§
    øžyj—‘  ã                  óè   — d Z ddlmZ ddlZddlZddlmZ ddlmZ ddl	m
Z
 ddlmZ ddlmZ dd	lmZmZ d&d„Zd'd„Zd'd„Zd'd„Zd'd„Zd'd„Zd'd„Zddœd(d„Zd'd„Zd'd„Zd'd „Zd)d!„Zd*d#„Zd+d%„Z dS ),uò  CLI handlers for ``hermes egress ...``.

Subcommands:
    install  â€” download the pinned iron-proxy binary
    setup    â€” interactive wizard: install binary, generate CA, mint tokens, write config
    start    â€” launch the proxy as a managed subprocess
    stop     â€” terminate the managed proxy
    status   â€” show binary version + config presence + listen state + mappings
    disable  â€” flip ``proxy.enabled`` to False (does not stop a running proxy)
    config   â€” print the generated proxy.yaml path (for debugging / external review)

The top-level command is ``hermes egress``.  Note that the inbound OAuth
reverse-proxy command (``hermes proxy``) lives elsewhere in
``hermes_cli/main.py`` â€” different direction, different purpose.
é    )ÚannotationsN)ÚList)ÚConsole)ÚPanel)ÚTable)Ú
iron_proxy)Úload_configÚsave_configÚparent_parserúargparse.ArgumentParserÚreturnÚNonec                ó€  — |                       d¬¦  «        }|                     ddt          j        › d�¬¦  «        }|                     ddd	¬
¦  «         |                     t          ¬¦  «         |                     dd¬¦  «        }|                     dt          ddt          j        › d�¬¦  «         |                     ddd¬
¦  «         |                     ddd¬
¦  «         |                     ddd¬
¦  «         |                     ddddd¬¦  «         |                     dddd¬¦  «         |                     t          ¬¦  «         |                     d d!¬¦  «        }|                     t          ¬¦  «         |                     d"d#¬¦  «        }|                     t          ¬¦  «         |                     dd$¬¦  «        }|                     t          ¬¦  «         |                     d%d&¬¦  «        }|                     t          ¬¦  «         |                     d'd(¬¦  «        }|                     d)dd*¬
¦  «         |                     t          ¬¦  «         |                     d+d,¬¦  «        }	|	                     t          ¬¦  «         |                     d-d.¬¦  «        }
|
                     t           ¬¦  «         dS )/zŸAttach the egress subcommand tree to a parent parser.

    Called from ``hermes_cli.main`` as part of building the top-level
    ``hermes egress`` parser.
    Úegress_command)ÚdestÚinstallzDownload iron-proxy binary (vú))Úhelpz--forceÚ
store_truez1Re-download even if a managed copy already exists)Úactionr   )ÚfuncÚsetupz=Interactive wizard: install + CA + mint tokens + write configz--tunnel-portNz"Override the tunnel port (default )ÚtypeÚdefaultr   z--from-bitwardenuÀ   Treat secrets as managed by Bitwarden â€” discover provider keys from secrets.bitwarden config instead of the current env.  Fails loudly if BW is unreachable rather than silently falling back.z--no-bitwardenz|Explicitly switch credential_source back to env on re-setup (only meaningful when the previous setup used --from-bitwarden).z--rotate-tokensu§   Mint fresh proxy tokens for every provider (default is to preserve tokens for providers that already had one â€” avoids 401-ing already-running sandboxes on re-setup).z	--restartÚrestartzŠIf a daemon is already running, restart it automatically after writing the new config/tokens (non-interactive default on a tty is to ask).)r   r   r   r   z--no-restartÚstore_falsez|Do not restart a running daemon after setup; you'll need to run `hermes egress restart` yourself for changes to take effect.)r   r   r   ÚstartzStart the managed iron-proxyÚstopzStop the managed iron-proxyz<Restart the managed iron-proxy (stop if running, then start)Úreloaduo   Hot-reload the running daemon's ruleset from proxy.yaml (management API â€” no restart, no dropped connections)ÚstatuszShow proxy state and mappingsz--show-tokensziPrint the proxy tokens (default: redacted prefix only). Beware: tokens may persist in your shell history.ÚdisablezTurn off the proxy integrationÚconfigz#Print the generated proxy.yaml path)Úadd_subparsersÚ
add_parserÚipÚ_IRON_PROXY_VERSIONÚadd_argumentÚset_defaultsÚcmd_installÚintÚ_DEFAULT_TUNNEL_PORTÚ	cmd_setupÚ	cmd_startÚcmd_stopÚcmd_restartÚ
cmd_reloadÚ
cmd_statusÚcmd_disableÚ
cmd_config)r   Úsubr   r   r   r   r   Úreload_pr    r!   Úcfgs              ú:/home/ragecks/.hermes/hermes-agent/hermes_cli/proxy_cli.pyÚregister_clir8   $   sM  € ð ×
&Ò
&Ð,<Ð
&Ñ
=Ô
=€Cà�nŠnØØF­RÔ-CÐFÐFÐFð ñ ô €Gð ×ÒØ˜,Ø@ð ñ ô ð ð ×Ò�kÐÑ*Ô*Ð*à�NŠNØØLð ñ ô €Eð 
×ÒØ�c¨4ØLµ"Ô2IÐLÐLÐLð ñ ô ð ð 
×ÒØ <ðNð ñ ô ð ð 
×ÒØ ðPð ñ ô ð ð
 
×ÒØ ,ð?ð ñ ô ð ð 
×ÒØ˜)¨LÀ$ðð ñ ô ð ð 
×ÒØ˜Y¨}ðLð ñ ô ð ð
 
×Ò�IÐÑ&Ô&Ð&à�NŠN˜7Ð)GˆNÑHÔH€EØ	×Ò�IÐÑ&Ô&Ð&à�>Š>˜&Ð'Dˆ>ÑEÔE€DØ×Ò�8ÐÑ$Ô$Ð$à�nŠnØØKð ñ ô €Gð ×Ò�kÐÑ*Ô*Ð*à�~Š~ØðGð ñ ô €Hð
 ×Ò�zÐÑ*Ô*Ð*à�^Š^˜HÐ+Jˆ^ÑKÔK€FØ
×ÒØ ðAð ñ ô ð ð
 ×Ò�ZÐÑ(Ô(Ð(à�nŠn˜YÐ-MˆnÑNÔN€GØ×Ò�kÐÑ*Ô*Ð*à
�.Š.˜Ð(Mˆ.Ñ
NÔ
N€CØ×Ò�*ÐÑ%Ô%Ð%Ð%Ð%ó    Úargsúargparse.Namespacer*   c                ó`  — t          ¦   «         }	 t          j        t          | j        ¦  «        ¬¦  «        }nE# t
          $ r8}|                     d|› �¦  «         |                     d¦  «         Y d }~dS d }~ww xY wt          j        |¦  «        pd}|                     d|› d|› �¦  «         dS )	N)Úforceu   [red]âœ— install failed:[/red] z?  Manual install: https://github.com/ironsh/iron-proxy/releasesé   ú(version unknown)u   [green]âœ“[/green] installed ú  r   )r   r%   Úinstall_iron_proxyÚboolr=   Ú	ExceptionÚprintÚiron_proxy_version)r:   ÚconsoleÚbinaryÚexcÚversions        r7   r)   r)   ‰   sÑ   € Ý‰iŒi€GðÝÔ&­T°$´*Ñ-=Ô-=Ð>Ñ>Ô>ˆˆøÝð ð ð Ø�ŠÐ=¸Ð=Ð=Ñ>Ô>Ð>Ø�ŠØMñ	
