+ iHj,Ha0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI H t ^RI HtHtHtHt^RIHtHtHtHtHtHt^RIHtHtHtHtH t H!t"H#t#H$t$H%t%]PL!]'4t(^t)]*]+]+]+3,t,Rt-Rt.^t/R t0R R lt1]!]-]1R 7t2R ]3R&]2Pht5]2Plt7]7Ppt9R6RRllt:]PvR73]PxR83]PzR93]P|R:33t?RRlt@RR/RRlltARR/RRlltBRRltCRRltDRR/RR lltERR/R!R"lltFR#RR$R%R&R'R(R)RRR*RR+^/R,R-lltGR.R/ltHR;R0R1lltI!R2R3]4tJR6R4R5lltK]KtLR#)`` call per fetch, cached in-process and on disk for ``cache_ttl_seconds``. Failures NEVER block startup. Subprocess-driven on purpose: one cross-platform binary beats the ``bitwarden-sdk-secrets`` Rust wheel. ) annotationsN)Path)DictListOptionalTuple) CachedFetch SecretCacheatomic_write_jsonentry_from_payload fingerprintresolve_cache_home) ErrorKind FetchResult SecretSourceclassify_cli_error coerce_floatis_valid_env_nameget_source_environmentrun_clisource_child_envzbws_cache.jsonzbws_cache.enc.jsonshermes-bws-encrypted-cache-v1c V^8dQhRRRR/#) cache_key _CacheKeyreturnstr)formats"C/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/bitwarden.py __annotate__r .siCc$RPV4#)|)join)rs&r_cache_key_strr%.s 88I r!)key_serializerzSecretCache[_CacheKey]_STOREc V^8dQhRRRR/#)r home_pathOptional[Path]rrr)rs"rr r 9sOO.ODOr!c<\V4R, \, #)cache)r _ENCRYPTED_CACHE_BASENAMEr)s&r_encrypted_disk_cache_pathr/9s i (7 25N NNr!c V^8dQhRRRR/#)rmessagerrrr)rs"rr r Is9999r!c"\V\4#N)r_BWS_ERROR_RULES)r1s&r_classify_bws_errorr5Is g'7 88r!install_if_missingFc V^8dQhRRRR/#)rr6boolrr*r)rs"rr r PsD^r!cj\P!R4;p'd \V4#^RIpVP R4pVe VP #V'd.VP R4VP R4P #R# \d"p\PRT4Rp?R#Rp?ii;i)zJExternal tools do not require PM platform support; acquire only on a miss.bwsNzbws auto-install failed: %s) shutilwhichrpminstalled_packagebinaryensure Exceptionloggerwarning)r6systemr=selectedexcs$ rfind_bwsrGPse$$v$F| ##E*H ? IIe ''.55 5  ? NN8# > >  ?s+B B2B--B2forcec V^8dQhRRRR/#)rrHr8rrr)rs"rr r bs..$.4.r!cf^RIpVPRRR7VPR4P#)zJExplicit setup/repair; PM re-verifies even a warm entry (including force).Nr:T)explicit)r=r@r>r?)rHr=s$ r install_bwsrLbs, IIedI#   & - --r!c V^8dQhRRRR/#)rrawbytesrrr)rs"rr r ms11u11r!cL\P!V4PR4#)ascii)base64 b64encodedecode)rNs&r_b64erUms   C ' ' 00r!c$V^8dQhRRRRRR/#)r access_tokenrsaltrOrr)rs"rr r qs& Q Qc Q Q5 Qr!c^RIHp^RIHpV!VP 4^ V\ R7P VPR44#)zHKDF the local cache key from the bootstrap BWS token. cryptography is imported lazily: eagerly mapping ``_rust.pyd`` on Windows blocks the updater replacing it.)hashes)HKDF) algorithmlengthrXinfoutf-8)cryptography.hazmat.primitivesrZ'cryptography.hazmat.primitives.kdf.hkdfr[SHA256_ENCRYPTED_CACHE_INFOderiveencode)rWrXrZr[s&& r_derive_encrypted_cache_keyrfqs< 6< &--/"4* ,,2F<3F3Fw3O,PQr!r)c ,V^8dQhRRRRRRRRR R /#) rrrrWrentry _CachedFetchr)r*rNoner)rs"rr r }s2isS_+9EIr!c F^RIHp\P!^4p\P!