epjdUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z m Z mZmZddlmZmZmZmZddlmZmZddlmZejeZd Zd Zd ZeeeeefZ iZ!d e"d <dZ#dGdZ$ee#e$Z%de"d<dHdIdZ&dJdZ'dKd Z(dLd"Z)dMdNd%Z*dOd'Z+dPd)Z,d#d#d*dQd.Z-d#edd#d/d0dd1dRd7Z.dd#ed#d/d0dd8dSd>Z/Gd?d@eZ0dTdCZ1dHdUdEZ2dHdUdFZ3dS)Vu1Password (`op` CLI) secret source. Resolve provider credentials from 1Password ``op://vault/item/field`` references at process startup so they don't have to live in plaintext in ``~/.hermes/.env``. Design summary -------------- * Users map environment-variable names to official 1Password secret references in ``secrets.onepassword.env``:: secrets: onepassword: enabled: true env: OPENAI_API_KEY: "op://Private/OpenAI/api key" ANTHROPIC_API_KEY: "op://Private/Anthropic/credential" * After ``.env`` loads, each reference is resolved with a single ``op read -- `` call and injected into ``os.environ`` (the same point in startup as the Bitwarden source). * Authentication is whatever the user's ``op`` CLI already uses — a service-account token (``OP_SERVICE_ACCOUNT_TOKEN``) for headless boxes, or a desktop/interactive session (``OP_SESSION_*``). Hermes never authenticates on the user's behalf; it shells out to an already-trusted, already-authenticated CLI. * Failures NEVER block startup. A missing ``op`` binary, expired auth, a bad reference, or a permission error each surface a one-line warning and Hermes continues with whatever credentials ``.env`` already had. The atomic-write / ``0600`` / TTL cache mechanics are shared with the other backends via :mod:`agent.secret_sources._cache` — successful, complete pulls are cached in-process and on disk under ``/cache/op_cache.json`` so back-to-back short-lived ``hermes`` invocations don't re-shell ``op`` for every reference. The disk file holds only resolved secret *values*; auth material is fingerprinted, never stored. ) annotationsN)Path)DictListOptionalTuple) CachedFetch DiskCache FetchResultis_valid_env_name) ErrorKind SecretSource)get_source_environmentOP_SERVICE_ACCOUNT_TOKEN)PATHHOME USERPROFILEAPPDATA LOCALAPPDATA SystemRootTMPDIRTMPTEMPXDG_CONFIG_HOMEXDG_RUNTIME_DIR OP_ACCOUNTOP_CONNECT_HOSTOP_CONNECT_TOKENOP_LOAD_DESKTOP_APP_SETTINGSzDict[_CacheKey, CachedFetch]_CACHEz op_cache.json cache_key _CacheKeyreturnstrc$|\}}}}|d|d|S)aSerialize a cache key for on-disk storage, omitting home_path. The disk file is already partitioned by home (it lives under ``/cache/``), so the path provides the home dimension; folding it into the key string too would be redundant. |)r"auth_fpaccount_homerefs_fps F/home/thesage/.hermes/hermes-agent/agent/secret_sources/onepassword.py _disk_key_strr.ys.(1$GWeW + + + +' + ++)key_serializerr _DISK_CACHE home_pathOptional[Path]rc6t|S)zAPath to the on-disk cache (exposed for tests and direct callers).)r1pathr2s r-_disk_cache_pathr7s   I & &&r/ referencesOptional[Dict[str, str]] Tuple[Dict[str, str], List[str]]ci}g}|piD]\}}t|s|d|d.t|ts|d|d]|}|ds|d|d|d|||<||fS)uReturn ``(valid_refs, warnings)`` from an ``env`` mapping. A reference is kept only if its target env-var name is a valid POSIX name and the value is a stripped ``op://…`` reference string. Everything else produces a warning and is dropped (never fatal). z Skipping z: not a valid env-var namez: reference is not a stringzop://: z! is not an op:// secret reference)itemsr append isinstancer%strip startswith)r8validwarningsnamerefcleaneds r-_validate_referencesrGsEH &B--//   c &&  OOJJJJ K K K #s##  OOKKKK L L L ))++!!'