+ jHj<bRt^RIHt^RIt^RIt^RIt^RIHt^RIH t ^RI H t ^RI H t ^RIHt^RIHtHtHtHtHtHtHtHtHtHtHtHtHt^R IH t H!t!H"t"H#t#R t$R t%]t&R R lt'RRlt(RRlt)RRlt*RRlt+RRlt,RRlt-RRlt.RRlt/RRlt0R R!lt1R"R#/R$R%llt2R#)&aCLI handlers for ``hermes secrets onepassword ...``. Unlike Bitwarden, the ``op`` binary is NOT auto-installed: 1Password publishes the CLI through OS package managers and signed installers, so Hermes expects an already-installed, already- authenticated ``op`` and never downloads one. ) annotationsN)Path)Optional)Console)Panel onepassword) argcfg_str cli_versiondisable_secret_sourceflagprint_status_panel print_tableregister_subcommandsrequire_enabled rotate_tokensecret_cli_env section_cfgyn) get_env_path load_config save_configsave_env_valueOP_SERVICE_ACCOUNT_TOKENz5https://developer.1password.com/docs/cli/get-started/cV^8dQhRR/#)returndict)formats"G/home/ubuntu/.hermes/hermes-agent/hermes_cli/onepassword_secrets_cli.py __annotate__r",s555c*\\4R4#r)rrrr#r!_op_cfgr%,s {}m 44r#c V^8dQhRRRR/#)rcfgrrr)r s"r!r"r"0sGG4GDGr#cFVPR/4PR/4#)secretsr) setdefault)r's&r!_op_cfg_for_writer+0s >>)R ( 3 3M2 FFr#c V^8dQhRRRR/#)rop_cfgrrr)r s"r!r"r"4s0000r#cXVPR4p\V\4'dV#/#)env)get isinstancer)r-r/s& r! _referencesr24s' **U CS$''3/R/r#c V^8dQhRRRR/#)r parent_parserzargparse.ArgumentParserrNoner)r s"r!r"r":s 7Dr#c\VRRR\\RR4\RR\ R24\R R 4\R R 433R R\R$3RR\ \R R4\ RR433RR\\RR4\RR433RR\\RR433RR\\ RR 433R!R"\R$334R##)%z>Attach the ``onepassword`` subcommand tree to a parent parser.secrets_op_commandsetupz:Verify the op CLI, set account / token env var, and enable --accountz=1Password account shorthand or sign-in address (op --account)z --token-envz1Env var holding a service-account token (default )--tokenz8Service-account token to store in .env non-interactivelyz --binary-pathz2Absolute path to the op binary (skips PATH lookup)statusz$Show config + op binary + referencestokenz?Rotate the service-account token: validate and store it in .envz@Provide the new token non-interactively (default: masked prompt)z --no-verifyz7Store without probing 1Password first (not recommended)setz$Map an env var to an op:// referenceenv_varz.Environment variable name, e.g. OPENAI_API_KEY referencez51Password reference, e.g. op://Private/OpenAI/api keyremoveu'Remove an env-var → reference mappingz"Environment variable name to unmapsyncz.Resolve references now and report what changedz--applyzIActually export resolved values into the current shell (default: dry-run)disablez"Turn off the 1Password integrationNr) r cmd_setupr _DEFAULT_TOKEN_ENV cmd_status cmd_tokenr cmd_set cmd_removecmd_sync cmd_disable)r4s&r! register_clirL:s(< NPY  \ ]  !RSeRffgh i  U V !U V \  9:rJ SU^  ] ^  Y Za   6  K L  T UB   \'W4p V 'dVP%RV 24MVP%RV R24S 'gVP%R4^#)rYrWrXrUz1Password secret sourceEnabledAccountz[dim]default[/dim]z Token env varz Token in envzOverride existingr\Tz Cache TTL (s)rZr[z op binaryz (r:z[yellow]not found[/yellow] ReferencesEnv varstylerS Referencec3J<"TFq\SV,43xK R#5iN)str).0name referencess& r! cmd_status..s R?QtC 4 012?Qs #z? Run [cyan]hermes secrets onepassword setup[/cyan] to enable.z% [green]Active op session:[/green] z$ [yellow]No active op session and uK is unset — Hermes will warn and skip 1Password on next startup.[/yellow]uv [yellow]No references mapped yet.[/yellow] Add one: [cyan]hermes secrets onepassword set ENV_VAR "op://…"[/cyan])rr%boolr0r rEr2rerfrarbrrrurclenrsortedr]rg) rOrhr-rYrWrdrU token_setrirjrxs & @r!rFrFsiG YF6::i()Gfi(G 68JKI&-0KV$JRZZ^^I./I ^^K (Fw 9 BwK G3334 )$ I' bfjj1Dd&K!LMN #fjj).