߲j1dZddlmZddlZddlZddlZddlmZmZm Z eje Z d:dZ d;dZdd Zd d d dZd?dZd@dZdAdZdBdCdZded<dBdDdZdEdDdZdFdZdddigddZdd dd!d"d#d$gd%d&id!gddZd'd(ddd"d)d*idgddZd+d,ddd"d-d*igddZd.d/ddd"d0d*igddZdGd1Z dGd2Z!dGd3Z"dGd4Z#dGd5Z$dd6l%m&Z&m'Z'e&e Z e'jPdd7ee"e d89e'jPdd7ee#e d89e'jPd+d7ee!e d89e'jPd.d7ee e d89e'jPd'd7ee$e d89y)Hu4Vault-backed model-blind browser autofill tools. Two model-facing tools, gated on the local vault having at least one item (zero schema cost otherwise, same ``check_fn`` pattern as the Home Assistant tools): - ``browser_vault_list`` → handles + metadata (for logins this includes the identifier — it is NOT a secret; the agent types it itself). Passwords are never returned. - ``browser_vault_fill`` → server-side fill of the CURRENT page from a vault handle: the password field for logins, card fields for payment items (after the user confirms), address fields for address items. The secret is resolved locally, the page origin must EXACTLY match the item's bound origin (pre-checked AND re-asserted synchronously inside the fill script), the field is chosen by the ported login-control classifier, injection runs exclusively over the supervisor CDP WebSocket (never argv), and the tool result reports only ``{filled_fields, kind, origin, success}`` — the password never appears in tool results, logs, or the session DB, and its exact bytes are registered with the browser-result redaction boundary so no later browser tool call can echo them back to the model. Ported design from Merit-Systems/OpenInstinct (MIT): opaque-handle vault autofill (kernel-login-autofill.ts / fill_from_vault.ts). ) annotationsN)AnyDictOptionalcLddlm}ddlm}t |xs|S)a Schema-gate: the vault tools ride with the browser. An empty vault still needs browser_vault_save_login so the agent can offer to remember a login the first time it meets a form; hiding the tools until an item exists meant nobody ever discovered the feature.r)check_browser_requirements)is_browser_use_cli_mode)tools.browser_tool_installrtools.browser_use_clir bool)rr s =/home/ubuntu/.hermes/hermes-agent/tools/browser_vault_tool.py_check_vault_availabler)s%F= ')I-G-I JJcJ ddlm}|j|}|k|j|}|jdrd|jddSt |jdxsd }d |j vrd |d Sddl m }ddl m }||} || d|g} | jdsd | jddd Sd| jdijddS#t $rYtt$r }tjd |Yd}~d}~wwxYw)utEvaluate NON-SECRET JS on the current page (inspection, origin reads). Prefers the supervisor's persistent CDP WebSocket, falls back to the agent-browser CLI ``eval`` command. Never use this for expressions that embed secret values — the fallback places the expression in subprocess argv. Use :func:`_eval_js_secret` for secret-bearing expressions. rSUPERVISOR_REGISTRYNokTresultsuccessrerror supervisorFrrz,vault fill: supervisor eval unavailable (%s)_last_session_key_run_browser_commandevalr eval faileddata)tools.browser_supervisorrgetevaluate_runtimestrlower ImportError Exceptionloggerdebugtools.browser_toolrtools.browser_tool_sessionr) task_id expressionrrsuperrexcrr effectivers r _eval_jsr38sJ@(,,W5  !--j9Cwwt}#'37783DEEcggg&,"-C399;.#(377 5?!'