+ jHjZRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t ^RIHt^RIHt^RIHt^RIHtHtHtHtHtHtHtHtHtHtHtH t H!t!H"t"^R I#H$t$H%t%H&t&H't'^R I(H)t)]t*]"t+R t,R t-R t.Rt/RRlt0RRlt1RRlt2RRlt3RRlt4RRlt5RRlt6RRlt7RR lt8R!R"lt9R#R$lt:R%R&lt;R'R(ltR-R./R/R0llt?R5t@R-R./R1R2lltAR6R7.tBR3R4ltCR#)8z2CLI handlers for ``hermes secrets bitwarden ...``.) annotationsN)Path)ListOptional)Console)Panel)Table)argcfg_str cli_versiondisable_secret_sourceflagprint_status_panel print_table prompt_indexregister_subcommandsrequire_enabled rotate_tokensecret_cli_env section_cfgyn) get_env_path load_config save_configsave_env_value)masked_secret_promptBWS_ACCESS_TOKENu[yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token.[/yellow]u [yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token. Continuing anyway.[/yellow]c^RIHpV#)zHImport ``agent.secret_sources.bitwarden`` on first use (crypto payload). bitwarden)agent.secret_sourcesr)_bws ;/home/ubuntu/.hermes/hermes-agent/hermes_cli/secrets_cli.py_load_bwr#*s 5 JcV^8dQhRR/#)namestr)formats"r" __annotate__r+0s K Kc Kr$cRVR8Xd \4#\R\: RV: 24h)u'PEP 562 lazy ``bw`` attribute (tests monkeypatch ``secrets_cli.bw``); an eager binding would re-import ``cryptography`` at import time. Existing callers (and upstream tests) monkeypatch attributes on ``hermes_cli.secrets_cli.bw`` directly. Resolving that attribute at module-import time would re-import ``cryptography`` eagerly — the very self-lock we are preventing (#86781). Defer the backend import until the first actual attribute access, so ``import hermes_cli.secrets_cli`` stays crypto-free while ``secrets_cli.bw.find_bws`` still resolves. bwzmodule z has no attribute )r#AttributeError__name__)r's&r" __getattr__r00s, t|z 78,.@I JJr$c V^8dQhRRRR/#)r& parent_parserzargparse.ArgumentParserreturnNoner))r*s"r"r+r+As 7Dr$c&\VRRR\\RR4\RR4\RR 433R R \R3R R \\RR4\ RR433RR\ \ RR433RR\R3RR\\ RR43334R#)z r$cP\V^R4VPRR7pVf"VPR4VP4pVPRV R\ V4 R24V# \ d2pTPR T R 24TPR 4Rp?R#Rp?ii;i) zAStep 1: locate or download bws; None (after printing) on failure.zInstall the bws CLIFinstall_if_missingNu# No bws on PATH — downloading…u [green]✓[/green]  ()u" [red]✗ Could not install bws: [/red]z> Manual install: https://github.com/bitwarden/sdk-sm/releases)rNfind_bwsrM install_bws _bws_version Exception)r-rHbinaryexcs&& r" _setup_binaryr]es '1+, 6 > MM? @^^%F -fXSf9M8NaPQ  :3%vFG VWsAA)) B%4&B  B%c V^8dQhRRRR/#)r&argsargparse.Namespacer3z list[str]r))r*s"r"r+r+usWW(:WyWr$cbRVPRVP;'gRP4;'g!\PP RR4RVP /pVP4UUu.uF'wr#V'dVP4'dK%VNK) upp#uuppi)zWSetup flags a no-TTY run must supply (BWS_SERVER_URL env substitutes for --server-url).r9r:BWS_SERVER_URLr8) access_token server_urlstriposenvironget project_iditems)r_providedr values& r"_missing_noninteractive_flagsrnus $++..B557__2::>>JZ\^;_)H%-NN$4 V$4[TUu{{}DD$4 VV Vs :"B+!B+c(V^8dQhRRRRRRRR/#) r&r_r`rHr token_envr(r3 Optional[str]r))r*s"r"r+r+~s*  ) G  P] r$c\V^R4VP;'gRP4;'g\RV R24P4pV'gVP R4R#VP R4'gVP \ 4\W#4V\PV&VP R\4 R V 24V#) zQStep 2: take the token from ``--access-token`` or a masked prompt and persist it.zProvide your access tokenrbz Paste access token (): z# [red]Empty token, aborting.