yjjm*dZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z m Z ddlmZddlmZddlmZdd lmZdd lmZmZmZmZdd lmZd3dZd4dZd4dZ d4dZ!d4dZ"d4dZ#d4dZ$d5dZ%d6d Z&d!d"d7d(Z'd!d"d8d,Z(d-d.gZ)d9d2Z*dS):uCLI handlers for ``hermes secrets bitwarden ...``. Subcommands: setup — interactive wizard: install bws, prompt for token + project, test fetch status — show current config + binary version + token validation status sync — run a fetch right now and show what would be applied (dry-run friendly) disable — flip ``secrets.bitwarden.enabled`` to False install — just download the bws binary (no token / project required) ) annotationsN)Path)ListOptional)Console)Panel)Table) bitwarden) get_env_path load_config save_configsave_env_value)masked_secret_prompt parent_parserargparse.ArgumentParserreturnNonec|d}|dd}|dd|dd |d d |t |d d}|t |dd}|dd|ddd|t |dd}|ddd|t |dd}|t |ddtj d}|ddd |t d!S)"zAttach the ``bitwarden`` subcommand tree to a parent parser. Called from ``hermes_cli.main`` as part of building the top-level ``hermes secrets`` parser. secrets_bw_command)destsetupzAInteractive wizard: install bws, store access token, pick project)help --project-idz.Pre-select a project UUID instead of prompting--access-tokenzCProvide the access token non-interactively (will be stored in .env) --server-urlzBitwarden region / self-hosted endpoint. Examples: https://vault.bitwarden.com (US, default), https://vault.bitwarden.eu (EU), or your self-hosted URL. Skips the interactive region prompt.)funcstatusz.Show config + binary + token validation statustokenz@Rotate the access token: validate a new one and store it in .envz@Provide the new token non-interactively (default: masked prompt)z --no-verify store_truez7Store without probing Bitwarden first (not recommended))actionrsyncz)Fetch secrets now and report what changedz--applyzKActually export the secrets into the current shell's env (default: dry-run)disablez"Turn off the Bitwarden integrationinstallz,Download and verify the pinned bws binary (v)z--forcez1Re-download even if a managed copy already existsN) add_subparsers add_parser add_argument set_defaults cmd_setup cmd_status cmd_tokencmd_sync cmd_disablebw _BWS_VERSION cmd_install)rsubrrrr!r"r#s >&'R> S SD Z  8$$$nnY-QnRRG k***nn NBO N N NG  @  k*****argsargparse.Namespaceintc t}|tjdd||d t jd}|(|dt j}t|}|d|d |d nF#t$r9}|d |d |d Yd}~dSd}~wwxYwtj sg}|j r|j s|d|jr|j sGt jdd s|d|jr|j s|d|r.|dd|ddS||dt+}|didi}|dd}|j pd } | s%t/d|d } | s|ddS| ds|d t3|| | t j|<|d!t5d"|||d#t7|||} | dS| r|d$| n|d%|jr4|j r|j } n||d&d} t9|| || '} | dS| s,|d(|d)dSt;d*d+,} | d-dd./| d0| d1d23t?| dD]Q\}}| tC||d4d5|d6d5R||  |"d7tG| d8 }|s< tI|}n%#tJ$r|d9YnwxYwd|cxkrtG| krnn| |dz d6} n'|d:tG| d;||jr|j sd t j&| | |d| ?\}}n1#t$r$}|d@|d Yd}~dSd}~wwxYw|s|dAnt;d*d+,} | d0d3| dBtO|D]E}||krdC}n$t j|rdD}ndE}| ||F|| |D]}|dF|d*|dG<| |dH<| |dI<|d||dJdK|dLd*|dMd*tQ|||dN|dOdPS)QNu[bold]Bitwarden Secrets Manager setup[/bold] Need an access token? In the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token Copy the token (starts with [cyan]0.