`gj&]>UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZmZddlmZmZmZmZddlmZmZej2eZdZd Zej<d Zd Z ee!e!e!e!fZ"iZ#d e$d <dZ%d'dZ&ee%e&Z'de$d<d(d)dZ( d*dZ)d+dZ*d,dZ+d-d.dZ,d/dZ-d0dZ.ddd d1dZ/dedddddd d2d Z0ddeddddd! d3d"Z1Gd#d$eZ2d4d%Z3d(d5d&Z4y)6u1Password (`op` CLI) secret source. Resolve provider credentials from 1Password ``op://vault/item/field`` references at process startup so they don't have to live in plaintext in ``~/.hermes/.env``. Design summary -------------- * Users map environment-variable names to official 1Password secret references in ``secrets.onepassword.env``:: secrets: onepassword: enabled: true env: OPENAI_API_KEY: "op://Private/OpenAI/api key" ANTHROPIC_API_KEY: "op://Private/Anthropic/credential" * After ``.env`` loads, each reference is resolved with a single ``op read -- `` call and injected into ``os.environ`` (the same point in startup as the Bitwarden source). * Authentication is whatever the user's ``op`` CLI already uses — a service-account token (``OP_SERVICE_ACCOUNT_TOKEN``) for headless boxes, or a desktop/interactive session (``OP_SESSION_*``). Hermes never authenticates on the user's behalf; it shells out to an already-trusted, already-authenticated CLI. * Failures NEVER block startup. A missing ``op`` binary, expired auth, a bad reference, or a permission error each surface a one-line warning and Hermes continues with whatever credentials ``.env`` already had. The atomic-write / ``0600`` / TTL cache mechanics are shared with the other backends via :mod:`agent.secret_sources._cache` — successful, complete pulls are cached in-process and on disk under ``/cache/op_cache.json`` so back-to-back short-lived ``hermes`` invocations don't re-shell ``op`` for every reference. The disk file holds only resolved secret *values*; auth material is fingerprinted, never stored. ) annotationsN)Path)DictListOptionalTuple) CachedFetch DiskCache FetchResultis_valid_env_name) ErrorKind SecretSourceOP_SERVICE_ACCOUNT_TOKENz\x1b\[[0-?]*[ -/]*[@-~])PATHHOME USERPROFILEAPPDATA LOCALAPPDATA SystemRootTMPDIRTMPTEMPXDG_CONFIG_HOMEXDG_RUNTIME_DIR OP_ACCOUNTOP_CONNECT_HOSTOP_CONNECT_TOKENzDict[_CacheKey, CachedFetch]_CACHEz op_cache.jsonc$|\}}}}|d|d|S)aSerialize a cache key for on-disk storage, omitting home_path. The disk file is already partitioned by home (it lives under ``/cache/``), so the path provides the home dimension; folding it into the key string too would be redundant. |) cache_keyauth_fpaccount_homerefs_fps S/root/.hermes/venv/lib/python3.12/site-packages/agent/secret_sources/onepassword.py _disk_key_strr)vs)(1$GWeWYay' ++)key_serializerr _DISK_CACHEc,tj|S)zAPath to the on-disk cache (exposed for tests and direct callers).)r,path home_paths r(_disk_cache_pathr1s   I &&r*cVi}g}|xsijD]\}}t|s|jd|d't|ts|jd|dM|j }|j ds|jd|d|d|||<||fS)uReturn ``(valid_refs, warnings)`` from an ``env`` mapping. A reference is kept only if its target env-var name is a valid POSIX name and the value is a stripped ``op://…`` reference string. Everything else produces a warning and is dropped (never fatal). z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsr append isinstancestrstrip startswith) referencesvalidwarningsnamerefcleaneds r(_validate_referencesr@sEH &B--/  c & OOix/IJ K #s# OOix/JK L ))+!!'