ô 	
ð 	
ð ˆqˆqˆqˆqˆqøøøøðøøøõ Ô# FÑ+Ô+ÐBÐ/B€GØ‡M‚MÐE°&ÐEÐE¸GÐEÐEÑFÔFÐFØˆ1s   �'8 ¸
A:Á-A5Á5A:c                óÔ  — t          ¦   «         }|                     t          j        dd¬¦  «        ¦  «         |                     ¦   «          |                     d¦  «         	 t	          j        d¬¦  «        }|€(|                     d¦  «         t	          j        ¦   «         }t	          j        |¦  «        pd}|                     d	|› d
|› �¦  «         n1# t          $ r$}|                     d|› d�¦  «         Y d }~dS d }~ww xY w|                     ¦   «          |                     d¦  «         	 t	          j	        ¦   «         \  }}n1# t          $ r$}|                     d|› d�¦  «         Y d }~dS d }~ww xY w|                     d	|› �¦  «         |                     ¦   «          |                     d¦  «         g }| j
        �rÐt          ¦   «         }|                     d¦  «        pi                      d¦  «        pi }	|	                     d¦  «        s,|                     d¦  «         |                     d¦  «         dS 	 ddlm}
 t          j                             |	                     dd¦  «        d¦  «                             ¦   «         }|s/|                     d|	                     dd¦  «        › d�¦  «         dS |
                     ||	                     dd¦  «        dd¬¦  «        \  }}t'          |                     ¦   «         ¦  «        }|s|                     d¦  «         dS |                     d t+          |¦  «        › d!�¦  «         no# t          $ r9}|                     d"|› d�¦  «         |                     d#¦  «         Y d }~dS d }~ww xY wt-          ¦   «         }|r|                     d$|› d%�¦  «         t	          j        |pd ¬&¦  «        }t	          j        ¦   «         }t3          t5          | d'd¦  «        ¦  «        }|�ry|�rvdd l}dd(lm} |j                             ¦   «         ry|                     d)¦  «         	 t?          d*¦  «                             ¦   «                               ¦   «         }n# tB          $ r d}Y nw xY w|d+k    r|                     d,¦  «         dS 	 dd l"}t	          j#        ¦   «         }|d-z  }| $                    ¦   «         rx| %                    ¦   «          &                    d.¦  «        }|d/|› �z  }| '                    tQ          |¦  «        tQ          |¦  «        ¦  «         |                     d0|› d1�¦  «         nI# tR          $ r#}|                     d2|› d3�¦  «         Y d }~n!d }~ww xY w|r|s|                     d4¦  «         t	          j*        |||¬5¦  «        }|s`|                     d6¦  «         |                     d7¦  «         tW          t          j,        ¦  «        D ]}|                     d8|› �¦  «         ŒdS t	          j-        |pd ¬&¦  «        }|r[|                     ¦   «          |                     d9¦  «         |D ]}|                     d8|› �¦  «         Œ|                     d:¦  «         t]          d;d<¬=¦  «        }| /                    d>d¬?¦  «         | /                    d@dA¬?¦  «         | /                    dBdC¬?¦  «         |D ]H}| 0                    |j1        dD 2                    |j3        ¦  «        ti          |j5        ¦  «        ¦  «         ŒI|                     |¦  «         |                     ¦   «          |                     dE¦  «         t          ¦   «         }| 6                    dFi ¦  «        } | j7        �B| j7        dk     s| j7        dGk    r|                     dH¦  «         dS tq          | j7        ¦  «        }!n-tq          |                      dIt          j9        ¦  «        ¦  «        }!|!| dI<   t'          |                      dJ¦  «        pg ¦  «        }"t'          t          j:        ¦  «        dK„ |"D ¦   «         z   }#t	          j#        ¦   «         dLz  }$d;}%	 t	          j;        |$¦  «         n2# tx          $ r%}d}%|                     dM|› d3�¦  «         Y d }~nd }~ww xY w|                      dN¦  «        }&t	          j=        ||||!|$|#|&¬O¦  «        }'t	          j>        |'¦  «        }(t	          j?        |¦  «        })t	          j@        ¦   «          |                     dP|(› �¦  «         |                     dQ|)› �¦  «         |%r|                     dR|$› dS�¦  «         d;| d<   |  6                    dTd;¦  «         |  6                    dUd;¦  «         |                      dV¦  «        }*| j
        rd| dV<   nSt5          | dWd¦  «        r!dX| dV<   |*dk    r|                     dY¦  «         n!|*dk    r|                     dZ¦  «         ndX| dV<   tƒ          |¦  «         t	          jB        ¦   «         }+|+jC        d u},|,rt	          jD        ¦   «          dd l}t5          | d[d ¦  «        }-|-d;u rd;}.ns|-du rd}.nl|,rh|j                             ¦   «         rL	 t?          d\¦  «                             ¦   «                               ¦   «         }n# tB          $ r d}Y nw xY w|d]v }.nd;}.nd}.|.rº	 t	          jE        t3          |                      dTd;¦  «        ¦  «        ¬¦  «        }/|/jF        rd^nd_}0|,rd`nda}1|                     d	|1› db|/jC        › dc|/j7        › dD|0› dd�	¦  «         n\# t          $ r8}|                     de|› d3�¦  «         |                     df¦  «         Y d }~nd }~ww xY w|,r|                     dg¦  «         |                     ¦   «          |                     dh¦  «         |                     di¦  «         dS )jNzé[bold]iron-proxy setup[/bold]

Routes outbound sandbox traffic through a local TLS-intercepting
proxy so prompt-injected agents never see real provider API keys.

