
    `gjV                    ,   d Z ddlmZ ddlZddlZddlZddlZddlZddlm	Z	 ddl
mZmZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZmZmZmZ ddlmZ ddZddZddZddZ ddZ!ddZ"ddZ#ddZ$dd	 	 	 	 	 	 	 	 	 ddZ%ddgZ&	 	 	 	 	 	 	 	 ddZ'y) u  CLI handlers for ``hermes secrets bitwarden ...``.

Subcommands:
    setup    — interactive wizard: install bws, prompt for token + project, test fetch
    status   — show current config + binary version + last fetch outcome
    sync     — run a fetch right now and show what would be applied (dry-run friendly)
    disable  — flip ``secrets.bitwarden.enabled`` to False
    install  — just download the bws binary (no token / project required)
    )annotationsN)Path)ListOptional)Console)Panel)Table)	bitwarden)get_env_pathload_configsave_configsave_env_value)masked_secret_promptc                   | j                  d      }|j                  dd      }|j                  dd       |j                  dd	       |j                  d
d       |j                  t               |j                  dd      }|j                  t
               |j                  dd      }|j                  ddd       |j                  t               |j                  dd      }|j                  t               |j                  ddt        j                   d      }|j                  ddd       |j                  t               y)zAttach the ``bitwarden`` subcommand tree to a parent parser.

    Called from ``hermes_cli.main`` as part of building the top-level
    ``hermes secrets`` parser.
    secrets_bw_command)destsetupzAInteractive wizard: install bws, store access token, pick project)help--project-idz.Pre-select a project UUID instead of prompting--access-tokenzCProvide the access token non-interactively (will be stored in .env)--server-urlzBitwarden region / self-hosted endpoint. Examples: https://vault.bitwarden.com (US, default), https://vault.bitwarden.eu (EU), or your self-hosted URL. Skips the interactive region prompt.)funcstatusz!Show config + binary + last fetchsyncz)Fetch secrets now and report what changedz--apply
store_truezKActually export the secrets into the current shell's env (default: dry-run))actionr   disablez"Turn off the Bitwarden integrationinstallz,Download and verify the pinned bws binary (v)z--forcez1Re-download even if a managed copy already existsN)add_subparsers
add_parseradd_argumentset_defaults	cmd_setup
cmd_statuscmd_synccmd_disablebw_BWS_VERSIONcmd_install)parent_parsersubr   r   r   r   r   s          I/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/secrets_cli.pyregister_clir.   (   sy    
&
&,@
&
ACNNP  E 
=   
R   
3   
I&^^H+N^OF
Z(>>&'R>SDZ  
 	8$nnY-QnRGk*nn;BOO;LAN  G @  
 k*    c           	     ~   t               }|j                  t        j                  dd             |j                          |j                  d       	 t	        j
                  d      }|%|j                  d       t	        j                         }t        |      }|j                  d| d	| d
       t        j                  j                         sg }| j                  r| j                  j                         s|j                  d       | j                  r| j                  j                         s?t         j"                  j%                  dd      j                         s|j                  d       | j&                  r| j&                  j                         s|j                  d       |r%|j                  ddj)                  |       d       y|j                          |j                  d       t+               }|j-                  di       j-                  di       }|j%                  dd      }| j                  xs dj                         }	|	st/        d| d      j                         }	|	s|j                  d       y|	j1                  d      s|j                  d        t3        ||	       |	t         j"                  |<   |j                  d!t5                d"|        |j                          |j                  d#       t7        | ||      }
|
y|
r|j                  d$|
        n|j                  d%       | j&                  r6| j&                  j                         r| j&                  j                         }n~|j                          |j                  d&       d}t9        ||	||
'      }|y|s#|j                  d(       |j                  d)       yt;        d*d+,      }|j=                  d-dd./       |j=                  d0       |j=                  d1d23       t?        |d      D ]A  \  }}|jA                  tC        |      |j%                  d4d5      |j%                  d6d5             C |j                  |       	 |jE                  d7tG        |       d8      j                         }|s0	 tI        |      }d|cxk  rtG        |      k  rn n||dz
     d6   }n|j                  d:tG        |       d;       }|j                          | j&                  r| j&                  j                         sd<nd.}|j                  d=| d>       	 t	        jL                  |	||d|
?      \  }}|s|j                  dA       nt;        d*d+,      }|j=                  d0d3       |j=                  dB       tO        |      D ]@  }||k(  rdC}n$t         j"                  j%                  |      rdD}ndE}|jA                  ||       B |j                  |       |D ]  }|j                  dF|         d*|dG<   ||dH<   |
|dI<   |j-                  d|       |j-                  dJdK       |j-                  dLd*       |j-                  dMd*       tQ        |       |j                          |j                  dN       |j                  dO       yP# t        $ r0}|j                  d| d       |j                  d       Y d }~yd }~ww xY w# tJ        $ r |j                  d9       Y w xY w# t        $ r}|j                  d@| d       Y d }~yd }~ww xY w)QNu  [bold]Bitwarden Secrets Manager setup[/bold]

