߲j>UdZddlmZddlZddlZddlZddlZddlmZddl m Z m Z ddl m Z ddlmZmZmZmZddlmZd ad ed <d(d Zd)d Zd)dZe ddZded<GddeZd*dZd+dZd,dZe hdZ!dZ"d-dZ#d.dZ$d/d.dZ%d0d1dZ&d2dZ'd3dZ(eZ)ded <ejTZ+d!Z,d/d4d"Z-d5d#Z.d6d$Z/d7d%Z0d8d&Z1d9d'Z2y):aProfile-scoped credential resolution for multi-profile gateway multiplexing. The multiplexing gateway serves many profiles from one process; each profile's ``.env`` keys **cannot** be unioned into ``os.environ`` (profile A's keys would leak into profile B's turns and subprocesses). This module is a fail-closed, context-local secret scope: ``set_secret_scope(mapping)`` installs the active profile's secrets for the current task (a contextvar, so it propagates into the agent's worker thread via ``copy_context()``); ``get_secret(name)`` reads from it and, when multiplexing is active with no scope set, RAISES rather than falling back to ``os.environ``. Design: ``website/docs/developer-guide/multiplexing-gateway.md``. ) annotationsN) OrderedDict) ContextVarToken)Path)DictMappingOptionalTuple)file_signatureFbool_MULTIPLEX_ACTIVEct|ay)zLMark whether the process is a profile multiplexer (get_secret fails closed).N)r r)actives 7/home/ubuntu/.hermes/hermes-agent/agent/secret_scope.pyset_multiplex_activersV ctSN)rrris_multiplex_activer%s rcrtryddlm}m}m}|}|duxr||||k7S)arTrue when the current task runs for a profile other than the process's own: always under multiplexing, else when a HERMES_HOME override names another home (dashboard/desktop backend, per-profile cron ticker). The MCP registry scope and the check_fn cache key both follow this predicate so a served profile's view never aliases the launch profile's (#111151).Tr)get_hermes_home_overrideget_process_hermes_homehermes_home_keyN)rhermes_constantsrrr)rrroverrides rserves_routed_profiler)s> cc')H 4  kOH$=QhQjAk$kkr _SECRET_SCOPE)defaultz'ContextVar[Optional[Mapping[str, str]]]c&eZdZdZddfd ZxZS)UnscopedSecretErroraA secret was read in multiplex mode with no scope installed. The fix is to wrap the call path in ``set_secret_scope(...)`` (the per-turn / per-adapter profile scope), not to widen the global allowlist. ``str(exc)`` is the ONE sentence an end user can act on; the developer diagnosis (which secret, which doc) rides ``__notes__`` so tracebacks and logs keep it. c|r|std|Drd|}}|rd|nd}t| d|d||_||_|r|j |yy)Nc3<K|]}|jywr)isspace).0chs r z/UnscopedSecretError.__init__..Fs7[ 7[szthis profile's zthis profile's API keyzHermes could not read z (an internal profile-scoping bug on the multiplexed gateway, not your configuration). Run `hermes gateway restart`; if it keeps happening, report it with `hermes debug share`.)anysuper__init__ secret_namedeveloper_detailadd_note)selfr-r.what __class__s rr,zUnscopedSecretError.