[dim]Project: https://github.com/ironsh/iron-proxy  (Apache-2.0)[/dim]Úcyan)Úborder_stylez2[bold]Step 1[/bold]  Install the iron-proxy binaryF)Úinstall_if_missingu*     No iron-proxy on PATH â€” downloadingâ€¦r?   u     [green]âœ“[/green] r@   u     [red]âœ— install failed: z[/red]r>   z'[bold]Step 2[/bold]  Generate a CA certu!     [red]âœ— CA generation failed: z:[bold]Step 3[/bold]  Mint proxy tokens for known providersÚsecretsÚ	bitwardenÚenableduS     [red]âœ— --from-bitwarden requested but secrets.bitwarden.enabled is false.[/red]zG  Run `hermes secrets bitwarden setup` first, or omit --from-bitwarden.r   )rO   Úaccess_token_envÚBWS_ACCESS_TOKENÚ u*     [red]âœ— --from-bitwarden requested but ú% is not set in the environment.[/red]Ú
project_id)Úaccess_tokenrU   Úcache_ttl_secondsÚ	use_cacheu�     [red]âœ— Bitwarden returned an empty secrets list.[/red]
  Check the project_id in secrets.bitwarden and the BWS access-token's project scope.z	  Pulled z env names from Bitwarden.u2     [red]âœ— Could not enumerate Bitwarden secrets: z›  Either fix the Bitwarden config and retry, or rerun setup without --from-bitwarden (the proxy will read secrets from the host process env at start time).z  [dim]Loaded z> provider key name(s) from ~/.hermes/.env for discovery.[/dim])Úavailable_env_namesÚrotate_tokens)ÚdatetimeuŸ   [yellow]âš [/yellow]  --rotate-tokens will invalidate proxy tokens in every running Hermes sandbox.  They will start 401-ing against upstreams until restarted.zType 'rotate' to confirm: Úrotatez[yellow]Cancelled.[/yellow]zmappings.jsonz%Y%m%dT%H%M%Szmappings.json.rotated-z  [dim]backup: z[/dim]z6  [yellow]Could not back up mappings before rotation: z	[/yellow]z_[dim]Note: --rotate-tokens is a no-op on first-time setup (no existing tokens to rotate).[/dim])ÚexistingÚ
discoveredr\   zE  [yellow]No known provider API keys found in env/Bitwarden.[/yellow]z,  Set at least one of these and rerun setup:z    - uU     [yellow]âš [/yellow]  Detected provider env vars that the proxy does not yet cover:zÁ  [dim]These providers use request signing or SDK-minted OAuth (SigV4, service-account files) and will hold real credentials inside the sandbox.  Egress isolation is INCOMPLETE for these.[/dim]TÚbold©Úshow_headerÚheader_stylezProvider env©ÚstylezUpstream hostsÚdimúProxy tokenÚgreenú, z6[bold]Step 4[/bold]  Write config and persist mappingsÚproxyiþÿ  ua     [red]âœ— --tunnel-port must be between 1 and 65534 (the plain-HTTP listener uses port+1).[/red]Útunnel_portÚextra_allowed_hostsc                ó.   — g | ]}|t           j        v¯|‘ŒS © )r%   Ú_DEFAULT_ALLOWED_HOSTS)Ú.0Úhs     r7   ú
<listcomp>zcmd_setup.<locals>.<listcomp>ƒ  s,   € ð 1ð 1ð 1Ø !­2Ô+DÐ"DÐ"DˆÐ"DÐ"DÐ"Dr9   z	audit.logu     [yellow]âš  Úupstream_deny_cidrs)ÚmappingsÚca_certÚca_keyrj   Ú	audit_logÚallowed_hostsrr   u     [green]âœ“[/green] config:   u     [green]âœ“[/green] mappings: u      [green]âœ“[/green] audit log: uf    [dim](reserved â€” not written by iron-proxy v0.39; per-request records land in iron-proxy.log)[/dim]Úauto_installÚenforce_on_dockerÚcredential_sourceÚno_bitwardenÚenvzB[yellow]Switched credential_source from bitwarden to env.[/yellow]z|[dim]Keeping credential_source=bitwarden from existing config. Pass --no-bitwarden to switch to env-based credentials.[/dim]r   z;  Restart the running proxy now with the new config? [Y/n] )rS   ÚyÚyesÚ	listeningznot yet listeningÚ	restartedÚstartedz% iron-proxy with the new config (pid=z, port=r   u>     [yellow]âš  could not start iron-proxy with the new config: zV  Run [cyan]hermes egress start[/cyan] manually before launching new Docker sandboxes.u·     [yellow]âš  stopped the running iron-proxy; config or tokens changed.  Run [cyan]hermes egress restart[/cyan] (or [cyan]start[/cyan]) before launching new Docker sandboxes.[/yellow]u_   [green]âœ“ iron-proxy is configured.[/green]  Sandboxes will route outbound traffic through it.aO    Start:   [cyan]hermes egress start[/cyan]