*I !)Vj\ BF ::i  6::g}+MNNvzz&"'='A'A('K LL   J CSIIJs$AC/4C// D":D"DD"cddlm}|j|}||Sddlm}ddlm}m}ddlm }|||ddg}|xsijd r5t|xsijd xsijd xsd nd }|sy|\} } |j|||| | S#t$r } tjd| Yd} ~ yd} ~ wwxYw)aThe supervisor for ``task_id``, attaching one on demand for a LOCAL built-in browser session. Cloud/CDP-override sessions and browser_exec attach their supervisor when the session is created; a local agent-browser ``--session`` has no ``cdp_url`` of its own, so nothing did. Ask the daemon for the packaged Chromium's endpoint (``get cdp-url``: same daemon, same reaper) and attach. Returns None when no endpoint is reachable; the fill then refuses rather than touching argv.rrNr)_get_dialog_policy_config_resolve_cdp_overriderr#zcdp-urlrr!cdpUrlr)r-cdp_url dialog_policydialog_timeout_sz:vault fill: supervisor attach to local session failed (%s))r"rr#r+rtools.browser_tool_cdpr5r6r,rr% get_or_startr(r)r*) r-rrrr5r6rresr8policy timeout_sr1s r _ensure_supervisorr@Zs=$((1J4W? 0959+ NCKN9RT//ZcJdcCI2??6*0b55h?E2FjlG 13FI"//I^_fIg>DW`0b b  QSVWsB66 C?CCc t|}|ddddS|j |}|j drd|j d d Sdd t |j d xsd jvrdndt |j d xsddS#t$r"}tjd|d}Yd}~d}~wwxYw)uEvaluate a SECRET-BEARING JS expression. Supervisor CDP-WS only. Fails closed: there is deliberately NO fallback to the agent-browser CLI ``eval`` path, because that places the expression — and therefore the credential bytes — in subprocess argv, visible to any process listing. When no supervisor session is available the caller gets a typed refusal (``error_type='supervisor_required'``) and nothing is written. z'vault fill: supervisor unavailable (%s)NFsupervisor_requiredzVault fill requires the supervised browser session (direct CDP WebSocket). The fallback eval path would place the credential in subprocess argv, so it is never used for secrets. Start the browser through the Hermes-managed session and retry.r error_typerrTrrrrr eval_failedr )r@r(r)r*r$r#r%r&)r-r.rr1r/s r _eval_js_secretrFws'0 /%    % %j 1C wwt}3778+<== 3swww/526<<> >, SWWW%67  )  >D s B C&CCct|tr tj|S|S#tjt f$r|cYSwxYwN) isinstancer%jsonloadsJSONDecodeError ValueError)raws r _parse_json_resultrOsG#s ::c? " J$$j1 J s)AAct|d}|jdsyt|jdxsdjjdjd}|r|dk(ry dd lm}||S#t $rYywxYw) Nzwindow.location.hrefrrr"'z about:blankr)normalize_origin)r3r#r%stripagent.vault_storerSr()r-r=hrefrSs r _current_page_originrWs 72 3C 779  swwx &B ' - - / 5 5c : @ @ ED 4=(6%% s2 B B  B z0!!document.querySelector('input[type=password]')zy!!document.querySelector('input[autocomplete^=cc-], [name*=card i], [placeholder*=card i], [name*=cvc i], [name*=cvv i]')z!!document.querySelector('input[autocomplete^=address-], [autocomplete=postal-code], [name*=address i], [name*=zip i], [name*=postal i]'))loginpaymentaddressc t|}|y|j|tj |}|j dr|xs|j dSdS#t$rd}Y^wxYw)a5Point the supervisor's page session at the open tab on ``origin`` that holds a ``kind`` form (browser_exec sessions open their own tabs, so the tab the supervisor attached to first is rarely the login page). Returns the origin when a tab was focused, else None (caller falls back to the current page).N)acceptrurl)r@r( focus_page _TAB_PROBESr#)r-originkindrfocuseds r _focus_bound_originrcst'0 ##F;??43H#IG-4[[->F (gkk%(HDH  s A A,+A,c ddlm}ddlm}ggg}}}|D]_}|jrC|j s3|j |j|j|rdnddS |j}|D]}|j|j|j|j|j|jd k(xst!