+ iHj:a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t HtHt^RIHtHtHt^RIHtHtHtHtHtHtHtHt]P<!]4t ^t!Rt"R7t#]$]%]%]%]%3,t&Rt'R R lt(]!]'](R 7t)R ]*R &])PVt,Rt-]P\R83]P^R93]P`R:3]PbR;3]PdR<33t3RRlt4RRlt5RRlt6RRlt7R=RRllt8RRlt9RRlt:RRRR/R R!llt;RRR"]"R#RR$RR%R&R'R(R)R/R*R+llt!R3R4]4t?R>R5R6llt@]@tAR#)?u1Password (`op` CLI) secret source. Users map env-var names to ``op://vault/item/field`` references in ``secrets.onepassword.env``; each is resolved with one ``op read -- `` call using whatever auth the user's ``op`` already has (``OP_SERVICE_ACCOUNT_TOKEN`` headless, ``OP_SESSION_*`` interactive) — Hermes never authenticates on the user's behalf, and failures never block startup. Complete pulls are cached in-process and under ``/cache/op_cache.json`` (values only; auth material is fingerprinted, never stored). ) annotationsN)Path)DictListOptionalTuple) CachedFetch SecretCache fingerprint) ErrorKind FetchResult SecretSourceclassify_cli_error coerce_floatget_source_environmentis_valid_env_namerun_cliOP_SERVICE_ACCOUNT_TOKENz op_cache.jsonc V^8dQhRRRR/#) cache_key _CacheKeyreturnstr)formats"E/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/onepassword.py __annotate__r7s,,Y,3,c Vwrr4V RV RV 2#)|r)rauth_fpaccount_homerefs_fps& r _disk_key_strr%7s#'0$GeYay' ++r)key_serializerzSecretCache[_CacheKey]_STOREzyInstall the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.c V^8dQhRRRR/#)rmessagerrr r)rs"rrrOs888 8rc"\V\4#N)r_OP_ERROR_RULES)r)s&r_classify_op_errorr-Os g 77rc V^8dQhRRRR/#)r referencesOptional[dict[str, str]]r tuple[dict[str, str], list[str]]r)rs"rrrSs  %= Bb rc/p.pT;'g/P4Fwr4\V4'gVPRV: R24K.\V\4'gVPRV: R24K\VP 4P R4'gVPRV: RV: R24KVP 4W&K W3#)zU``(valid_refs, warnings)``: keep valid env names bound to stripped ``op://`` strings.z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsrappend isinstancerstrip startswith)r/validwarningsnamerefs& r_validate_referencesr=SsEH &&B--/  && OOix/IJ KC%% OOix/JK L''00 OOixr#8YZ [))+EK0 ?rc V^8dQhRRRR/#)r token_envrrr)rs"rrrcs****rc J\4pRV3RRR3UUu.uFwr#V RVPVR4 2NK pppT\V4Uu.uF(qUPR4'gKV RW, 2NK* up, p\ RP V44#uuppiuupi) zSHA-256 prefix over everything `op` would authenticate with (token, account, Connect host/token, ``OP_SESSION_*``), so a new identity never sees old cached values.token= OP_SESSION_ )r" OP_ACCOUNT) connect_hostOP_CONNECT_HOST) connect_tokenOP_CONNECT_TOKEN)rgetsortedr8 _fingerprintjoin)r? source_envlabelvarpartskeys& r_auth_fingerprintrTcs()J )7+-RPTUPT5':>>#r#:";<PTEU F:4F h4FS..YfJg(Qz'(4F hhE  %( )) Uis"B B &B c V^8dQhRRRR/#)rr/dict[str, str]rrr)rs"rrrns``.`S`rc^a\RPV3Rl\S4444#)rEc3><"TFq RSV, 2xK R#5i)rBNr).0r;r/s& r $_refs_fingerprint..os"!^K]4F!Jt,<+=">K]s)rMrNrL)r/sfr_refs_fingerprintr\ns#  !^6R\K]!^^ __rrCc V^8dQhRRRR/#)r binary_pathrrOptional[Path]r)rs"rrrrsnrcT;'g\P!R4pV'd4V'd.