߲j>UdZddlZdZedhZehdZdefdZeZdede fd Z d Z dede fd Z de fd Z dede fd ZdZdede fdZdZdede fdZdedefdZdefdZehdZeeed<y)a Secret-scrub policy for Hermes child processes: pure data + predicates for which env names are Hermes-managed credentials. The env *builders* applying it (``_make_run_env``, ``_sanitize_subprocess_env``, ``hermes_subprocess_env``) live in ``tools.environments.local``.N_HERMES_FORCE_AWS_BEARER_TOKEN_BEDROCK>EGH_TOKENHASS_URL LLM_MODEL HASS_TOKEN XAI_API_KEY GROQ_API_KEY VERCEL_TOKEN EMAIL_ADDRESS GITHUB_APP_ID OPENAI_ORG_ID WHATSAPP_MODECOHERE_API_KEYEMAIL_PASSWORDGOOGLE_API_KEYMODAL_TOKEN_IDOPENAI_API_KEYSIGNAL_ACCOUNTVERCEL_TEAM_IDANTHROPIC_TOKENDAYTONA_API_KEYEMAIL_IMAP_HOSTEMAIL_SMTP_HOSTMISTRAL_API_KEYOPENAI_API_BASEOPENAI_BASE_URLSIGNAL_HTTP_URLDEEPSEEK_API_KEYGATEWAY_RELAY_IDHELICONE_API_KEYPARALLEL_API_KEYTOGETHER_API_KEYWHATSAPP_ENABLEDANTHROPIC_API_KEYFIRECRAWL_API_KEYFIRECRAWL_API_URLFIREWORKS_API_KEYVERCEL_OIDC_TOKENVERCEL_PROJECT_IDANTHROPIC_BASE_URLEMAIL_HOME_ADDRESSMODAL_TOKEN_SECRETOPENROUTER_API_KEYPERPLEXITY_API_KEYSLACK_HOME_CHANNELDISCORD_AUTO_THREADOPENAI_ORGANIZATIONSIGNAL_HOME_CHANNELSLACK_ALLOWED_USERSDISCORD_HOME_CHANNELGATEWAY_RELAY_SECRETSIGNAL_ALLOWED_USERSGATEWAY_ALLOWED_USERSSIGNAL_IGNORE_STORIESTELEGRAM_HOME_CHANNELWHATSAPP_ALLOWED_USERSDISCORD_REQUIRE_MENTIONEMAIL_HOME_ADDRESS_NAMESLACK_HOME_CHANNEL_NAMEVERTEX_CREDENTIALS_PATHSIGNAL_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNEL_NAMEGATEWAY_RELAY_DELIVERY_KEYGITHUB_APP_INSTALLATION_IDSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_HOME_CHANNEL_NAMEGITHUB_APP_PRIVATE_KEY_PATHDISCORD_FREE_RESPONSE_CHANNELSGOOGLE_APPLICATION_CREDENTIALSHERMES_DASHBOARD_SESSION_TOKENreturncXtt} ddlm}|j D]i}|j |j |jdk(r|j t|jsO|j|jk ddl m }|jD]C\}}|jd}|dvs|dk(s!|jds3|j|E |j!d t#|S#t$rYwxYw#t$rY6wxYw) z=Derive the blocklist from provider, tool, and gateway config.r)PROVIDER_REGISTRYaws_sdk)OPTIONAL_ENV_VARScategory>tool messagingsettingpasswordCLAUDE_CODE_OAUTH_TOKEN)set_STATIC_PROVIDER_ENV_BLOCKLISThermes_cli.authrLvaluesupdateapi_key_env_vars auth_type_AWS_SDK_CREDENTIAL_ENV_VARSbase_url_env_varadd ImportErrorhermes_cli.configrNitemsgetdiscard frozenset)blockedrLpconfigrNnamemetadatarOs H/home/ubuntu/.hermes/hermes-agent/tools/environments/local_env_policy.py_build_provider_env_blocklistrj,s:;G  5(//1 6G NN733 4  I-;<'' G445  6 7/557 "ND(||J/H00 )hll:.F D!  "" OO-. W 1        s6A$D6D6D DD DD D)(D)rgcB|tvxs|jtvS)aP``name`` is a blocklisted provider/tool credential, matched the way the platform's environment resolves names: exact plus case-folded. On Windows the environment block is case-insensitive, so ``openai_api_key`` IS ``OPENAI_API_KEY``; consistent with ``_is_hermes_internal_secret``, which already folds (``key.upper()``).)