  Restart: [cyan]hermes egress restart[/cyan]  (after any re-setup)
  Reload:  [cyan]hermes egress reload[/cyan]   (apply ruleset edits in-place, no restart)
  Status:  [cyan]hermes egress status[/cyan]
  Stop:    [cyan]hermes egress stop[/cyan]
  Disable: [cyan]hermes egress disable[/cyan])Gr   rD   r   Úfitr%   Úfind_iron_proxyrA   rE   rC   Úensure_ca_certÚfrom_bitwardenr	   ÚgetÚagent.secret_sourcesrO   ÚosÚenvironÚstripÚfetch_bitwarden_secretsÚlistÚkeysÚlenÚ_load_env_file_into_environÚdiscover_provider_mappingsÚload_mappingsrB   ÚgetattrÚsysr[   ÚstdinÚisattyÚinputÚlowerÚEOFErrorÚshutilÚ_proxy_state_dirÚexistsÚnowÚstrftimeÚcopy2ÚstrÚOSErrorÚmerge_mappingsÚsortedÚ_BEARER_PROVIDERSÚdiscover_uncovered_providersr   Ú
add_columnÚadd_rowÚreal_env_nameÚjoinÚupstream_hostsÚ_redact_tokenÚproxy_tokenÚ
setdefaultrj   r*   r+   rn   Úensure_audit_logÚRuntimeErrorÚbuild_proxy_configÚwrite_proxy_configÚwrite_mappingsÚensure_management_tokenr
   Ú
get_statusÚpidÚ
stop_proxyÚstart_proxyr   )2r:   rF   rG   rI   rH   Úca_crtru   rY   r6   Úbw_cfgÚbwrV   rN   Ú_Úloadedr^   r]   r\   Ú_sysÚ_dtÚansÚ_shutilÚ	state_dirÚmappings_srcÚtsÚbackuprs   Úenv_nameÚ	uncoveredÚnameÚtableÚmÚ	proxy_cfgrj   Úextra_hostsÚallowedÚaudit_log_pathÚaudit_log_okÚ
deny_cidrsÚiron_cfgÚcfg_pathÚmappings_pathÚexisting_sourceÚlive_statusÚwas_runningÚrestart_prefÚ
do_restartÚ
new_statusr   Úverbs2                                                     r7   r,   r,   ˜   sî  € Ý‰iŒi€GØ‡M‚M•%”)ð	Qð ðñ ô ñ ô ð ð ‡M‚M�O„O€OØ‡M‚MÐFÑGÔGÐGð	ÝÔ#°uÐ=Ñ=Ô=ˆØˆ>Ø�MŠMÐFÑGÔGÐGÝÔ*Ñ,Ô,ˆFÝÔ'¨Ñ/Ô/ÐFÐ3FˆØ�ŠÐA¨fÐAÐA¸ÐAÐAÑBÔBÐBÐBøÝð ð ð Ø�ŠÐ?°CÐ?Ð?Ð?Ñ@Ô@Ð@Øˆqˆqˆqˆqˆqøøøøðøøøð
 ‡M‚M�O„O€OØ‡M‚MÐ;Ñ<Ô<Ð<ðÝÔ*Ñ,Ô,‰ˆ��øÝð ð ð Ø�ŠÐE¸#ÐEÐEÐEÑFÔFÐFØˆqˆqˆqˆqˆqøøøøðøøøð ‡M‚MÐ2¨&Ð2Ð2Ñ3Ô3Ð3ð ‡M‚M�O„O€OØ‡M‚MÐNÑOÔOÐOà%'ÐØÔñ @Ý‰mŒmˆØ—'’'˜)Ñ$Ô$Ð*¨×/Ò/°Ñ<Ô<ÐBÀˆØ�zŠz˜)Ñ$Ô$ð 		Ø�MŠMð<ñô ð ð �MŠMð$ñô ð ð �1ð&	Ø<Ð<Ð<Ð<Ð<Ð<Ýœ:Ÿ>š>Ø—
’
Ð-Ð/AÑBÔBÀBñô çŠe‰gŒgð ð  ð Ø—’ð;Ø—z’zÐ"4Ð6HÑIÔIð;ð ;ð ;ñô ð ð
 �qØ×3Ò3Ø)Ø!Ÿ:š: l°BÑ7Ô7Ø"#Øð	 4ñ ô ‰JˆG�Qõ #' w§|¢|¡~¤~Ñ"6Ô"6ÐØ&ð Ø—’ð8ñô ð ð
 �qØ�MŠMØP�CÐ 3Ñ4Ô4ÐPÐPÐPñô ð ð øõ ð 		ð 		ð 		Ø�MŠMØPÀSÐPÐPÐPñô ð ð �MŠMð7ñô ð ð
 �1�1�1�1�1øøøøð		øøøõ" -Ñ.Ô.ˆØð 	Ø�MŠMð7 ð 7ð 7ð 7ñô ð õ
 Ô.Ø/Ð7°4ðñ ô €Jõ ÔÑ!Ô!€HÝ•'˜$ °Ñ7Ô7Ñ8Ô8€Fð ñ &
�(ñ &
ØÐÐÐØ,Ð,Ð,Ð,Ð,Ð,ØŒ:×ÒÑÔð 	Ø�MŠMð=ñô ð ð
ÝÐ8Ñ9Ô9×?Ò?ÑAÔA×GÒGÑIÔI��øÝð ð ð Ø���ðøøøà�hŠˆØ—’Ð;Ñ<Ô<Ð<Ø�qð
	Ø$Ð$Ð$Ð$ÝÔ+Ñ-Ô-ˆIØ$ Ñ6ˆLØ×"Ò"Ñ$Ô$ð @Ø—W’W‘Y”Y×'Ò'¨Ñ8Ô8�Ø"Ð%B¸bÐ%BÐ%BÑB�Ø—’�c ,Ñ/Ô/µ°V±´Ñ=Ô=Ð=Ø—’Ð>°Ð>Ð>Ð>Ñ?Ô?Ð?øøÝð 	ð 	ð 	Ø�MŠMð"Øð"ð "ð "ñô ð ð ð ð ð ð øøøøð	øøøð
 
ð 
˜ð 
Ø�Šð4ñ	
ô 	
ð 	
õ
 Ô ØØØðñ ô €Hð ð 	Ø�ŠØSñ	
ô 	
ð 	
ð 	�ŠØ:ñ	
ô 	
ð 	
õ �rÔ3Ñ4Ô4ð 	/ð 	/ˆHØ�MŠMÐ- 8Ð-Ð-Ñ.Ô.Ð.Ð.Øˆqõ
 Ô/Ø/Ð7°4ðñ ô €Ið ð 
Ø�Š‰ŒˆØ�Šð(ñ	
ô 	
ð 	
ð ð 	+ð 	+ˆDØ�MŠM˜/ 4˜/˜/Ñ*Ô*Ð*Ð*Ø�Šð*ñ	
ô 	
ð 	
õ ˜d°Ð8Ñ8Ô8€EØ	×Ò�^¨6ÐÑ2Ô2Ð2Ø	×ÒÐ%¨UÐÑ3Ô3Ð3Ø	×Ò�]¨'ÐÑ2Ô2Ð2Øð 
ð 
ˆØ�ŠØŒOØ�IŠI�aÔ&Ñ'Ô'Ý˜!œ-Ñ(Ô(ñ	
ô 	
ð 	
ð 	
ð
 ‡M‚M�%ÑÔÐð ‡M‚M�O„O€OØ‡M‚MÐJÑKÔKÐKå
‰-Œ-€CØ—’˜w¨Ñ+Ô+€Ið
 ÔÐ#ØÔ˜aÒÐ 4Ô#3°eÒ#;Ð#;Ø�MŠMð?ñô ð ð �1Ý˜$Ô*Ñ+Ô+ˆˆå˜)Ÿ-š-¨µrÔ7NÑOÔOÑPÔPˆØ*€IˆmÑå�y—}’}Ð%:Ñ;Ô;ÐA¸rÑBÔB€KÝ•2Ô,Ñ-Ô-ð 1ð 1Øð1ñ 1ô 1ñ €Gõ Ô(Ñ*Ô*¨[Ñ8€Nð €Lð7Ý
Ô˜NÑ+Ô+Ð+Ð+øÝð 7ð 7ð 7ØˆØ�ŠÐ5 sÐ5Ð5Ð5Ñ6Ô6Ð6Ð6Ð6Ð6Ð6Ð6øøøøð7øøøð —’Ð4Ñ5Ô5€JÝÔ$ØØØØØ ØØ&ðñ ô €Hõ Ô$ XÑ.Ô.€HÝÔ% hÑ/Ô/€Mõ ÔÑ Ô Ð Ø‡M‚MÐ>°HÐ>Ð>Ñ?Ô?Ð?Ø‡M‚MÐC°MÐCÐCÑDÔDÐDØð 
Ø�ŠðA¨~ð Að Að Añ	
ô 	
ð 	
ð  €IˆiÑØ×Ò˜¨Ñ.Ô.Ð.Ø×ÒÐ,¨dÑ3Ô3Ð3ð  —m’mÐ$7Ñ8Ô8€OØÔð /Ø)4ˆ	Ð%Ñ&Ð&Ý	��~ uÑ	-Ô	-ð /Ø).ˆ	Ð%Ñ&Ø˜kÒ)Ð)Ø�MŠMØTñô ð øð 
˜KÒ	'Ð	'ð 	�ŠðLñ	
ô 	
ð 	
ð 	
ð
 */ˆ	Ð%Ñ&Ý�ÑÔÐå”-‘/”/€KØ”/¨Ð-€KØð Ý
Œ‰Œˆð ÐÐÐÝ˜4 ¨DÑ1Ô1€LØ�tÐÐØˆ
ˆ
Ø	˜Ð	Ð	Øˆ
ˆ
Ø	ð ØŒ:×ÒÑÔð 		ðÝØQñô ç’%‘'”'Ÿ%š%™'œ'ð �øõ ð ð ð Ø���ðøøøàÐ 0Ð0ˆJˆJàˆJˆJàˆ
àð 
ð	ÝœÝ#'¨	¯ª°nÀdÑ(KÔ(KÑ#LÔ#Lðñ ô ˆJð (2Ô';ÐT˜˜ÐATˆIØ"-Ð<�;�;°9ˆDØ�MŠMðV¨ð Vð VØ"œðVð VØ/9Ô/EðVð VØIRðVð Vð Vñô ð ð øõ ð 	ð 	ð 	Ø�MŠMð*Øð*ð *ð *ñô ð ð �MŠMð2ñô ð ð ð ð ð ð øøøøð	øøøð  
ð 
Ø�ŠðRñ	
ô 	
ð 	
ð ‡M‚M�O„O€OØ‡M‚Mð	<ñô ð ð ‡M‚Mð	8ñô ð ð ˆ1sÄ   Á"A0C Ã
DÃC<Ã<DÄ.E Å