Need an access token? In the Bitwarden web app:
  Secrets Manager → Machine accounts → [your account] →
  Access tokens → Create access token

Copy the token (starts with [cyan]0.[/cyan]…) — it cannot be retrieved later.cyan)border_stylez([bold]Step 1[/bold]  Install the bws CLIFinstall_if_missingu#     No bws on PATH — downloading…u     [green]✓[/green]   (r   u"     [red]✗ Could not install bws: [/red]z>  Manual install: https://github.com/bitwarden/sdk-sm/releases   r   BWS_SERVER_URL r   r   zP  [red]Non-interactive mode (no TTY) requires all setup flags.[/red]
  Missing: z, z

  Usage:
    hermes secrets bitwarden setup \
      --access-token '0.xxx' \
      --server-url 'https://vault.bitwarden.com' \
      --project-id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'z.[bold]Step 2[/bold]  Provide your access tokensecretsr
   access_token_envBWS_ACCESS_TOKENz  Paste access token (z): z#  [red]Empty token, aborting.[/red]z0.u     [yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token.  Continuing anyway.[/yellow]u     [green]✓[/green] stored in z as z,[bold]Step 3[/bold]  Pick a Bitwarden regionu     [green]✓[/green] using uN     [green]✓[/green] using bws default (US Cloud, https://vault.bitwarden.com)z#[bold]Step 4[/bold]  Pick a project
server_urlz?  [yellow]No projects visible to this machine account.[/yellow]ur     In the Bitwarden web app, open the machine account → Projects tab and grant it access to at least one project.Tboldshow_headerheader_style#   stylewidthNameIDdimrF   name?idz  Select project [1-z]:   [red]Enter a number.[/red]     [red]Out of range — pick 1-.[/red]   z[bold]Step z[/bold]  Test fetch)access_token
project_idbinary	use_cacher>   u     [red]✗ Fetch failed: zB  [yellow]Fetch succeeded but the project has no secrets.[/yellow]Statusu5   [dim]bootstrap token — never overrides itself[/dim]z9[yellow]already set in env (will be overwritten)[/yellow]z[green]new[/green]z  [yellow]warning:[/yellow] enabledrT   r>   cache_ttl_seconds,  override_existingauto_installuv   [green]✓ Bitwarden Secrets Manager is enabled.[/green]  Secrets will be pulled at the start of every Hermes process.z  Status:  [cyan]hermes secrets bitwarden status[/cyan]
  Refresh: [cyan]hermes secrets bitwarden sync[/cyan]
  Disable: [cyan]hermes secrets bitwarden disable[/cyan]r   ))r   printr   fitr(   find_bwsinstall_bws_bws_version	ExceptionsysstdinisattyrS   stripappendr>   osenvirongetrT   joinr   
setdefaultr   
startswithr   r   _resolve_server_url_list_projectsr	   
add_column	enumerateadd_rowstrinputlenint
ValueErrorfetch_bitwarden_secretssortedr   )argsconsolerU   versionexcmissingcfgsecrets_cfg	token_envtokenr>   rT   projectstableipchoiceidxstep_numr:   warningskeyr   ws                           r-   r$   r$   f   s   iGMM		`
  	
	 MMOMM<=6>MM?@^^%Fv&-fXS	CD 99!!d&7&7&=&=&?NN+,DOO$9$9$;::>>"2B7==?~.DOO$9$9$;NN>*MM"ii01 2LL  MMOMMBC
-C>>)R0 jb1  24FGI$"++-E$'=i[%LMSSU;<D!_	