_HERMES_PROVIDER_ENV_BLOCKLISTupperrgs ri_is_provider_env_blocklistedroUs& 2 2 >zz|==?)BUZZ_cH|jjtS)umPure name check (``BUZZ_*``), regardless of session context — the snapshot exclusion must stay conservative even when the carve-out is inactive. Case-folded: on Windows the env block is case-insensitive, so a lowercase-stored ``buzz_private_key`` IS the credential; it needs the carve-out (and the snapshot exclusion) just like the canonical name.)rm startswith"_TERMINAL_FIRST_PARTY_ENV_PREFIXESrns ri$_matches_terminal_first_party_prefixrus ::< " "#E FFrpctjjdry ddlm}|ddj j dk(S#t$rYywxYw) uTrue when this process/session operates as a Buzz agent: ``BUZZ_MANAGED_AGENT`` in the process env (set only by Buzz Desktop's buzz-acp harness), or the live session's platform is ``buzz`` via the gateway ContextVar — authoritative under a concurrent multi-session host, so a sibling Telegram session resolves its OWN platform. Gateway / CLI / cron / kanban processes never carry it. See #76243. BUZZ_MANAGED_AGENTTrget_session_envHERMES_SESSION_PLATFORMbuzzF)osenvironrbgateway.session_contextrystriplower Exceptionrxs ri_buzz_terminal_context_activersX zz~~*+;8"=CCEKKMQWWW s-A AAc0t|xr tS)z``name`` is a first-party platform credential (``BUZZ_*``) AND the current process/session context entitles it to reach terminal children.)rurrns ri_is_terminal_first_party_envrs 0 5 Y:W:YYrp) VIRTUAL_ENV CONDA_PREFIX PYTHONHOMEkeyc|j}|jdr|jdry|jdxr|jdS)aTrue for Hermes-internal secrets injected under *dynamic* names the static blocklist cannot enumerate: ``AUXILIARY__API_KEY``/``_BASE_URL`` (per-task side-LLM credentials) and ``GATEWAY_RELAY_*_SECRET``/``_KEY``/``_TOKEN`` (relay auth; non-secret routing hints stay visible). Stripped on every spawn path regardless of env_passthrough registration or ``inherit_credentials``. AUXILIARY_)_API_KEY _BASE_URLTGATEWAY_RELAY_)_SECRET_KEY_TOKEN)rmrsendswith)rrms ri_is_hermes_internal_secretrsM IIKE  %%..9R*S   , - _%..A^2__rp) _ALLOWED_ _ALLOW_ALL_ _ALLOW_FROM _ALLOW_BOTS_ALLOW_PUBLIC__IGNORED_CHANNELS_NO_THREAD_CHANNELS_FREE_RESPONSE_CHANNELS_BACKFILL_CHANNELS_GROUP_ALLOWEDc|jjdsjdrytfdtDS)uTrue for a platform authorization gate (``DISCORD_ALLOWED_CHANNELS``, ``TELEGRAM_ALLOW_ALL_USERS``, ``GATEWAY_ALLOWED_USERS``, ``WHATSAPP_GROUP_ALLOW_FROM`` ...) — profile-scoped policy a child acting for ANOTHER profile must never inherit.HERMES__Fc3&K|]}|v yw)N).0markerrms ri z&is_profile_gate_env..sG6vGs)rmrsany_PROFILE_GATE_ENV_MARKERS)rgrms @riis_profile_gate_envrs@ JJLE  "e&6&6s&; G-FG GGrpenvcX|Dcgc]}t|s|c}D]}||=|Scc}w)zTDrop every authorization gate from *env* in place (see :func:`is_profile_gate_env`).)r)rkrs ristrip_profile_gate_envrs59a"5a"89 H J:s''cP ddlm}|S#t$r tcYSwxYw)zCredential env keys owned by plugin-registered terminal backends (Tier-1: stripped from every spawned subprocess). Computed at call time because plugins register after import; fail-soft to empty.rplugin_strip_env_keys)agent.terminal_env_registryrrrdrs ri_plugin_terminal_env_strip_keysrs*E$&& {s %%>rr GITHUB_TOKENr rrrSLACK_APP_TOKENSLACK_BOT_TOKENr DISCORD_BOT_TOKENr-TELEGRAM_BOT_TOKENr6SLACK_SIGNING_SECRETr8GATEWAY_ALLOW_ALL_USERSrBrCrFrI_ALWAYS_STRIP_KEYS)__doc__r}!_HERMES_PROVIDER_ENV_FORCE_PREFIXrdr\rVrjrlstrboolrortrurr_ACTIVE_VENV_MARKER_VARSrrrdictrrr__annotations__rrprirsb %5! )*D)EF!*,"6#y#L"?!@?s?t?Z&0"GsGtGt$ZsZtZ,I `C `D `( HcHdH  &/0&IcNrp