**  OONDNNcNNN    d (?r/ token_envct}d||dd|ddd|ddd|ddg}t|D]7}|d r ||d ||8d |}t j|d  d dS)u)SHA-256 prefix over the auth material `op` would use. Folds in the service-account token, ``OP_ACCOUNT``, the 1Password Connect ``OP_CONNECT_HOST``/``OP_CONNECT_TOKEN``, and *all* ``OP_SESSION_*`` vars (the names `op` actually exports for interactive sessions — ``OP_SESSION_``). Signing out and into a different identity therefore changes the cache key, so a value cached under a previous identity is never served under a new one. Never logged or displayed; the raw token never leaves this hash. ztoken=zaccount=rz connect_host=rzconnect_token=r OP_SESSION_= utf-8N) rgetsortedrAr>joinhashlibsha256encode hexdigest)rH source_envpartskeymaterials r-_auth_fingerprintr[s())J0 2..005:>>,3355? '8"==??A(:B??AA E j!!55 >>- ( ( 5 LLC33*S/33 4 4 4yyH >(//'22 3 3 = = ? ? DDr/Dict[str, str]cdfdtD}tj|dddS)u<SHA-256 prefix over the configured name→reference mapping.rMc32K|]}|d|VdS)rLNr().0rDr8s r- z$_refs_fingerprint..s6UU$D55:d#355UUUUUUr/rNNrO)rRrQrSrTrUrV)r8rZs` r-_refs_fingerprintrasbyyUUUU&BTBTUUUUUH >(//'22 3 3 = = ? ? DDr/rJ binary_pathc|rFt|}|r!tj|tjr|SdSt jd}|rt|ndS)u[Resolve a usable ``op`` binary, or None. When ``binary_path`` is set it is used verbatim and PATH is NOT consulted — pinning an absolute path is a way to avoid trusting whatever ``op`` shows up first on ``PATH``. A pinned-but-missing path returns None (the caller surfaces a clear error) rather than silently falling back. Nop)rexistsosaccessX_OKshutilwhich)rbpinnedfounds r-find_oprmslk"" ==?? ry99 Mt L  E )4;;;T)r/textcpddlm}||ddS)zCRemove ANSI control sequences and trim, for safe message surfacing.r) strip_ansirJ)tools.ansi_striprpreplacer@)rnrps r-_scrubrtsB++++++ :d   # #FB / / 5 5 7 77r/ token_valuect}i}tD]}||}||||<|D]\}}|dr|||< |r||d<d|d<|S)zEBuild a minimal allowlisted environment for the ``op`` child process.NrKr1NO_COLOR)r_OP_ENV_ALLOWLISTrPr=rA)rurWenvrYvals r- _op_child_envr|s'))JC nnS!! ?CH$$&&S >>- ( ( CH6*5 &'C O Jr/r*rurd referencer*c t|dg}|r|d|gz }|d|gz } tj|t|ddddt}nR#tj$r }t dtd ||d }~wt$r}t d ||d }~wwxYw|jd krOt|j pd d d}|rt d|d|t d|jd||j pd d}| st d||S)uResolve a single ``op://`` reference to its value. Raises :class:`RuntimeError` on any failure — including a ``returncode 0`` with empty output, which would otherwise silently clobber a good ``.env``/shell credential with ``""``. readz --accountz--TrNrs)rzcapture_outputrnencodingerrorstimeoutzop read timed out after zs for Nzfailed to invoke op: rrJzop read failed for r<zop read exited z for z z$op read returned an empty value for )r% subprocessrunr|_OP_RUN_TIMEOUTTimeoutExpired RuntimeErrorOSError returncodertstderrstdoutrstripr@) rdr~r*rucmdprocexcerrvalues r- _run_op_readrs"ggv&C& W%%D) CC~ k**#     $ K K Ki K K    CCC838899sBC !T[&B''-  KIYIICIIJJ J Ado A AI A A   [ B & &v . .E ;;==QO)OOPPP Ls#-AB  A;; B BB T,)r*rHbinaryrb use_cachecache_ttl_secondsr2rrboolrfloatct|\}} |si| fSt|d} t ||pd|t |ndt |f} |rt| } | r+| |rt| j | fSt | ||} | | t| <t| j | fS|pt|}|tdi}d}t|D]]} t!