 9e$!BJJyMM3LN3C4	{ST MMOMM@A$T;@J3J<@A6	
 4??002__**,
;<
!&%ZPMM[\MM? $V<F!4 U+h* 	HDAqMM#a&!%%"4aeeD#6FG	He]]%9#h-#LMSSUF&k C(3x=(%cAg.t4
MM;CM?'RS  MMOT__-B-B-Dq1HMMKz)<=>
66!!
 Z[$V<v."'? 	'CiP$T-MM#v&	' 	e :4QC89: "K	 *K *K-y9.4.5>40MMOMM	G MM	C
 G  :3%vFG;	
 J  <=(  1#f=>sC   A Z7 )[3 \ 7	[0 &[++[03\\	\<\77\<c                b   t               }t               }|j                  d      xs i j                  d      xs i }t        |j                  d            }|j                  dd      }|j                  dd      }t	        |j                  dd      xs d      j                         }t        t        j                  j                  |            }t        d	d d
      }	|	j                  dd       |	j                  d       |	j                  dt        |             |	j                  d|       |	j                  dt        |             |	j                  d|xs d       |	j                  d|xs d       |	j                  dt        t        |j                  dd	                         |	j                  dt	        |j                  dd                   |	j                  dt        t        |j                  dd                         t        j                  d	      }
|
r"|	j                  d|
 dt        |
       d        n|	j                  dd!       |j                  t!        |	d"d#$             |s|j                  d%       y&|s|j                  d'| d(       |s|j                  d)       y&)*Nr:   r
   rX   r;   r<   rT   r9   r>   Fr      )rA   boxpaddingr?   rK   EnabledzToken env varzToken in envz
Project IDz[dim](unset)[/dim]z
Server URLz:[dim]default (US Cloud, https://vault.bitwarden.com)[/dim]zOverride existingr[   zCache TTL (s)rY   rZ   zAuto-installr\   Tr3   z
bws binaryz (r   z[yellow]not installed[/yellow]zBitwarden Secrets Managerr1   )titler2   z=
  Run [cyan]hermes secrets bitwarden setup[/cyan] to enable.r   z
  [yellow]Enabled but uG    is not set — Hermes will skip BSM and warn on next startup.[/yellow]uC   
  [yellow]Enabled but no project_id — nothing to fetch.[/yellow])r   r   rj   boolrs   rf   rh   ri   r	   rp   rr   _ynr(   r_   ra   r]   r   )rz   r{   r   bw_cfgrX   r   rT   r>   	token_setr   rU   s              r-   r%   r%   #  s<   iG
-Cggi &B++K8>BF6::i()G

-/ABIL"-JVZZb17R8>>@JRZZ^^I./Iev>E	Rv&	R	MM)S\2	MM/Y/	MM.S^4	MM,Z%G3GH	MMRR 
MM%s4

;NPU0V+W'XY	MM/S4G)M%NO	MM.Sfjj.N)O%PQ[[E2Flxr,v2F1Gq%IJl%EFMM%%@vVWVW&yk 21 1	
 R	
 r/   c                   t               }t               }|j                  d      xs i j                  d      xs i }|j                  d      s|j                  d       y|j                  dd      }t        j
                  j                  |d      j                         }|s|j                  d	| d
       y|j                  dd      }|s|j                  d       yt        |j                  dd      xs d      j                         }	 t        j                  ||d|      \  }}	|s|j                  d       yt        |j                  dd            xs | j                  }t        dd      }|j                  dd       |j                  d       d}t        |      D ]  }||k(  r|j!                  |d       t        t        j
                  j                  |            }|r|s|j!                  |d       Z| j                  r5||   t        j
                  |<   |dz  }|j!                  |d|rdndz          |j!                  |d |rd!ndz           |j                  |       |	D ]  }|j                  d"|         | j                  s|j                  d#       y|j                  d$| d%       y# t        $ r}
|j                  d|
 d       Y d }
~
yd }
~
ww xY w)&Nr:   r
   rX   z`[yellow]Bitwarden integration is disabled.  Run `hermes secrets bitwarden setup` first.[/yellow]r7   r;   r<   r9   z[red]z is not set.[/red]rT   z$[red]No project_id configured.[/red]r>   F)rS   rT   rV   r>   z[red]Fetch failed: r6   z'[yellow]No secrets in project.[/yellow]r   r[   Tr?   r@   rH   r1   rK   Actionz![dim]skip (bootstrap token)[/dim]z[dim]skip (already set)[/dim]z[green]exported[/green]z (overrode)z[green]would export[/green]z (overrides)z[yellow]warning:[/yellow] u   
  This was a dry-run — secrets are picked up automatically on the next [cyan]hermes[/cyan] invocation.  Re-run with [cyan]--apply[/cyan] to export into the current shell instead.z
  [green]Exported z( secret(s) into current process.[/green])r   r   rj   r]   rh   ri   rf   rs   r(   rx   rb   r   applyr	   rp   ry   rr   )rz   r{   r   r   r   r   rT   r>   r:   r   r}   overrider   appliedr   alreadyr   s                    r-   r&   r&   T  s   iG
-Cggi &B++K8>BF::i ?	
 

