+ iHj(Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t Ht^RIHtHtHtHtHtRR.tRtRt]P0!R 4tR R ltR R ltRRltRRltRRlt!RR]4tR#)uz``command`` secret source — resolve secrets via a user-configured helper. Ports the desktop app's TypeScript ``CommandSecretsProvider`` semantics. The helper (``keepassxc-cli``, ``secret-tool``, a script that cats a tmpfs env file, ...) comes from ``secrets.command`` in ``config.yaml`` — NEVER from ``.env``, which holds only secret values. Security model: the command string is the USER'S OWN configuration, so it runs via ``/bin/sh -c``; the requested key reaches the child ONLY via ``HERMES_SECRET_KEY`` (never interpolated, so a hostile key name is inert); hard timeout (default 3s) + 1 MiB output cap, every failure degrades to "no value"; failure logs carry ONLY structured fields (exit code / signal / errno), never the command, the helper's stderr (captured and DISCARDED) or any value; startup runs the helper exactly ONCE with an empty key; POSIX-only (needs ``/bin/sh``). ) annotationsN)Path)DictOptional) ErrorKind FetchResult SecretSource coerce_floatsource_child_envrunquote_dotenv_valueg@z^([A-Za-z_][A-Za-z0-9_]*)=(.*)$cV^8dQhRR/#)returnbool)formats"A/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/command.py __annotate__r)s==T=ch\PR8H;'g\P!4R8H#)ntWindows)osnameplatformsystemrrr _is_windowsr)s$ 77d? < = 2 so a lone ``"`` stays intact while ``""``/``''`` correctly yield an empty string. z"')striplen)r(ts& rr r 1sB A 1v{qtqu}12w Hrc ,V^8dQhRRRRRRRRRR /#) r commandr secret_keytimeout_secondsfloatmax_output_bytesintrz Optional[str]r)rs"rrr=s19:9:9:#9:9:Y\9:an9:rc \4'd\R4R#\4pWR&\P!RRV.V\P \P \P RR7pTPTR 7wrxTP*^8wdi\-TP*4RrTP*^8d/\P.!TP*)4P0p Rp \RT RT 24R#\3T4T8d\RT R24R#TP5RRR7# \d$p\RTP 24Rp?R#Rp?ii;i \Pd\P!\P!TP4\P 4M, \"\$\3dTP'4Mi;iTPR R 7M& \P\(\3dMi;i\R TR R 24R#i;i \(d\-TP*)4p ELui;i)uRun the helper via ``/bin/sh -c`` and return its stdout, or None. The key travels as DATA in ``HERMES_SECRET_KEY``. stdout/stderr are piped (never inherited); stderr is discarded. Any failure logs structured fields only and returns None — never raises. zSthe 'command' provider is POSIX-only (needs /bin/sh); resolving no value on WindowsNHERMES_SECRET_KEYz/bin/shz-cT)envstdinstdoutr%start_new_sessionz2helper failed to spawn; resolving no value: errno=)timeoutg?zhelper timed out after gzs; resolving no valuenone?z(helper failed; resolving no value: code=z signal=zhelper output exceeded the z-byte cap; resolving no valuezutf-8replace)errors)rr&r subprocessPopenDEVNULLPIPEOSErrorerrno communicateTimeoutExpiredrkillpggetpgidpid_signalSIGKILLProcessLookupErrorPermissionErrorkill ValueError returncoderSignalsrr,decode) r/r0r1r3r7procexc stdout_bytes_stderr_discardedcodesignames &&&& r _run_helperr[=s}} bc  C) g &Cz7I7I??:??" *.*:*:?*:*S'  !DOO,fg ??Q  0!//4??*:;@@D 7vXgY OP <++ *+;*<C O 8 Jrcr]tRt^tRtRtRtRt]PR]PR/t RRlt R R lt R tR #) CommandSourceaUUser-configured helper command as a registered **bulk** source. Composes with the other sources through ``apply_all()``; there is deliberately NO single-provider selector. The helper enumerates a KEY=VALUE blob in one run. Config:: secrets: command: enabled: true command: "cat /run/user/1000/hermes-secrets.env" r/zCommand helperbulkziSet secrets.command.command in config.yaml to a fast, non-interactive helper that prints KEY=VALUE lines.uRun the helper manually in a shell to see its real error — Hermes discards helper stderr so diagnostics can't leak secret material.cV^8dQhRR/#)r rdictr)rs"rrCommandSource.__annotate__s  t rc  >RRRRR/RRRRR/RRR R\/R RR RR//#) enabled descriptionz Master switchdefaultFr/z@Helper run via /bin/sh -c; must print a KEY=VALUE blob on stdouthelper_timeout_secondszHard timeout for one helper runoverride_existingz)Helper values overwrite .env/shell values)_COMMAND_TIMEOUT_SECONDS)selfs&r config_schemaCommandSource.config_schemasQ   5I  'i!2' $}6W'02J'L -1\^gin!o   rc$V^8dQhRRRRRR/#)r cfgrm home_pathrrrr)rs"rrrns!$;rc \V\4'dTM/p\4p\VP R4;'gR4P 4pV'g!VP R\P4#\4'd!VP R\P4#\VP R\4\4p\VRV\4pVf!VP R\P4#\V4pV'gVP P#R4V#WsnV#)r/rszmsecrets.command.enabled is true but secrets.command.command is empty. Set the helper command in config.yaml.zNthe 'command' secret source is POSIX-only (needs /bin/sh); skipping on WindowsrtzGhelper command failed (see structured fields above); no secrets appliedz7helper output was not a KEY=VALUE map; nothing to apply) isinstancermrrgetr+failrNOT_CONFIGUREDrr rvr[_MAX_OUTPUT_BYTESINTERNALrhwarningsappendsecrets)rwr{r|resultr/r;r9rs&&& rfetchCommandSource.fetchs T**ccggi(..B/557;; ST]TlTln n ==;;o(779 9sww'?AYZ79Wb'3DE >;;h(113 3$F+ OO " "#\ ]M  rrN)__name__ __module__ __qualname____firstlineno____doc__rlabelshaperrrremediation_hintsrxr__static_attributes__rrrrjrjsL  D E E  #X/ rrji) r __future__rrrresignalrLrAr$pathlibrtypingrragent.secret_sources.baserrrr r __all__rvrcompilerbrr&r r[rhrjrrrrs} #   !jj 0 1 JJ9 : =;  9:x :L:r