||||| ||< #t$r1}| t ||dz }Yd}~Vd}~wwxYw|rZ|sX|rVt%t|t'j}|t| <t| ||||| fS)uResolve ``references`` (name → ``op://…``) to ``(secrets, warnings)``. Raises :class:`RuntimeError` only when no ``op`` binary is available — a fatal "can't fetch anything" condition. Per-reference failures (expired auth, bad reference, empty value) are collected as warnings and the reference is dropped, so one bad entry never sinks the rest. Only a complete, error-free pull is cached, so a transient auth failure isn't frozen in for the whole TTL window. rJNzop CLI not found. Install the 1Password CLI (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path to its absolute location.rr})secrets fetched_at)rGrrPr@r[r%rar!is_freshdictrr1rrmrrQrr>r timewrite)r8r*rHrrbrrr2rBrCrur"cached disk_cachedrdr read_errorsrDrentrys r-fetch_onepassword_secretsrAs@*+:66OE8 8|(**..y"==CCEEK)$$ 2#/IR%  I7I&&  2foo&788 2''1 1!&&y2CYOO  " +F9  +,,h6 6  '7;''B z H   !GKu  (E$KkGDMM    OOCHH % % % 1 KKKKKK JJJDMMdikkJJJ!y)U,=yIII H s?E F&'FF)rzr*service_account_token_envrboverride_existingrr2enabledrzrrr ct}|s|St|\} } |j| i} | D]g\} } | |kr|j| &|s:tj | r|j| b| | | <h| s|St|}||_ ||r d|d|_ nd|_ |S t| |||||\}}n-#t$r }t||_ |cYd}~Sd}~wwxYw||_|j||D]\} }| |kr$| |jvr|j| /|sCtj | r$| |jvr|j| t|tj| <|j| |S)u^Resolve configured ``op://`` references and set them on ``os.environ``. Called by ``load_hermes_dotenv()`` after the .env files have loaded. Intentionally defensive — any failure returns a :class:`FetchResult` with ``error`` set (or surfaces warnings); it never raises. Parameters mirror the ``secrets.onepassword.*`` config keys so the caller can splat the dict in. References that are already satisfied by the current environment (when ``override_existing`` is false) are skipped *before* fetching, so ``op`` is never invoked for a value that would be discarded. N!secrets.onepassword.binary_path (!) is not an executable op binary.secrets.onepassword.enabled is true but the op CLI was not found on PATH. Install it (https://developer.1password.com/docs/cli/get-started/) or set secrets.onepassword.binary_path.r8r*rHrrr2)r rGrCextendr=skippedr>rfenvironrPrmrberrorrrr%rapplied)rrzr*rrbrrr2resultrBrC refs_to_fetchrDrErrfetch_warningsrrs r-apply_onepassword_secretsrsv.]]F  *3//OE8 O8$$$%'M[[]]"" c , , , N ! !$ ' ' '   RZ^^D%9%9  N ! !$ ' ' ' ! d  [ ! !FF ~  (K((( LL 3 L   ";$// # # #  3xx  FN O>***}} $ $ e , , ,6>))%%d+++   RZ^^D%9%9 6>))%%d+++   4d#### Ms1D D4D/)D4/D4cTeZdZdZdZdZdZdZdd Zdd Z dd Z ddZ dfd Z xZ S)OnePasswordSourceu1Password as a registered secret source. Thin adapter over the module's fetch machinery. ``fetch()`` only *fetches* — precedence, override semantics, conflict warnings, and the ``os.environ`` writes are the orchestrator's job (see ``agent.secret_sources.registry.apply_all``). 