[/red]N0.u [green]✓[/green] stored in z as ) rNrdrfrrM startswith!_NOT_BSM_TOKEN_WARNING_CONTINUINGrrgrhr)r_rHrpr<s&&& r" _setup_tokenrw~s '112    $ $" + + - v v1EH^_h^iilFm1n1t1t1vE  ;<   D ! ! 789$!BJJy MM3LN3C4 {ST Lr$c ,V^8dQhRRRRRRRRRR /#) r&r[rr<r(rHrrer3rqr))r*s"r"r+r+s0##4##g#3#S`#r$c b\V^R4\WW#R7pVfR#V'g%VPR4VPR4R#\VRRRR ^/3R R RR /33R \ V^444\ VR\ V4 R2\ V44pWE^, ,R,#)zXStep 4: list projects and let the user pick one; None (after printing) when none usable.zPick a projectreNz? [yellow]No projects visible to this machine account.[/yellow]ur In the Bitwarden web app, open the machine account → Projects tab and grant it access to at least one project.#stylecyanwidthNameIDdimc3"TF5wr\V4VPRR4VPRR43xK7 R#5i)r'?idN)r(ri).0ips& r" !_setup_project..s5cLbDA#a&!%%,aeeD#.>?Lbs=?z Select project [1-z]: r)rN_list_projectsrMr enumeraterlen)r[r<rHreprojectsidxs&&&& r"_setup_projectrs '1&'fWLH  WX E F3&'1 =>PWY^O_H`acIV^`aLbce w"6s8}oS I3x= YC !G T ""r$c V^8dQhRRRR/#r&r_r`r3rJr))r*s"r"r+r+sD D &D 3D r$cha\4p\4pVP\P!RRR74\ W4pVf^#\ PP4'g:\V4pV'd'VPRRPV4 R24^#\4pVPR/4PR/4pVPR \4o\WS4pVf^#\!V^R 4\#WV4pVf^#TPV'dR V 2MR 4VP$;'gR P'4p \)V 4p V 'g\+W7W(4p V f^#\!Y*'d^M^R4VP-WyVRVR7wrT 'gTPR4M&\1TRRR/3R3T3Rl\3T 444T FpTPRT 24K TP5RYR7R S3RRR3FwppTPTT4K \7T4TP4TPR4TPR4^# \.d!p TPRT R24Rp ? ^#Rp ? ii;i) u[bold]Bitwarden Secrets Manager setup[/bold] Need an access token? In the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token Copy the token (starts with [cyan]0.[/cyan]…) — it cannot be retrieved later.r}) border_styleNzP [red]Non-interactive mode (no TTY) requires all setup flags.[/red] Missing: z, z Usage: hermes secrets bitwarden setup \ --access-token '0.xxx' \ --server-url 'https://vault.bitwarden.com' \ --project-id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'secretsraccess_token_envzPick a Bitwarden regionu [green]✓[/green] using uN [green]✓[/green] using bws default (US Cloud, https://vault.bitwarden.com)rbz Test fetchF)rdrjr[ use_cachereu [red]✗ Fetch failed: rVzB [yellow]Fetch succeeded but the project has no secrets.[/yellow]rr|Statusc3><"TFq\VS43xK R#5iN) _fetch_status)rkeyrps& r"rcmd_setup..sU_c=i89_sz [yellow]warning:[/yellow] T)enabledrjreuv[green]✓ Bitwarden Secrets Manager is enabled.