߲j:UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl Z ddl mZmZmZej"eZdZeZded<eZded <eZded <iZd ed <iZd ed<iZd ed<eZded<e j<ZiZ ded<ejBZ"e j<Z#e$dhZ%ded<e$hdZ&ded<d0dZ'd1dZ(d2dZ)d3dZ*d4dZ+d4dZ,d5dZ-d6d7dZ.d8d Z/d9d:d!Z0d;d"Z1dd#dd)Z5dd#d?d*Z6d>d+Z7dd,d@d-Z8dAd.Z9dBd/Z:y)CzFHelpers for loading Hermes .env files consistently across entrypoints.) annotationsN)Path)atomic_replacefast_safe_loadload_yaml_file_readonly)_API_KEY_TOKEN_SECRET_KEYset[str] _WARNED_KEYS_WARNED_UTF32_PATHS_SCOPED_SKIP_LOGGEDdict[str, str]_SECRET_SOURCESzdict[str, dict[str, str]]_SECRET_SOURCE_VALUES_BY_HOME_SECRET_SOURCE_RESTORE_BY_HOME_APPLIED_HOMESz&dict[str, tuple[str | None, str, int]]_DOTENV_PUBLISHEDHERMES_DASHBOARD_SESSION_TOKENzfrozenset[str]_SPAWN_CREDENTIAL_KEYS>COPILOT_CLI_PATHCOPILOT_ACP_BASE_URLHERMES_ACP_AUTH_METHODHERMES_ACP_AUTO_APPROVEHERMES_COPILOT_ACP_ARGSHERMES_COPILOT_ACP_COMMAND_PROFILE_MANAGED_ENV_KEYSc0ddlm}t||S)uKEY names assigned in a dotenv file (including empty ``KEY=``), via the same tokenizer that installs profile scopes — a key the installer sees is a key the dashboard scrub sees (BOM'd first line included).r) load_env_file)agent.secret_scoper set)pathr s :/home/ubuntu/.hermes/hermes-agent/hermes_cli/env_loader.py_env_keys_defined_in_dotenvr%Js1 }T" ##c|jsyt|}tD]+}||vs|tjvstj|=-y)a@After ``.env`` loaded with override, delete inherited ``_PROFILE_MANAGED_ENV_KEYS`` it does not define. Deliberately NARROW: only keys that change *which provider path* is used. Does **not** run when the ``.env`` file does not exist (bare-profile case, which follows ``#66930`` / ``#67027`` semantics). N)existsr%rosenviron)r#definedkeys r$%_clear_known_keys_missing_from_dotenvr-RsG ;;=)$/G(  g #"3 3 r&c,tj|S)uSource label that supplied ``env_var`` (``"bitwarden"`` …), None for .env/shell keys. Metadata only — never authorization to persist the raw value.)rget)env_vars r$get_secret_sourcer1as   w ''r&c ttS)uEvery env-var name some profile's external secret source supplied (names only — the map is process-wide, so a value must be resolved through the active profile's secret scope).)tuplerr&r$secret_source_namesr5gs  !!r&c ttjtt |j iS)z>Return the external-secret value snapshot for ``hermes_home``.)dictrr/strrresolve hermes_homes r$get_secret_source_valuesr<ms/ -11#d;6G6O6O6Q2RTVW XXr&cbt5tt|cdddS#1swYyxYw)aResolve one profile's configured sources without mutating ``os.environ``: multiplex gateways route turns to profiles that never ran the process-global dotenv path, so resolve against a private mapping seeded from that ``.env`` and record the per-home snapshot for ``build_profile_secret_scope()``. Fail-open / once-per-home like ``_apply_external_secret_sources``; never returns plaintext .env entries.N)_SECRET_SOURCE_CACHE_LOCK_hydrate_profile_secret_sourcesrr:s r$hydrate_profile_secret_sourcesr@rs- #B.tK/@ABBBs%.ct|j}|tvr t|Stj |dt j |d t|}|siS ddl m }m }ddl m }tjj!Dcic]\}}||s||}}}|j#||dz |dz } | j%r0|| j!D]\} } |j'| | t||d<||||} | j(siSt+d | j(Drtj-|i} | j.j!D]1\}}|j1|}||j2t4|<|| |<3| t|<t7| S#t$ricYSwxYwcc}}w#t$ricYSwxYw) zALocked implementation for :func:`hydrate_profile_secret_sources`.Nr)_is_global_envr  apply_all.env.op.env HERMES_HOME)r*c3HK|]}|jjywN)resultok).0srcs r$ z2_hydrate_profile_secret_sources..s 3S3::== 3s ")r8r9rr<rpopr_load_secrets_config Exceptionr!rBr agent.secret_sources.registryrDr)r*itemsupdater( setdefaultsourcesalladd provenancer/sourcerr7)homehome_keycfgrBr rDnamevalue local_envop_env_name_valuereportvaluesapplieds r$r?r?{s4<<>"H>!'--"%%h5"&&x6"4(  D;46JJ4D4D4F_[T5.Y]J^T5[_ _tf}56  ! ==?!.v!6! 4 v$$UF3 4#&t9 - 3i8 >>  3FNN 338$F**002 g d# =  't  /5!(+ <Q  `  s= G */G$G*G/A;G$ GGG$$ G21G2cp|Qtjtjtjtjyt t |j}tj|tj|dtj|dy)uForget applied homes so the next load re-pulls (tests, long-running processes after config edits). ``hermes_home`` limits the reset to ONE home: a multiplex gateway keeps every profile's snapshot in this process, and a per-fire cron re-pull or a plugin-discovery refresh for one home must not wipe a sibling's hydrated snapshot — the sibling's next scope build would run empty until it re-hydrated (#102041).N) rclearrrrr8rr9discardrO)r;r\s r$reset_secret_source_cacherjs%++-&,,.4 $,,./H8$!%%h5"&&x6r&ct|}|sy|dk(ry ddlm}||}||jrd|jdSd|dS#t$rYwxYw)zc``" (from Bitwarden)"``-style suffix; ``""`` for .env/shell keys (only external sources are named). bitwardenz (from Bitwarden)r get_sourcez (from ))r1rRrolabelrQ)r0rZro registereds r$format_secret_source_suffixrssx w 'F  " <'  !j&6&6Z--.a0 0VHA     s+A AAcg}|D]^}t|dkDsdt|d}|jr |d|dz }||vr|j|t||k\s^ndj |S)z>Compact ``U+XXXX ('c'), ...`` summary of non-ASCII codepoints.zU+04X (rpz, )ord isprintableappendlenjoin)r_limitseenchrqs r$_format_offending_charsrsD r7S=R &E~~2bV1%D  E"4yE! 99T?r&c >ttjjD]\}t fdt Ds|j r0|jddjd}|tj<tvrntjt|t|z }t|xsd}tdd|d|d k7rd nd d |d tjtdtjy)auStrip non-ASCII from credential env vars (``_CREDENTIAL_SUFFIXES``) so the codebase never sees them. Emits a one-line warning to stderr when characters are stripped. Silent stripping would mask copy-paste corruption (Unicode lookalike glyphs from PDFs / rich-text editors, ZWSP from web pages) as opaque provider-side "invalid API key" errors (see #6843). c3@K|]}j|ywrI)endswith)rLsuffixr,s r$rNz/_sanitize_loaded_credentials..sKF3<<'Kasciiignore)errorsz non-printablez Warning: z contained z non-ASCII charactersrlrwu8) — stripped so the key can be sent as an HTTP header.filea@ This usually means the key was copy-pasted from a PDF, rich-text editor, or web page that substituted lookalike Unicode glyphs for ASCII letters. If authentication fails (e.g. "API key not valid"), re-copy the key from the provider's dashboard and run `hermes setup` (or edit the .env file in a plain-text editor).N)listr)r*rSany_CREDENTIAL_SUFFIXESisasciiencodedecoder rXr{rprintsysstderr)r_cleanedstrippeddetailr,s @r$_sanitize_loaded_credentialsrs2::++-. UK6JKK  ==? ,,wx,8??H! 3 ,  u:G ,(/B? C5 H:5I A 2.b934:=** F  1   r& load_passc|j} |jd}ddlm}ddl m }t|dtj|dj}t5|t!t"}t%t&j(}t*j-D]/\} \} } } | |k7s|j/| | k(s%| || =+| || <1i} |D]:\} }|.