+ jHj#lRt^RIHt^RItRtRRltRRltRR ltR R ltR R lt RRlt R#)u``hermes vault`` — manage the local encrypted autofill vault. Subcommands: - ``hermes vault add`` interactive wizard; the password is read via getpass (never echoed, never accepted as argv). The login identifier is visible metadata and prompted normally. - ``hermes vault list`` metadata — labels, kinds, identifiers, origins, handles. Passwords are never shown. - ``hermes vault rm`` remove an item by handle/id. The vault backs the password-blind browser autofill tools (``browser_vault`` list / fill): the agent sees handles and login identifiers, types the identifier itself, and fills the password server-side without ever seeing it. ) annotationsNc^RIHpV!4#)Console) rich.consolerrs 5/home/ubuntu/.hermes/hermes-agent/hermes_cli/vault.py_consoler s $ 9cV^8dQhRR/#returnNone)formats"r __annotate__rsQiQidQir c ^RIHpHpHpHp\ 4pVP R4VP;'gRP4P4pWb9dg\RRPV4 R24P4P4;'gRpWb9gKRVP RV: R 24RpKlRpV'g\R 4P4pK#VR8XEd!RpV'g\R 4P4pK#Rp W9dG\R RPV4 R 24P4P4;'gRp KLRp V 'g-\V P4 R24P4p K4Rp V 'g\P!R4p K \P!R4p RV RV RV /V P4'dRV /M/Cp V!4PRW}VR7pEM ^RIHpHpHpVR8XdTMTpRpV'g\R4P4pK#VP RV R24/p VFpVVV,9pVP%RR4 V'dRMR R2pVR8Xd\PM\pV!V4P4pV'd!V'gV!V4P4pK(V'gKVV V&K V!4PWgWR7pTP R!VP& R"VP R#VP(;'gR$ 24R # Td pTP RT 24R p?R #R p?ii;i)%r)LOGIN_IDENTIFIER_TYPES VAULT_KINDS VaultErrorget_vault_storez[bold]Add a vault item[/] (the password is encrypted at rest and the agent never sees it; the identifier is visible metadata the agent can type itself)zKind (/z ) [login]: loginz[red]Unknown kind [/]z$Label (e.g. 'GitHub work account'): z'Site origin (e.g. https://github.com): zIdentifier type (z ) [email]: emailz: zPassword (hidden): u`Authenticator key (optional, hidden; the 2FA "setup key" or otpauth:// link — Enter to skip): identifier_type identifierpassword otp_secret)kindlabelsecretorigin)ADDRESS_FIELDSPAYMENT_FIELDSREQUIRED_FIELDSpaymentzGSite origin the item may be filled on (e.g. https://shop.example.com): z[dim]zG fields are filled only on that origin; card values are read hidden.[/]_ z (optional)[red]Error:[/] Nz[green]Stored.[/] handle=[bold]z [/] kind=z origin=-)agent.vault_storerrrrr printr!striplowerinputjoin capitalizegetpassadd_itemr%r&r'replaceidr$)argsrrrrcr!r"r$id_typerrr r#metar%r&r'fieldsfieldrequiredpromptreadvalueexcs& r_cmd_addrCs4  AGG  IIOO " " $ * * ,D  !vchh{34K@AGGIOOQ\\U\  " GG(4 5D E<=CCE5 7?FHIOOQG7-chh7M.N-O{[\UWUW  J "g&8&8&:%;2#>?EEG H"??+@A tvJ "7jH2<1A1A1C1CL*- F #$--E.D Z Y'+y'8^nFFhiooq GGeD6!hi jF OD$99!MM#s348R4WWYZ*.)*;wV **,u L..0E5$)F5M #$--4V-cD GG-dggYi {(SWS^S^SeSebeRf gh  /#'(sW,M">A#M""M"15M"'A M"2 M"M"3BM"M"M"_cmd_list..{sR=QTW))40=Qsz<[dim]Vault is empty. Add an item with `hermes vault add`.[/]N)Tablez Vault items ())titleHandlebold)styler,zT[dim]Passwords are never shown; the agent fills them server-side from the handle.[/]z[yellow]uX[/] is enabled but locked — the agent will ask you to unlock it when it needs a login.)rQSourceKindLabel IdentifierOrigin)agent.vault_backendsrGr needs_unlock is_unlockedappendrIextend list_itemsr. rich.tablerNlen add_columnadd_rowr7r!r"rr$) r8rGr9rowslockedrNtablecolsourcer;namerKs & @r _cmd_listripsF6 Ar&#%    (;(;(=(= MM'.. /  RW=O=O=QRR &  NO $mCI;a89PC   S/t  LQ LF MM$''699djj$//BXBXUXZ^ZeZeZlZlil m!  fg (4& xyzr cV^8dQhRR/#r r)rs"rrrsgg$gr c^RIHp^RIHpHp^RIHpHpHp\4pV!4Uu/uFqPVbK p pVP'gVP'dVP;'g VPp W9d+VPRV : RRPV 4 R24R#V!4p V!V!V R 4V 4p VP'dV PR R4MR V R &V!V 4TPR W,P R VP'dRMR R24R#V!4U u0uFqPkK pp V P#4FGwrW9dRpMV!V 4'dRV R2pMRpVPRVP R R V 24KI VPR4R#uupiuup i)zfShow the detected password managers; `--disable`/`--enable` flip the opt-out (`vault..enabled`).rF)external_backend_classes is_installed) _ensure_dict load_config save_configz[red]Unknown password manager z[/] (expected one of z, rONvaultenabledFz[green]r*onoffz[/] for browser logins.uK[green]detected[/] · the agent asks you to unlock it when it needs a loginz3[dim]turned off[/] (`hermes vault sources --enable z ` to use it)z[dim]not installed[/]z z<10zW[dim]Managers are picked up automatically when their CLI is installed and signed in.[/])rYrGagent.vault_backends.baserlrmhermes_cli.configrnrorpr rhenabledisabler.r2poprIitems)r8rGrlrmrnrorpr9clsclassesrhcfgsectionbrrstatuss& r _cmd_sourcesrs5PHH A(@(BC(Bxx}(BGC {{{dlll{{**dll   GG4THrs< # Qih{:gDF48 2r