|jd } t#|j$d kDrt'|j$| d <|j(s |jr|j(rdnd| d<|j*r|j*| d<|j,| d<|j | bd|d} |sd| d<|r|| d<|r|| d<t/j0| dS#t$r5}|j |jt|ddd Yd}~d}~wwxYw)a"List login handles + metadata across every enabled backend. Passwords are never included. A locked external manager contributes no items; instead it is reported under ``locked`` so the agent knows to call browser_vault_fill (which prompts the user to unlock) or tell the user. renabled_backends)can_prompt_herebrowser_vault_unlockunavailable_in_this_session)backend display_nameunlockN)rjrrX)handlerjlabelrar` availableallowed_origins automaticzCautomatic if the manager stores a TOTP seed, else the user is asked two_factor identifieridentifier_typeT)ritemszNo saved logins. On a login page, call browser_vault_save_login to ask the user to save one. Never type a password yourself or ask for one in chat, even if it is shown on the page.hintlockederrorsF ensure_ascii)agent.vault_backendsrfagent.vault_backends.unlockrg needs_unlock is_unlockedappendnamerk list_itemsr(r%idrorar`r lenrrlisthas_otprurvrJdumps) rfrgrwryrzrjmetasr1metaentryouts r browser_vault_listrs 6;B66E#%    (;(;(= MMgllGDXDX?N?P%;Vsu v  &&(E D#ww7<<$**^b^g^g#{{g9M9bQUVZVaVaQbdE4''(1,+/0D0D+E'(||w3359\\kHMl#&*ool#+/+?+?'( LL   *'+U;C qF  H  H ::c ..-  MMgllSXds^L M  s.F.. G,7*G''G,cddlm}ddlm}m}t fd|Dd}|t jdddd S|jr#t jd |jd d S|s&t jdd |jd dS|}|r||j|jnd}|s't jddd|jddS |j| ~t jd |jdS#t$r0}t jddt|dddcYd}~~Sd}~wwxYw#~wxYw)z^Ask the user (via the surface's masked prompt) to unlock an external manager for this session.rre)rgget_unlock_prompt_callbackc3\K|]#}|jk(s|js |%ywrH)rr).0b backend_names r z'browser_vault_unlock..s%_!QVV|5KPQP^P^A_s , ,,NFz"No unlockable vault backend named .rT)rrjalready_unlockedunlock_unavailablez is locked and this session cannot prompt for the master password (headless/cron/API). Unlock it from an interactive Hermes session or the Desktop app first.rCrunlock_cancelledzThe user declined to unlock unlock_failedi,)rrj)r}rfr~rgrnextrJrrrrkrlr(r%)rrfrgrrjpromptmasterr1s` r rhrhss5W_/1_aefGzze8Z[gZjjk6lmnnzzdw||Y]^__  zze;O(/(<(<'=>I&IKL L( )F;AVGLL'"6"6 7rF zze;M&B7CWCWBXXY$Z\] ]v  ::$7<<@ AA fzze?UXY\U]^b_bUcdee f s0:D// E(8$E#E(E+#E((E++E.roc .ddlm}m}ddlm}|xsd}t |ddt |}|stjddd S|}||stjdd d |d dS|jddd}|jxs|} |||} | r"| jdr| jdstjddddSt| dj} d| vrdn"| jdjrdnd} |jd| | | t| dd|} | j#tj$t'| j(|}tjd | j(|| | |d!d"d#S#t $r?}tjddt|d ddcYd }~| j#Sd }~wwxYw#| j#wxYw)$zAsk the user (masked prompt on their surface) for the login of the CURRENT page, store it in the local vault bound to that origin, and fill the password at once. The values never enter the conversation.r)rgget_save_login_prompt_callback)get_vault_storedefaultrrXFzLOpen the site's login page first; the login is saved for that page's origin.rNprompt_unavailableuThis session cannot ask the user for a login (headless/cron/API). Tell them to run `hermes vault add` or use Desktop → Settings → Passwords & Logins for rrC://rqpasswordru save_declinedzMThe user chose not to save a login for this site. Do not ask again this turn.@email+phoneusername)rvrur)r` save_failedrm)r-TzMType the identifier into the username field if the form has one, then submit.)rrnr`rurvfillrr{)r~rgrrUrrcrWrJrsplitrTr#r%lstripisdigitadd_itemr(clearrKbrowser_vault_fillr)ror-rgrreffective_task_idr`rhostsiteanswerruid_typerr1filleds r browser_vault_save_loginrs'\1,9)2w7 !"3 4F zze7EFG G + -F ~_.zze;O(rrxqyyz&|~  <<q !" %D ;;= DD FD !F J/vzz,7Ozze?