[/green] Secrets will be pulled at the start of every Hermes process.z Status: [cyan]hermes secrets bitwarden status[/cyan] Refresh: [cyan]hermes secrets bitwarden sync[/cyan] Disable: [cyan]hermes secrets bitwarden disable[/cyan])cache_ttl_seconds,)override_existingT) auto_installT)r#rrMrfitr]sysstdinisattyrnjoinr setdefaultri_DEFAULT_TOKEN_ENVrwrN_resolve_server_urlrjrfboolrfetch_bitwarden_secretsrZrsortedupdater)r_r-rHr[missingcfg secrets_cfgr<rerj project_givenrwarningsr\wrdefaultrps& @r"r@r@s BiG MM%)) \  2 'F ~ 99    /5  MM"ii012LL M -C..B/::;KK 24FGI  2E } '1/0$T@J MM / |<gi//''R..0J$M #F7G   ' 11l;66fPUbl7n  Z[Gv'898DUVG_U W  4QC89t R,i8:T46LN WsG,N MMO MMQR MMMN +  1#f=>sJ J1J,,J1c V^8dQhRRRR/#)r&rdictr3r))r*s"r"r+r+s)))$)r$c\VR4#r)r)rs&r"_bw_cfgrs sK ((r$c$V^8dQhRRRRRR/#)r&rr(rpr3r))r*s"r"r+r+s!  s s s r$cdW8XdR#\PPV4'dR#R#)u5[dim]bootstrap token — never overrides itself[/dim]z9[yellow]already set in env (will be overwritten)[/yellow]z[green]new[/green])rgrhri)rrps&&r"rrs$ F zz~~cJ r$c V^8dQhRRRR/#rr))r*s"r"r+r+s" " '" C" r$c\4p\4p\\44p\ VP R44pVP R\ 4pVP RR4p\VR4p\PP VR4P4pVPRR7p \WIWR7wr\TRR \V43R V3R \\ V443R V 3R T;'gR3RT;'gR3R\\ VP RR4443R\VP RR443R\\ VP RR4443RV 'dV R\!V 4 R2MR33 4V Fp VP#V 4K V'gVP#R4^#V'gVP#RV R24V'gVP#R 4^#)!rrrjrbreFrR)rr[r<rezBitwarden Secrets ManagerEnabledz Token env varz Token in envzToken validationz Project IDz[dim](unset)[/dim]z Server URLz:[dim]default (US Cloud, https://vault.bitwarden.com)[/dim]zOverride existingrz Cache TTL (s)rrz Auto-installrTz bws binaryz (rUz[yellow]not installed[/yellow]z= Run [cyan]hermes secrets bitwarden setup[/cyan] to enable.z [yellow]Enabled but uG is not set — Hermes will skip BSM and warn on next startup.[/yellow]uC [yellow]Enabled but no project_id — nothing to fetch.[/yellow])r#rrrrrirr rgrhrfrW_token_validation_statusr_ynr(rYrM) r_r-rHbw_cfgrrprjrer<r[token_validationvalidation_messagesmessages & r"rArAs BiG [] #F6::i()G -/ABIL"-J.J JJNN9b ) / / 1E [[E[ 2F,De-L)w ; CL! )$ T%[)* -. z99%9: zaa%ab c$vzz2Eu'M"NOP #fjj) ' g'  VW  0 <;; <  \] r$c V^8dQhRRRR/#rr))r*s"r"r+r+s2 2 &2 32 r$c`aaaaa\4o\4o\\44oSP R\ 4p\ SR4oRVVVVV3Rllp\SSPTRRRV R2T\\SPSP R 4'dR R 7 #R R 7 #) zRotate the BSM access token without re-running the whole setup wizard: probe Bitwarden with the new token (unless ``--no-verify``) and only then persist it, so a bad paste never bricks the working token.rrec V^8dQhRRRR/#)r&r<r(r3rr))r*s"r"r+cmd_token..__annotate__ scdr$c<VPR4'gSP\4SP'dR#SP RR7pVfSPR4R#SPR4\ WSS R7pVfSPR4R#SPR\ V4 R \ V4^8wdR MR R 24\SPR R 4;'gR 4pV'd:V'd2Y2Uu0uF qDR,kK up9dSPRV R24R#uupi)rtTrRu`[red]bws binary not available — cannot verify. Re-run with --no-verify to store anyway.[/red]FuVerifying against Bitwarden…rzu>[red]✗ New token was rejected — nothing was changed.[/red]u#[green]✓ Token accepted[/green] (z projectsrbz visible).rjrz$[yellow]Warning: configured project z is not visible to this machine account. Grant it access in the Bitwarden web app or re-run `hermes secrets bitwarden setup` to pick a different project.[/yellow]) rurM_NOT_BSM_TOKEN_WARNING no_verifyrWrrr(ri) r<r[rrjrr_r-rrHres & r"verifycmd_token..verify s*%% MM0 1 >>>5 > MMK L 67!