-/ABIJJNN9b)//1Ei[(:;<L"-J<=VZZb17R8>>@J	66!!	
 ?@FJJ2E:;ItzzHd8E	V6*	XGg d)MM#BCrzz~~c*+8MM#>?::%clBJJsOqLGMM#8WMZ\]^MM#<RY_abcd MM% 821#678 ::8	
  	,WI5]^_Q  +C578s   J9 9	K!KK!c                    t               }t               }|j                  di       j                  di       }d|d<   t        |       |j	                  d       y)Nr:   r
   FrX   u   [green]Disabled.[/green]  Bitwarden secrets will NOT be pulled on the next Hermes invocation.
  Your access token is left in .env — remove it manually if you also want to revoke the credential.r   )r   r   rl   r   r]   )rz   r{   r   r   s       r-   r'   r'     sW    iG
-CnnY+K, F9MM	$ r/   c                   t               }	 t        j                  t        | j                              }|j                  d| dt        |       d       y# t        $ r}|j                  d| d       Y d }~yd }~ww xY w)	N)forceu   [green]✓[/green] r5   r   r   z[red]Install failed: r6   r7   )r   r(   r`   r   r   r]   ra   rb   )rz   r{   pathr}   s       r-   r*   r*     ss    iG~~D$45+D6\$5G4HJK -cU&9:s   A
A 	A? A::A?c                    | rdS dS )Nz[green]yes[/green]z[dim]no[/dim] )bs    r-   r   r     s    #$9/9r/   c                   	 t        j                  t        |       dgddd      }|j                  dk(  r9|j                  xs |j
                  j                         j                         d   S 	 y# t        t         j                  f$ r Y yw xY w)Nz	--versionTrR   )capture_outputtexttimeoutr   zversion unknown)

subprocessrunrs   
returncodestdoutstderrrf   
splitlinesOSErrorTimeoutExpired)rU   ress     r-   ra   ra     s    
nn[+&	
 >>QJJ,#**335@@B1EE   Z../ s   A+A0 0BBr9   r=   c                  t         j                  j                         }||d<   |j                  dd       |r||d<   	 t	        j
                  t        |       ddddg|d	d	d
      }|j                  dk7  r|j                  xs |j                  j                         dd }|j                  d| d       |j                         }d|v sd|v r|j                  d       yd|v sd|v r|j                  d       y	 t        j                   |j                  xs d      }	t%        |	t&              sg S |	D 
cg c]'  }
t%        |
t(              s|
j+                  d      s&|
) c}
S # t        t        j                  f$ r}|j                  d| d       Y d}~yd}~ww xY w# t        j"                  $ r}|j                  d| d       Y d}~yd}~ww xY wc c}
w )zICall ``bws project list`` and return the parsed list, or None on failure.r<   NO_COLOR1r8   projectlistz--outputjsonT   )envr   r   r   z  [red]Couldn't list projects: r6   Nr   rZ   z   [red]bws project list failed: invalid_clientz400 bad requesta$    [yellow]'invalid_client' from the US identity endpoint usually means the token is for a different Bitwarden region.  Re-run [cyan]hermes secrets bitwarden setup[/cyan] and pick EU or self-hosted at the region prompt, or set [cyan]secrets.bitwarden.server_url[/cyan] in config.yaml.[/yellow]authorizationinvalidzu  [yellow]This usually means the access token is wrong or revoked. Double-check it in the Bitwarden web app.[/yellow]z[]z  [red]bws returned non-JSON: rN   )rh   ri   copyrl   r   r   rs   r   r   r]   r   r   r   rf   lowerr   loadsJSONDecodeError
isinstancer   dictrj   )rU   r   r{   r>   r   r   r}   errlowereddatar   s              r-   ro   ro     s    **//
C#CNN:s# *
nn[)VZ@
 ~~zz'SZZ..0#68VDE))+w&*;w*FMM=  '9+?MME zz#**,- dD!	C!z!T2quuT{ACC= Z../ 7uFCD2  6se6BC
 DsA   (E" :#F 3G	GG"F;FFG0G