E3ÅE.Å.E3È=A;M Ê:A(M Ì$&M Í
NÍ.N	Î	NÑ3Q5 Ñ5RÒRÒ%B(U Õ
U;ÕU6Õ6U;á%a: á:
b)âb$â$b)ê3j; ê;k
ë	k
ë6m í
ní.nînc                óÞ  — t          ¦   «         }t          ¦   «         }|                     d¦  «        pi }|                     d¦  «        s|                     d¦  «         dS |                     dd¦  «        }|                     d¦  «        pi                      d¦  «        }|dk    o%|d uo!t	          |                     d¦  «        ¦  «        }|dk    rg|set	          |                     d	d
¦  «        ¦  «        r|                     d¦  «         n,|                     d¦  «         |                     d¦  «         dS |r7|�5t          |¦  «        }t	          |                     d	d
¦  «        ¦  «        |d	<   |r½|pi                      dd¦  «        }t          j                             |d¦  «                             ¦   «         s0|                     d|› d�¦  «         |                     d¦  «         dS |pi                      d¦  «        s,|                     d¦  «         |                     d¦  «         dS 	 t          j
        t	          |                     dd¦  «        ¦  «        ||¬¦  «        }n0# t          $ r#}	|                     d|	› �¦  «         Y d }	~	dS d }	~	ww xY w|j        r4|j        rdnd}
|                     d|j        › d|j        › d|
› �¦  «         n|                     d ¦  «         dS d!S )"Nri   rP   uL   [yellow]proxy.enabled is false â€” run `hermes egress setup` first.[/yellow]r>   rz   r|   rN   rO   Úallow_env_fallbackFuÉ   [yellow]âš  credential_source=bitwarden but secrets.bitwarden is disabled or missing â€” falling back to host-env secrets (allow_env_fallback=true).  Rotated Bitwarden keys will NOT propagate.[/yellow]uv   [red]âœ— Refusing to start: proxy.credential_source is 'bitwarden' but secrets.bitwarden is disabled or missing.[/red]zÈ  Re-enable it (`secrets.bitwarden.enabled: true`), switch back to env credentials with `hermes egress setup --no-bitwarden`, or set `proxy.allow_env_fallback: true` to opt into the host-env fallback.rQ   rR   rS   u<   [red]âœ— Refusing to start: credential_source=bitwarden but rT   zv  Either export the access token, or run `hermes egress setup --no-bitwarden` to switch back to env-based credentials.rU   uh   [red]âœ— Refusing to start: credential_source=bitwarden but secrets.bitwarden.project_id is empty.[/red]zy  Run `hermes secrets bitwarden setup` to configure the project, or switch back via `hermes egress setup --no-bitwarden`.rx   T)rM   Úrefresh_secrets_from_bitwardenÚbitwarden_configu+   [red]âœ— failed to start iron-proxy:[/red] z[green]listening[/green]z"[yellow]not yet listening[/yellow]u+   [green]âœ“[/green] iron-proxy running  pid=z  port=r@   u1   [red]âœ— iron-proxy did not come up cleanly[/red]r   )r   r	   r†   rD   rB   Údictrˆ   r‰   rŠ   r%   r¶   rC   r´   r   rj   )r:   rF   r6   rÉ   rz   r¸   Ú
refresh_bwÚbw_access_envr    rH   r   s              r7   r-   r-   "  s³  € Ý‰iŒi€GÝ
‰-Œ-€CØ—’˜Ñ Ô Ð& B€IØ�=Š=˜Ñ#Ô#ð Ø�Šðñ	
ô 	
ð 	
ð ˆqð "ŸšÐ&9¸5ÑAÔAÐØ�gŠg�iÑ Ô Ð& B×+Ò+¨KÑ8Ô8€Fà˜[Ò(ð 	(Ø˜$Ðð	(å�—’˜IÑ&Ô&Ñ'Ô'ð ð ˜KÒ'Ð'°
Ð'Ý�	—’Ð2°EÑ:Ô:Ñ;Ô;ð 	Ø�MŠMð>ñô ð ð ð �MŠMð!ñô ð ð
 �MŠMð5ñô ð ð �1ð
 ð 
�fÐ(Ý�f‘”ˆÝ'+Ø�MŠMÐ.°Ñ6Ô6ñ(
ô (
ˆÐ#Ñ$ð ð Ø˜ 2×*Ò*Ð+=Ð?QÑRÔRˆÝŒz�~Š~˜m¨RÑ0Ô0×6Ò6Ñ8Ô8ð 
	Ø�MŠMðHØ ðHð Hð Hñô ð ð �MŠMð)ñô ð ð
 �1Ø�˜"×!Ò! ,Ñ/Ô/ð 
	Ø�MŠMð?ñô ð ð �MŠMð#ñô ð ð
 �1ðÝ”Ý# I§M¢M°.À$Ñ$GÔ$GÑHÔHØ+5Ø#ð
ñ 
ô 
ˆˆøõ
 ð ð ð Ø�ŠÐIÀCÐIÐIÑJÔJÐJØˆqˆqˆqˆqˆqøøøøðøøøð „zð ð Ôð6Ð&Ð&à5ð 	ð
 	�Šð6¸&¼*ð 6ð 6ØÔ&ð6ð 6Ø*3ð6ð 6ñ	
ô 	
ð 	
ð 	
ð
 	�ŠÐIÑJÔJÐJØˆqØˆ1s   È28I+ É+
