sjs0dZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z m Z ddlmZddlmZddlmZd Zdd lmZmZmZmZdd lmZd Zd6dZd7dZd8dZd8dZ d8dZ!d8dZ"d8dZ#d8dZ$d9d Z%d:d#Z&d$d%d;d+Z'd$d%duCLI handlers for ``hermes secrets bitwarden ...``. Subcommands: setup — interactive wizard: install bws, prompt for token + project, test fetch status — show current config + binary version + token validation status sync — run a fetch right now and show what would be applied (dry-run friendly) disable — flip ``secrets.bitwarden.enabled`` to False install — just download the bws binary (no token / project required) ) annotationsN)Path)ListOptional)Console)Panel)Tablez2.0.0) get_env_path load_config save_configsave_env_value)masked_secret_promptcddlm}|S)zHImport ``agent.secret_sources.bitwarden`` on first use (crypto payload).r) bitwarden)agent.secret_sourcesr)_bws :/home/agent/.hermes/hermes-agent/hermes_cli/secrets_cli.py_load_bwr1s555555 Jnamestrc^|dkrtStdtd|)uPEP 562 module-level lazy resolver. Existing callers (and upstream tests) monkeypatch attributes on ``hermes_cli.secrets_cli.bw`` directly. Resolving that attribute at module-import time would re-import ``cryptography`` eagerly — the very self-lock we are preventing (#86781). Defer the backend import until the first actual attribute access, so ``import hermes_cli.secrets_cli`` stays crypto-free while ``secrets_cli.bw.find_bws`` still resolves. bwzmodule z has no attribute )rAttributeError__name__)rs r __getattr__r8s6 t||zz I8IIII J JJr parent_parserargparse.ArgumentParserreturnNonec|d}|dd}|dd|dd |d d |t |d d}|t |dd}|dd|ddd|t |dd}|ddd|t |dd}|t |ddtd}|ddd |t d!S)"zAttach the ``bitwarden`` subcommand tree to a parent parser. Called from ``hermes_cli.main`` as part of building the top-level ``hermes secrets`` parser. secrets_bw_command)destsetupzAInteractive wizard: install bws, store access token, pick project)help --project-idz.Pre-select a project UUID instead of prompting--access-tokenzCProvide the access token non-interactively (will be stored in .env) --server-urlzBitwarden region / self-hosted endpoint. Examples: https://vault.bitwarden.com (US, default), https://vault.bitwarden.eu (EU), or your self-hosted URL. Skips the interactive region prompt.)funcstatusz.Show config + binary + token validation statustokenz@Rotate the access token: validate a new one and store it in .envz@Provide the new token non-interactively (default: masked prompt)z --no-verify store_truez7Store without probing Bitwarden first (not recommended))actionr%syncz)Fetch secrets now and report what changedz--applyzKActually export the secrets into the current shell's env (default: dry-run)disablez"Turn off the Bitwarden integrationinstallz,Download and verify the pinned bws binary (v)z--forcez1Re-download even if a managed copy already existsN) add_subparsers add_parser add_argument set_defaults cmd_setup cmd_status cmd_tokencmd_sync cmd_disable _BWS_VERSION cmd_install)rsubr$r*r+r.r/r0s r register_clir>Lsp  & &,@ & A AC NN P   E  =  R  3 I&&& ^^ =F Z((( NN O   E  O  F  I&&& >>&'R> S SD Z  8$$$nnY-QnRRG k***nn KL K K KG  @  k*****rargsargparse.Namespaceintc t}t}|tjdd||d |d}|)|d|}t|}|d|d |d nF#t$r9}|d |d |d Yd}~dSd}~wwxYwtj sg}|j r|j s|d|jr|j sGt jdd s|d|jr|j s|d|r.