|ri|| ni| |d j1fd ||D}|| | <<| j-D]\} }||s| t&j(vrt&j(j/| }t*j/| }|duxr||d k(}| t2vr|r|sl|r|dn|} |t&j(| <| ||ft*| < dddt5y#t$rP|jtj r|t tj d}|jd}Y wxYw#1swYt5yxYw) uGLoad one dotenv file into ``os.environ`` like ``dotenv.load_dotenv`` — same parser, same ``${VAR}`` / ``${VAR:-default}`` / precedence rules — except that ``${VAR}`` resolves against the value VAR had before this process's earlier passes published it (see ``_DOTENV_PUBLISHED``). ``load_pass`` groups the layered files of one ``load_hermes_dotenv`` call: within a pass a later layer (project, managed) still sees the earlier layer's output, as it always did; only OTHER passes' output is peeled. A bare call (``hermes send``'s direct reload) is its own pass. utf-8-sigNzlatin-1r)DotEnv)parse_variablesF) dotenv_pathstream interpolaterlc3@K|]}|jywrI)r9)rLatomlookups r$rNz-_load_dotenv_with_fallback../sX V 4Xrr) read_bytesrUnicodeDecodeError startswithcodecsBOM_UTF8r{ dotenv.mainrdotenv.variablesrrioStringIOparse _DOTENV_LOCKnext_DOTENV_PASSESr7r)r*rrSr/r|rr)r#overriderrawtextrr assignments lookup_envr^baseline publishedpublished_passresolvedr_currentrecordoursrs @r$_load_dotenv_with_fallbackr s? // C%zz+&#0v$r{{47HV[\bbdeK C  ^,I,0,< ;L;R;R;T 0 7D78Y*z~~d/Cy/P#"4('/Jt$  0 +-& #KD% 7?3J3(3E_E_T^E_XQVAWXX"HTN  # $>>+ CKD%}X$"**2DjjnnT*G&**40F%>'VAY*>D--'$$(vaygH$BJJt '/ &B d # C!C8!"O % >>&// *c&//*,-Czz)$%C8!"s,G+AH3:H3C4H3AH0/H03Ic|jsy ddlm} |j }d}|j tjs|j tjrMt|j}|tvr+tj|tjd|y|j tj s|j tj"rH t%j&t%j(|dd5}|j+}dddd}n? t/|d d 5}|j+}dddr|dj d ry Dcgc]}|j1d d}}||} | |k7s|rddl} | j5t|j6dd\} } t9j:| dd5}|j=| |j?t9j@|jCdddtE| |yy#t$rYywxYw#t $rYywxYw#1swY;xYw#t,$rYywxYw#1swY,xYw#t $rYywxYwcc}w#1swYrxYw#tF$r' t9jH| #tJ$rYwxYwwxYw#t $rYywxYw)a Pre-sanitize a .env file before python-dotenv reads it. Sniffs a leading BOM *before* any text decode: UTF-16 (Notepad "Unicode") is rewritten as clean UTF-8; UTF-32 is refused (left untouched) so we never fall through to the errors=replace corruption path.Nr)_sanitize_env_linesFz^Skipping .env sanitize for %s: UTF-32 BOM detected; leaving file untouched to avoid corruptionzutf-16)encodingnewlineTrreplace)rru�rlz.tmpz.env_)dirrprefixwzutf-8)r)&r(hermes_cli.configr ImportErrorrrQrr BOM_UTF32_LE BOM_UTF32_BEr8r9rrXloggerwarning BOM_UTF16_LE BOM_UTF16_BEr TextIOWrapperBytesIO readlinesropenrtempfilemkstempparentr)fdopen writelinesflushfsyncfilenor BaseExceptionunlinkOSError) r#rrforce_utf8_rewritepath_keyforiginalliner sanitizedrfdtmps r$_sanitize_env_file_if_neededr@s ;;=9oo  ~~f))*cnnV=P=P.Qt||~& . .  # #H - NNHIM O ~~f))*cnnV=P=P.Q !!"**S/HdS )WX;;= )" d[C )q;;= )  ..x8  9ABDLL,BB'1  $6 &&3t{{+;FSZ&[GB YYr39)QLL+GGIHHQXXZ()sD)%7Y  $ ) )!     ) )   C )) ! IIcN     sI I6+I8!I+2I8>J JJ=K'J#?K'J42AJ(7J4 II I('I(+I50I88 JJJ J J J #K'(J1-J44 K$>KK$ K K$K  K$$K'' K32K3T)r; project_envload_external_secretscddlm}|r t|n|}ddlm}ddlm}|rx|qt |j}|tvr+tj|tjd||r!ddl m }|js t|gSg} |dz } |r t|nd} t!t"} | j%r t'| | r| j%r t'| | j%r*t)| d | | j+| t-| |d z } | j%r-t.j0j3d st)| d | | r0| j%r t)| | | | j+| t4ryt4j3t |jij7D];\}}t.j0j3||k7s)|t.j0|<=ddl m }|r|js t9|t;| t=|| S)zLoad Hermes env files: ``~/.hermes/.env`` overrides stale shell exports; project ``.env`` is a dev fallback that only fills gaps when the user env exists (and overrides shell vars when it does not).rget_process_hermes_home)is_multiplex_active)get_hermes_home_overrideNzumultiplex: skipping process-global dotenv load for routed profile home %s (credentials resolve via the profile scope))_early_recoveryrETrrrFOP_SERVICE_ACCOUNT_TOKENFr)hermes_constantsrrr!rrr8r9rrXrdebug hermes_clir$_should_skip_external_secret_sourcesr@rrr(rrrzr-r)r*r/rrS_apply_external_secret_sources_apply_managed_env_reapply_terminal_config_bridge)r;rrr home_pathrrr\rloadeduser_envproject_env_pathrrar^r_s r$load_hermes_dotenvrs9%0[!6M6OI 79!9!;!Gy((*+ . .  # #H - LLWXa c 2"GGI.y9 F6!H,7tK(T^$I$X.,335$%56"8diP h-h7  "F }}rzz~~.HI"6EYO,335"#3&jT]^ &' &9==c)BSBSBU>VXZ[aac )KD%zz~~d#u,#( 4  )+_%Y%Y%[&y1+$I. Mr&c t|jtjk7ryddlm}|dy#t $rYywxYw)zRe-assert config.yaml's explicit ``terminal.*`` keys over reloaded .env via the single shared bridge ``apply_terminal_config_to_env`` (also used by terminal_tool and the TUI/dashboard launchers) so the semantics can't drift between sites.Nr)apply_terminal_config_to_env)env)rr9_process_hermes_homerrrQ)rrs r$rrsI  ? " " $(<(>(F(F(H H B$.    s2AA AAc ddlm}|j}|y|dz }|j syt |t |d|y#t$rYywxYw)zApply the managed-scope .env last, with override, so it beats user/shell. Does NOT stop the agent from later mutating os.environ (v1 relies on filesystem permissions). Fail-open: never blocks startup.r) managed_scopeNrETr)rrget_managed_dirrQr(rr)rr managed_dir managed_envs r$rrsd,#335 &K     -{TYO sA AAc tt|j}|tvry t |}|syt d|jD}|sy ddlm } |||}|jsytj||jr?t|jj!D]\}}|j"t$|<i}t'|j} |jD]} | j)| j*| D]+}|t,j.vst,j.|||<-|r |t0|<|jj!D cic]\} } | j2s| |vs| || c} } t4|<|jD]_} | j6r[t9d| j:dt=| j6dt=| j6dk7rd nd t>j@ | jBjDrt9d| j:d | jBjDt>j@ tG| jH| jBjJ|| } | r+t9d| j:d| t>j@ | jBjLD]-}t9d| j:d |t>j@ /b|jND] }t9d|t>j@ "y#t $rYywxYw#t$rYywxYw#t $rYywxYwcc} } w)uoPull secrets from every enabled external source into env — AFTER dotenv (sources need .env bootstrap tokens), BEFORE Hermes reads credentials; failures never block startup. Precedence/conflicts/provenance live in ``registry.apply_all``; this wrapper owns the once-per-home guard, the post-apply ASCII sweep, the ``_SECRET_SOURCES`` map and status lines.Nc3fK|])}t|txr|jddu+yw)enabledTN) isinstancer7r/)rLvs r$rNz1_apply_external_secret_sources.. s-]1jD)FaeeI.