+ iHjW,Rt^RIHt^RIt^RIt^RIt^RIHt^RIH t ^RI H t H t H t HtHt^RIHt^RIHt.ROtR R lt]!R R44tRRRlltRRltRRlt]!R4t!RR ] ],4t!RR ] ],4tR#)aShared cache substrate for external secret-source backends. Two-layer fetch cache (in-process + on-disk); the disk half writes atomically with ``0600`` permissions and honours a TTL, so that logic is audited in exactly one place. Each backend supplies only its cache-key shape and a serializer. The disk layer is strictly best-effort: a miss just triggers a refetch, because a cache problem must never block Hermes startup. ) annotationsN) dataclass)Path)CallableDictGenericOptionalTypeVar)secure_parent_dir)atomic_json_write CachedFetch DiskCache SecretCachec V^8dQhRRRR/#)materialstrreturn)formats"@/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/_cache.py __annotate__r!sEE#E#Ecv\P!VPR44P4R,#)uESHA-256 prefix used as a cache key — never logged, never displayed.zutf-8:NN)hashlibsha256encode hexdigest)rs&r fingerprintr!s( >>(//'2 3 = = ? DDrc<]tRt^&t$RtR]R&R]R&RRltRtR #) r z;A set of fetched secret values plus when they were fetched.zdict[str, str]secretsfloat fetched_atc V^8dQhRRRR/#)r ttl_secondsr"rboolr)rs"rrCachedFetch.__annotate__-sQQEQdQrc nV^8;'d*\P!4VP, V8#))timer#)selfr%s&&ris_freshCachedFetch.is_fresh-s(QPPDIIK$//$A[#PPrrN)__name__ __module__ __qualname____firstlineno____doc____annotations__r,__static_attributes__rrrr r &sE QQrc V^8dQhRRRR/#r home_pathOptional[Path]rrr)rs"rrr1s.Drc(Vf^RIHpV!4pV#)z[``home_path`` as resolved by ``load_hermes_dotenv()``, else ``$HERMES_HOME``/``~/.hermes``.)get_hermes_home)hermes_constantsr:)r7r:s& rresolve_cache_homer<1s4#% rc V^8dQhRRRR/#)rpayloadobjectrOptional[CachedFetch]r)rs"rrr:s D D D+@ Drc\V\4'gR#VPR4VPR4r!\V\4'd\V\\34'gR#VP 4UUu/uF7wr4\V\ 4'gK\V\ 4'gK5W4bK9 ppp\V\ V4R7#uuppi)u``{"secrets": {...}, "fetched_at": n}`` → :class:`CachedFetch`, or None if malformed. Only str→str pairs survive (JSON permits other types; env vars need strings). Nr!r#)r!r#) isinstancedictgetintr"itemsrr )r>r!r#kvtypeds& rentry_from_payloadrJ:s gt $ $!++i0'++l2KZ gt $ $JzC<,P,P%mmo [odaAs1CT STVYHZTQToE [ uz1B CC \sC C8Cc$V^8dQhRRRRRR/#)rpathrr>rCrNoner)rs"rrrHs!>>D>4>D>rch^RIHpV!VP4\V4\ WRRR7R#)zSecret cache entry at 0600 from creation; the containing dir is tightened to 0700 (``secure_parent_dir`` refuses ``/``, top-level dirs and the install tree). Raises ``OSError`` on failure; callers decide whether that is best-effort.)mkdir_under_hermes_homeNi)indentmode)r;rOparentr r )rLr>rOs&& ratomic_write_jsonrSHs'9DKK(ddDu=rKcf]tRt^VtRtRRltRRRlltRRRlltRR R lltRR R llt R t R#)r uBest-effort, profile-aware on-disk cache for fetched secret values. One JSON object per backend at ``/cache/``:: {"key": "", "secrets": {...