Ë
    ãß²j-  ã                  ó¨   — d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
 ddlmZmZ dd„Zdef	 	 	 dd	„Zdd
„Zdd„Zdddœ	 dd„Zddd„Zdd„Zy)zYHelpers shared by the non-local terminal backends (docker, ssh, singularity, cloud SDKs).é    )ÚannotationsN)ÚCallableÚIterable)Ú_SHELL_ENV_NAME_RE)Ú_is_hermes_internal_secretÚ_is_provider_env_blocklistedc                 óH   — 	 ddl m}   | «       xs i S # t        $ r i cY S w xY w)uW   ``~/.hermes/.env`` values, or ``{}`` â€” a broken .env must not fail command execution.r   ©Úload_env)Úhermes_cli.configr   Ú	Exceptionr
   s    úE/home/ubuntu/.hermes/hermes-agent/tools/environments/remote_common.pyÚload_hermes_env_varsr      s+   € ðÝ.Ù‹zÒ˜RÐøÜò ØŠ	ðús   ‚ “! !© c                ó^  — t        «       }d}d}d„ }	 ddlm}m} ddlm}m}  |«       }t         |«       «      }|D �ch c]  }t        |«      rŒ|’Œ }	}t        | «      |	D �ch c]  }t        |«      rŒ|’Œ c}z  }
|
r |«       ni }i }t        «       }t        |
«      D ]p  }t        j                  |«      xs |j                  |«      }|�	 |||«      }|�|||<   Œ>|sŒA ||«      rŒJt        j                  |«      sŒ`|j!                  |«       Œr ||fS # t        $ r Y Œçw xY wc c}w c c}w )aK  Values to forward into a remote shell plus the scoped names that must be unset there.

    Implicit passthrough (skill ``required_environment_variables`` + ``terminal.env_passthrough``)
    is filtered through the Hermes provider-credential blocklist and the dynamic internal-secret
    check; ``explicit_forward`` entries (docker_forward_env) are an operator opt-in that bypasses
    both. Each value is the routed profile's secret when multiplex is active; a name the active
    scope lacks is returned in the unset set so a shared sandbox cannot leak another profile's
    value.
    NFc                 ó   — y)NFr   )Ú_names    r   ú<lambda>z)resolve_passthrough_env.<locals>.<lambda>&   s   � ó    r   )Úget_all_passthroughÚresolve_passthrough_value)Ú_is_global_envÚis_multiplex_active)ÚsetÚtools.env_passthroughr   r   Úagent.secret_scoper   r   r   r   r   ÚsortedÚosÚgetenvÚgetr   Ú	fullmatchÚadd)Úexplicit_forwardÚhermes_env_loaderÚpassthrough_keysr   Úmultiplex_activeÚis_global_envr   r   ÚkÚimplicit_forwardÚforward_keysÚ
hermes_envÚexec_envÚunset_namesÚkeyÚvalues                   r   Úresolve_passthrough_envr0      sD  € ô "%£ÐØ $ÐØÐÙ'€MðßXß[Ù.Ó0ÐÜÑ2Ó4Ó5Ðð $4ÖY˜aÔ;UÐVWÕ;XšÐYÐÐYÜÐ'Ó(Ø#ö,LØÔ+GÈÕ+JŠò,Lñ L€Lá(4Ñ"Ô$¸"€JØ!€HÜ›E€KÜ�lÓ#ò !ˆÜ—	‘	˜#“Ò5 *§.¡.°Ó"5ˆØ$Ð0Ù-¨c°5Ó9ˆEØÐØ!ˆH�SŠMÚ¡m°CÕ&8Ô=O×=YÑ=YÐZ]Õ=^Ø�O‰O˜CÕ ð!ð �[Ð Ð øô! ò ÙðüâYùò,Ls(   “'D ¾D%ÁD%Á#D*Á4D*Ä	D"Ä!D"c                ó\   — t        |«      }|s| S ddj                  d„ |D «       «      › d| › �S )z_Prefix ``cmd_string`` with ``unset`` of the profile-scoped names the remote shell must not see.zunset Ú c              3  óF   K  — | ]  }t        j                  |«      –— Œ y ­w)N)ÚshlexÚquote)Ú.0Úns     r   ú	<genexpr>z prepend_unset.<locals>.<genexpr>D   s   è ø€ Ò;°œUŸ[™[¨Ÿ^Ñ;ùs   ‚!z 2>/dev/null || true
