+ iHjKa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RI H t H t ^RI H t ^RIHtHtHtHt^RIHtHtHtHtHtHtHt^RIHtHt]P<!]4t /t!R]"R &/t#R ]"R &/t$R ]"R &Rs%]PL!4t'RR:R;llt>R#)?uzSecret-source registry + apply orchestrator. Owns everything that must be uniform across backends: registration (name/scheme uniqueness, API-version gating), the wall-clock timeout around ``fetch()``, precedence (mapped beats bulk; within a shape ``secrets.sources`` order, else registration order; first claim wins), ``override_existing`` semantics (may beat .env/shell, never another source, never a protected var), cross-source conflict warnings, and provenance. Startup entry point: :func:`apply_all` via ``hermes_cli.env_loader``; plugins register through ``PluginContext.register_secret_source()`` → :func:`register_source`. ) annotationsN) dataclassfield)Path)DictListMutableMappingOptional)SECRET_SOURCE_API_VERSION ErrorKind FetchResult SecretSourceis_valid_env_namereset_source_environmentset_source_environment)hermes_home_keynormalize_scopedict[str, SecretSource]_SOURCESdict[str, str]_SOURCE_ORIGINSz"dict[str, dict[str, SecretSource]]_SCOPED_SOURCESFcR]tRt^/t$RtR]R&R]R&R]R&R]R&RtR]R &R tR #) AppliedVarz7Provenance record for one env var the orchestrator set.strnamesourceshapebool overrode_envF authoritativeN)__name__ __module__ __qualname____firstlineno____doc____annotations__r __static_attributes__r!B/home/ubuntu/.hermes/hermes-agent/agent/secret_sources/registry.pyrr/s&A I K J M4r)rc]tRt^ I J t4GY4"'"=i=!&t!y>!&t!rr r? Optional[str]r!)r@s"r*rArAZs  \ m r)c\V\4'gRV: R2#VP;'gRpV'd;VPRR4P 4'dWP 48wdRV: 2#VP \8wdRV RVP R\ 2#VPR 9dRV R VP: 2#R #) zJReason a source is unregistrable (already formatted for the log), or None.zIgnoring secret source z$: does not inherit from SecretSource_z)Ignoring secret source with invalid name zIgnoring secret source 'z$': built against secret-source API vz, this Hermes speaks vz)': shape must be 'mapped' or 'bulk', got N)mappedbulk) isinstancer rreplaceisalnumlower api_versionr r)rrs& r*_validate_sourcerVZs fl + +( 2VWW ;;  "D t||C,4466$**,:N:4(CC 66*4&1&&''=>W=XZ [ ||--)$/XY_YeYeXhii r)rRbuiltinscopec ,V^8dQhRRRRRRRRRR/#) r>rr rRrrWrXrKr?r!)r@s"r*rArAis1LdT(48r)caa\S4pV'd\PV4R#\V4pSPo\ ;_uu_4\ \4pVe&VP\PV/44SV9d*V'g"\PRS4RRR4R#\VV3RlVP44R4pV'd.\PRSSPV4RRR4R#Vf\M\PV/4pSVS&VfV'dRMR\S&RRR4R# +'giR#;i) zRegister a secret source; True on success. Rejections are logged, never raised. ``replace`` allows same-name override (last-writer-wins); scheme collisions across *different* names are always rejected.FNz9Secret source '%s' already registered; ignoring duplicatec3<"TFCwrVS8wgKSP'gK"VPSP8XgK?VxKE R#5irD)scheme).0norrs& r* "register_source..{sET$5DAd'-}}9:V]]9Ra$5s AAA AzKIgnoring secret source '%s': scheme '%s://' is already owned by source '%s'rWpluginT)rVloggerwarningrr_REGISTRY_LOCKrHrupdatergetnextitemsr\ setdefaultr) rrRrWrXproblem effectiveownertargetrs f$$$ @r*register_sourcerois! v&Gw E "E ;;D N     _00; < 9 W NNVX\ ] TIOO$5TUY[  NNh 7 #]0J0J5RT0Ut =18IhOD !! " # " s&AEE;AE0E E E, c V^8dQhRRRR/#)r>rXrKr?rr!)r@s"r*rArAs=%<r)c\\4pVP\P \ V4/44V#)zOGlobal sources overlaid with the scope's (default: current home) registrations.)rHrrfrrgr)rXmergeds& r*_mergedrss. (^F MM/%%oe&rrrXrKr?Optional[SecretSource]r!)r@s"r*rArAs"((S(M(=S(r)c\4\;_uu_4\V4PV4uuRRR4# +'giR#;irD)_ensure_builtin_sourcesrersrgrrXs&$r* get_sourcerzs+ u~!!