[/cyan]…) — it cannot be retrieved later.cyan) border_stylez([bold]Step 1[/bold] Install the bws CLIFinstall_if_missingu# No bws on PATH — downloading…u [green]✓[/green]  (r$u" [red]✗ Could not install bws: [/red]z> Manual install: https://github.com/bitwarden/sdk-sm/releasesrBWS_SERVER_URLrrzP [red]Non-interactive mode (no TTY) requires all setup flags.[/red] Missing: z, z Usage: hermes secrets bitwarden setup \ --access-token '0.xxx' \ --server-url 'https://vault.bitwarden.com' \ --project-id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'z.[bold]Step 2[/bold] Provide your access tokensecretsr access_token_envBWS_ACCESS_TOKENz Paste access token (): z# [red]Empty token, aborting.[/red]0. [yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token. Continuing anyway.[/yellow]u [green]✓[/green] stored in  as z,[bold]Step 3[/bold] Pick a Bitwarden regionu [green]✓[/green] using uN [green]✓[/green] using bws default (US Cloud, https://vault.bitwarden.com)z#[bold]Step 4[/bold] Pick a project server_urlz? [yellow]No projects visible to this machine account.[/yellow]ur In the Bitwarden web app, open the machine account → Projects tab and grant it access to at least one project.Tbold show_header header_style#stylewidthNameIDdimrRname?idz Select project [1-z]:  [red]Enter a number.[/red] [red]Out of range — pick 1-.[/red]z [bold]Step z[/bold] Test fetch) access_token project_idbinary use_cacherJu [red]✗ Fetch failed: zB [yellow]Fetch succeeded but the project has no secrets.[/yellow]Statusu5[dim]bootstrap token — never overrides itself[/dim]z9[yellow]already set in env (will be overwritten)[/yellow]z[green]new[/green]z [yellow]warning:[/yellow] enabledr`rJcache_ttl_seconds,override_existing auto_installuv[green]✓ Bitwarden Secrets Manager is enabled.[/green] Secrets will be pulled at the start of every Hermes process.z Status: [cyan]hermes secrets bitwarden status[/cyan] Refresh: [cyan]hermes secrets bitwarden sync[/cyan] Disable: [cyan]hermes secrets bitwarden disable[/cyan]r))rprintrfitr.find_bws install_bws _bws_version Exceptionsysstdinisattyr_stripappendrJosenvirongetr`joinr setdefaultr startswithrr _resolve_server_url_list_projectsr add_column enumerateadd_rowstrinputlenr7 ValueErrorfetch_bitwarden_secretssortedr )r5consoleraversionexcmissingcfg secrets_cfg token_envrrJr`projectstableipchoiceidxstep_numrBwarningskeyrws r2r)r)ys4 iiG MM  `         MMOOO MM<=== 666 > MM? @ @ @^%%Fv&& CfCCCCCDDDD  F3FFFGGG  ;   qqqqq  9    ! -d&7&=&=&?&? - NN+ , , , /DO$9$9$;$; /:>>"2B77==?? /~... +DO$9$9$;$; + NN> * * *   MML"ii00LLL   1 MMOOO MMBCCC --C>>)R00 jb11 24FGGI   $" + + - -E V$%Li%L%L%LMMSSUU  ;<<<q   D ! !   _   9e$$$!BJy MMSLNNSS SSTTT MMOOO MM@AAA$T;@@Jq  @J@@AAAA  6    %T4?0022%T_**,,   ;<<< !&%ZPPP  1  MM[ \ \ \ MM?   1$V<<< F!444     U+++h** H HDAq MM#a&&!%%"4"4aeeD#6F6F G G G G e T]]#L#h--#L#L#LMMSSUUF  &kk    <=== C((((3x==(((((%cAg.t4  MMRCMMRRR S S S T MMOOOLT_-B-B-D-DLqq1H MM====>>> 6!!      =#===>>>qqqqq  Z[[[[$V<<< v... """'?? ' 'CiP$$ .T- MM#v & & & & e :: 8Q889999"K  *K  *K -y999.444.555>4000 MMOOO MM G MM C 1sC"A*C D.D  DV))W  W 6Z [Z<<[c Nt}t}|dpidpi}t|d}|dd}|dd}t |ddpd}t j|d}t|} tj d } t|| || \} } td dd } | dd| d| dt|| d|| dt| | d| | d|pd| d|pd| dtt|dd | dt |dd| dtt|dd| r*| d | d!t| d"n| d d#|t#| d$d%&| D]}|||s|d'd(S| s|d)|d*|s|d+d(S),NrBr rdrCrDr`rArJFr;)rdrarrJr)rMboxpaddingrKrWEnabledz Token env varz Token in envzToken validationz Project IDz[dim](unset)[/dim]z Server URLz:[dim]default (US Cloud, https://vault.bitwarden.com)[/dim]zOverride existingrgz Cache TTL (s)rerfz Auto-installrhTz bws binaryz (r$z[yellow]not installed[/yellow]zBitwarden Secrets Managerr9)titler:z= Run [cyan]hermes secrets bitwarden setup[/cyan] to enable.rz [yellow]Enabled but uG is not set — Hermes will skip BSM and warn on next startup.[/yellow]uC [yellow]Enabled but no project_id — nothing to fetch.[/yellow])rr rvboolrrrrtrur.rk_token_validation_statusr r|r~_ynrmrir)r5rrbw_cfgrdrr`rJr token_setratoken_validationvalidation_messagesrmessages r2r*r*6siiG --Cggi  &B + +K 8 8 >BF6::i(())G -/ABBIL"--JVZZ b117R88>>@@J JNN9b ) ) / / 1 1EU I [E 2 2 2F,D ---)) ev > > >E Rv&&& R MM)S\\222 MM/Y/// MM.S^^444 MM$&6777 MM,Z%G3GHHH MMRR MM%s4 ;NPU0V0V+W+W'X'XYYY MM/S4G)M)M%N%NOOO MM.Sfjj.N.N)O)O%P%PQQQ G l%I%I,v2F2F%I%I%IJJJJ l%EFFF MM%%@vVVVWWW& g  VWWWq    1y 1 1 1      R    1r4ct}t}|dpidpi}|dd}t|ddpd}|jpd}|sot js| ddS| d td |d }|s| d dS| d s| d|j stjd}|| ddS| dt||||}|| ddS| dt!|dt!|dkrdnddt|ddpd} | r)|r'| d|Dvr| d| dt#|||t$j|<tj| dt+d|d |d!s| d"d#S)$u-Rotate the BSM access token without re-running the whole setup wizard. Prompts for (or accepts via ``--access-token``) a new machine-account token, probes Bitwarden with it (unless ``--no-verify``), and only then persists it to .env — so a bad paste never bricks the working token. rBr rCrDrJrAu9[red]No TTY — pass the token with --access-token.[/red]r?uCreate a new token in the Bitwarden web app: Secrets Manager → Machine accounts → [your account] → Access tokens → Create access token zPaste new access token (rEz![red]Empty token, aborting.[/red]rFu[yellow]Warning: token doesn't start with '0.' — usually that means you pasted something other than a BSM access token.[/yellow]Tr;Nu`[red]bws binary not available — cannot verify. Re-run with --no-verify to store anyway.[/red]uVerifying against Bitwarden…rIu>[red]✗ New token was rejected — nothing was changed.[/red]u#[green]✓ Token accepted[/green] (z projectsz visible).r`ch|] }|d SrZ.0rs r2 zcmd_token..s9T9T9Ta!D'9T9T9Tr4z$[yellow]Warning: configured project z is not visible to this machine account. Grant it access in the Bitwarden web app or re-run `hermes secrets bitwarden setup` to pick a different project.[/yellow]u[green]✓[/green] stored in rHz.. Takes effect on the next Hermes invocation.rdu[yellow]Note: the Bitwarden integration is currently disabled — run `hermes secrets bitwarden setup` (or set secrets.bitwarden.enabled: true) to turn it on.