JÉ5JÊJc                óž   — t          ¦   «         }t          j        ¦   «         r|                     d¦  «         n|                     d¦  «         dS )Nu%   [green]âœ“[/green] iron-proxy stoppedz%[dim]iron-proxy was not running[/dim]r   )r   r%   rµ   rD   )r:   rF   s     r7   r.   r.   š  sG   € Ý‰iŒi€GÝ	„}�„ð ?Ø�ŠÐ=Ñ>Ô>Ð>Ð>à�ŠÐ=Ñ>Ô>Ð>Øˆ1r9   c                ó�   — t          ¦   «         }t          j        ¦   «         }|r|                     d¦  «         t	          | ¦  «        S )ai  Stop the running daemon (if any) and start it with the current config.

    The one-command way to apply config changes (new allowlist hosts, rotated
    tokens, a Bitwarden key rotation) without making the operator remember the
    stop/start dance.  Delegates to ``cmd_start`` so all the credential-source
    guards run exactly as they do for ``start``.
    z)[dim]stopped the running iron-proxy[/dim])r   r%   rµ   rD   r-   )r:   rF   rÔ   s      r7   r/   r/   £  s@   € õ ‰iŒi€GÝ”-‘/”/€KØð CØ�ŠÐAÑBÔBÐBÝ�T‰?Œ?Ðr9   c                ó   — t          ¦   «         }	 t          j        ¦   «          n0# t          $ r#}|                     d|› �¦  «         Y d}~dS d}~ww xY w|                     d¦  «         |                     d¦  «         dS )uø  Hot-reload the running daemon's ruleset via the management API.

    Applies allowlist / token / mapping changes already written to
    proxy.yaml WITHOUT restarting the daemon â€” no dropped connections, no
    restart window.  When the change involves new upstream SECRETS (a
    Bitwarden rotation, a newly added provider key), use
    ``hermes egress restart`` instead: the daemon reads real credentials
    from its own environment at spawn time, and a reload does not
    re-populate that env.
    u   [red]âœ— reload failed:[/red] Nr>   u[   [green]âœ“[/green] iron-proxy ruleset reloaded in-place (no restart, connections preserved)u°   [dim]Note: new upstream secrets (rotated keys, new providers) still need `hermes egress restart` â€” the daemon reads real credentials from its environment at spawn time.[/dim]r   )r   r%   Úreload_proxyrC   rD   )r:   rF   rH   s      r7   r0   r0   ²  s¬   € õ ‰iŒi€GðÝ
ŒÑÔÐÐøÝð ð ð Ø�ŠÐ<°sÐ<Ð<Ñ=Ô=Ð=Øˆqˆqˆqˆqˆqøøøøðøøøð ‡M‚Mð	.ñô ð ð ‡M‚Mð	@ñô ð ð
 ˆ1s   �$ ¤
A®AÁAF)Úshow_tokensrä   rB   rŸ   c                óü  — t          ¦   «         }|                     d¦  «        pi }t          j        ¦   «         }d'd„}ddd	 |t	          |                     d
¦  «        ¦  «        ¦  «        › �d|j        pd› �d|j        pd› �d|j        pd› �d|j        pd› �d|j	        › �|j
        r
d|j
        › �ndd ||j        ¦  «        › �d|                     dd¦  «        › �d |t	          |                     dd¦  «        ¦  «        ¦  «        › �dg}t          j        ¦   «         }|ru|                     ddg¦  «         |D ][}| r|j        nt          |j        ¦  «        }|                     d|j        › d|› d d!                     |j        ¦  «        › d"�¦  «         Œ\t          j        ¦   «         }	|	r4|                     dd#g¦  «         |	D ]}
|                     d|
› �¦  «         Œt	          |                     d
¦  «        ¦  «        r|j        s|                     dd$g¦  «         nGt	          |                     d
¦  «        ¦  «        r%|j
        r|j        s|                     dd%g¦  «         d&                     |¦  «        S )(zDPlain-text egress status for slash commands, Dashboard, and Desktop.ri   ÚvaluerB   r   rŸ   c                ó   — | rdndS )Nr~   Únorm   ©ræ   s    r7   Úynzformat_status_text.<locals>.ynÕ  s   € ØÐ'ˆuˆu 4Ð'r9   zEgress proxy statusrS   z	Enabled: rP   zBinary: z	(missing)zBinary version: z	(unknown)zConfig: z(not generated)z	CA cert: zTunnel port: zProcess: pid zProcess: (stopped)zListening: zCredential src: rz   r|   zDocker enforce: ry   Tz*Scope: Docker backend only in this releasezToken mappings:ú  - z: z (rh   r   zHUncovered providers (real credentials still visible inside the sandbox):zDNext: run `hermes egress setup` to mint tokens and write proxy.yaml.zBNext: run `hermes egress start` before launching Docker sandboxes.Ú
