+ iHjRt^RIHt^RIt^RIHtHt^RIHt^RI H t H t H t H t ^RIHt!RR]4t!R R ]4tR R ltR RltRRltRtRRltRRltRRltRRltR#)aLogin-backend contract + registry for the browser credential vault. A ``LoginBackend`` lists login metadata (never secrets) and resolves ONE password at fill time. External managers (1Password, Bitwarden) additionally need a per-session unlock; ``resolve_password`` raises ``UnlockRequired`` while locked so the tool can ask the surface to prompt. Handles are namespaced by ``prefix`` so ``backend_for_handle`` needs no lookup table. ) annotationsN)ABCabstractmethod)Path)DictListOptionalSequence) VaultItemMetac2a]tRt^tRtRV3RlltRtV;t#)UnlockRequiredzXThe backend is locked for this session; the surface must prompt for the master password.cV^8dQhRR/#)backend LoginBackend)formats">/home/ubuntu/.hermes/hermes-agent/agent/vault_backends/base.py __annotate__UnlockRequired.__annotate__s c L<\SV`VP R24WnR#)z is lockedN)super__init__ display_namer)selfr __class__s&&rrUnlockRequired.__init__s# G001<= r)r)__name__ __module__ __qualname____firstlineno____doc__r__static_attributes__ __classcell__)rs@rr r sbrr c]tRt^t$R]R&R]R&R]R&RtR]R&RR ltR R lt]R R l4t ]RRl4t ]RRl4t RRlt RRlt RtR#)rstrnamerprefixFbool needs_unlockc V^8dQhRRRR/#)rhandler&returnr)r)rs"rrLoginBackend.__annotate__"s..3.4.rc 8VPVP4#N) startswithr(rr,s&&rownsLoginBackend.owns"s  --rcV^8dQhRR/#)rr-r)r)rs"rrr.%sTrc R#)Trrs&r is_unlockedLoginBackend.is_unlocked%srcV^8dQhRR/#)rr-zlist[VaultItemMeta]r)rs"rrr.)sff/frc R#)zWMetadata only. Locked external backends return [] (the agent sees a lock hint instead).Nrr7s&r list_itemsLoginBackend.list_items(rc V^8dQhRRRR/#)rr,r&r-zOptional[VaultItemMeta]r)rs"rrr.-sCCsC'>Crc R#r0rr2s&&rget_metaLoginBackend.get_meta,s@Crc V^8dQhRRRR/#)rr,r&r-r)rs"rrr.0sGGsGsGrc R#)z8Server-side only; raises ``UnlockRequired`` when locked.Nrr2s&&rresolve_passwordLoginBackend.resolve_password/r>rc V^8dQhRRRR/#)rr,r&r-z Optional[str]r)rs"rrr.3s#-rc R#)zCurrent one-time code for a login that stores a TOTP seed, else None (the user is asked). Server-side only, like resolve_password.Nrr2s&&r resolve_otpLoginBackend.resolve_otp3src V^8dQhRRRR/#)rr,r&r-dict[str, str]r)rs"rrr.8s;;S;^;rc (RVPV4/#)zFull payload of a payment/address item (server-side only). External managers list only logins, so the base returns the password-only shape.password)rEr2s&&rresolve_secretLoginBackend.resolve_secret8sD11&9::rrN)rrr r!__annotations__r*r3r8rr<rArErIrOr#rrrrrso I KL$.ffCCGG ;;rrc 0V^8dQhRRRRRRRRR RR R /#) rargv Sequence[str]envrLsecretr&timeoutfloatlabelr-subprocess.CompletedProcessr)rs"rrr>sA H H H~ Hs H]b H!$ H)D Hrc \P!