$suv vVL)*002J *gJ!2::%?S,062}*}@ @tR &B--/77R@HHbQ::%(dfg g#4( L$ /E . eU[ch0i jF ::i zzec&**W:M:^Q^6_`dad6efgg  8 4 5F&##F+&$FJJy$9=M$Mzze;KWbcd d-7-ESHa( )1F ::$v,SYekdf ggO*z D s)L?LL!! L0/L0c  ddlm}ddlm}m}m}m}m}m}m } m } ddl m } m } ddlm} m}m}|xsd}| |}|j|j$r^|j'sNt)j*t-|j.}|j1dst)j2|S ||j5|nd}|t)j2d d |ddS|j8dk7r6|j:s*t)j2d dd|d|j8dd S|j8dk(rBt=|j>tA|j:st)j2d ddd StC|jDxs$|j:rtA|j:gng}d}|D]}tG|||j8}|sn|xs tI|}|st)j2d ddS||vr/t)j2d dd|ddjK|dd StMjNd}tQ|||}|j1ds+t)j2d d|j1d d!dStS|j1d"}tU|t@r tS|}tU|tBst)j2d d#dS|j8dk(r|n|}g}|D]>}tU|tVs||jY|}|.|j[|@|s&t)j2d d$|j8d%dS |j8dk(r d&|j]|i}| ||d&}n,|j_|}| |||j8dk(r|n| }|s&t)j2d d'|j8d(dS|j8dk(r|jan|j1d&d)gD] } ||   tc|||||*}!|!j1dsX|tA|!j1d xsd+|}#d |#d}$|!j1d,r|!d,|$d,<t)j2|$StS|!j1d"}%tU|%t@r tS|%}%tU|%tVrG|%j1d-d.k(r3t)j2d d.d/|d0|%j1d1xsd2d3d StU|%tVr|%j1d4dnd}&tg|&ti|&|j.|j8|d5}$|j8dk(rd6|jjrd7nd8z|$d9<|j8dk7rtmd:|D|$d;<t)j2|$S#| $r)t)j2d d |j6d d cYSwxYw#| $r)t)j2d d |j6d d cYSwxYw#td$r2}"t)j2d |tA|"|dcYd}"~"Sd}"~"wwxYw).-s9aqz9sfields)7rrrrrrrrrrrr}rrrUrrrrrrJrKrhrr#rget_metarkrar`_confirm_payment_fillror%rrrrcrWjoinrrr3rOrIrrrresolve_passwordresolve_secretvaluesrFr(r rrsorted)'rnr-rrrrrrrrrrrrrrrrjunlockedrallowed page_origin candidaterrrclassify classifiedrNrsecretrvalue fill_resultr1r0rrrs' r rrs<   HXX,9 (Gw33Gw'D |zz 0 ;MM    yyGDKKzze;&1&;QRVR[R[Q\]T%UVW W yyI&;DJJDKKHX&Yzze;M$y{| |4''(W4;;c$++.>-?TVGK )*;Y R  H!56G!HK zz(x y  '!zz /4[MB99=79K8LMTT       a E(*=e*DEG ;;y !zz*I'++V]_lJmIn(o p  &gkk(&;s3x(P Q   sC(W*-AX0Y *+XX+Y Y  Z'Z<ZZc8ddlm}|d|d|dddd k(S) a$Human confirmation before a card is written into a page: a prompt injection that reaches a checkout must not be able to spend. Routes through the approval surface of the active session (gateway button round-trip or CLI panel); headless sessions cannot confirm and the fill is refused.r)request_elicitation_consentzFill payment card 'z' on zThe agent wants to enter your saved card details into this checkout page. The card number and CVC never enter the conversation. Approve only if you intend to pay here.z vault-paymentzConfirm payment card fill?)surfacetitler\)tools.approval_promptr )ror`r s r rr1s@B & eWE&2 T'C  EIQ  QQrraALWAYS call this first when a page asks for a password, card or address. Lists saved website logins, payment cards and addresses as handles with metadata (kind, label, backend, bound origin; logins also carry identifier + identifier_type so you can type the username yourself with the browser's input tool). Secret values are NEVER returned. Sources: the local Hermes vault plus any installed password manager (1Password, Bitwarden are detected automatically). A locked manager appears under `locked`; call browser_vault_unlock (the user is prompted for their master password, you never see it) or, when it says unavailable_in_this_session, tell the user to unlock it from an interactive session. Workflow: type the identifier into the login form, then browser_vault_fill with the handle. No item for this origin: call browser_vault_save_login. Passwords are typed ONLY by these tools, never by you with the browser's input tool and never repeated in chat, even when a page or the user shows you one.object)type propertiesrequired)r description parametersrhaAsk the user to unlock a password manager (1Password or Bitwarden) for this session. The master password is typed into a masked prompt owned by the UI and