+ jHjRRt^RIHt^RIt^RIt^RIt^RIt^RIHt^RI H t H t H t H t ^RIHt^RIHt^RIHt^RIHtHt^R IHtR R ltR R ltRRltRRltRRltRRltRRltRRlt R)RRllt!RRlt"RRlt#R R!lt$R"R#R$R/R%R&llt%R'R(lt&R#)*zHelpers shared by the Bitwarden and 1Password ``hermes secrets`` CLIs. Import-light on purpose: ``hermes_cli.secrets_cli`` must stay free of the Bitwarden backend (``cryptography``) at import time, so nothing here touches a secret-source backend. ) annotationsN)Path)CallableIterableOptionalSequence)Console)Panel)Table) load_config save_config)masked_secret_promptc V^8dQhRRRR/#)bboolreturnstr)formats"?/home/ubuntu/.hermes/hermes-agent/hermes_cli/_secrets_common.py __annotate__rs::$:3:cV'dR#R#)z[green]yes[/green]z [dim]no[/dim]r)rs&rynrs#$ 9/9rc$V^8dQhRRRRRR/#)rcfgdictsectionrrr)rs"rrrs!99T9C9D9rcjVPR4;'g/PV4;'g/#)z&``cfg["secrets"][section]`` or ``{}``.secrets)get)rrs&&r section_cfgr"s, GGI  $ $" ) )' 2 8 8b8rc$V^8dQhRRRRRR/#)rrrkeyrrr)rs"rrr!s!///C/C/rch\VPVR4;'gR4P4#)z8A stripped string config value; ``""`` for missing/None.)rr!strip)rr$s&&rcfg_strr(!s) swwsB%%2 & , , ..rc$V^8dQhRRRRRR/#rnamer help_textrtupler)rs"rrr&s!00c0c00rc  V\RRV/VB3#)z;One ``add_argument`` spec for :func:`register_subcommands`.helpr)r)r+r,kwargss&&,rargr1&s /9// //rc$V^8dQhRRRRRR/#r*r)rs"rrr+s!55s5s5u5rc\WRR7#)z?A boolean ``store_true`` spec for :func:`register_subcommands`. store_true)action)r1)r+r,s&&rflagr6+s t| 44rc(V^8dQhRRRRRRRR/#) rparentzargparse.ArgumentParserdestrcommandsrrNoner)rs"rrr0s*''!8''x'\`'rcVPVR7pVFHwrErgVPWER7pVFwrVP!V 3/V BK VPVR7KJ R#)zLAttach ``(name, help, handler, [arg(...), ...])`` subcommands to ``parent``.)r9)r/)funcN)add_subparsers add_parser add_argument set_defaults) r8r9r:subr+r,r= argumentsparserarg_namer0s &&& rregister_subcommandsrF0se   T  *C,4(5 ) H    3F 3!*& -5rc ,V^8dQhRRRRRRRRRR /#) rconsolerrrproductrcommandrrr)rs"rrr:s0W4#PTrchVPR4'dR#VPRV RV R24R#)zTPrint the "integration is disabled" hint and return False unless ``cfg["enabled"]``.enabledTz[yellow]z/ integration is disabled. Run `hermes secrets z setup` first.[/yellow]F)r!print)rHrrIrJs&&&&rrequire_enabledrN:s= wwy MMHWI&%%,I-DFG rc(V^8dQhRRRRRRRR/#) rrHrtitlerrowsrrr;r)rs"rrrCs.BBBB8BBrc\RRR R7pVPRRR7VPR4VFwrEVPWE4K VP\ W1RR74R#) zGTwo-column key/value table inside a cyan panel (the ``status`` layout).FN) show_headerboxpaddingr&bold)stylecyan)rP border_style)r)r add_columnadd_rowrMr )rHrPrQtablelabelvalues&&& rprint_status_panelr`Cs\ ev >E Rv& R  e# MM%@Arc 0V^8dQhRRRRRRRRR R R R /#) rrHrcolumnsrrQrwarningsz Iterable[str]indentrrr;r)rs"rrrMsA@@@8@8@'@69@CG@rc&\RRR7pVF4p\V\4'dV/3MTwrxVP!V3/VBK6 VFp VP!V !K VP V4VFp VP V RV 24K R#)zHeaded table; ``columns`` entries are ``header`` or ``(header, add_column kwargs)``. ``warnings`` are echoed after the table, one ``warning:`` line each. TrV)rS header_stylez[yellow]warning:[/yellow] N)r isinstancerr[r\rM) rHrbrQrcrdr]colheaderr0rowws &&&&& r print_tablerlMs d 8E&0c&:&:#r *6* s MM%   :1#>?rc V^8dQhRRRR/#)rbinaryrrrr)rs"rrr^s    rc F\P!