\P!V\P4'gR#\ V4#)uResolve a usable ``op`` binary, or None. A pinned ``binary_path`` is used verbatim — pinned-but-missing returns None rather than falling back to PATH.opN)shutilwhichosaccessX_OKr)r^founds& rfind_oprhrs@  - -6<<-E [;)H)H ;rc V^8dQhRRRR/#)rtextrrr)rs"rrr{s8888rcZ^RIHpV!V4PRR4P4#)z`Full ECMA-48 ANSI strip (so a control sequence can't hide text after a redaction marker) + trim.) strip_ansirC)tools.ansi_striprlreplacer7)rjrls& r_scrubrp{s&+ d  # #FB / 5 5 77rc V^8dQhRRRR/#)r token_valuerrrVr)rs"rrrss~rc\4p\Uu/uFq"V9gK W!V,bK ppVPRVP444V'dWR&RVR&V#uupi)c3^"TF#wrVPR4'gKW3xK% R#5i)rDN)r8)rYkvs& rrZ _op_child_env..s#T"4$! ]8Svv"4s- -r1NO_COLOR)r_OP_ENV_ALLOWLISTupdater4)rrrOruenvs& r _op_child_envr}si')J%6 J%6z/ 1m %6C JJJT*"2"2"4TT*5 &'C O J Ks A( A(r"rrc ,V^8dQhRRRRRRRRRR/#)rrar referencerr"rrrr)rs"rrrs0Tcsc[^rc \V4R.pV'd VRV., pVRV., p\V\V4\RR\ RV: 2RR7pVP^8wd]\ VP ;'gR 4R ,pV'd\R V: R V 24h\R VP RV: 24hVP;'gR PR4pVP4'g\RV: 24hV#)zResolve one ``op://`` reference; raises ``RuntimeError`` on any failure, including an exit-0 empty value (applying it would clobber a good credential with ``""``).readz --accountz--razop read timed out after zs for N)r|timeoutrPtimeout_messagestdinrC:NNzop read failed for r3zop read exited z for z z$op read returned an empty value for ) rrr}_OP_RUN_TIMEOUT returncoderpstderr RuntimeErrorstdoutrstripr7)rarr"rrcmdprocerrvalues&&$$ r _run_op_readrs"gv&C W%%D) C 3M+6W[%=o=NfU^Ta#bjn pD !T[[&&B'- !4YMC5IJ J_T__,=U9-PQQ[[  B & &v .E ;;==A)OPP Lrr?binaryr^ use_cacheTcache_ttl_seconds, home_pathc<V^8dQhRRRRRRRRRRR R R R R RRR/ #)rr/rVr"rr?rr_r^rboolrfloatrrr1r)rs"rrrsZ++!+,/+AD+ +03+EI++0>+& +rc&\V4wrV'g/V 3#\4PVR4P4p \ V4T;'gRVe \ V4MR\ V43p V'd2\PWV4p V e\V P4V 3#T;'g \V4p V f \R4h/p^p\V4Fp\WV,WR7VV&K V'dOV'gGV'd?\P!V \#\V4\$P$!4R7Wg4W3# \d/pT P\ T44T^, pRp?KRp?ii;i)u!Resolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises ``RuntimeError`` only when no ``op`` binary is available; per-ref failures become warnings. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rCNzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.)r"rr)secrets fetched_at)r=rrKr7rTrr\r'lookupdictrrhrrLrr5storertime)r/r"r?rr^rrrr9r:rrrcachedrar read_errorsr;excs$$$$$$$$ rfetch_onepassword_secretsrs\+:6OE 8|(*..y"=CCEK-i8'--R.7.CC NM^_dMegIyYG  '1 1  ' '7;'B zWX X!GKu  (4['cGDM Y DMdiik Z& 3    OOCH % 1 K s#E F"#F  Fc V^8dQhRRRR/#)rr^rrr)rs"rrrsoososorc$V'dRV: R2#R#)z!secrets.onepassword.binary_path (z!) is not an executable op binary.zsecrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r)r^s&r_missing_binary_errorrs2;/Abcc nrr|service_account_token_envoverride_existingc<V^8dQhRRRRRRRRRRR RR R R R RR/ #)renabledrr|r0r"rrr^rrrrr_rr r)rs"rrrs^00030EH0"0FI008=0P^0 0rc zaaa\4pV'gV#\V4wrVPPV 4RVV3RlloVPPV3RlV 44V P 4U U u/uFwrS!V 4'dKWbK p p p V 'gV#\ V4pWnVf\V4Vn V#\WSWVR7wppYn TPPT4TP 4FpwppS!T4'd/TTP9dTPPT4KBT\P T&TP"PT4Kr T#uup p i \dp\T4Tn TuRp?