[/yellow]r)rr rvrrrr_rorprqrirry no_verifyr.rkr{rrrtru clear_cachesr ) r5rrrrrJrrarr`s r2r+r+qstiiG --Cggi  &B + +K 8 8 >BF -/ABBIVZZ b117R88>>@@J   $" + + - -E  Xy!!  MMK   1  6   %%N %N%N%NOOUUWW  9:::q   D ! !   K   >555 > MMA   1 6777!&%ZPPP   MMP   1  UH  U U.1(mmq.@.@ssb U U U   L"55;<<  ( z9T9T89T9T9T'T'T MM.z...   9e$$$!BJyO MM 6  6 6I 6 6 6 ::i    G   1r4ct}t}|dpidpi}|ds|ddS|dd}tj|d}|s|d |d dS|d d}|s|d dSt|d dpd} tj ||d|\}} n1#t$r$} |d| dYd} ~ dSd} ~ wwxYw|s|ddSt|ddp|j } tdd} | dd| dd} t|D]}||kr| |dttj|}|r| s| |df|j r8||tj|<| dz } | |d|rdndz| |d |rd!ndz|| | D]}|d"||j s|d#n|d$| d%dS)&NrBr rdz`[yellow]Bitwarden integration is disabled. Run `hermes secrets bitwarden setup` first.[/yellow]r?rCrDrAz[red]z is not set.[/red]r`z$[red]No project_id configured.[/red]rJF)r_r`rbrJz[red]Fetch failed: r>z'[yellow]No secrets in project.[/yellow]rrgTrKrLrTr9rWActionz![dim]skip (bootstrap token)[/dim]z[dim]skip (already set)[/dim]z[green]exported[/green]z (overrode)zreen]would export[/green]z (overrides)z[yellow]warning:[/yellow] u This was a dry-run — secrets are picked up automatically on the next [cyan]hermes[/cyan] invocation. Re-run with [cyan]--apply[/cyan] to export into the current shell instead.z [green]Exported z( secret(s) into current process.[/green])rr rvrirtrurrrr.rrnrapplyr r|rr~)r5rrrrrr`rJrBrroverriderappliedralreadyrs r2r,r,siiG --Cggi  &B + +K 8 8 >BF ::i   ?   q -/ABBI JNN9b ) ) / / 1 1E  ;i;;;<<<qL"--J  <===qVZZ b117R88>>@@J 6!!      7C777888qqqqq  ?@@@qFJJ2E::;;ItzH d 8 8 8E V6*** XGg d d )   MM#B C C C rz~~c**++  8  MM#> ? ? ?  : d%clBJsO qLG MM#8W<\MMZ\] ^ ^ ^ ^ MM#r?)rr.rlrrrirmrn)r5rpathrs r2r0r0siiG~D$4$4555 JDJJ\$5G5GJJJKKKq  9c999:::qqqqqsAA"" B,B  Bbrrc|rdndS)Nz[green]yes[/green]z [dim]no[/dim]r)rs r2rr,s#$ 9  /9r4rarc tjt|dgddddd}|jdkr8|jp|jdSn#ttj f$rYnwxYwdS) Nz --versionTutf-8replacer^)capture_outputtextencodingerrorstimeoutrzversion unknown) subprocessrunr returncodestdoutstderrrr splitlinesOSErrorTimeoutExpired)raress r2rmrm0s  n [[+ &      >Q  J,#*3355@@BB1E E  Z. /      sA+A//BBrArIrdOptional[Path]rrJtuple[str, list[str]]c|sdgfS|sdgfS|dgfSg}|ds|dtj}t |dd}t |||| }|_|d }|r1|d | Dd |fSd|fS)Nz-[dim]not checked[/dim] (integration disabled)z&[dim]not checked[/dim] (token missing)z*[dim]not checked[/dim] (bws not installed)rFrGT)filerecordrSrIF)stylesc3>K|]}|VdS)N)rstrip)rlines r2 z+_token_validation_status..Zs*KKdDKKMMKKKKKKr4z[red]failed[/red]z[green]passed[/green]) ryrsioStringIOrr{ export_textrrextendr) rdrarrJmessagescapture probe_consolerdetailss r2rr?s C>BB <7;; ~;R??H   D ! !  _   kmmGSAAAMfe]zRRRH++5+99??AA  L OOKKg6H6H6J6JKKK K K K"H,, "H ,,r4rrOptional[List[dict]]c jddlm}|dd}||d<|dd|r||d< tjt |d d d d g|d d ddd}n=#t tjf$r$}|d|dYd}~dSd}~wwxYw|j dkr|j p|j dd}|d|d| } d| vsd| vr|dnd| vsd| vr|ddS tj|j pd} n6#tj$r$}|d|dYd}~dSd}~wwxYwt#| t$sgSd| DS) zICall ``bws project list`` and return the parsed list, or None on failure.r)build_subprocess_envF) scrub_secretsinherit_profile_homerDNO_COLOR1r@projectlistz--outputjsonTrr)envrrrrrz [red]Couldn't list projects: r>Nrfz [red]bws project list failed: invalid_clientz400 bad requesta$ [yellow]'invalid_client' from the US identity endpoint usually means the token is for a different Bitwarden region. Re-run [cyan]hermes secrets bitwarden setup[/cyan] and pick EU or self-hosted at the region prompt, or set [cyan]secrets.bitwarden.server_url[/cyan] in config.yaml.