©ræ   rB   r   rŸ   )r	   r†   r%   r³   rB   Úbinary_pathÚbinary_versionÚconfig_pathÚca_cert_pathrj   r´   r   r‘   Úextendr«   rª   Úappendr§   r¨   r©   r¤   Ú
configured)rä   r6   rÉ   r    rê   Úlinesrs   rÈ   ÚtokrÅ   rÆ   s              r7   Úformat_status_textr÷   Ï  sð  € å
‰-Œ-€CØ—’˜Ñ Ô Ð& B€IÝŒ]‰_Œ_€Fð(ð (ð (ð (ð 	Ø
Ø8�B�B•t˜IŸMšM¨)Ñ4Ô4Ñ5Ô5Ñ6Ô6Ð8Ð8Ø6�6Ô%Ð4¨Ð6Ð6ØA˜6Ô0Ð?°KÐAÐAØ<�6Ô%Ð:Ð):Ð<Ð<Ø>�FÔ'Ð<Ð+<Ð>Ð>Ø,˜Ô*Ð,Ð,Ø(.¬
ÐLÐ$˜œ
Ð$Ð$Ð$Ð8LØ,�b�b˜Ô)Ñ*Ô*Ð,Ð,ØF˜9Ÿ=š=Ð)<¸eÑDÔDÐFÐFØO˜2˜2�d 9§=¢=Ð1DÀdÑ#KÔ#KÑLÔLÑMÔMÐOÐOØ4ð€Eõ  ÔÑ!Ô!€HØð ZØ�Š�bÐ+Ð,Ñ-Ô-Ð-Øð 	Zð 	ZˆAØ#.ÐP�!”-�-µMÀ!Ä-Ñ4PÔ4PˆCØ�LŠLÐX ¤ÐXÐX°3ÐXÐX¸$¿)º)ÀAÔDTÑ:UÔ:UÐXÐXÐXÑYÔYÐYÐYåÔ/Ñ1Ô1€IØð (Ø�ŠØØVð
ñ 	ô 	ð 	ð ð 	(ð 	(ˆDØ�LŠL˜ ˜˜Ñ'Ô'Ð'Ð'åˆI�MŠM˜)Ñ$Ô$Ñ%Ô%ð a¨fÔ.?ð aØ�Š�bÐ`ÐaÑbÔbÐbÐbÝ	ˆi�mŠm˜IÑ&Ô&Ñ	'Ô	'ð a°´ð aÀÔ@Pð aØ�Š�bÐ^Ð_Ñ`Ô`Ð`à�9Š9�UÑÔÐr9   c                óÐ  — t          ¦   «         }t          ¦   «         }|                     d¦  «        pi }t          j        ¦   «         }t          dd d¬¦  «        }|                     dd¬¦  «         |                     d¦  «         |                     dt          t          |                     d	¦  «        ¦  «        ¦  «        ¦  «         |                     d
t          |j        pd¦  «        ¦  «         |                     d|j        pd¦  «         |                     dt          |j        pd¦  «        ¦  «         |                     dt          |j        pd¦  «        ¦  «         |                     dt          |j        ¦  «        ¦  «         |                     d|j        r
d|j        › �nd¦  «         |                     dt          |j        ¦  «        ¦  «         |                     dt          |                     dd¦  «        ¦  «        ¦  «         |                     dt          t          |                     dd¦  «        ¦  «        ¦  «        ¦  «         |                     |¦  «         t          j        ¦   «         }|�r|                     ¦   «          |                     d¦  «         t          dd¬¦  «        }|                     dd¬¦  «         |                     d d!¬¦  «         |                     d"d#¬¦  «         |D ]X}| j        r|j        nt-          |j        ¦  «        }	|                     |j        d$                     |j        ¦  «        |	¦  «         ŒY|                     |¦  «         | j        r|                     d%¦  «         t          j        ¦   «         }
|
rF|                     ¦   «          |                     d&¦  «         |
D ]}|                     d'|› �¦  «         Œd(S ))Nri   F)r   é   )ra   ÚboxÚpaddingrS   r_   rc   ÚEnabledrP   ÚBinaryz[dim](missing)[/dim]zBinary versionz[dim](unknown)[/dim]ÚConfigz[dim](not generated)[/dim]zCA certzTunnel portÚProcesszpid z[dim](stopped)[/dim]Ú	ListeningzCredential srcrz   r|   zDocker enforcery   Tz[bold]Token mappings[/bold]r`   zReal envrK   ÚUpstreamre   rf   rg   rh   u�   [yellow]âš [/yellow]  proxy tokens just printed in full â€” they may persist in your shell history.  Consider clearing it after this command.zY[yellow]Uncovered providers[/yellow] (real credentials still visible inside the sandbox):rë   r   )r   r	   r†   r%   r³   r   r¥   r¦   Ú_ynrB   rŸ   rî   rï   rð   rñ   rj   r´   r   rD   r‘   rä   r«   rª   r§   r¨   r©   r¤   )r:   rF   r6   rÉ   r    rÇ   rs   Úm_tablerÈ   rö   rÅ   rÆ   s               r7   r1   r1      s¥  € Ý‰iŒi€GÝ
‰-Œ-€CØ—’˜Ñ Ô Ð& B€IÝŒ]‰_Œ_€Få˜e¨°vÐ>Ñ>Ô>€EØ	×Ò�R˜vÐÑ&Ô&Ð&Ø	×Ò�RÑÔÐØ	‡M‚M�)¥C­¨Y¯]ª]¸9Ñ-EÔ-EÑ(FÔ(FÑ$GÔ$GÑHÔHÐHØ	‡M‚M�(¥C¨Ô(:Ð(TÐ>TÑ$UÔ$UÑVÔVÐVØ	‡M‚MÐ" FÔ$9Ð$SÐ=SÑTÔTÐTØ	‡M‚M�(¥C¨Ô(:Ð(ZÐ>ZÑ$[Ô$[Ñ\Ô\Ð\Ø	‡M‚M�)¥C¨Ô(;Ð([Ð?[Ñ$\Ô$\Ñ]Ô]Ð]Ø	‡M‚M�-¥C¨Ô(:Ñ$;Ô$;Ñ<Ô<Ð<Ø	‡M‚M�)¸6¼:Ð$aÐ$7¨6¬:Ð$7Ð$7Ð$7ÐKaÑbÔbÐbØ	‡M‚M�+¥C¨Ô(8Ñ$9Ô$9Ñ:Ô:Ð:Ø	‡M‚MÐ"¥C¨	¯ªÐ6IÈ5Ñ(QÔ(QÑ$RÔ$RÑSÔSÐSØ	‡M‚MÐ"¥C­¨Y¯]ª]Ð;NÐPTÑ-UÔ-UÑ(VÔ(VÑ$WÔ$WÑXÔXÐXØ‡M‚M�%ÑÔÐåÔÑ!Ô!€HØñ Ø�Š‰ŒˆØ�ŠÐ3Ñ4Ô4Ð4Ý D°vÐ>Ñ>Ô>ˆØ×Ò˜:¨VÐÑ4Ô4Ð4Ø×Ò˜:¨UÐÑ3Ô3Ð3Ø×Ò˜=°ÐÑ8Ô8Ð8Øð 	Oð 	OˆAØ#'Ô#3ÐU�!”-�-½ÀqÄ}Ñ9UÔ9UˆCØ�OŠO˜AœO¨T¯YªY°qÔ7GÑ-HÔ-HÈ#ÑNÔNÐNÐNØ�Š�gÑÔÐØÔð 	Ø�MŠMð)ñô ð õ Ô/Ñ1Ô1€IØð )Ø�Š‰ŒˆØ�ŠðCñ	