&ZP   MMZ [ h-H 8JPR0SS]_ `L"5;;< (z89T8aD''89T'T MM6zlCgg h :Us D<r9uCreate a new token in the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token zPaste new access token (rsrNu[yellow]Note: the Bitwarden integration is currently disabled — run `hermes secrets bitwarden setup` (or set secrets.bitwarden.enabled: true) to turn it on.[/yellow])r intropromptrsaveenv_path clear_caches disabled_note) r#rrrrirr rrdrrr)r_rprr-rrHresf @@@@r"rBrBs BiG [] #F -/ABI.J2 ""I  6*)C8 l$jj33d   G  r$c V^8dQhRRRR/#rr))r*s"r"r+r+Ks0 0 %0 #0 r$c \4p\4p\\44p\ W#RR4'g^#VP R\ 4p\PP VR4P4pV'gVPRV R24^#VP RR4pV'gVPR4^#VPWVR\VR 4R 7wrxT'gTPR4^#\TP RR44;'g TPp .p ^p \!T4Fp \\PP T 44pY8XdRpMnT'd T 'gRpM[TP'd7Y},\PT &T ^, p RT'dRMR,pMRT'dRMR,pT P#Y34K \%TRRR/3R3Y4TP'gTPR4^#TPRT R24^# \d!p TPR T R 24R p ? ^#R p ? ii;i) Bitwardenrrrbz[red]z is not set.[/red]rjz$[red]No project_id configured.[/red]Fre)rdrjrrez[red]Fetch failed: rVNz'[yellow]No secrets in project.[/yellow]rz![dim]skip (bootstrap token)[/dim]z[dim]skip (already set)[/dim]z[green]exported[/green]z (overrode)zreen]would export[/green]z (overrides)rr|r}Actionu This was a dry-run — secrets are picked up automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.z [green]Exported z( secret(s) into current process.[/green])r#rrrrrirrgrhrfrMrr rZrapplyrappendr)r_r-rHrrpr<rjrrr\overriderowsappliedralreadyactions& r"rCrCKs BiG [] #F 7K E E -/ABI JJNN9b ) / / 1E  i[(:;<L"-J  <=66SZ[acoSp7   ?@FJJ2E:;IItzzH DGgrzz~~c*+  8F X4F ZZZ%lBJJsO qLG.7-PRSF2nUWXF SM"6GV#45x@$Q ::: B C   ,WI5]^_ ;  +C578s I I9I44I9c V^8dQhRRRR/#rr))r*s"r"r+r+~s%%(%S%r$c\RR4#)ru[green]Disabled.[/green] Bitwarden secrets will NOT be pulled on the next Hermes invocation. Your access token is left in .env — remove it manually if you also want to revoke the credential.)r )r_s&r"rDrD~s  $ %%r$c V^8dQhRRRR/#rr))r*s"r"r+r+s  ( S r$c\4p\4pVP\VP4R7pVP RV R\ V4 R24^# \d!pTP RT R24Rp?^#Rp?ii;i))forceu[green]✓[/green] rTrUz[red]Install failed: rVN)r#rrXrrrMrYrZ)r_r-rHpathr\s& r"rErEs| BiG~~D$4~5 +D6\$5G4HJK  -cU&9:sAA B )BB rerbc ,V^8dQhRRRRRRRRRR /#) r&rrr[rPr<r(rer3ztuple[str, list[str]]r))r*s"r"r+r+s4---,-58-FI--r$cV'*R3V'*R3VRJR33FwrEV'gKRV R2.3u# .pVPR4'gVP\4\\P !4R^R7p\ WWsR 7fSVPR R 7P4pV'd'VPR VP444R V3#RV3#)zintegration disabledz token missingNzbws not installedz[dim]not checked[/dim] (rUrtT)filerecordr~rzF)stylesc3@"TFqP4xK R#5ir)rstrip)rlines& r"r+_token_validation_status..sK6JdKKMM6Jsz[red]failed[/red]z[green]passed[/green]) rurrvrioStringIOr export_textrfextend splitlines) rr[r<reskippedreasonmessages probe_consoledetailss $$$$ r"rrs")[*@AIC_#t^-@AC 7-fXQ7; ;CH   D ! !9:t3GMf]JR++5+9??A  OOKg6H6H6JK K"H,, "H ,,r$c ,V^8dQhRRRRRRRRRR /#) r&r[rr<r(rHrrer3zOptional[list[dict]]r))r*s"r"r+r+s;DD DD'.D?BDDr$c 4a \4pWR&V'dW4R&\P!\V4RRRR.VRRRR ^R R 7pTP^8wdTP;'g TPP4R,pTP RT R 24TP4o \FYwr\;QJdT 3RlT4F 'gK RM R M!T 3RlT44'gKGTP T 4R# R#\P!TP;'gR4p \#T \$4'g.