}, "fetched_at": 1.0} The file holds only secret *values*, never raw auth material — backends fingerprint tokens/sessions before they reach ``key_serializer``. Both ``read`` and ``write`` short-circuit when ``ttl_seconds <= 0``, so a TTL of zero disables both layers symmetrically: an opted-out user never gets secret values written to disk at all. c$V^8dQhRRRRRR/#rbasenamerkey_serializerzCallable[[K], str]rrMr)rs"rrDiskCache.__annotate__ds#...9K.PT.rc WnW nR#N _basename_key_serializerr+rXrYs&&$r__init__DiskCache.__init__ds !-rNc V^8dQhRRRR/#r6r)rs"rrrZhsHHnHHrc H\V4R, VP, #)cache)r<r^r+r7s&&rrLDiskCache.pathhs!),w6GGrc(V^8dQhRRRRRRRR/#) rkeyrTr%r"r7r8rr@r)rs"rrrZks/ T T T T. TTi Trc V^8:dR#\VPV4RRR7;_uu_4p\P!V4pRRR4\ X\4'd&TPR4TPT48wdR#\T4pTeTPT4'dT#R# +'giLw;i \\P 3dR#i;i)zEFresh cached entry for ``key``, or None (I/O error, mismatch, stale).Nrz utf-8-sig)encodingri) openrLjsonloadOSErrorJSONDecodeErrorrBrCrDr_rJr,)r+rir%r7fr>entrys&&&& rreadDiskCache.readks !  dii *C+FF!))A,G'4((GKK,>$BVBVWZB[,["7+)enn[.I.IuStSGF--.  s.%C B6C 6 C C C C('C(c ,V^8dQhRRRRRRRRR R /# rrirTrsr r%r"r7r8rrMr)rs"rrrZys0;U~imrc V^8:dR#RVPV4RVPRVP/p\VP V4V4R# \ dR#i;i)z[Persist ``entry`` atomically at mode 0600; no-op when ``ttl_seconds <= 0`` or on I/O error.Nrir!r#)r_r!r#rSrLrp)r+rirsr%r7r>s&&&&& rwriteDiskCache.writeys_ !  $..s3Y |]b]m]mn  dii 2G <   sA A"!A"c V^8dQhRRRR/#rr7r8rrMr)rs"rrrZs~rc vVPV4P4R# \\3dR#i;i)z6Delete the on-disk cache file if present (idempotent).N)rLunlinkFileNotFoundErrorrprfs&&rclearDiskCache.clears3  IIi ' ' )!7+   s #88r]r\) r.r/r0r1r2rarLrtryrr4rrrr r Vs' .H TrcV]tRt^tRtRRltR RRlltR RRlltR R R lltR t R#)rzTwo-layer cache: in-process dict (L1) over a :class:`DiskCache` (L2). L1 saves repeated fetches WITHIN one process (CLI startup, gateway hot-reload); L2 saves them ACROSS back-to-back short-lived processes. c$V^8dQhRRRRRR/#rWr)rs"rrSecretCache.__annotate__s(UUU9KUPTUrc 6/Vn\WR7VnR#))rYN)memoryr diskr`s&&$rraSecretCache.__init__s,. "+H"T rNc ,V^8dQhRRRRRRRRR R /#) rrirTr%r"r7r8 read_diskz-Optional[Callable[[], Optional[CachedFetch]]]rr@r)rs"rrrs1  ! % N G Sh rc VPPV4pV'dVPV4'dV#V'dV!4MVPP WV4pVeW`PV&V#)zFresh entry from L1, else from L2 (promoted into L1), else None. ``read_disk`` swaps in an alternative L2 reader (e.g. an encrypted file). )rrDr,rrt)r+rir%r7rcached disk_cacheds&&&&& rlookupSecretCache.lookups_ % fook22M%.ikDIINN3U^4_  "*KK rc ,V^8dQhRRRRRRRRR R /#rwr)rs"rrrs0<<<;rs# !==.# E  QQ Q D> CL2 2j#'!*#r