`gj@dZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z ddlmZdd lmZdd lmZmZmZmZd Zd Zdd ZddZddZddZddZddZddZ ddZ!ddZ"ddZ#y)uCLI handlers for ``hermes secrets onepassword ...``. Subcommands: setup — verify the op CLI, set account / token env var, enable status — show config + op binary + auth + configured references set — map an env var to an ``op://…`` reference remove — drop a mapping sync — resolve references now and show what would be applied (dry-run) disable — flip ``secrets.onepassword.enabled`` to False Unlike Bitwarden, the ``op`` binary is NOT auto-installed: 1Password publishes the CLI through OS package managers and signed installers, so Hermes expects an already-installed, already-authenticated ``op`` and never downloads one. ) annotationsN)Path)Optional)Console)Panel)Table) onepassword) get_env_path load_config save_configsave_env_valueOP_SERVICE_ACCOUNT_TOKENz5https://developer.1password.com/docs/cli/get-started/cV|jd}|jdd}|jdd|jdd td |jd d |jd d|j t |jdd}|j t |jdd}|jdd|jdd|j t|jdd}|jdd|j t|jdd}|jddd |j t|jd!d"}|j ty#)$z>Attach the ``onepassword`` subcommand tree to a parent parser.secrets_op_command)destsetupz:Verify the op CLI, set account / token env var, and enable)help --accountz=1Password account shorthand or sign-in address (op --account)z --token-envz1Env var holding a service-account token (default )z--tokenz8Service-account token to store in .env non-interactivelyz --binary-pathz2Absolute path to the op binary (skips PATH lookup))funcstatusz$Show config + op binary + referencessetz$Map an env var to an op:// referenceenv_varz.Environment variable name, e.g. OPENAI_API_KEY referencez51Password reference, e.g. op://Private/OpenAI/api keyremoveu'Remove an env-var → reference mappingz"Environment variable name to unmapsyncz.Resolve references now and report what changedz--apply store_truezIActually export resolved values into the current shell (default: dry-run))actionrdisablez"Turn off the 1Password integrationN) add_subparsers add_parser add_argument_DEFAULT_TOKEN_ENV set_defaults cmd_setup cmd_statuscmd_set cmd_removecmd_sync cmd_disable) parent_parsersubrrset_prrrs U/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/onepassword_secrets_cli.py register_clir/-s  & &,@ & AC NN I  E  L @AS@TTU V  G  A I& ^^H+Q^ RF Z( NN5'MN NE y'WX {)`a G$ ^^H+T^ UF  (LM Z( >>&'W> XD X  8$nnY-QnRG k*ct}|jtjdtddt }|j dij di}|j|jd|jxs|jdd xsd j}tj|}|B|r|jd |d n|jd |jd ty|jd|dt|d|r||d<|jrO|jjr5|jj|d<|jd|dd|j|jd|jxs|jdxstj}||d<|j xsd j}|r?t#|||t$j&|<|jdt)d|n}t$j&j|r|jd|nIt+||jdd }|r|jd|dn|jd|dd|d<|j di|j dd |j d!dt-||j|jd"|jd#y$)%Nz[bold]1Password secret source setup[/bold] Hermes resolves [cyan]op://vault/item/field[/cyan] references through your already-installed, already-authenticated 1Password CLI (`op`). Don't have it yet? Install + sign in: [cyan][/cyan]cyan) border_stylesecretsr z&[bold]Step 1[/bold] Locate the op CLI binary_pathu [red]✗ z& is not an executable op binary.[/red]u& [red]✗ op not found on PATH.[/red]z Install the 1Password CLI: u [green]✓[/green] z (raccountz Account: [cyan]z#[bold]Step 2[/bold] Authenticationservice_account_token_envu5 [green]✓[/green] service-account token stored in z as u6 [green]✓[/green] using service-account token from u0 [green]✓[/green] using existing op session (z [yellow]No service-account token and no active op session detected.[/yellow] Either run [cyan]op signin[/cyan] (desktop/interactive) or set a service-account token in z, then re-run status.Tenabledenvcache_ttl_seconds,override_existingu6[green]✓ 1Password secret source is enabled.[/green]z Map credentials: [cyan]hermes secrets onepassword set OPENAI_API_KEY "op://Private/OpenAI/api key"[/cyan] Preview: [cyan]hermes secrets onepassword sync[/cyan] Status: [cyan]hermes secrets onepassword status[/cyan]r)rprintrfit _DOCS_URLr setdefaultr6getstripop_srcfind_op _op_versionr9 token_envr#tokenr osenvironr _op_whoamir ) argsconsolecfgop_cfgr6binaryrIrJwhos r.r%r%dsiG MM  ;z op binaryz (rz[yellow]not found[/yellow] Referencesz1Password secret sourcer3)titler4rV header_styleEnv var Referencez? Run [cyan]hermes secrets onepassword setup[/cyan] to enable.rz% [green]Active op session:[/green] z$ [yellow]No active op session and uK is unset — Hermes will warn and skip 1Password on next startup.