|dd|ddS||dt+}|didi}|dd} |j pd } | s%t/d| d } | s|ddS| ds|d t3| | | t j| <|d!t5d"| ||d#t7|||} | dS| r|d$| n|d%|jr4|j r|j } n||d&d} t9|| || '} | dS| s,|d(|d)dSt;d*d+,}|d-dd./|d0|d1d23t?| dD]Q\}}| tC||d4d5|d6d5R|| |"d7tG| d8 }|s< tI|}n%#tJ$r|d9YnwxYwd|cxkrtG| krnn| |dz d6} n'|d:tG| d;||jr|j sd |&| | |d| ?\}}n1#t$r$}|d@|d Yd}~dSd}~wwxYw|s|dAnt;d*d+,}|d0d3|dBtO|D]E}|| krdC}n$t j|rdD}ndE}| ||F|||D]}|dF|d*|dG<| |dH<| |dI<|d| |dJdK|dLd*|dMd*tQ|||dN|dOdPS)QNu[bold]Bitwarden Secrets Manager setup[/bold] Need an access token? In the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token Copy the token (starts with [cyan]0.[/cyan]…) — it cannot be retrieved later.cyan) border_stylez([bold]Step 1[/bold] Install the bws CLIFinstall_if_missingu# No bws on PATH — downloading…u [green]✓[/green]  (r1u" [red]✗ Could not install bws: [/red]z> Manual install: https://github.com/bitwarden/sdk-sm/releasesr'BWS_SERVER_URLr(r&zP [red]Non-interactive mode (no TTY) requires all setup flags.[/red] Missing: z, z Usage: hermes secrets bitwarden setup \ --access-token '0.xxx' \ --server-url 'https://vault.bitwarden.com' \ --project-id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'z.[bold]Step 2[/bold] Provide your access tokensecretsraccess_token_envBWS_ACCESS_TOKENz Paste access token (): z# [red]Empty token, aborting.[/red]0. [yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token. Continuing anyway.[/yellow]u [green]✓[/green] stored in  as z,[bold]Step 3[/bold] Pick a Bitwarden regionu [green]✓[/green] using uN [green]✓[/green] using bws default (US Cloud, https://vault.bitwarden.com)z#[bold]Step 4[/bold] Pick a project server_urlz? [yellow]No projects visible to this machine account.[/yellow]ur In the Bitwarden web app, open the machine account → Projects tab and grant it access to at least one project.Tbold show_header header_style#stylewidthNameIDdimr\r?idz Select project [1-z]:  [red]Enter a number.[/red] [red]Out of range — pick 1-.[/red]z [bold]Step z[/bold] Test fetch) access_token project_idbinary use_cacherTu [red]✗ Fetch failed: zB [yellow]Fetch succeeded but the project has no secrets.[/yellow]Statusu5[dim]bootstrap token — never overrides itself[/dim]z9[yellow]already set in env (will be overwritten)[/yellow]z[green]new[/green]z [yellow]warning:[/yellow] enabledrirTcache_ttl_seconds,override_existing auto_installuv[green]✓ Bitwarden Secrets Manager is enabled.[/green] Secrets will be pulled at the start of every Hermes process.z Status: [cyan]hermes secrets bitwarden status[/cyan] Refresh: [cyan]hermes secrets bitwarden sync[/cyan] Disable: [cyan]hermes secrets bitwarden disable[/cyan]r))rrprintrfitfind_bws install_bws _bws_version ExceptionsysstdinisattyrhstripappendrTosenvirongetrijoinr setdefaultr startswithr r _resolve_server_url_list_projectsr add_column enumerateadd_rowrinputlenrA ValueErrorfetch_bitwarden_secretssortedr )r?rconsolerjversionexcmissingcfg secrets_cfg token_envr+rTriprojectstableipchoiceidxstep_numrLwarningskeyr*ws rr6r6sC BiiG MM  `         MMOOO MM<=== 66 > MM? @ @ @^^%%Fv&& CfCCCCCDDDD  F3FFFGGG  ;   qqqqq  9    ! -d&7&=&=&?