G)u7   US Cloud  (https://vault.bitwarden.com — bws default)r9   )z&EU Cloud  (https://vault.bitwarden.eu)zhttps://vault.bitwarden.euc                .   | j                   r4| j                   j                         r| j                   j                         S t        j                  j	                  dd      j                         }|r|j                  d| d       |S t        |j	                  dd      xs d      j                         }|r|j                  d| d       t        dd	d
d      }|j                  ddd       |j                  d       t        t        d      D ]#  \  }\  }}|j                  t        |      |       % |j                  t        t        t              dz         d       |j                  |       t        t              dz   }		 d|	 d}
|r|
dz  }
|
dz  }
|j                  |
      j                         }|s|r|S |j                  d       J	 t        |      }d|cxk  rt        t              k  rn nt        |dz
     d   S ||	k(  rW|j                  d      j                         }|s|j                  d       y
|j!                  d      s|j                  d       |S |j                  d|	 d       # t        $ r |j                  d       Y w xY w)a  Pick a Bitwarden server URL for setup.

    Resolution order:
      1. ``--server-url`` CLI flag (non-interactive)
      2. ``BWS_SERVER_URL`` env var (so users running with that already set
         in their shell don't have to re-enter it)
      3. Existing ``secrets.bitwarden.server_url`` value (for re-runs)
      4. Interactive menu: US / EU / self-hosted

    Returns the chosen URL as a string (empty string = bws default,
    i.e. US Cloud).  Returns None if the user aborted with an empty
    custom URL.
    r8   r9   z'  Detected [cyan]BWS_SERVER_URL[/cyan]=u    in your shell — using it.r>   z  Existing config: [cyan]z?[/cyan]. Press Enter to keep, or pick a different option below.Tr?   Nr   )rA   rB   r   r   rC   r1   rD   rE   zRegion / endpointr7   zSelf-hosted / custom URLz  Select region [1-]z (Enter to keep current)z: rO   zD  Enter your Bitwarden server URL (e.g. https://vault.example.com): z!  [red]Empty URL, aborting.[/red])zhttp://zhttps://u]     [yellow]Warning: URL doesn't start with http:// or https:// — bws may reject it.[/yellow]rP   rQ   )r>   rf   rh   ri   rj   r]   rs   r	   rp   rq   _REGION_PRESETSrr   ru   rt   rv   rw   rm   )rz   r   r{   env_urlexistingr   r   label_url
custom_idxpromptr   r   customs                 r-   rn   rn     s   $ 4??002$$&&jjnn-r288:G5gY>Z[	
 ;??<4:;AACH'z 2E E	

 dT6RE	Sa0	()%oq9 %=E4c!fe$%	MM#c/*Q./1KLMM%_%)J
&zl!400F$v&,,.MM89	f+C +s?++"37+A..*]]5 eg  AB$$%<=? M7
|7KLA   	MM89	s   I6 6JJ)r+   zargparse.ArgumentParserreturnNone)rz   argparse.Namespacer   rv   )r   r   r   rs   )rU   r   r   rs   )
rU   r   r   rs   r{   r   r>   rs   r   zOptional[List[dict]])rz   r   r   r   r{   r   r   zOptional[str])(__doc__
__future__r   argparser   rh   r   rc   pathlibr   typingr   r   rich.consoler   
rich.panelr   
rich.tabler	   agent.secret_sourcesr
   r(   hermes_cli.configr   r   r   r   hermes_cli.secret_promptr   r.   r$   r%   r&   r'   r*   r   ra   ro   r   rn   r   r/   r-   <module>r      s    #   	  
  !     0  :6+|zz.bGT  :  FH/D/D/D'./D?B/D/Dl DLLM
LMLM LM 	LMr/   