[/yellow]uv [yellow]No references mapped yet.[/yellow] Add one: [cyan]hermes secrets onepassword set ENV_VAR "op://…"[/cyan])rr rDboolstrrEr# isinstancedictrKrLrFrGr add_columnadd_row_ynrHlenr@rsortedrM)rNrOrPrQr;r9rIr6 references token_setrRtable ref_tablenamerSs r.r&r&siG -Cggi &B + +M : @bF6::i()G&**Y+1r288:G 68JKIfjj39r:@@BK&0E1BD&IE"rJRZZ^^I./I ^^K (F ev >E Rv& R MM)S\* MM)W<(<= MM/9- MM.#i.1 MM%s4 ;NPT0U+V'WX MM/3vzz2Es'K#LM  kfXR F0C/DA#FG k#?@ MM,C O 45 MM%%>VTUd@ Yf5[):& ;D   dC 4(8$9 : ; i  XY i)  MMB3%H I MM7 {CPP    O  r0c`t}tj|j|ji\}}|j|vr|D]}|j d|dyt }|jdijdi}|jd}t|tsi}||d<||j||j<t||j d|jd||j|jd s|j d y ) N[red][/red]r8r5r r<u [green]✓[/green] mapped [cyan]u [/cyan] → r;uy [yellow]Note: the integration is disabled — run [cyan]hermes secrets onepassword setup[/cyan] to turn it on.[/yellow]r) rrF_validate_referencesrrr@r rCrDrfrgr )rNrOvalidwarningswrPrQenv_maps r.r'r'siG114<<2PQOE8 ||5  -A MME!F+ , - -C ^^Ir * 5 5mR HFjjG gt $u !$,,/GDLL MM *4<<.    ! ::i   T  r0c|t}t}|jdijdi}|jd}t |t r|j |vr |jd|j dy||j =t||jd|j dy ) Nr5r r<z[yellow]z is not mapped.[/yellow]r8u-[green]✓[/green] removed mapping for [cyan]r2r) rr rCrDrfrgrr@r )rNrOrPrQrys r.r(r(siG -C ^^Ir * 5 5mR HFjjG gt $ G(C .FGH  MMA$,,wWX r0c t}t}|jdxsijdxsi}|jds|jdyt |jdt r|jdni}|s|jdyt |jd d xsd j}|jd t}t |jd d xsd j}|jrItjd ||||t|jdd d}|jr |jd|jdytd d} | jdd| jdt!|j"D]} | j%| dt!|j&D]} | j%| d|j| |j(D]} |jd| |jdt+|j"dy tj,||||d\} } t|jdd }td d} | jdd| jdt!|D]} | |k(r| j%| d| | vr| j%| d 2t0j2j| r|s| j%| d!ftt0j2j| }| j%| d"|rd#nd z|j| | D]} |jd| |jd$y#t.$r}|jd|dYd}~yd}~wwxYw)%Nr5r r;zb[yellow]1Password integration is disabled. Run `hermes secrets onepassword setup` first.[/yellow]r8r<us[yellow]No op:// references configured. Add one with `hermes secrets onepassword set ENV_VAR "op://…"`.[/yellow]rr9r7r:r6Tr?)r;r<r9r:r6r?r=rsrtrYr`rbr3rZActionz[green]exported[/green]z,[dim]skipped (already set / token var)[/dim]z[yellow]warning:[/yellow] z [green]Exported z( secret(s) into current process.[/green]F)rmr9rIr6 use_cachezim]skip (token var)[/dim]z$[red]unresolved (see warnings)[/red]z[dim]skip (already set)[/dim]zreen]would export[/green]z (overrides)u This was a dry-run — references resolve automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.)rr rDr@rfrgrerEr#applyrFapply_onepassword_secretsrderrorrrhrlappliedriskippedrwrkfetch_onepassword_secrets RuntimeErrorrKrL)rNrOrPrQrmr9rIr6resultrorqrxr5rwexcoverridealreadys r.r)r)siG -Cggi &B + +M : @bF ::i   A &0E1BD&IE"rJ   N &**Y+1r288:G 68JKIfjj39r:@@BK zz11&/#"6::.A4#HI  << MME&,,v6 7$V< &1 "6>>* ;D MM$ 9 : ;6>>* PD MM$ N O P e  MM$ F G ZZ^^D !( MM$ ? @2::>>$/0G MM-7PRS   MM% 8 21#678 MM * ;  cU&)*s-O O0O++O0ct}t}|jdijdi}d|d<t||j dy)Nr5r Fr;u[green]Disabled.[/green] 1Password references will NOT be resolved on the next Hermes invocation. Your reference mappings are left in config.yaml — remove them with [cyan]hermes secrets onepassword remove ENV_VAR[/cyan] if you no longer need them.r)rr rCr r@)rNrOrPrQs r.r*r*|sUiG -C ^^Ir * 5 5mR HFF9 MM  r0c|rdSdS)Nz[green]yes[/green]z [dim]no[/dim])bs r.rjrjs#$ 9/9r0c tjt|dgddd}|jdk(r9|jxs |j j jdS y#ttjf$rYywxYw)Nz --versionTcapture_outputtexttimeoutrzversion unknown) subprocessrunre returncodestdoutstderrrE splitlinesOSErrorTimeoutExpired)rRress r.rHrHs  nn [+ &   >>Q JJ,#**335@@B1E E   Z.. /   sA+A00B  B c.t|dg}|r|d|gz } tj|ddd}|j dk7ry|j xsdj}|jd d dd xsd S#ttjf$rYywxYw) zAReturn a short identity string if op is authenticated, else None.whoamirT rNrr7  x authenticated) rerrrrrrrEreplace)rRr9cmdrouts r.rMrMs v; !C W%%nnSD"M ~~ ::  " " $C ;;tS !$3 ' :?: Z.. /sA88BB)r+zargparse.ArgumentParserreturnNone)rNzargparse.Namespacerint)rrdrre)rRrrre)rRrr9rerz Optional[str])$__doc__ __future__rargparserKrpathlibrtypingr rich.consoler rich.panelr rich.tableragent.secret_sourcesr rFhermes_cli.configr r r r r#rBr/r%r&r'r(r)r*rjrHrMrr0r.rsy #  60 C /+nN b8 v >  \ ~  *:  ;r0