#T U u.uF6p \#T \&4'gKT P)R4'gK4T NK8 up # \\P 3d!pTP R T R 24Rp?R#Rp?ii;i \P d!pTP RT R 24Rp?R#Rp?ii;iuup i)zICall ``bws project list`` and return the parsed list, or None on failure.rrcprojectlistz--outputjsonTzutf-8replaceF)envcapture_outputtextencodingerrorstimeoutcheckz [red]Couldn't list projects: rVN:Ni,Nz [red]bws project list failed: c3,<"TF qS9xK R#5irr))rrIlowereds& r"r!_list_projects..s1A<sz[]z [red]bws returned non-JSON: r)r subprocessrunr(OSErrorTimeoutExpiredrM returncodestderrstdoutrflower_PROJECT_LIST_HINTSanyrloadsJSONDecodeError isinstancerrri) r[r<rHrerresr\errneedleshintdatarrs &&&$ @r"rrs  C# * nn [)VZ @Dtgiackpr  ~~zz''SZZ..06 8VDE))+0MGs11sss1111 d# 1zz#**,,- dD ! !  Ct!z!T2AquuT{AAt CC' Z.. / 7uFCD    6se6BC DsG,F"G=G H=HHG:GGH2H  Hc(V^8dQhRRRRRRRR/#) r&r_r`rrrHrr3rqr))r*s"r"r+r+s,%% %+/%:A%%r$cVP'd;VPP4'dVPP4#\PP RR4P4pV'dVP RV R24V#\ VR4pV'dVP RV R24\RR R RR 7pVPR R ^R7VPR4\\^4F#wpwrxVP\V4V4K% \\4^,p VP\V 4R4VP V4RV R2V'dRMR,p \W*R,V \V4RR7p V ^8XdV#V \\48:d\V ^, ,^,#VP!R4P4p V 'gVP R4R #V P#R4'gVP R4V #)zPick a Bitwarden server URL: ``--server-url``, then ``BWS_SERVER_URL``, then the existing ``secrets.bitwarden.server_url``, then the interactive US / EU / self-hosted menu. None (after printing) when a custom URL is left empty.rcrbz' Detected [cyan]BWS_SERVER_URL[/cyan]=u in your shell — using it.rez Existing config: [cyan]z?[/cyan]. Press Enter to keep, or pick a different option below.TboldN) show_header header_styleboxpaddingr{r})r|r~zRegion / endpointzSelf-hosted / custom URLz Select region [1-]z (Enter to keep current)z: z [red]Enter a number.[/red]) allow_empty empty_messagezD Enter your Bitwarden server URL (e.g. https://vault.example.com): z! [red]Empty URL, aborting.[/red]u] [yellow]Warning: URL doesn't start with http:// or https:// — bws may reject it.[/yellow])r&)zhttp://zhttps://)rerfrgrhrirMr r add_columnr_REGION_PRESETSadd_rowr(rrrinputru) r_rrHenv_urlexistingtablerlabel_url custom_idxrrcustoms &&& r"rrs  4??0022$$&&jjnn-r288:G ?yHdef{L1H 1( MM%":,a 0RZ4N`b cF w ztH~%C EC ax c/""sQw'** ]]a b h h jF  9:   4 5 5 uv Mr$)))invalid_clientz400 bad requesta$ [yellow]'invalid_client' from the US identity endpoint usually means the token is for a different Bitwarden region. Re-run [cyan]hermes secrets bitwarden setup[/cyan] and pick EU or self-hosted at the region prompt, or set [cyan]secrets.bitwarden.server_url[/cyan] in config.yaml.[/yellow])) authorizationinvalidzu [yellow]This usually means the access token is wrong or revoked. Double-check it in the Bitwarden web app.[/yellow])u7US Cloud (https://vault.bitwarden.com — bws default)rb)z&EU Cloud (https://vault.bitwarden.eu)zhttps://vault.bitwarden.eu)D__doc__ __future__rargparserrrgrrpathlibrtypingrr rich.consoler rich.panelr rich.tablerhermes_cli._secrets_commonr r r r r rrrrrrrrrhermes_cli.configrrrrhermes_cli.secret_promptrrYrrrrvr#r0rFrNr]rnrwrr@rrrArBrCrDrErrrr&rr)r$r"r>s8"  !  UT9 'C W"  K">5  W #"D N) " J2 j0 f% -LN-( DEGDHDL %r$