&? - NN+ , , , /DO$9$9$;$; /:>>"2B77==?? /~... +DO$9$9$;$; + NN> * * *   MML"ii00LLL   1 MMOOO MMBCCC --C>>)R00 jb11 24FGGI   $" + + - -E V$%Li%L%L%LMMSSUU  ;<<<q   D ! !   _   9e$$$!BJy MMSLNNSS SSTTT MMOOO MM@AAA$T;@@Jq  @J@@AAAA  6    %T4?0022%T_**,,   ;<<< !&%ZPPP  1  MM[ \ \ \ MM?   1$V<<< F!444     U+++h** H HDAq MM#a&&!%%"4"4aeeD#6F6F G G G G e T]]#L#h--#L#L#LMMSSUUF  &kk    <=== C((((3x==(((((%cAg.t4  MMRCMMRRR S S S T MMOOOLT_-B-B-D-DLqq1H MM====>>> 66!! 7    =#===>>>qqqqq  Z[[[[$V<<< v... """'?? ' 'CiP$$ .T- MM#v & & & & e :: 8Q889999"K  *K  *K -y999.444.555>4000 MMOOO MM G MM C 1sC0A,C D '.DD )V99WWZ$$ [.[  [c lt}t}t}|dpidpi}t |d}|dd}|dd}t |ddpd}tj|d} t | } | d } t|| | | \} } td dd }| dd| d| dt|| d|| dt| | d| | d|pd| d|pd| dtt |dd | dt |dd| dtt |dd| r*| d | d!t| d"n| d d#|t#|d$d%&| D]}|||s|d'd(S| s|d)|d*|s|d+d(S),NrLrrmrMrNrirKrTFrE)rmrjr+rTr)rWboxpaddingrUraEnabledz Token env varz Token in envzToken validationz Project IDz[dim](unset)[/dim]z Server URLz:[dim]default (US Cloud, https://vault.bitwarden.com)[/dim]zOverride existingrpz Cache TTL (s)rnroz Auto-installrqTz bws binaryz (r1z[yellow]not installed[/yellow]zBitwarden Secrets ManagerrC)titlerDz= Run [cyan]hermes secrets bitwarden setup[/cyan] to enable.rz [yellow]Enabled but uG is not set — Hermes will skip BSM and warn on next startup.[/yellow]uC [yellow]Enabled but no project_id — nothing to fetch.[/yellow])rrr rboolrr{r}r~rt_token_validation_statusr rr_ynrvrrr)r?rrrbw_cfgrmrrirTr+ token_setrjtoken_validationvalidation_messagesrmessages rr7r7Zs BiiG --Cggi  &B + +K 8 8 >BF6::i(())G -/ABBIL"--JVZZ b117R88>>@@J JNN9b ) ) / / 1 1EU I [[E[ 2 2F,D ---)) ev > > >E Rv&&& R MM)S\\222 MM/Y/// MM.S^^444 MM$&6777 MM,Z%G3GHHH MMRR MM%s4 ;NPU0V0V+W+W'X'XYYY MM/S4G)M)M%N%NOOO MM.Sfjj.N.N)O)O%P%PQQQ G l%I%I,v2F2F%I%I%IJJJJ l%EFFF MM%%@vVVVWWW& g  VWWWq    1y 1 1 1      R    1rct}t}t}|dpidpi}|dd}t |ddpd}|jpd}|sotj s| ddS| d td |d }|s| d dS| d s| d|j s|d}|| ddS| dt||||} | | ddS| dt!| dt!| dkrdnddt |ddpd} | r)| r'| d| Dvr| d| dt#|||t$j|<|| dt+d|d |d!s| d"d#S)$u-Rotate the BSM access token without re-running the whole setup wizard. Prompts for (or accepts via ``--access-token``) a new machine-account token, probes Bitwarden with it (unless ``--no-verify``), and only then persists it to .env — so a bad paste never bricks the working token. rLrrMrNrTrKu9[red]No TTY — pass the token with --access-token.[/red]rIuCreate a new token in the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token zPaste new access token (rOz![red]Empty token, aborting.[/red]rPu[yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token.[/yellow]TrENu`[red]bws binary not available — cannot verify. Re-run with --no-verify to store anyway.[/red]uVerifying against Bitwarden…rSu>[red]✗ New token was rejected — nothing was changed.