[/yellow] authorizationinvalidzu [yellow]This usually means the access token is wrong or revoked. Double-check it in the Bitwarden web app.[/yellow]z[]z [red]bws returned non-JSON: cfg|].}t|t|d,|/Sr) isinstancedictrvrs r2 z"_list_projects..s6 C C C!z!T22 CquuT{{ CA C C Cr4)tools.environments.localrrxrrrrrrirrrrrlowerrloadsJSONDecodeErrorrr) rarrrJrrrrerrlowereddatas r2r{r{_sV >=====  U O O OC#CNN:s###+ *  n [[)VZ @      Z. / CCCCDDDttttt ~z'SZ..00#6 DDDDEEE))++ w & &*;w*F*F MM=     ' '9+?+? MME   tz#*,--   BsBBBCCCttttt dD ! ! C Ct C C CCs/-A%%B;BBEF+F  F)u7US Cloud (https://vault.bitwarden.com — bws default)rA)z&EU Cloud (https://vault.bitwarden.eu)zhttps://vault.bitwarden.eurr Optional[str]c"|jr2|jr|jStjdd}|r|d|d|St |ddpd}|r|d|dtdd d d }|d dd|dttdD]+\}\}}| t ||,| t ttdzd||ttdz} d| d} |r| dz } | dz } | | } | s|r|S|dV t| } n%#t$r|dYwxYwd| cxkrttkrnnt| dz dS| | krl| d} | s|dd S| ds|d| S|d| dP)aPick a Bitwarden server URL for setup. Resolution order: 1. ``--server-url`` CLI flag (non-interactive) 2. ``BWS_SERVER_URL`` env var (so users running with that already set in their shell don't have to re-enter it) 3. Existing ``secrets.bitwarden.server_url`` value (for re-runs) 4. Interactive menu: US / EU / self-hosted Returns the chosen URL as a string (empty string = bws default, i.e. US Cloud). Returns None if the user aborted with an empty custom URL. r@rAz' Detected [cyan]BWS_SERVER_URL[/cyan]=u in your shell — using it.rJz Existing config: [cyan]z?[/cyan]. Press Enter to keep, or pick a different option below.TrKNr)rMrNrrrOr9rPrQzRegion / endpointr?zSelf-hosted / custom URLz Select region [1-]z (Enter to keep current)z: r[zD Enter your Bitwarden server URL (e.g. https://vault.example.com): z! [red]Empty URL, aborting.[/red])zhttp://zhttps://u] [yellow]Warning: URL doesn't start with http:// or https:// — bws may reject it.[/yellow]r\r])rJrrrtrurvrirr r|r}_REGION_PRESETSr~rrr7rry)r5rrenv_urlexistingrrlabel_url custom_idxpromptrrcustoms r2rzrzsu$ '4?0022'$$&&&jnn-r2288::G [g [ [ [   ;??<44:;;AACCH   E E E E   dT6 R R RE Sa000 ()))%oq99%%=E4 c!ffe$$$$ MM#c/**Q.//1KLLL MM%_%%)J M4z444  1 0 0F$v&&,,..   MM8 9 9 9  f++CC    MM8 9 9 9 H   + + + +s?++ + + + + +"37+A. . *  ]]5egg   ABBBt$$%<==  ?M K KKKLLLA MsH''I I )rrrr)r5r6rr7)rrrr)rarrr) rdrrarrrrJrrr) rarrrrrrJrrr)r5r6rrrrrr)+__doc__ __future__rargparserrrtrropathlibrtypingrr rich.consoler rich.panelr rich.tabler agent.secret_sourcesr r.hermes_cli.configr r r rhermes_cli.secret_promptrr3r)r*r+r,r-r0rrmrr{rrzrr4r2rsq#"""""  !!!!!!!! 000000 :99999H+H+H+H+`z z z z z8 8 8 8 vN N N N bG G G G T      ::::    ( ------BFH2D2D2D2D2D2DrDL LMLMLMLMLMLMr4