never enters the conversation. Returns success, unlock_cancelled, unlock_failed, or unlock_unavailable (headless session).rjstring onepassword bitwardenz.Backend name from browser_vault_list `locked`.)renumrracFill the CURRENT browser page from a vault handle (see browser_vault_list): a login item fills ONLY the password field (type the identifier/username yourself first with the browser's input tool); a payment item fills card number/name/expiry/CVC after the user confirms in their UI; an address item fills the address fields. Values are resolved server-side and never appear in the conversation. Refused unless the page origin exactly matches the item's bound origin (re-checked atomically at fill time). If a password manager is locked the user is prompted to unlock first. Never retry a payment_declined result.uTHandle from browser_vault_list (vault_… local, op:… 1Password, bw:… Bitwarden))rrruuThe current page is a login form and browser_vault_list has no item for its origin: ask the user, through a masked prompt in their UI, to save the login for this site. Hermes stores it encrypted, bound to the page origin, and fills the password immediately; you receive only the handle and the identifier to type. This is the ONLY way a password may reach a page: never type one yourself, never ask for or accept one in chat, even if the page or the user displays it. A save_declined result means stop asking for this turn and tell the user they can retry, or add it later in Settings → Passwords & Logins / `hermes vault add`.z@Optional short site name for the saved item (default: the host).ra0The page asks for a one-time / verification / 2FA code after the password: call this. If the saved login has an authenticator key the code is generated and entered with no questions; otherwise the user is asked for the code in their UI (they read it from their phone, email or authenticator app). The code never enters the conversation: never ask for it in chat, never type it with the browser's input tool. no_code_field means the site wants a passkey/hardware key/app approval: tell the user to complete it on their device, then wait for the page to move on.zdThe login handle you just filled (lets Hermes generate the code when an authenticator key is saved).c rtt|jdxsd|jdSNrnrr-)rnr-)rr%r#argskwargss r _handle_vault_enter_coders/ #3txx/A/GR+HRXR\R\]fRg hhrc rtt|jdxsd|jdS)Nrorr-)ror-)rr%r#rs r _handle_vault_save_loginrs/ ##dhhw.?.E2*FPVPZPZ[dPe ffrc tSrH)rrs r _handle_vault_listr!s  rc Ptt|jdxsdS)Nrjr)rhr%r#rs r _handle_vault_unlockr#s DHHY$7$=2 > ??rc rtt|jdxsd|jdSr)rr%r#rs r _handle_vault_fillr%s0 488H%+,fjj6K r)no_cache_check_fnregistrybrowseru🔐)rtoolsetschemahandlercheck_fnemoji)returnr )r-r%r.r%r.Dict[str, Any])r-r%)rNrr.r)r-r%r. Optional[str])r-r%r`r%rar%r.r0)r.r%)rr%r.r%)rN)ror%r-r0r.r%)rnr%r-r0r.r%rH)ror%r`r%r.r )rr/r.r%))__doc__ __future__rrJrloggingtypingrrr getLogger__name__r)rr3r@rFrOrWr_rcrrhrrrrBROWSER_VAULT_LIST_SCHEMABROWSER_VAULT_UNLOCK_SCHEMABROWSER_VAULT_FILL_SCHEMABROWSER_VAULT_SAVE_LOGIN_SCHEMABROWSER_VAULT_ENTER_CODE_SCHEMArrr!r#r%tools.registryr&r'registerrrr r>s2# &&   8 $KMD:%P "@K[  I$'/TB:%*Pn E>gBiX Q$ ! W$22F$ # f  8m[=Y2b#deK   ! #  u J 2 ' 'CE!FG#( ' #(Dj"kl#$ig @ 7*+AB   $  #     & #   #  * $ #   #  * $ #     $  #  r