CONFIGUREDrDrnrlrBINARY_MISSINGrrYrrr>r) rcfgrrenv_maprHrIrlrrrrs r.fetchzOnePasswordSource.fetch+sqT*c''%..*Wd:SwY]^xx( RS\SkSkmM#''-06B7 %# >;;4[A9C[C[\ \ G&? #cggi.@.FB*GSWSaSabeSfcggFY[^>_af1g#'% #G^!~.  G;;s3x);CH)EF F Gs-AE** F*3,F%F*%F*N)rr)rrrrrr )__name__ __module__ __qualname____doc__rJr[shapescheme token_env_keyrdefault_token_envoverride_existing_default _AUTH_HINTr AUTH_FAILED AUTH_EXPIREDr_MISSING_BINARY_HINTremediation_hintsrrr(r0r.rr sm; D E E F/M*!%NJ".. IrLr_rdrnrurrrrrrr_reset_cache_for_testshashlibrrr(r0r.rsF #  ..]]   8 $0  #sC$ % &, "--AR_!`` .']^=>,-HI 8  *`8>@TV235GY!bD"+!+,/+AD+ +03+EI++0>+& +\o7;2%7B"s`d0030EH0"0FI008=0P^0 0f< <~ &= Br0