߲j<ndZddlmZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZddlmZmZmZmZmZddgZd Zd Zej0d Zdd Zdd ZddZd dZd!dZGddeZdeedd d"dZ d#dZ!eed d$dZ"eed d%dZ#ddiZ$dZ%y)&uz``command`` secret source — resolve secrets via a user-configured helper. Ports the desktop app's TypeScript ``CommandSecretsProvider`` semantics. The helper (``keepassxc-cli``, ``secret-tool``, a script that cats a tmpfs env file, ...) comes from ``secrets.command`` in ``config.yaml`` — NEVER from ``.env``, which holds only secret values. Security model: the command string is the USER'S OWN configuration, so it runs via ``/bin/sh -c``; the requested key reaches the child ONLY via ``HERMES_SECRET_KEY`` (never interpolated, so a hostile key name is inert); hard timeout (default 3s) + 1 MiB output cap, every failure degrades to "no value"; failure logs carry ONLY structured fields (exit code / signal / errno), never the command, the helper's stderr (captured and DISCARDED) or any value; startup runs the helper exactly ONCE with an empty key; POSIX-only (needs ``/bin/sh``). ) annotationsN)Path)DictOptional) ErrorKind FetchResult SecretSource coerce_floatsource_child_envrunquote_dotenv_valueg@iz^([A-Za-z_][A-Za-z0-9_]*)=(.*)$cZtjdk(xstjdk(S)NntWindows)osnameplatformsystemA/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/command.py _is_windowsr)s! 77d? = 2 so a lone ``"`` stays intact while ``""``/``''`` correctly yield an empty string. rz"')striplen)rawts rr r 1sB A 1v{qtqu}12w Hrctr tdyt}||d< tjdd|g|tj tj tj d} |j| \}}|j*dk7ret-|j*d} } |j*dkr- tj.|j* j0} d} td| d| yt3||kDrtd|dy|j5ddS#t$r"}td|jYd}~yd}~wwxYw#tj$r tjtj|jtj n*#t"t$tf$r|j'YnwxYw |jd n$#tjt(tf$rYnwxYwtd |d d YywxYw#t($rt-|j* } YcwxYw)uRun the helper via ``/bin/sh -c`` and return its stdout, or None. The key travels as DATA in ``HERMES_SECRET_KEY``. stdout/stderr are piped (never inherited); stderr is discarded. Any failure logs structured fields only and returns None — never raises. zSthe 'command' provider is POSIX-only (needs /bin/sh); resolving no value on WindowsNHERMES_SECRET_KEYz/bin/shz-cT)envstdinstdoutrstart_new_sessionz2helper failed to spawn; resolving no value: errno=)timeoutg?zhelper timed out after gzs; resolving no valuernone?z(helper failed; resolving no value: code=z signal=zhelper output exceeded the z-byte cap; resolving no valuezutf-8replace)errors)rrr subprocessPopenDEVNULLPIPEOSErrorerrno communicateTimeoutExpiredrkillpggetpgidpid_signalSIGKILLProcessLookupErrorPermissionErrorkill ValueError returncodestrSignalsrr$decode) command secret_keytimeout_secondsmax_output_bytesr)procexc stdout_bytes_stderr_discardedcodesignames r _run_helperrR=s} bc  C)C g &Cz7I7I??:??" *.*:*:?*:*S' ' !DOO,fg ??Q  0!//4??*:;@@D 7vXgY OP <++ *+;*<C O ? Jrc`eZdZdZdZdZdZejdejdiZ d dZ d dZ y ) CommandSourceauUser-configured helper command as a registered **bulk** source. Composes with the other sources through ``apply_all()``; there is deliberately NO single-provider selector. The helper enumerates a KEY=VALUE blob in one run. Config:: secrets: command: enabled: true command: "cat /run/user/1000/hermes-secrets.env" rHzCommand helperbulkziSet secrets.command.command in config.yaml to a fast, non-interactive helper that prints KEY=VALUE lines.uRun the helper manually in a shell to see its real error — Hermes discards helper stderr so diagnostics can't leak secret material.c0dddddddtdddddS) Nz Master switchF) descriptiondefaultz@Helper run via /bin/sh -c; must print a KEY=VALUE blob on stdoutzHard timeout for one helper runz)Helper values overwrite .env/shell values)enabledrHhelper_timeout_secondsoverride_existing)_COMMAND_TIMEOUT_SECONDS)selfs