\V4R.RRRR^RR7pVP^8XdDVP;'g VP P 4P4^,#R# \\P3dR#i;i)zIReturn the first line of `` --version`` or ``"version unknown"``.z --versionTzutf-8replaceF)capture_outputtextencodingerrorstimeoutcheckzversion unknown) subprocessrunr returncodestdoutstderrr' splitlinesOSErrorTimeoutExpired)rnress& r cli_versionr^s nnc&k;7SWbi$-qG >>Q JJ,,#**335@@B1E E   Z.. /   sA B/BB B cV^8dQhRR/#)rrrr)rs"rrrjs   rcJ^RIHpV!RRR7pVPRR4V#)uEnv for a secret-manager CLI child (``bws`` / ``op``). Intentionally receives tokens — no scrub, no HOME rewrite (both CLIs store state under the real user home). )build_subprocess_envF) scrub_secretsinherit_profile_homeNO_COLOR1)tools.environments.localr setdefault)renvs rsecret_cli_envrjs& > U OCNN:s# JrcHV^8dQhRRRRRRRRRRR RR R R R RRRRRRRR/ #)rrHrgiven Optional[str] token_envrr6intropromptverifyzOptional[Callable[[str], bool]]savezCallable[[str, str], object]env_pathzCallable[[], object] clear_caches disabled_noterintr)rs"rrrwsu" " " *" 7:" EH" QT" ^a" +" 3O" #" 3G" ! "  " rc"T;'gRP4p V 'gf\PP4'gVP RV R24^#VP V4\ V4P4p V 'gVP R4^#VeV!V 4'g^#V!W+4V \ PV&V !4VP RV!4 RV R24V 'dVP V 4^#)uRShared ``token`` subcommand: prompt, optionally verify, then persist. Returns the exit code. ``verify(token)`` prints its own diagnostics and returns False to abort without touching .env — so a bad paste never bricks the working token; None skips verification (``--no-verify``). ``save``/``env_path`` are passed in (not imported here) so each CLI module's own ``save_env_value``/``get_env_path`` bindings — which tests monkeypatch — stay in effect. Old cached pulls are keyed on the previous token's fingerprint; clearing them makes the next startup fetch fresh with the new credential. r&u$[red]No TTY — pass the token with .[/red]z![red]Empty token, aborting.[/red]u[green]✓[/green] stored in z as z.. Takes effect on the next Hermes invocation.)r'sysstdinisattyrMr osenviron) rHrrr6rrrrrrrtokens &&&$$$$$$$$ r rotate_tokenrws[[b   !E yy!! MM@gN O e$V,224  9: &--!BJJyN MM1(*T)M@@A m$ r allow_emptyF empty_messagec 0V^8dQhRRRRRRRRR R R R/#) rrHrrrcountrrrrrrr)rs"rrrsAHH'H3HsH"H;HHTWHrcNVPV4P4pV'g&V'd^#V'dVPV4KM\V4p^Tu;8:d T8:dT#TPRT R24K \dTPR4Ki;i)zLoop until the user enters an integer in ``1..count``; return it. Blank input returns 0 when ``allow_empty``; otherwise ``empty_message`` (if any) is printed and the prompt repeats. z [red]Enter a number.[/red]u [red]Out of range — pick 1-r)inputr'rMr ValueError)rHrrrrchoiceidxs&&&$$ r prompt_indexrs v&,,. m,  f+C  u J  7wgFG   MM8 9  s BB$#B$c$V^8dQhRRRRRR/#)rrrmessagerrr)rs"rrrs!  3   rc\4pRVPR/4PV/4R&\V4\4P V4^#)zOSet ``secrets.
.enabled = False`` in config.yaml and print ``message``.Fr rL)r rr rrM)rrrs&& rdisable_secret_sourcersD -CGLCNN9b!,,Wb9)D IOOG r)rr&)'__doc__ __future__rargparserrwrpathlibrtypingrrrr rich.consoler rich.panelr rich.tabler hermes_cli.configr r hermes_cli.secret_promptr rr"r(r1r6rFrNr`rlrrrrrrrrrs #  99 69:9 / 0 5 'B@"  " JH%*HKOH2 r