^ 4p\ V4p\ W4p\ P!RVPRVP/R R7PR4p V!V4PWiVPR44p R\RVR\V4R \V4R \V 4/p \\V4V 4\ P"P%V4R # \&dR #i;i) zPersist an AES-GCM encrypted last-good entry atomically (best-effort). The raw token only derives the key; a successful write removes the legacy plaintext cache.AESGCMsecrets fetched_at) separatorsr_versionkeyrXnonce ciphertextN),:)+cryptography.hazmat.primitives.ciphers.aeadrmosurandomr%rfjsondumpsrnroreencrypt_ENCRYPTED_CACHE_VERSIONrUr r/r'diskclearrA) rrWrhr)rmrXrsserialized_keyrr plaintextrtpayloads $$$$ r_write_encrypted_disk_cacher}sFzz"~ 2' 2),=JJ  |U5E5E FS] &/ C[((>;P;PQX;YZ 6~5;u|US]M^`4Y?I )$ sD D D D c ,V^8dQhRRRRRRRRR R /#) rrrrWrmax_age_secondsfloatr)r*rOptional[_CachedFetch]r)rs"rr r s2Yc\a*8DZr!c a V^8:dR#^RIHp\P!\ V4P RR74o \ V4p\S \4'd1S PR4\8wgS PR4V8wdR#V 3RlR 4wrgp\W4p \\P!V!V 4PWxVPR44PR444p V fR#\ P !4V P", p V ^8gW8dR#T # \$dR#i;i) zMDecrypted encrypted-cache entry if it matches ``cache_key`` and is in-window.Nrlz utf-8-sig)encodingrqrrc 3<"TFEp\P!\SPVR44P R4RR7xKG R#5i)rQT)validateN)rR b64decodergetre).0krs& r -_read_encrypted_disk_cache..sF#M,Kq$*#3#3C Ar8J4K4R4RSZ4[fj#k#k,KsA Ar_)rXrsrt)rwrmrzloadsr/ read_textr% isinstancedictrr}rfr decryptrerTtimerorA) rrWrr)rmrrXrsrtrrrh entry_agers $$$$ @r_read_encrypted_disk_cachers !F**7 BLLVaLbc' 27D));;y)-EE;;u%7#M,K#MZ),="4:: 3K  >3H3H3Q R Y YZa b$   =IIK%"2"22  1} (CtNN s%BD>A1D>4D><D>> E  E r?cache_ttl_seconds, use_cacheT server_urlrencrypted_cache_enabled!encrypted_cache_max_stale_secondsc@V^8dQhRRRRRRRRRR R RR RR R R RRR/ #)rrWr project_idr?r*rrrr8rr)rrr tuple[dict[str, str], list[str]]r)rs"rr r srKKK&)K3AKK/3KHKKK@DK(- K & Kr!c aaaaaS'g \R4hV'g \R4h\S4Y;'gR3oRVVV3RlloV'dBS^8d;\PSSSV'dVV3RlMRR7p V eV P.3#T;'g \ R R 7p V f \R 4h\ V SW4wr\)T \ P !4R7pT'dWS^8dT\P$S&T'd\+SSTSR7Y3#\PP-STSS4Y3# \dp T'd\\T 44\P\P39dR;rT'd S!T4pR pM3S^8d-\PPS\R 4S4pRpTek\R\ P !4TP", 4pT\P$S&TPRT RT R\'T4 R2.3uRp ? #hRp ? ii;i)uQPull the secrets for ``project_id`` from BSM → ``(secrets, warnings)``. ``server_url``: region / self-hosted instance (empty = US Cloud). With ``encrypted_cache_enabled`` fresh entries are written AES-GCM encrypted and a last-good entry may be served after NETWORK/TIMEOUT failures for up to ``encrypted_cache_max_stale_seconds`` — independent of the fresh TTL, so ``cache_ttl_seconds: 0`` can coexist with a break-glass offline cache. Raises ``RuntimeError`` on fatal conditions (missing binary, auth failure, unparseable output); env_loader catches, the setup wizard lets it propagate. zBitwarden access token is emptyzBitwarden project_id is emptyrc V^8dQhRRRR/#)rmax_agerrrr)rs"rr -fetch_bitwarden_secrets..__annotate__sXXX+AXr!c"<\SSVSR7#))rrWrr))r)rrWrr)s&r_read_encrypted0fetch_bitwarden_secrets.._read_encrypteds)IL:AYX Xr!c<S!S4#r3r)rrsr)fetch_bitwarden_secrets..s /@Ar!N) read_diskTr6ubws binary not available — auto-install failed and `bws` is not on PATH. Install manually from https://github.com/bitwarden/sdk-sm/releases or re-run `hermes secrets bitwarden setup`.zstale ENCRYPTED disk cacheinfzstale disk cachezbws live fetch failed (z); falling back to z (zs old))rnro)rrWrhr)) RuntimeError_token_fingerprintr'lookuprnrG _run_bws_listr5rrNETWORKTIMEOUTr~readrmaxrromemoryintrirwrite)rWrr?rrrr)rrcachedr:rnwarningsrFstalelabelagerhrrsd$$d$$d$$ @@rfetch_bitwarden_secretsrs( <== :;;#L1:?O?ORPIXX&* ()F]Acg   >>2% %  5 5H5C {?