#Rp?ii;i)a(Resolve configured ``op://`` references and set them on ``os.environ`` (``hermes secrets onepassword sync --apply``). Never raises. Refs already satisfied by the env (when ``override_existing`` is false) and the token var are skipped *before* fetching, so ``op`` never runs for a discarded value.c V^8dQhRRRR/#)rr;rrrr)rs"rr/apply_onepassword_secrets..__annotate__skksktkrc<VS8H;'g8S'*;'d)\\PPV44#)zFTrue when ``name`` must not be applied (token var or env already set).)rrdenvironrK)r;rrs&r_guarded+apply_onepassword_secrets.._guardeds;00jj9J5J5i5itTVT^T^TbTbcgThOijrc3H<"TFpS!V4'gKVxK R#5ir+r)rYnrs& rrZ,apply_onepassword_secrets..s:Uhqk!!Us" "Nr/r"r?rrr)r r=r:extendskippedr4rhr^rerrorrrrrr5rdrapplied)rr|r"rr^rrrresultr9r:rr< refs_to_fetchrrfetch_warningsrr;rrs$$$d$d$$ @rapply_onepassword_secretsrsr]F  *3/OE OO8$kk NN:U::*/++-K-x{VQV-MK  [ !F ~,[9  ";$AZ)#UN OO>*}} e D>>6>>)%%d+   4d# ' M7L 3x  s*F F F F:F5/F:5F:c]tRtRtRtRtRtRtRtRt ] t Rt R t ]P] ]P ] ]P"]/tR R ltR R ltRtR#)OnePasswordSourcei z~1Password as a registered **mapped** source (explicit per-var bindings, so its claims outrank bulk sources on contested vars). onepassword 1PasswordmappedrarTzRun `hermes secrets onepassword token` to paste a fresh service-account token ({token_env}), or `op signin` for an interactive session.cV^8dQhRR/#)rrrr)rs"rrOnePasswordSource.__annotate__s   t  rc bRRRRR/RRRR//RRRRR /R RR R\/R RR RR /RRRRR/RRRRR//#)r descriptionz Master switchdefaultFr|z1Map of ENV_VAR -> op://vault/item/field referencer"z0op --account shorthand (empty = default account)rCrzOEnv var holding the service-account token (unset = desktop/interactive session)r^z,Pin the op binary (empty = resolve via PATH)rz!Disk+memory cache TTL; 0 disablesrrz+Resolved values overwrite .env/shell valuesT)_DEFAULT_TOKEN_ENV)selfs&r config_schemaOnePasswordSource.config_schemas   5I M#VXacef  'Y[dfhi '-:a*35G*I M+Y[dfhi -1TV_ad!e -1^`iko!p  rc$V^8dQhRRRRRR/#)rcfgrrrrr r)rs"rrr+s!$;rc  \V\4'dTM/p\4pVPR4p\ \V\4'dTMR4wrVVP P V4V'g+V'g!VPR\P4V#\VPR4;'gR4p\V4pWn Vf*VP\V4\P4#\T\VPR4;'gR4VP!V4V\#VPRR4R4VR 7wrYnTP P T 4T# \$d8p TP\T 4\'\T 444uRp ? #Rp ? ii;i) r|Nzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.r^rCr"rrgr@r)r6rr rKr=r:rfailr NOT_CONFIGUREDrrhr^rBINARY_MISSINGrr?rrr-r) rrrrenv_mapr9r:r^rrrrs &&& rfetchOnePasswordSource.fetch+suT**c''%..*Wd:S:SwY]^x( RS\SkSkmM#''-066B7 %# >;;4[A9C[C[\ \ G&? #cggi.@.F.FB*GSWSaSabeSfcggFY[^>_af1g#'% #G!~.  G;;s3x);CH)EF F Gs$ "F .;F G,G G GrN)__name__ __module__ __qualname____firstlineno____doc__r;rPshapescheme token_env_keyrdefault_token_envoverride_existing_default _AUTH_HINTr AUTH_FAILED AUTH_EXPIREDr_MISSING_BINARY_HINTremediation_hintsrr__static_attributes__rrrrr sr; D E E F/M*!%NJ".. Irs #  ..]]   8 $0  #sC$ % &, "--AR_!`` .']^=>,-HI 8  *`8RTV0+24+GY+!+68+LP+ #+AE+\o06:0KM0%70LN0#0@C0ae0f< <~ &r