>$.FF]s/1rrCz z : applied z secretrrrlrz: scopeu: → z Secret sources: )(r8rr9rrPrQrrerRrDrrVrX applied_anyrrYrSrZrr"rTskipped_existingr)r*r authoritativerrfrrqr{rrrJerror_remediation_hintr^ error_kindwarnings conflicts)rr\r] any_enabledrDrdr^rfresuppliedrMnahintwarnconflicts r$rr s 4 ?**,-H>! "9-  ]PSPZPZP\]]K ;3 * >> x  $&#..446 3MD'$+NNOD ! 3 F6$$%H~~.,,-., 2:: ::d+F4L,28%h/!'!2!2!8!8!:0_AaooRSW]R]6!9 0_"8,~~ = ;; BsyykC ,<+=>"%ckk"2a"73R@BHK  T ::   BsyykCJJ$4$4#56SZZ H$SXXszz/D/DcQYZD399+VD62DJJ'' =D BsyykD6* < = =$$@ "8*-CJJ?@E   @0_sG MM& M!7M0 M0M0 MM MM! M-,M-r c ddlm}|||}|y|j|}t|tr|ni}t |j ||xsdjS#t$rYywxYw)zbThe failed source's one-line fix-it hint; a plugin remediation() could raise and startup must not.rrnr rl) rRror/r r7r8 remediationstriprQ) source_namer secrets_cfgrrorZsrc_cfgs r$rr]st <Ku5 >//+.'6'B6%%j':@bAGGII sA'AA'' A32A3c"|dz }|jsiS|tk(r' ddlm}|xsi}|j dxsiS t |xsi}|j dxsiS#t $rY0wxYw#t $ricYSwxYw)zeRead just the ``secrets:`` section of config.yaml, isolated so a malformed config can't break dotenv.z config.yamlr)read_raw_configsecrets)r(rrr%r/rQr)r config_pathr%datas r$rPrPlsm+K     (**  9"$*D88I&," ,&{39r 88I  $"$     s#%A1 B1 A=<A= B Bcj ddlm}|S#t$rtjdz cYSwxYw)uThe HERMES_HOME the running process was launched under. Must be the *true* process home, ignoring any context-local ``set_hermes_home_override`` a per-request task has installed. Both callers depend on that: * ``_reapply_terminal_config_bridge`` guards "only re-bridge config into the shared ``os.environ`` when THIS load is for the process's own profile". If this followed the task override, a per-turn handler scoped to a *secondary* profile (the multiplex dashboard serving every profile from one process) would satisfy the guard and bridge that profile's ``terminal.backend`` into the shared env — e.g. a ``local`` sibling profile clobbering the launch profile's ``TERMINAL_ENV=ssh`` while leaving its ``TERMINAL_SSH_*`` untouched, so the session silently runs commands locally (cross-profile terminal-backend leak). * ``_load_secrets_config`` uses it to decide whether the shared (mtime,size)-keyed config cache is safe to reuse; under an override it must fall through to an isolated parse of the scoped profile. ``hermes_constants.get_process_hermes_home()`` is the override-immune resolver built for exactly this; delegate to it. rrz.hermes)rrrQrr[rs r$rrs3.'<&(( 'yy{Y&&'s  22)r#rreturnr )r#rr*None)r0r8r* str | None)r*ztuple[str, ...])r;zstr | os.PathLiker*r)r[rr*rrI)r;str | os.PathLike | Noner*r+)r0r8r*r8))r_r8r}intr*r8)r*r+)r#rrboolr int | Noner*r+)r;r-rr-rr0r*z list[Path])rrr*r+)rr1r*r+)r!r8r"r7rr,r*r8)rrr*r7)r*r);__doc__ __future__rrr itertoolsloggingr)r threadingpathlibrdotenvutilsrrr getLogger__name__rrr"r __annotations__rrrrrrRLockr>rcountrr frozensetrrr%r-r1r5r<r@r?rjrsrrrrrrrrrrPrr4r&r$r@sL"   II   8 $A h #X% #X%#%$;=8=<> 9>5 +IOO-=?9> "y *34T3U)VV -67-> $  ( " Y B5p7&&  BW[4#nD R-1,0"& _)_*_ _  _D  37P$Q@h_c %.'r&