)r   Újoin)Ú
cmd_stringÚnamess     r   Úprepend_unsetr<   ?   s:   € ä�5‹M€EÙØÐØ�C—H‘HÑ;°UÔ;Ó;Ð<Ð<RÐS]ÐR^Ð_Ð_r   c                ó2   — | ri t         j                  ¥| ¥S dS )z¶Env for the docker/ssh CLIENT subprocess: forwarded values travel here (owner-readable
    /proc/*/environ) while the argv carries names only; ``None`` = inherit when nothing to add.N)r   Úenviron)Úvaluess    r   Úclient_env_withr@   G   s    € ñ (.Ð#Œb�j‰jÐ#˜FÐ#Ð7°4Ð7r   F)ÚcheckÚenvc               óZ   — t        j                  | dddd||t         j                  |¬«	      S )z½``subprocess.run`` with the backend-standard capture settings: text mode with utf-8/replace
    decoding and stdin closed (DEVNULL) so a CLI that unexpectedly prompts cannot hang the agent.Tzutf-8Úreplace)Úcapture_outputÚtextÚencodingÚerrorsÚtimeoutrA   ÚstdinrB   )Ú
subprocessÚrunÚDEVNULL)ÚcmdrI   rA   rB   s       r   Úrun_capturerO   M   s1   € ô �>‰>Ø˜D t°gÀiØ˜u¬J×,>Ñ,>ÀCôIð Ir   c                ó   — |rddd| gS dd| gS )zF``bash [-l] -c <cmd>`` argv tail used by every spawn-per-call backend.Úbashz-lz-cr   )r:   Úlogins     r   Ú	bash_argvrS   V   s   € á/4ˆF�D˜$ 
Ð+ÐT¸6À4ÈÐ:TÐTr   c                ó„   — 	 ddl m}  || d¬«       y# t        $ r Y yt        $ r}t        t	        |«      «      ‚d}~ww xY w)zÜLazy-install an optional SDK via ``tools.lazy_deps`` (idempotent). Missing ``tools.lazy_deps``
    is tolerated (the SDK import that follows fails with its own message); any other failure
    surfaces as ``ImportError``.r   )ÚensureF)ÚpromptN)Útools.lazy_depsrU   ÚImportErrorr   Ústr)ÚfeatureÚ_lazy_ensureÚes      r   Úensure_lazy_depr]   [   s>   € ð"Ý:Ù�W UÖ+øÜò ÙÜò "Üœ#˜a›&Ó!Ð!ûð"ús   ‚ “	?ž?¦:º?)Úreturnúdict[str, str])r#   úIterable[str]r$   zCallable[[], dict[str, str]]r^   ztuple[dict[str, str], set[str]])r:   rY   r;   r`   r^   rY   )r?   r_   r^   zdict[str, str] | None)
rN   ú	list[str]rI   ÚfloatrA   ÚboolrB   zdict | Noner^   zsubprocess.CompletedProcess)F)r:   rY   rR   rc   r^   ra   )rZ   rY   r^   ÚNone)Ú__doc__Ú
__future__r   r   r4   rK   Útypingr   r   Ú#tools.environments.base_session_envr   Ú#tools.environments.local_env_policyr   r   r   r0   r<   r@   rO   rS   r]   r   r   r   ú<module>rj      sp   ðÙ _å "ã 	Û Û ß %å Bß hóð ?AØNbð%!Ø/Kð%!à!@ó%!óP`ó8ð BGÐ[_ñ IØ0óIôUô

"r   