__init__Bsx /C7[{7[4[,. )K2= .C[ $TF+3 3 ' 0  MM* + r)r)r))r-strr.r3)__name__ __module__ __qualname____doc__r, __classcell__)r2s@rr"r"8s,,rr"c,tj|S)zTInstall the active profile's secret mapping; ``None`` clears. Returns a reset token.)rset)secretss rset_secret_scoper<Ts   W %%rc.tj|yr)rreset)tokens rreset_secret_scoper@Ysrc*tjS)z>The active secret mapping, or None when no scope is installed.)rgetrrrcurrent_secret_scoperC]s    r>$TZPWDHOMELANGPATHUSERSHELLLC_ALLTMPDIR PYTHONPATH HERMES_HOME VIRTUAL_ENV SSL_CERT_FILEHERMES_PROFILEAPI_SERVER_HOSTAPI_SERVER_PORT_HERMES_GATEWAYHERMES_KANBAN_DBGATEWAY_RELAY_URLAPI_SERVER_ENABLEDHERMES_API_TIMEOUTHERMES_KANBAN_BOARDGATEWAY_RELAY_BOT_IDSHERMES_MAX_ITERATIONSHERMES_REDACT_SECRETSGATEWAY_RELAY_ENDPOINTGATEWAY_RELAY_WAKE_URLAPI_SERVER_CORS_ORIGINSGATEWAY_RELAY_PLATFORMSHERMES_GATEWAY_LOCK_DIRGATEWAY_RELAY_ROUTE_KEYSGATEWAY_RELAY_INSTANCE_IDGATEWAY_RELAY_DISPLAY_NAMEHERMES_NOUS_TIMEOUT_SECONDSHERMES_KANBAN_WORKSPACES_ROOT$GATEWAY_RELAY_ALLOW_DIRECT_PLATFORMS)HERMES_KANBAN_HERMES_TELEGRAM_ TERMINAL_c@|tvxs|jtS)z@True for genuinely process-global (non-profile-secret) env vars.)_GLOBAL_ENV_EXACT startswith_GLOBAL_ENV_PREFIXES)names r_is_global_envrps $ $ M8L(MMrcLtjj|}||S|Sr)osenvironrBror vals r _environ_orrvs# **.. C/3.w.rct|r t||Stj}|)|j|}||Str|St||Strt |d|dt||S)u5Resolve a credential by env-var name, honoring the active profile scope. Global vars always read ``os.environ``. With a scope installed, a miss returns ``default`` under multiplexing (never another profile's ``os.environ`` value) but falls through to ``os.environ`` otherwise — single-profile deployments inject credentials via the process env (systemd, ``op run``), so the scope must stay a ``.env`` overlay, not a blindfold (otherwise cron 401s). With no scope: multiplex INACTIVE reads ``os.environ``; ACTIVE raises (fail closed). z get_secret(aB) called with no profile secret scope active while multiplexing is on. This credential read must run inside a set_secret_scope(...) block (the per-turn / per-adapter profile scope). Reading os.environ here would risk leaking another profile's value. See website/docs/developer-guide/multiplexing-gateway.md (Workstream A).)rprvrrBrr")ror scoperus r get_secretrysd4))    E iio ?J+wKT71KK! $"    tW %%rc&t||}||S|S)u``get_secret`` for callers that want a ``str``: ``default`` only when the secret is genuinely unset. Still raises ``UnscopedSecretError`` — swallowing it hides a spawn-site bug.)ryrts rget_secret_strr{s T7 #Ck7*s*rcl|j}|s|S|d}|dvrod}|t|kr]||}|dk(r |dk(r|dz }#||k(r/||dzdjjdr|d|dzS|S|dz }|t|kr]|St j d |d djS) uFStrip a dotenv-style inline comment (python-dotenv semantics): quoted values scan to the matching close quote (backslash-aware for double quotes) and drop a trailing ``# ...``, else stay untouched; unquoted values truncate only at a ``#`` PRECEDED BY WHITESPACE (``foo#bar`` survives, ``value # c`` → ``value``).r)'"r~\N#z\s+#)maxsplit)striplenlstriprmresplit)valuequoteir's r_strip_inline_commentrs KKME  !HE  #e*nqB|d QU{).q1uv)=)=)?)J)J3)OuWq1u~ZUZZ FA#e*n 88GUQ / 2 8 8 ::rc|j}t|dk\r|d|dcxk(rdk(rxnnu|dd}g}d}|t|krM||dk(xr ||dz|dzdv}|j|r||dzn||||rdndz }|t|krMdj|St|dk\r|d|dcxk(rd k(r n|S|ddS|S) zvParse the small .env value subset Hermes writes itself (bare, 'single', or "double" with ``\"`` / ``\\`` escapes).rrr~rr)r~rr)r})rrappendjoin) raw_valuerquotedparsedrescapeds r_parse_env_valuers OO E 5zQ58uRy7C7q #f+oQi4'NF1q5Q,?;,NG MM7&Q-q B g1 $A#f+owwv 5zQ58uRy7C7 LQr{ Lrz0'OrderedDict[str, Tuple[tuple, Dict[str, str]]]'_ENV_FILE_CACHE@ct5|tjntjt |ddddy#1swYyxYw)z@Drop one path from the ``load_env_file()`` memo, or all of them.N)_ENV_FILE_CACHE_LOCKrclearpopr3)env_paths rinvalidate_env_file_cachers@ 5    ! ! #   H t 4 555s 7AAc|jtjr|ttjd} |j dS#t $r|j dcYSwxYw)zBOM stripped; invalid UTF-8 falls back to latin-1 exactly as ``env_loader._load_dotenv_with_fallback`` installs it into ``os.environ``.Nzutf-8zlatin-1)rmcodecsBOM_UTF8rdecodeUnicodeDecodeError)raws r_decode_env_bytesrs\ ~~foo&#foo&'(%zz'"" %zz)$$%sAA+*A+cZi}|jD]}|j}|r|jdr'|jdr|tddj }|j d\}}}|j}|s||st t|||<|S)z?Tokenize already-read ``.env`` text. See :func:`load_env_file`.rzexport N=) splitlinesrrmrr partitionrr)textr;raw_linelinekeyseprs r_parse_env_textrs GOO% J~~ts+  ??9 %I(//1D..-S%iik 3+,A%,HIGCL J Nrct|} t|d5}ttj|j }t 5tj|}|=|d|k(r5tj|t|dcdddcdddSddd|j}ttj|j |k(}dddtt}r}t 5t|ft|<tj|t!tt"kDr-tj%dt!tt"kDr-ddd|S|S#1swYxYw#1swYxYw#t$rt|icYSwxYw#1swY|SxYw)u'THE ``.env`` tokenizer: every reader (profile scope, ``hermes_cli.config.load_env``, the dashboard scrub, skill secret capture, managed .env, setup prompts) parses through here so no two boundaries disagree on which keys/values a file defines. Dict only — never touches ``os.environ``. ``export`` prefix, ``#`` comments, quote escapes reversed; a BOM is stripped so it doesn't prefix the first key. Invalid UTF-8 decodes as latin-1, exactly like ``env_loader._load_dotenv_with_fallback`` installs it into ``os.environ``. Absent/unreadable → ``{}``. Memoised per path on the open descriptor's stat identity (see the cache comment above). Always returns a fresh dict: callers mutate what they get back (``build_profile_secret_scope`` layers external secrets over it). rbNrrF)last)r3openr rrfstatfilenorrrB move_to_enddictreadOSErrorrrrr_ENV_FILE_CACHE_MAXpopitem)rrhandle fingerprintcachedrsettledr;s r load_env_filers h-C (D ! OV(&--/)BCK% +(,,S1%&){*B#//4q ?  + + O O + ++-C%RXXfmmo%>?;NG O /45G ! 4$/g#?OC  ' ' ,o&)<<''U'3o&)<< 4 N7N+ + + O O !(+  4 Ns[ F3F AF F F!AF(F A,F9F FFFF65F69Gc*tt|dz } ddlm}|t|}|j d|j Dddlm}|}|t|r|jd||S#t$ri}YawxYw)uBuild a profile's secret mapping from ``/.env`` plus its external secret sources. Global vars are NOT copied in — ``get_secret`` reads those from ``os.environ`` — so the scope holds only profile secrets.z.envr)get_secret_source_valuesc3BK|]\}}t|r||fywr)rp)r&kvs rr(z-build_profile_secret_scope..Is XdanUVFWAq6Xs )bridged_allow_all_usersGATEWAY_ALLOW_ALL_USERS) rrhermes_cli.env_loaderr Exceptionupdateitemsgateway.config_loaderr_is_process_home setdefault) hermes_homer;rexternal_secretsrbridgeds rbuild_profile_secret_scoper?sD-67GB3D4EF NNX&6&<&<&>XX>%'G/ <4g> N sB BBcddlm} t|j|jk(S#t$rYywxYw)Nr)rF)rrrresolver)rrs rrrTsB8K ((*.E.G.O.O.QQQ s.7 AA)rr returnNone)rr )r;Optional[Mapping[str, str]]rr)r?rrr)rr)ror3rr )ror3r Optional[str]rrr)r))ror3r r3rr3)rr3rr3)rr3rr3)rzOptional[Path]rr)rbytesrr3)rr3rDict[str, str])rrrr)rrrr)rrrr )3r7 __future__rrrrr threading collectionsr contextvarsrrpathlibrtypingrr r r utilsr r__annotations__rrrr RuntimeErrorr"r<r@rC frozensetrlrnrprvryr{rrrLockrrrrrrrrrrrrs # #)11  4%  l:DO]a9b 6b,,,8& 8N / &>+;.<EPMAQ%y~~'5%  %P*r