1Password is a **mapped** source: the user explicitly binds each env var to an ``op://`` reference under ``secrets.onepassword.env``, so its claims outrank bulk sources (e.g. a Bitwarden project dump) on contested vars. onepassword 1Passwordmappedrdcfgrr$rcrtt|to|ddS)NrT)rr?rrP)selfrs r-rz#OnePasswordSource.override_existings0 JsD))Pcgg6I4.P.PQQQr/ct}t|tr$t|dp|}t |hS)Nr)_DEFAULT_TOKEN_ENVr?rr%rP frozenset)rrrHs r-protected_env_varsz$OnePasswordSource.protected_env_vars sI& c4  OCGG$?@@MINNI)%%%r/c Jddddidddddtddddd d dd d dd S)Nz Master switchF) descriptiondefaultz1Map of ENV_VAR -> op://vault/item/field referencez0op --account shorthand (empty = default account)rJzOEnv var holding the service-account token (unset = desktop/interactive session)z,Pin the op binary (empty = resolve via PATH)z!Disk+memory cache TTL; 0 disablesrz+Resolved values overwrite .env/shell valuesT)rrzr*rrbrr)r)rs r- config_schemazOnePasswordSource.config_schemas'65IIR R  G-** N C"" M""/   r/r2rr c (t|tr|ni}t}|d}t t|tr|nd\}}|j||s|sd|_tj |_ |St|dpd}t|}||_ |(|r d|d|_nd|_tj|_ |S t|dd } n#t t"f$rd } YnwxYw t%|t|d pdt|d pt&|| | \} } nN#t($rA} t| |_t+t| |_ |cYd} ~ Sd} ~ wwxYw| |_|j| |S)Nrzzksecrets.onepassword.enabled is true but the env: map is empty. Add ENV_VAR: op://vault/item/field entries.rbrJrrrrrgr@r*rr)r?rr rPrGrCrrr NOT_CONFIGURED error_kindr%rmrbBINARY_MISSINGr TypeError ValueErrorrrr_classify_op_errorr) rrr2renv_maprBrCrbrttlrrrs r-fetchzOnePasswordSource.fetch/sOT**2cc''%...!'400 :GGd  x x(((  =J %.$<!M#''-006B77 %%# > 3 333 > !* 8F M  3S99::CC:&   CCC  &? CGGI..4"55GG788N.s7 5 5c3'> 5 5 5 5 5 5r/) unauthorizedz not signed inzsession expiredauthentication401403z empty valuec3 K|]}|vV dSrr(rs r-r`z%_classify_op_error..s7 . .c3'> . . . . . .r/)network connectionz resolve hostdns) lowerr TIMEOUTranyr EMPTY_VALUENETWORKINTERNAL)rrs @r-rrsmmooGg  g%%)<)G)G!W,,''  5 5 5 5&4 5 5 555%$$$$  . . . .&- . . ...!   r/Nonecltt|dS)zDrop in-process AND disk caches. Used after a token rotation (`hermes secrets onepassword token`) so the next startup resolves fresh with the new credential instead of serving values cached under the old token's fingerprint. N)r!clearr1r6s r- clear_cachesrs+ LLNNNi     r/c$t|dS)zClear in-process AND disk caches. Tests can pass ``home_path`` to scope the disk cleanup to a tmpdir. Without it we fall back to the same default resolution as the writer. N)rr6s r-_reset_cache_for_testsrs r/)r"r#r$r%r)r2r3r$r)r8r9r$r:)rHr%r$r%)r8r\r$r%)rJ)rbr%r$r3)rnr%r$r%)rur%r$r\) rdrr~r%r*r%rur%r$r%)r8r\r*r%rHr%rr3rbr%rrrrr2r3r$r:)rrrzr9r*r%rr%rbr%rrrrr2r3r$r )rr%r$r )r2r3r$r)4r __future__rrSloggingrfrirrpathlibrtypingrrrragent.secret_sources._cacher r r r agent.secret_sources.baser rr getLoggerrloggerrrryr%r#r!__annotations___DISK_CACHE_BASENAMEr.r1r7rGr[rarmrtr|rrrrrrrr(r/r-rsZ%%%N#"""""  ............ >=======<<<<<<  8 $ $ 0: #sC$ % ')))))&,,,,#  '''''8EEEE2EEEE*****,88880 444444~'!" $CCCCCC\%)%7"" $]]]]]]JL.L.L.L.L. L.L.L.^2!!!!!r/