* OOD82cW,MN  d   (?r*cdtjj|ddtjjddg}ttjD];}|j ds|j |dtj|=dj |}tj|jdjd d S) uSHA-256 prefix over the auth material `op` would use. Folds in the service-account token, ``OP_ACCOUNT``, and *all* ``OP_SESSION_*`` vars (the names `op` actually exports for interactive sessions — ``OP_SESSION_``). Signing out and into a different identity therefore changes the cache key, so a value cached under a previous identity is never served under a new one. Never logged or displayed; the raw token never leaves this hash. ztoken=zaccount=r OP_SESSION_= utf-8N) osenvirongetsortedr9r5joinhashlibsha256encode hexdigest) token_envpartskeymaterials r(_auth_fingerprintrUs  2./0 2::>>,345Ebjj!5 >>- ( LLC5"**S/!23 45yyH >>(//'2 3 = = ? DDr*cdjfdtD}tj|j dj ddS)u<SHA-256 prefix over the configured name→reference mapping.rEc32K|]}|d|yw)rDNr").0r=r:s r( z$_refs_fingerprint..s"U$D6:d#3"45UsrFNrG)rLrKrMrNrOrP)r:rTs` r(_refs_fingerprintrZsDyyU&BTUUH >>(//'2 3 = = ? DDr*rBc|rBt|}|jr&tj|tjr|Syt j d}|r t|SdS)u[Resolve a usable ``op`` binary, or None. When ``binary_path`` is set it is used verbatim and PATH is NOT consulted — pinning an absolute path is a way to avoid trusting whatever ``op`` shows up first on ``PATH``. A pinned-but-missing path returns None (the caller surfaces a clear error) rather than silently falling back. Nop)rexistsrHaccessX_OKshutilwhich) binary_pathpinnedfounds r(find_opresRk" ==?ryy9M LL E4;)T)r*cjtjd|jddjS)zCRemove ANSI control sequences and trim, for safe message surfacing.rB) _ANSI_CSI_REsubreplacer8)texts r(_scrubrls+   B % - -fb 9 ? ? AAr*ci}tD])}tjj|}|%|||<+tjj D]\}}|j ds|||<|r||d<d|d<|S)zEBuild a minimal allowlisted environment for the ``op`` child process.rCr1NO_COLOR)_OP_ENV_ALLOWLISTrHrIrJr4r9) token_valueenvrSvals r( _op_child_envrtsC jjnnS! ?CH JJ$$&S >>- (CH *5 &'C O Jr*r%rqc Xt|dg}|r|d|gz }|d|gz } tj|t|ddddt}|jd k7rJt|jxsd d d}|rt d|d|t d|jd||jxsd jd}|jst d||S#tj $r}t dtd ||d }~wt$r}t d ||d }~wwxYw)uResolve a single ``op://`` reference to its value. Raises :class:`RuntimeError` on any failure — including a ``returncode 0`` with empty output, which would otherwise silently clobber a good ``.env``/shell credential with ``""``. readz --accountz--TrFrj)rrcapture_outputrkencodingerrorstimeoutzop read timed out after zs for Nzfailed to invoke op: rrBzop read failed for r3zop read exited z for z z$op read returned an empty value for )r7 subprocessrunrt_OP_RUN_TIMEOUTTimeoutExpired RuntimeErrorOSError returncoderlstderrstdoutrstripr8) r\ referencer%rqcmdprocexcerrvalues r( _run_op_readrs`"gv&C W%%D) CC~~ k*#   !T[[&B'- !4YMC5IJ Jdoo.eI= A  [[ B & &v .E ;;=A)OPP L-  $ $&&7vi] K   C23%89sBCs#)C D)3D  D)D$$D)T,)r%rQbinaryrb use_cachecache_ttl_secondsr0cht|\}} |si| fStjj|dj } t ||xsd| t |ndt|f} |rxtj| } | r(| j|rt| j| fStj| ||} | | t| <t| j| fS|xs t|}| tdi}d}t!|D]} t#||||| ||<|rM|sK|rIt't|t)j(}|t| <tj+| ||||| fS#t$r)}| j%t ||dz }Yd}~d}~wwxYw)uResolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises :class:`RuntimeError` only when no ``op`` binary is available — a fatal "can't fetch anything" condition. Per-reference failures (expired auth, bad reference, empty value) are collected as warnings and the reference is dropped, so one bad entry never sinks the rest. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rBNzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.rru)secrets fetched_at)r@rHrIrJr8rUr7rZris_freshdictrr,rwrerrKrr5r timewrite)r:r%rQrrbrrr0r;r<rqr#cached disk_cachedr\r read_errorsr=rentrys r(fetch_onepassword_secretsr6s*+:6OE8 8|**..B/557K)$ 2#/IR% II& foo&78'1 1!&&y2CYO  " +F9  ++,h6 6  '7;'B z H  !GKu  (E$KkGDMDMdiikJ!y)U,=yI H   OOCH % 1 K sE?? F1F,,F1)rrr%service_account_token_envrboverride_existingrr0c t}|s|St|\} } |jj| i} | j D]h\} } | |k(r|j j | '|s;tjj| r|j j | d| | | <j| s|St|}||_ ||r d|d|_ |Sd|_ |S t| |||||\}}||_|jj||j D]\} }| |k(r*| |j vr|j j | 5|sItjj| r*| |j vr|j j | |tj| <|j"j | |S#t$r}t||_ |cYd}~Sd}~wwxYw)u^Resolve configured ``op://`` references and set them on ``os.environ``. Called by ``load_hermes_dotenv()`` after the .env files have loaded. Intentionally defensive — any failure returns a :class:`FetchResult` with ``error`` set (or surfaces warnings); it never raises. Parameters mirror the ``secrets.onepassword.