߲j;7dZddlmZddlZddlZddlZej dZdZdZ dZ dd hZ e hd Z dd Z dd Zddd ZddZe dZddZddZddZddZd dZd!dZd"dZy)#aEgress-proxy (iron-proxy) plumbing for the Docker backend. Builds the mount/env/host args that route a sandbox through the host-side credential firewall, and guards the three config surfaces (docker_forward_env, docker_env, docker_extra_args) that could otherwise weaken or bypass it. ) annotationsNztools.environments.dockerz hermes-egressz#/etc/ssl/certs/hermes-egress-ca.crt"_HERMES_EGRESS_NODE_OPTIONS_APPEND--use-openssl-caz--use-bundled-ca> NO_PROXYno_proxy HTTP_PROXY http_proxy HTTPS_PROXY https_proxy SSL_CERT_FILECURL_CA_BUNDLEREQUESTS_CA_BUNDLENODE_EXTRA_CA_CERTSc ddlm}ddlm}|jdxsi}|jdsgigfS|j}t|jdd d)fd }|js|d S|jr |js|d |jd S|j|jjs|d|jdS|j!}|s|dSd|jdt"dg}d|j}d|jdz} d|d|d| d| dddddt"dt"dt"d t"d!d"t$d#i } |D]\} | j&| | j(<| j&| d$| j(<t+| d%d&xsd&D]} | j&| | <^d'd(g} || | fS#t$r%}t j d|gigfcYd}~Sd}~wwxYw)*u``(volume_args, env_overrides, host_args)`` for routing through iron-proxy; all empty when the proxy is disabled/unconfigured/not running. Under ``proxy.enforce_on_docker`` (default) any half-configured state raises so the sandbox refuses to start unprotected; otherwise it warns and continues. Only ImportError is swallowed — a broken config must fail visibly rather than silently disable enforcement.r load_config iron_proxyz%Egress proxy plumbing unavailable: %sNproxyenabledenforce_on_dockerTcTr t|tjd|gigfS)Nu:%s — continuing without proxy (enforce_on_docker=false). RuntimeErrorloggerwarning)msgenforces E/home/ubuntu/.hermes/hermes-agent/tools/environments/docker_egress.py _degradedz0_egress_proxy_args_for_docker.._degraded1s- s# #SUXYB|zvproxy.enabled is true but iron-proxy is not configured. Run `hermes egress setup` to mint tokens and write proxy.yaml.z.iron-proxy is enabled but not running on port z&. Start it with `hermes egress start`.z!iron-proxy CA cert vanished from z0. Re-run `hermes egress setup` to regenerate it.ziron-proxy is configured but mappings.json is empty or corrupt. Re-run `hermes egress setup` to mint provider tokens before starting a sandbox.z-v:z:rozhttp://host.docker.internal:r r rr rz127.0.0.1,localhost,::1rrr r rHERMES_EGRESS_PROXY1rHERMES_PROXY_TOKEN_alias_env_namesz --add-hostz!host.docker.internal:host-gateway)rstr)hermes_cli.configragent.proxy_sourcesr ImportErrorrdebugget get_statusbool configuredpid listening tunnel_port ca_cert_pathexists load_mappings _CONTAINER_CA_NODE_OPTIONS_SENTINEL proxy_token real_env_namegetattr)ripexc proxy_cfgstatusr mappings volume_args proxy_urlplain_http_url env_overridesmalias host_argsrs @r_egress_proxy_args_for_dockerrIsq 18  !!'*0bI == #B| ]]_F9==!4d; > !H  01 1 F//0-DEK/v/A/A.BCI3F4F4F4J3KLN yynn-- m-}s 2%%4M,1)* aoo&AB +AOO+<=>Q 126<" 1E#$==M%  11BCI  22W  >'..1 2 < < >s CCr!c ddlm}t|jdxsijd|S#tt f$r|cYSt $r"}tjd||cYd}~Sd}~wwxYw)zIRead proxy.enforce_on_docker; any config failure fails safe to *default*.rrrrz:Could not read proxy config for egress collision check: %sN) r*rr0r.r,OSError Exceptionrr)defaultrr>s r_egress_enforce_on_dockerr\sm1[]&&w/52::;NPWXYY  ! SUXYs!8;A8A8A3-A83A8c@ttdhzt|zS)awEnv names that would weaken or bypass enforced egress if overridden. Every name the egress layer writes is critical: mapped tokens land under arbitrary ``real_env_name``/``alias_env_names`` entries from mappings.json, so a suffix heuristic would silently unprotect