r config_schemazCommandSource.config_schemas4'65I'i#%'6W2J'L1\in!o   rcDt|tr|ni}t}t|j dxsdj }|s |j dtjStr |j dtjSt|j dtt}t|d|t}| |j dtjSt|}|s|j j#d|S||_|S)NrHrfmsecrets.command.enabled is true but secrets.command.command is empty. Set the helper command in config.yaml.Nthe 'command' secret source is POSIX-only (needs /bin/sh); skipping on WindowsrhzGhelper command failed (see structured fields above); no secrets appliedz7helper output was not a KEY=VALUE map; nothing to apply) isinstancedictrrEgetr#failrNOT_CONFIGUREDrr rjrR_MAX_OUTPUT_BYTESINTERNALr_warningsappendsecrets)rkcfg home_pathresultrHr-r+rys rfetchzCommandSource.fetchsT*ccggi(.B/557;; ST]TlTln n =;;o(779 9sww'?AYZ79Wb'3DE >;;h(113 3$F+ OO " "#\ ]M  rN)returnrq)rzrqr{rr~r) __name__ __module__ __qualname____doc__rlabelshaperrtrvremediation_hintsrlr}rrrrarasG  D E E  #X/ rraF)rirJrKr{ct}|xsdj}|s d|_|Str|jj d|St |d||}||jj d|St|}||_|s|jj d|S|jD]\}} | jdk(r|jj |5|s;tjj|r|jj |r| tj|<|jj ||S)a5Run the helper once at startup and set its KEY=VALUE output on ``os.environ``. LEGACY shim retained for API symmetry with ``apply_bitwarden_secrets``; the startup path goes through :class:`CommandSource` + the registry orchestrator instead (which owns precedence and the environ writes). rfrnrozahelper command failed at startup; no secrets applied (process env / .env values remain in effect)z|helper output was not a KEY=VALUE map; nothing applied at startup (a bare-value helper still resolves single keys on demand))rr#errorrrwrxrRr_ryitemsskippedrenvironrrapplied) rHrirJrKr{r|r+rykeyvalues rapply_command_secretsrsJ]F}"##%G  =   } "  "o7G HF ~ ;  'GFN  Q  mmo # U ;;=B  NN ! !# &  RZZ^^C%8 NN ! !# &  3c" # Mrc|jdd}|jd}d|DDcgc],}|r(|jdstj |r|.}}|D]d}tj |}|J|j d|k(s1t |j d}|jdk7r|cSdcSt|dkDry|j}|dk(rytj |}|rH|j d|k7r4tjd |j djy|Scc}w) asParse a secret-fetch helper's stdout. Supports BOTH shapes: * a bare value (single secret): the whole trimmed stdout is the value. * a dotenv blob (KEY=VALUE lines): parse them and return the entry for ``wanted_key``. Mirrors the TS ``parseSecretOutput`` exactly, including the cross-key misroute guard and the base64-padding disambiguation. rTrUc3<K|]}|jyw)N)r#).0r%s r z&parse_secret_output..s2SSYY[2srVNr"r rfz=*) r1rWrXrYrZr[r r#r$re fullmatch) r+ wanted_keytextlinesr] dotenv_linesr^r env_shapeds rparse_secret_outputr sF >>&$ 'D JJt E 3E2  ,1F L : OOD !}} 771: #(4E"KKMR/5 9T 9:" <1 JJLE {'J   Q : - LL 0 0 3 9 9 ; < D Lcs1E)rJrKcj|xsdj}|syt||||}|yt||S)uResolve a single secret by running the helper with the key in ``HERMES_SECRET_KEY``. Returns None on any failure — never raises.rfN)r#rRr)rHrrJrKr+s rget_command_secretrMsB}"##%G  #8H IF ~ vs ++rcl|xsdj}|siSt|d||}|iSt|S)zEnumerate secrets by running the helper ONCE with an empty key. Returns the dotenv map ONLY when the helper emits a KEY=VALUE blob; a bare-value helper returns ``{}``. Never raises. rf)r#rRr_)rHrJrKr+s rlist_command_secretsr^sD}"##%G  "o7G HF ~ V $$rget_source_environment)zagent.secret_sources.baserctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncer") _PLUGIN_COMPAT_LAZYrrAttributeErrorr importlibhermes_cli.plugin_compatrgetattr import_module)rtargetrrs r __getattr__rwse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AAr)r~bool)rrEr~None)r%rEr~rE) rHrErIrErJfloatrKintr~ Optional[str])r+rEr~Dict[str, str]) rHrErirrJrrKrr{zOptional[Path]r~r)r+rErrEr~r) rHrErrErJrrKrr~r)rHrErJrrKrr~r)&r __future__rrrrsignalr>r3rpathlibrtypingrragent.secret_sources.baserrr r r __all__rjrucompilerYrrr rRr_rarrrrrrrrrrsb #   !jj 0 1 BJJ9 : =;  9:x :L:J$5- $ A AA A  A  AAF@L6- , , , ,  ,  ,(6- % %% %  %*U Br