*`` config keys so the caller can splat the dict in. References that are already satisfied by the current environment (when ``override_existing`` is false) are skipped *before* fetching, so ``op`` is never invoked for a value that would be discarded. N!secrets.onepassword.binary_path (!) is not an executable op binary.secrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r:r%rQrrr0)r r@r<extendr4skippedr5rHrIrJrerberrorrrr7rapplied)enabledrrr%rrbrrr0resultr;r< refs_to_fetchr=r>rrfetch_warningsrrs r(apply_onepassword_secretsrs.]F  *3/OE8 OO8$%'M[[]" c , , NN ! !$ '  RZZ^^D%9 NN ! !$ ' ! d"  [ !FF ~ 3K?C(( L 3 L   ";$// # FN OO>*}} $ e , ,6>>)%%d+  RZZ^^D%96>>)%%d+   4d# $ M+ 3x  s&G H'G>8H>Hc@eZdZdZdZdZdZdZd dZd dZ d dZ dd Z y )OnePasswordSourceu1Password as a registered secret source. Thin adapter over the module's fetch machinery. ``fetch()`` only *fetches* — precedence, override semantics, conflict warnings, and the ``os.environ`` writes are the orchestrator's job (see ``agent.secret_sources.registry.apply_all``). 1Password is a **mapped** source: the user explicitly binds each env var to an ``op://`` reference under ``secrets.onepassword.env``, so its claims outrank bulk sources (e.g. a Bitwarden project dump) on contested vars. onepassword 1Passwordmappedr\c\tt|txr|jddS)NrT)boolr6rrJ)selfcfgs r(rz#OnePasswordSource.override_existings' JsD)Pcgg6I4.PQQr*ct}t|trt|j dxs|}t |hS)Nr)_DEFAULT_TOKEN_ENVr6rr7rJ frozenset)rrrQs r(protected_env_varsz$OnePasswordSource.protected_env_varss7& c4 CGG$?@MINI)%%r*c Hddddidddddtddddd d dd d dd S)Nz Master switchF) descriptiondefaultz1Map of ENV_VAR -> op://vault/item/field referencez0op --account shorthand (empty = default account)rBzOEnv var holding the service-account token (unset = desktop/interactive session)z,Pin the op binary (empty = resolve via PATH)z!Disk+memory cache TTL; 0 disablesrz+Resolved values overwrite .env/shell valuesT)rrrr%rrbrr)r)rs r( config_schemazOnePasswordSource.config_schemase'65IR R  G-* N C" M"/  r*c t|tr|ni}t}|jd}t t|tr|nd\}}|j j ||s |sd|_tj|_ |St|jdxsd}t|}||_ |,|r d|d|_nd|_tj|_ |S t|jdd } t%|t|jd xsdt|jd xst&|| | \} } | |_|j j | |S#t t"f$rd } YwxYw#t($r5} t| |_t+t| |_ |cYd} ~ Sd} ~ wwxYw)Nrrzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.rbrBrrrrrgr@r%rr)r6rr rJr@r<rrr NOT_CONFIGURED error_kindr7rerbBINARY_MISSINGfloat TypeError ValueErrorrrr_classify_op_errorr) rrr0renv_mapr;r<rbrttlrrrs r(fetchzOnePasswordSource.fetch$sT*c''%..!'40Gd x x(J %.$<$<!M#''-06B7 %# >7 G33 > !* 8 8F M  3S9:C &? CGGI.4"5GG78N.ks 5c3'> 5) unauthorizedz not signed inzsession expiredauthentication401403z empty valuec3&K|]}|v ywrr"rs r(rYz%_classify_op_error..qs .c3'> .r)network connectionz resolve hostdns) lowerr TIMEOUTrany AUTH_FAILED EMPTY_VALUENETWORKINTERNAL)messagers @r(rrcsmmoGg   g%)<)G!W,'''  5&4 55$$$$$$  .&- ..     r*cVtjtj|y)zClear in-process AND disk caches. Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir. Without it we fall back to the same default resolution as the writer. N)rclearr,r/s r(_reset_cache_for_testsr|s  LLNi r*)r# _CacheKeyrr7r)r0Optional[Path]rr)r:Optional[Dict[str, str]]r Tuple[Dict[str, str], List[str]])rQr7rr7)r:Dict[str, str]rr7)rB)rbr7rr)rkr7rr7)rqr7rr) r\rrr7r%r7rqr7rr7)r:rr%r7rQr7rrrbr7rrrrr0rrr)rrrrrr%r7rr7rbr7rrrrr0rrr )rr7rr )r0rrNone)5r __future__rrMloggingrHrer`r}rpathlibrtypingrrrragent.secret_sources._cacher r r r agent.secret_sources.baser r getLoggerrloggerrrcompilerhrpr7rr__annotations___DISK_CACHE_BASENAMEr)r,r1r@rUrZrerlrtrrrrrrr"r*r(rsE%N#  .. >   8 $ 0 rzz45 4 #sC$ % ')$)&,# Y '(%8E*E*,B . 4 44 4  4  4~'!" $CCC C  C  CCCC&C\%)%7"" $] ] "] ] # ]  ]]]]]Jz zz2!r*