[/red]u#[green]✓ Token accepted[/green] (z projectsz visible).rich|] }|d Src.0rs r zcmd_token..s9T9T9Ta!D'9T9T9Trz$[yellow]Warning: configured project z is not visible to this machine account. Grant it access in the Bitwarden web app or re-run `hermes secrets bitwarden setup` to pick a different project.[/yellow]u[green]✓[/green] stored in rRz.. Takes effect on the next Hermes invocation.rmu[yellow]Note: the Bitwarden integration is currently disabled — run `hermes secrets bitwarden setup` (or set secrets.bitwarden.enabled: true) to turn it on.[/yellow]r)rrr rrr{rhrxryrzrrrr no_verifyrtrrr r}r~ clear_cachesr ) r?rrrrrrTr+rjrris rr8r8s BiiG --Cggi  &B + +K 8 8 >BF -/ABBIVZZ b117R88>>@@J   $" + + - -E  Xy!!  MMK   1  6   %%N %N%N%NOOUUWW  9:::q   D ! !   K   >55 > MMA   1 6777!&%ZPPP   MMP   1  UH  U U.1(mmq.@.@ssb U U U   L"55;<<  ( z9T9T89T9T9T'T'T MM.z...   9e$$$!BJyOO MM 6  6 6I 6 6 6 ::i    G   1rct}t}t}|dpidpi}|ds|ddS|dd}t j|d}|s|d |d dS|d d}|s|d dSt|d dpd} | ||d|\} } n1#t$r$} |d| dYd} ~ dSd} ~ wwxYw| s|ddSt|ddp|j } tdd} | dd| dd}t| D]}||kr| |dtt j|}|r| s| |df|j r8| |t j|<|dz }| |d|rdndz| |d |rd!ndz|| | D]}|d"||j s|d#n|d$|d%dS)&NrLrrmz`[yellow]Bitwarden integration is disabled. Run `hermes secrets bitwarden setup` first.[/yellow]rIrMrNrKz[red]z is not set.[/red]riz$[red]No project_id configured.[/red]rTF)rhrirkrTz[red]Fetch failed: rHz'[yellow]No secrets in project.[/yellow]rrpTrUrVr^rCraActionz![dim]skip (bootstrap token)[/dim]z[dim]skip (already set)[/dim]z[green]exported[/green]z (overrode)zreen]would export[/green]z (overrides)z[yellow]warning:[/yellow] u This was a dry-run — secrets are picked up automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.z [green]Exported z( secret(s) into current process.[/green])rrr rrrr}r~r{rrrwrapplyr rrr)r?rrrrrr+rirTrLrroverriderappliedralreadyrs rr9r9s BiiG --Cggi  &B + +K 8 8 >BF ::i   ?   q -/ABBI JNN9b ) ) / / 1 1E  ;i;;;<<<qL"--J  <===qVZZ b117R88>>@@J 66!! 7    7C777888qqqqq  ?@@@qFJJ2E::;;ItzH d 8 8 8E V6*** XGg d d )   MM#B C C C rz~~c**++  8  MM#> ? ? ?  : d%clBJsO qLG MM#8W<\MMZ\] ^ ^ ^ ^ MM#Q  J,#*3355@@BB1E E  Z. /      sA+A//BBrKrSrmOptional[Path]r+rTtuple[str, list[str]]c|sdgfS|sdgfS|dgfSg}|ds|dtj}t |dd}t |||| }|_|d }|r1|d | Dd |fSd|fS)Nz-[dim]not checked[/dim] (integration disabled)z&[dim]not checked[/dim] (token missing)z*[dim]not checked[/dim] (bws not installed)rPrQT)filerecordr]rSF)stylesc3>K|]}|VdS)N)rstrip)rlines r z+_token_validation_status..s*KKdDKKMMKKKKKKrz[red]failed[/red]z[green]passed[/green]) rr|ioStringIOrr export_textr{extendr) rmrjr+rTmessagescapture probe_consolerdetailss rrrgs C>BB <7;; ~;R??H   D ! !  _   kmmGSAAAMfe]zRRRH++5+99??AA  L OOKKg6H6H6J6JKKK K K K"H,, "H ,,rrrOptional[List[dict]]c jddlm}|dd}||d<|dd|r||d< tjt |d d d d g|d d ddd}n=#t tjf$r$}|d|dYd}~dSd}~wwxYw|j dkr|j p|j dd}|d|d| } d| vsd| vr|dnd| vsd| vr|ddS tj|j pd} n6#tj$r$}|d|dYd}~dSd}~wwxYwt#| t$sgSd| DS) zICall ``bws project list`` and return the parsed list, or None on failure.r)build_subprocess_envF) scrub_secretsinherit_profile_homerNNO_COLOR1rJprojectlistz--outputjsonTrr)envrrrrrz [red]Couldn't list projects: rHNroz [red]bws project list failed: invalid_clientz400 bad requesta$ [yellow]'invalid_client' from the US identity endpoint usually means the token is for a different Bitwarden region. Re-run [cyan]hermes secrets bitwarden setup[/cyan] and pick EU or self-hosted at the region prompt, or set [cyan]secrets.bitwarden.server_url[/cyan] in config.yaml.[/yellow] authorizationinvalidzu [yellow]This usually means the access token is wrong or revoked. Double-check it in the Bitwarden web app.[/yellow]z[]z [red]bws returned non-JSON: cfg|].}t|t|d,|/Sr) isinstancedictrrs r z"_list_projects..s6 C C C!z!T22 CquuT{{ CA C C Cr)tools.environments.localrrrrrrrrrrrrr{lowerrloadsJSONDecodeErrorrr) rjr+rrTrrrrerrlowereddatas rrrsV >=====  U O O OC#CNN:s###+ *  n [[)VZ @      Z. / CCCCDDDttttt ~z'SZ..00#6 DDDDEEE))++ w & &*;w*F*F MM=     ' '9+?+? MME   tz#*,--   BsBBBCCCttttt dD ! ! C Ct C C CCs/-A%%B;BBEF+F  F)u7US Cloud (https://vault.bitwarden.com — bws default)rK)z&EU Cloud (https://vault.bitwarden.eu)zhttps://vault.bitwarden.eurr Optional[str]c"|jr2|jr|jStjdd}|r|d|d|St |ddpd}|r|d|dtdd d d }|d dd|dttdD]+\}\}}| t ||,| t ttdzd||ttdz} d| d} |r| dz } | dz } | | } | s|r|S|dV t| } n%#t$r|dYwxYwd| cxkrttkrnnt| dz dS| | krl| d} | s|dd S| ds|d| S|d| dP)aPick a Bitwarden server URL for setup. Resolution order: 1. ``--server-url`` CLI flag (non-interactive) 2. ``BWS_SERVER_URL`` env var (so users running with that already set in their shell don't have to re-enter it) 3. Existing ``secrets.bitwarden.server_url`` value (for re-runs) 4. Interactive menu: US / EU / self-hosted Returns the chosen URL as a string (empty string = bws default, i.e. US Cloud). Returns None if the user aborted with an empty custom URL. rJrKz' Detected [cyan]BWS_SERVER_URL[/cyan]=u in your shell — using it.rTz Existing config: [cyan]z?[/cyan]. Press Enter to keep, or pick a different option below.TrUNr)rWrXrrrYrCrZr[zRegion / endpointrIzSelf-hosted / custom URLz Select region [1-]z (Enter to keep current)z: rdzD Enter your Bitwarden server URL (e.g. https://vault.example.com): z! [red]Empty URL, aborting.[/red])zhttp://zhttps://u] [yellow]Warning: URL doesn't start with http:// or https:// — bws may reject it.[/yellow]rerf)rTr{r}r~rrrrr rr_REGION_PRESETSrrrrArr)r?rrenv_urlexistingrrlabel_url custom_idxpromptrrcustoms rrrsu$ '4?0022'$$&&&jnn-r2288::G [g [ [ [   ;??<44:;;AACCH   E E E E   dT6 R R RE Sa000 ()))%oq99%%=E4 c!ffe$$$$ MM#c/**Q.//1KLLL MM%_%%)J M4z444  1 0 0F$v&&,,..   MM8 9 9 9  f++CC    MM8 9 9 9 H   + + + +s?++ + + + + +"37+A. . *  ]]5egg   ABBBt$$%<==  ?M K KKKLLLA MsH''I I )rr)rrrr )r?r@rrA)rrrr)rjrrr) rmrrjrr+rrTrrr) rjrr+rrrrTrrr)r?r@rrrrrr)+__doc__ __future__rargparserrr}rrxpathlibrtypingrr rich.consoler rich.panelr rich.tabler r;hermes_cli.configr r r r hermes_cli.secret_promptrrrr>r6r7r8r9r:r<rrvrrrrrrrrs#"""""  !!!!!!!!   :99999 K K K K(H+H+H+H+`{ { { { |9 9 9 9 xO O O O dH H H H V        "::::    ( ------BFH2D2D2D2D2D2DrDL LMLMLMLMLMLMr