@ @ )#|ZT, TYY[ AE q ',FMM) $ " '),.3y J   KK  i0A9 M  =  ,SX69;L;LiN_N_:`` E&'(IJ4"Q& ((E%L)L* #tyy{U-=-==>+0 i(}}-cU2EeWBsSVxjX^_' )s%=E IC0IIIIc V^8dQhRRRR/#)rrNrrr)rs"rr r s 1 1s 1s 1r!ctVPRR4P4p.pVP4FhpVP4pVPR4'dM@VR9gK5\P !RRV4;p'gKWVP V4Kj V'dRPV4#T#)zReduce a bws (color-eyre) error dump to its numbered cause lines joined with ``; `` (dropping ``Location:``/``Backtrace`` on); raw text if unrecognized.rz^\d+:\s*z; )z Location:zBacktrace omittedz Run with )rzError:)replacestrip splitlines startswithresubappendr$)rNtextcauseslinestrippedcauses& r_summarize_bws_stderrrs ;;vr " ( ( *DF!::<   N O O  > ){BPX8Y/Yu/Y/Y MM% " !'499V 0D0r!c ,V^8dQhRRRRRRRRRR/#) rr:rrWrrrrrr)rs"rr r s0%%t%3%C%S%Zz%r!c \V4RRVRR.p\4pWR&VPRR4V'dW5R&\WE\RR \ R 2R 7pVP ^8wdV\ VP;'gVP;'gR 4p\R VP RVR, 24hVPP4pV'g/R.3#\P!V4p \T \4'g"\R\!T 4P" 24h/p .p T Fp \T \$4'd#T P'R4T P'R43MRwr\T\4'd\T\4'gKm\)T4'dYT&KT P+RT: R24K Y3# \Pdp \RT 24T hRp ? ii;i)secretlistz--outputrzBWS_ACCESS_TOKENNO_COLOR1BWS_SERVER_URLr:zbws timed out after zs fetching secrets)envtimeoutrtimeout_messagerz bws exited z: :NNz'bws returned no output (empty project?)zbws returned non-JSON output: Nzbws returned unexpected shape: rrvaluezSkipping secret z: not a valid env-var name)NN)rr setdefaultr_BWS_RUN_TIMEOUT returncoderstderrstdoutrrrzrJSONDecodeErrorrrtype__name__rr_is_valid_env_namer)r:rWrrcmdrprocerrrNrrFrnritemrrrs&&&& rrrs s8Xvz:v FC  C*NN:s# *  3)9%9:J9KK]#^ `D !#DKK$D$D4;;$D$D"E[(9CI;GHH ++   C =>>>L**S/ gt $ $!@ =*QST+U W -1Y[dfj!k ],QS\^bc =*\^gikl  r!c$V^8dQhRRRRRR/#)rcfgrr)rrrr)rs"rr r[s!((($(;(r!c \V\4'dTM/p\4pVPV4p\ 4P VR4P 4pV'g%VPRV R2\P4#\VP R4;'gR4pV'g!VPR\P4#\\VP RR44R7pWsn Vf!VPR \P4#VP R 4p\V\4'dTM/p\YVT\!VP R R 4R 4\VP RR4;'gR4P 4V\VP RR44\!VP R^4R4R7wrYnTP.P1T 4T# \"dqp TP\T 4\%\T 444TP&\P(8XdRT RTP* R2TnTuRp ? #Rp ? ii;i)rz&secrets.bitwarden.enabled is true but z3 is not set. Run `hermes secrets bitwarden setup`.rzMsecrets.bitwarden.project_id is empty. Run `hermes secrets bitwarden setup`.rTrNzhbws binary not available and auto-install is disabled. Run `hermes secrets bitwarden setup` to install.rrrgr@rrFrr)rWrr?rrr)rrz5Bitwarden rejected the machine-account access token (uF) — it was likely revoked, expired, or belongs to another region. ())rrr token_envrrrfailrNOT_CONFIGUREDrrGr8 binary_pathBINARY_MISSINGrrrr5 error_kind AUTH_FAILEDerrorrnrextend) rrr)resultrrWrr? encrypted_cfgrnrrFs &&& rfetchBitwardenSource.fetch[s7T**c>>#.-/334DbIOOQ ;;!GHXGYZQ QR[RjRjl l.44"5 ;;n(779 9T#''.$2O-PQ# >;; RS\SkSkm m 12 )3M4)H)H b   7)".sww7JC/PRW"Xsww|R8>>B?EEGS\(,]->->y%-P(Q2>}?P?PQdfg?hjm2n ! G!x(   KKC"5c#h"? @  I$9$99!$$4#56CCI<<.PQ!S M  s BH JA%I<6J<JrN)r __module__ __qualname____firstlineno____doc__namershapescheme token_env_keydefault_token_envoverride_existing_default _AUTH_HINTrr  AUTH_EXPIREDremediation_hintsrr__static_attributes__rr!rrr7siG D 'E E F&M*!% D #.. Ir>s #  ..   8 $ #sC- '08"--AR`!aa kk ##O'KLSTOP 95$..1 Q<@.;?>KDHK"K6:KNPK!%KGLK01 K\ 1%PLlL^ &r!