__annotate__scdr#c<\P!S4pVfSPR\ R24R#SPR4\ VSVR7pVfSPR4R#SPRV R24R #) Nu&[red]op CLI not found — install it (z3) or re-run with --no-verify to store anyway.[/red]FuVerifying with `op whoami`…) token_valueuD[red]✗ New token was rejected by op — nothing was changed.[/red]u#[green]✓ Token accepted[/green] (z).T)rarbr]r_rg)r=rirjrWrUrhs& r!verifycmd_token..verifys , > MM8 DAA  56e< ; MM` a ;C5CDr#r;ucCreate a new service-account token at https://my.1password.com → Developer → Service Accounts. zPaste new token (z): NrYu[yellow]Note: the 1Password integration is currently disabled — run `hermes secrets onepassword setup` to turn it on.[/yellow])r intropromptrsaveenv_path clear_caches disabled_note) rr%r0rEr rr= no_verifyrrrar)rOr-rdrrWrUrhs& @@@r!rGrGsiG YF 68JKIfi(G&-0K Y  M#9+S1~~~t6 lATAT$jj33d  M r#c V^8dQhRRRR/#rNr)r s"r!r"r""sI I %I #I r#c a a a a \4p\4p\WRR4'g^#\V4pV'gVP R4^#\ VR4pVP R\4o \ VR4pVP'Ed\P!RVVS V\VP RR44^R7pVP'd"VP R VP R 24^#\TR R R /3R3\VP4Uu.uFqwR3NK up\VP 4Uu.uFqwR3NK up,VP"4VP R\%VP4 R24^#\P&!VVS VRR7wo p\TP RR44o RT T T 3Rllo \TR R R /3R3T 3Rl\T44T4TP R4^#uupiuupi \(d!p TP R T R 24Rp ? ^#Rp ? ii;i) 1Passwordrus[yellow]No op:// references configured. Add one with `hermes secrets onepassword set ENV_VAR "op://…"`.[/yellow]rWrXrUTr\)rYr/rWrXrUr\rZrrrprqrSActionz[green]exported[/green]z,[dim]skipped (already set / token var)[/dim]z [green]Exported z( secret(s) into current process.[/green]F)rxrWrdrU use_cacheNc V^8dQhRRRR/#)rrwrurr)r s"r!r"cmd_sync..__annotate__ZsSSSSSSr#c<VS8XdR#VS9dR#\\PPV44pV'd S'gR#RV'd R,#R,#)zim]skip (token var)[/dim]z$[red]unresolved (see warnings)[/red]z[dim]skip (already set)[/dim]zreen]would export[/green]z (overrides)rV)r{rerfr0)rwalreadyoverrider)rds& r!actioncmd_sync..actionZsM 9 0 w 9rzz~~d+, 82,'RRrRRr#c36<"TFqS!V43xK R#5irtr)rvrwrs& r!rycmd_sync..esE2D$t %2Dsu This was a dry-run — references resolve automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.)rr%rr2r]r r0rEapplyraapply_onepassword_secretsr{errorrr}appliedskippedrr|fetch_onepassword_secrets RuntimeError)rOrhr-rxrWrUresultrwrexcrrr)rds& @@@@r!rJrJ"s1iG YF 7K G GV$J   N fi(G 68JKI&-0K zzz11&/#"6::.A4#HI  <<< MME&,,v6 7 y7F"34h?;A&..;Q R;Q4- .;Q RRXY_YgYgRhiRh$DERhi j OO   ,S-@,AAijk "<<!#  FJJ2D9:HSS9w&78(CE&2DExQ MM * O Si  cU&)*s$" H  HH I )II c V^8dQhRRRR/#rNr)r s"r!r"r"ns(Sr#c\RR4#)ru[green]Disabled.[/green] 1Password references will NOT be resolved on the next Hermes invocation. Your reference mappings are left in config.yaml — remove them with [cyan]hermes secrets onepassword remove ENV_VAR[/cyan] if you no longer need them.)r )rOs&r!rKrKns   r#rrVc(V^8dQhRRRRRRRR/#)rrirrWrurrz Optional[str]r)r s"r!r"r"ys.RRtRcR3R Rr#c \V4R.pV'd VRV., p\4pV'dW$R&\P!W4RRRR^ RR7pTP ^8wdR #TP;'gR P4PR R 4R ,;'gR# \\P 3dR #i;i)zShort identity string if op is authenticated, else None. ``token_value`` probes a candidate token via the child's ``OP_SERVICE_ACCOUNT_TOKEN`` without touching the caller's environment.whoamir9rTzutf-8replaceF)r/capture_outputtextencodingerrorstimeoutcheckNrV  :NxN authenticated) rur subprocessrunOSErrorTimeoutExpired returncodestdoutr`r)rirWrcmdr/ress&&$ r!rgrgys v; !C W%%  C*5 &'nn DY  ~~ JJ  " # # % - -dC 8 > Q Q/Q Z.. /sB--C  C )3__doc__ __future__rargparsererpathlibrtypingr rich.consoler rich.panelragent.secret_sourcesrrahermes_cli._secrets_commonr r r r r rrrrrrrrhermes_cli.configrrrrrEr_rcr%r+r2rLrDrFrHrIrGrJrKrgrr#r!rs#  6UT/ C  5G0 8I X- ` 0  'TI XRRRr#