ô 	
ð 	
ð ð 	)ð 	)ˆDØ�MŠM˜- ˜-˜-Ñ(Ô(Ð(Ð(àˆ1r9   c                ón  — t          ¦   «         }t          ¦   «         }|                     di ¦  «        }|                     d¦  «        s|                     d¦  «         dS d|d<   t          |¦  «         |                     d¦  «         t          j        ¦   «         j        �|                     d¦  «         dS )Nri   rP   z+[dim]proxy.enabled was already false.[/dim]r   Fu-   [green]âœ“[/green] proxy.enabled set to falseug     iron-proxy is still running â€” stop it with [cyan]hermes egress stop[/cyan] if you want it down too.)	r   r	   r¬   r†   rD   r
   r%   r³   r´   )r:   rF   r6   rÉ   s       r7   r2   r2   7  s²   € Ý‰iŒi€GÝ
‰-Œ-€CØ—’˜w¨Ñ+Ô+€IØ�=Š=˜Ñ#Ô#ð Ø�ŠÐCÑDÔDÐDØˆqØ €IˆiÑÝ�ÑÔÐØ‡M‚MÐAÑBÔBÐBõ 
„}�„ÔÐ&Ø�ŠðGñ	
ô 	
ð 	
ð ˆ1r9   c                óÒ   — t          ¦   «         }t          j        ¦   «         }|j        €|                     d¦  «         dS |                     t          |j        ¦  «        ¦  «         dS )NuD   [yellow](no config generated â€” run `hermes egress setup`)[/yellow]r>   r   )r   r%   r³   rð   rD   rŸ   )r:   rF   r    s      r7   r3   r3   N  sa   € Ý‰iŒi€GÝŒ]‰_Œ_€FØÔÐ!Ø�ŠØRñ	
ô 	
ð 	
ð ˆqØ‡M‚M•#�fÔ(Ñ)Ô)Ñ*Ô*Ð*Øˆ1r9   c                 óÊ  — 	 ddl m}  n# t          $ r Y dS w xY w	  | ¦   «         }n# t          $ r Y dS w xY wd}t	          t
          j        ¦  «        t	          t
          j        ¦  «        z  }|D ]t}|t          j	        v r%t          j	        |          
                    ¦   «         rŒ5|                     |¦  «        pd 
                    ¦   «         }|r|t          j	        |<   |dz  }Œu|S )u¥  Backfill provider keys from ``~/.hermes/.env`` into ``os.environ``.

    ``hermes egress setup`` discovers providers by reading ``os.environ``, but
    many operators keep their keys ONLY in ``~/.hermes/.env`` (which the agent
    loads at runtime but which is NOT exported into an interactive shell).
    Without this, ``setup`` reports "no provider keys found" even though the
    keys plainly exist â€” a confusing first-run papercut.

    Only fills names that aren't already set in the process env (an exported
    value always wins), and only for known bearer-provider names so we don't
    slurp unrelated secrets into the process. Returns the count of names added.
    r   )Úload_envrS   r>   )Úhermes_cli.configr  ÚImportErrorrC   Úsetr%   r£   Ú_NON_BEARER_PROVIDERSrˆ   r‰   rŠ   r†   )r  Úfile_envÚaddedÚknownrÆ   Úvals         r7   r�   r�   _  s  € ðØ.Ð.Ð.Ð.Ð.Ð.Ð.øÝð ð ð ØˆqˆqðøøøðØ�8‘:”:ˆˆøÝð ð ð Øˆqˆqðøøøà€EÝ•Ô$Ñ%Ô%­­BÔ,DÑ(EÔ(EÑE€EØð ð ˆØ•2”:ÐÐ¥"¤*¨TÔ"2×"8Ò"8Ñ":Ô":ÐØØ�|Š|˜DÑ!Ô!Ð' R×.Ò.Ñ0Ô0ˆØð 	Ø"�BŒJ�tÑØ�Q‰JˆEøØ€Ls   ‚	 ‰
–›
& ¦
4³4ræ   c                ó   — | rdndS )Nz[green]yes[/green]z[dim]no[/dim]rm   ré   s    r7   r  r  €  s   € Ø#(Ð=ÐÐ¨oÐ=r9   Útokenc                óZ   — t          | ¦  «        dk     r| S | d d…         › d| dd …         › �S )Né   é   u   â€¦éüÿÿÿ)rŽ   )r  s    r7   rª   rª   „  s:   € Ý
ˆ5�z„z�B‚€ØˆØ�C�R�CŒjÐ)Ð)˜U 2 3 3œZÐ)Ð)Ð)r9   )r   r   r   r   )r:   r;   r   r*   )rä   rB   r   rŸ   )r   r*   rí   )r  rŸ   r   rŸ   )!Ú__doc__Ú
__future__r   Úargparserˆ   Útypingr   Úrich.consoler   Ú
rich.panelr   Ú
rich.tabler   Úagent.proxy_sourcesr   r%   r  r	   r
   r8   r)   r,   r-   r.   r/   r0   r÷   r1   r2   r3   r�   r  rª   rm   r9   r7   ú<module>r     sê  ððð ð  #Ð "Ð "Ð "Ð "Ð "à €€€Ø 	€	€	€	Ø Ð Ð Ð Ð Ð à  Ð  Ð  Ð  Ð  Ð  Ø Ð Ð Ð Ð Ð Ø Ð Ð Ð Ð Ð à 0Ð 0Ð 0Ð 0Ð 0Ð 0Ø 6Ð 6Ð 6Ð 6Ð 6Ð 6Ð 6Ð 6ð]&ð ]&ð ]&ð ]&ðJð ð ð ðGð Gð Gð GðTuð uð uð uðpð ð ð ðð ð ð ðð ð ð ð: /4ð .ð .ð .ð .ð .ð .ðb4ð 4ð 4ð 4ðnð ð ð ð.	ð 	ð 	ð 	ð"ð ð ð ðB>ð >ð >ð >ð*ð *ð *ð *ð *ð *r9   