any mapped credential not ending in ``_API_KEY``/``_TOKEN`` (e.g. ``AWS_SECRET_ACCESS_KEY``). NODE_OPTIONS)set_PROXY_CONTROL_ENV)rEs r_critical_egress_env_namesras" ! "n%5 5M8J JJr!ditPqc0|jdr&|jd\}}}|dvr |dd|r|fSdfSy|jdsyt|ddD]<\}}|tvr|dk(r(||dzd}|jdr|dd}d |xsdfcSyy) a ``("env"|"env-file", inline_value)`` when ``arg`` spells a docker env flag under pflag parsing, else ``None``. ``inline_value`` is the joined value (``--env=N=v``, ``-eN=v``) or ``None`` when the flag consumes the next arg (``-e``, ``--env``, ``-ite``).--=)z--env --env-fileN-r#eenv) startswith partition enumerate_DOCKER_RUN_BOOL_SHORTHANDS)argflagsepinlineposchrests r_env_flag_valuervs  ~~dMM#.c6 * *8sV4 44 4 >># SW%R , ,  9sQwx=Ds#ABx$,$& & r!c2|Dchc]}|j}}g}d}|t|kr||}|dk(rnt|}|}|\}} |dk(r|jdnW| | n|dzt|kr||dznd} | j ddd} | j|vr|j| || dndz }|j ddd vr|j||dz }|t|krt t|Scc}w) zCReturn docker_extra_args entries that can override egress controls.rrdzenv-filerfr#rerg)z --networkz--net)upperlenrvappendsplitrlsortedr_) extra_argscritical_namesncritical_folded collisionsiroparsedkind inline_valuevaluenames r_extra_args_egress_collisionsrs9 +99Qqwwy9O9J A c*o m $;  %  !' D,z!!!,/(4(@ )*QZ)@Jq1u%b{{3*1-::z/check_forward_env_collisions..sOa!'')2NOs""z@docker_forward_env would inject real egress-protected variables zgRemove these names from docker_forward_env or disable enforce_on_docker to opt out of egress isolation.z?Explicit docker_forward_env values will override egress tokens.rrr)ryr}r) forward_envcriticalrrrrs @rcheck_forward_env_collisionsrsV+33Qqwwy3OO;OOJNzl [5Y  [4sA ct ddlm}|jDchc]}|jc}d fd t fdtzD}|rtd||ddy y cc}w#t $rYIwxYw) zReject docker_env overrides of proxy-control vars or real provider keys (read from the live token mappings; for those ANY override collides since a real key bypasses the swap).rrcZ|vry|vr|vxs ||k7S|vxr ||k7S)NFr()r egress_env provider_keysuser_envs r _collidesz.check_docker_env_collisions.._collidessO H  J&F(1+A*F FJ?8A;*Q-#??r!c34K|]}|s |ywrr()rrrs rrz.check_docker_env_collisions..sXa9UV<Xs z;docker_env in config.yaml overrides egress-proxy variables z^Remove these keys from docker_env or disable enforce_on_docker to opt out of egress isolation.zTFalling back to docker_env values; sandbox traffic will NOT route through the proxy.rN)rr)returnr0) r_r+rr7r;rZr}r`r)rrrr=rFrrrs`` @@rcheck_docker_env_collisionsrs"eM 8242B2B2DEQE @X$6$FXXJI* V*-  .F    s!A<A7A<7A<< BBcFt||}|rtd||ddyy)Nz7docker_extra_args would override egress-proxy controls zNRemove these args or disable enforce_on_docker to opt out of egress isolation.z.Extra Docker args may bypass egress isolation.r)rr)r~rrrs rcheck_extra_args_collisionsr s2.z8DJEj\ RcH  Jr!c|r|ri||ni||}|jtd}|r|j}|jddj }|t vrT|Dcgc]}|t vs ||k7s|}}|rt jd|||Dcgc]}|t vs||k(s|}}||vr|j|dj|j|d<|ds|jdd|Scc}wcc}w)aMerge docker_env with egress overrides (egress wins under enforcement, docker_env otherwise) and resolve the NODE_OPTIONS sentinel: the flag is APPENDED to the operator's NODE_OPTIONS after stripping conflicting CA-mode flags so it wins deterministically.Nr^rxzOverriding conflicting NODE_OPTIONS CA-mode flag(s) %s with egress-required %s to keep Node routed through the egress CA store. ) popr9stripr.r|_CA_MODE_FLAGSrrr{join) rrrmerged raw_append append_tokentokenstdroppeds rmerge_egress_envrs,3z ' 'J 'Ga*GaX`GaF2D9J!'') NB/557 > )"(VQA,?ADUqVGV'(/?"(XA1N+Bars#    6 7#5 =$&89 T3nDD+9DFODTWD K(06#D/ [.8Jr!