\V4WR,RRRRVRR7 # \Pdp\ T RTR R 24ThR p?i\ dp\ R T R T 24ThR p?ii;i) udRun a manager CLI feeding *secret* on stdin (never argv, never env). Spawn/timeout → RuntimeError. Tutf-8replaceF)rUinputcapture_outputtextencodingerrorsrWcheck unlock timed out after .0fsNfailed to invoke : ) subprocessrunlistTimeoutExpired RuntimeErrorOSError)rSrUrVrWrYexcs&$$$$ rrun_with_stdin_secretrq>sH~~ JC}TPTYuN N  $ $VeW$CGHs'-0A=A A=%A=&A88A=c4V^8dQhRRRRRRRRRR R RR R /#) rrSrTrUrL secret_envr&rVrWrXrYr-rZr)rs"rrrKsK H Hm H^ HQT H^a Hlq H" H'B Hrc .\V4pW6V&\P!\V4V\PRRRRVRR7 # \P dp\ T RTR R24ThR p?i\dp\ R T R T 24ThR p?ii;i) zRun a manager CLI whose non-interactive contract reads the secret from a named env var. The variable is set on the child's environment only (never argv, never our process).Tr]r^F)rUstdinr`rarbrcrWrdrerfrgNrhri)dictrjrkrlDEVNULLrmrnro)rSrUrsrVrWrY child_envrps&$$$$$ rrun_with_secret_envryKsS I"jH~~ JIZ-?-?PT[_YuN N  $ $VeW$CGHs)5ABA// B<B=BBcV^8dQhRR/#)rr-rvr)rs"rrr[s00d0rc^RIHpV!4PR4;'g/p\V\4'dV#/#))load_config_readonlyvault)hermes_cli.configr}get isinstancerv)r}cfgs r_cfgr[s76  $ $W - 3 3CS$''3/R/rc ^RIHp^RIHpW3#)r|)BitwardenLoginBackend)OnePasswordLoginBackend)agent.vault_backends.bitwardenr agent.vault_backends.onepasswordr)rrs rexternal_backend_classesrasDH # ;;rc V^8dQhRRRR/#rr'r&r-r)r)rs"rrrgs * *s *t *rc\^RIp\4PV4;'g/p\V\4'd%\ VPR4;'gR4MRpV'd\ V4P4#VR8Xd^RIH pV!4RJ#VPR4RJ#)uRIs the manager CLI reachable — honouring a configured ``binary_path`` over PATH.N binary_path onepassword)find_opbw) shutilrrrrvr&ris_file agent.secret_sources.onepasswordrwhich)r'rsectionexplicitrs& r is_installedrgsfjj$$"G8B7D8Q8Qs7;;}-334WYHH~%%'' }<y$$ << T ))rc V^8dQhRRRR/#rr)rs"rrrtsSTrc\4PV4;'g/p\V\4'dVPR4RJdR#\ V4#)zAn installed manager is a login source unless the user opted out (``vault..enabled: false``). Zero-config on purpose: a user with ``bw``/``op`` on PATH should never have to discover a toggle.enabledF)rrrrvr)r'rs& r is_enabledrtsGfjj$$"G'4  W[[%;u%D  rcV^8dQhRR/#)rr-zlist[LoginBackend]r)rs"rrr}s  , rc :^RIHp\4pV!4.p\4Ftp\ VP 4'gK VP VP 4;'g/pTPT!\V\4'dTM/44Kv V#)zZLocal first (always on), then every detected external manager the user has not turned off.)LocalLoginBackend) agent.vault_backends.localrrrrr'rappendrrv)rroutclsrs renabled_backendsr}ss< &C023C') chh  ggchh'--2G JJsj$&?&?7RH I* Jrc V^8dQhRRRR/#)rr,r&r-zOptional[LoginBackend]r)rs"rrrsIIsI'=Irc@a\V3Rl\44R4#)c3X<"TFqPS4'gKVxK! R#5ir0)r3).0br,s& r %backend_for_handle..sA.q&&..s* *N)nextr)r,sfrbackend_for_handlers A,.A4 HHr)r" __future__rrjabcrrpathlibrtypingrrrr agent.vault_storer Exceptionr rrqryrrrrrrrrrrse##11+Y;3;D H H 0 < * Ir