$' s > A c$V^8dQhRRRRRR/#rur!)r@s"r*rArAs'YYY}YH^Yr)c\4\V4p\;_uu_4Vf\M\P V/4P V4uuRRR4# +'giR#;i)zrrcurrentr previousrvrXrKr?rr!)r@s"r*rArAs2s\E[ -9=r)c\4\V4p\;_uu_4Vf\M\P V/4pVP V4VJd RRR4R#VfVPVR4MW$V&VeV'g\PVR4RRR4R# +'giR#;i)z@Restore a host-owned source registration if it is still current.NFT)rxrrerrrjrgpop)rrrrXrns&&&$ r*restore_registrationrs E "E "]0J0J5RT0U ::d 7 *    JJtT "#4L  V   t ,    s7B,%&B, B,, B= c V^8dQhRRRR/#)r>rXrKr?list[SecretSource]r!)r@s"r*rArAs--=-4F-r)c\4\;_uu_4\\V4P 44uuRRR4# +'giR#;irD)rxrer7rsvaluesrXs$r* list_sourcesrs. GEN))+, s "A A cV^8dQhRR/#)r>r?rr!)r@s"r*rArAs % %/ %r)c \4\;_uu_4\P4UUu/uF#wr\P V4R8XgK!WbK% pppVP \P \4/44\VP44uuRRR4#uuppi +'giR#;i)uSources registered outside the bundled set: global ``"plugin"`` origins plus every scoped registration (bundled sources register with scope=None). Includes both legacy global plugin registrations (``_SOURCE_ORIGINS == "plugin"``) and the current scope's profile-keyed registrations — every scoped entry is plugin-registered by definition, since bundled sources register with ``scope=None`` (#64229 profile isolation). rbN) rxrerrirrgrfrrr7r)r^srrs r*list_plugin_sourcesrs #+>>#3Z#3417J7J17MQY7Y$!$#3Z o))/*;R@AFMMO$ Z s#B3B- B- AB3-B33 C cV^8dQhRR/#r>r?Noner!)r@s"r*rArAs d d dr)c T\;_uu_4\'d RRR4R#Rs\F/wrp\W.R7p\ \ W14!4RR7K1 RRR4R# \ d\PRTRR7Kci;i +'giR#;i)zIdempotently register the bundled sources (lazy so import stays cheap; per-source guarded so one broken source can't block the others).NT)fromlist)rWz+Failed to register bundled %s secret sourceexc_info) re_BUILTINS_LOADED_BUILTIN_SOURCES __import__rogetattr Exceptionrcrd) module_name class_namer-modules r*rxrxs      .> *KU d#K,G ; =tL/?  dLe^bc d s3BB(A,B,#B BB B B' cV^8dQhRR/#rr!)r@s"r*rArAs!!4!r)c\;_uu_4\P4\P4\P4RsRRR4R# +'giR#;i)FN)rerclearrrrr!r)r*_reset_registry_for_testsrs;   s ?A A) c ,V^8dQhRRRRRRRRR R /#) r>rr cfgrH home_pathrenvironMutableMapping[str, str]r?r r!)r@s"r*rArAs1## #4#D#!9#>I#r)caaaaSPS4p\PP^RSP 2R7pRVVVV3RllpVP V4pVP VR7pTPR R 7\%T\4'g@\4PR\T4P R2\P"4#T# \PPd`TP4\4PRTR RSP R 2\P4uTPR R 7#\d^p \4PR \T 4P R T 2\P"4uRp ? TPR R 7#Rp ? ii;i TPR R 7i;i)uRun source.fetch() under a wall-clock budget; never raises. A worker thread enforces the budget: a source that blows it is reported as TIMEOUT and its eventual result discarded (the thread may linger until process exit — acceptable for a startup-only path). z secret-src-) max_workersthread_name_prefixcV^8dQhRR/#)r>r?r r!)r@s"r*rA)_fetch_with_timeout..__annotate__s 0 0  0r)cv<\S4pSPSS4\V4# \T4i;irD)rfetchr)tokenrrrrs r*_fetch#_fetch_with_timeout.._fetchs2*73E 0||C3(/(/s+ 8)timeoutzfetch exceeded z.0fuBs budget — startup continued without this source (raise secrets.z-.timeout_seconds if the backend is just slow)F)waitz fetch raised z: Nzfetch returned z instead of FetchResult)fetch_timeout_seconds concurrentfuturesThreadPoolExecutorrsubmitr. TimeoutErrorcancelr failr TIMEOUTshutdownrtyper"INTERNALrQ) rrrrrexecutorrfuturer.excs ffff r*_fetch_with_timeoutrs**3/G!!44YdekepepdqWr4sH& 0 0( g]]7]3F u% fk * *}!!ODL4I4I3JJa"b"+"4"46 6 M!!.. 9 MMO=%%}EL)/ 5b'd'0&7&79 9 u% g=%% d3i6H6H5IC5&QS\SeSef fu% g u%sJG#CA)GGG%G&AF>&G'G>GGGc$V^8dQhRRRRRR/#)r> secrets_cfgrHrrr?r!)r@s"r*rArAs!00$0c0d0r)cXVPV4p\V\4'dV#/#rD)rgrQrH)rrrs&& r*_sectionrs' //$ CS$''3/R/r)c$V^8dQhRRRRRR/#)r>rrHrXrKr?rr!)r@s"r*rArA s"$-Ser)cB\VR7Uu/uFq"PVbK ppVPR4p\V\4'd+VUu.uFp\V\ 4'gKVNK upM.pVUu.uF qwV9gK VNK ppV'd@\ PRRPV4RPV4;'gR4\PVUu.uF qwV9gK VNK up\ V4,4p .p V FCp W;,P\W 44'dV PW;,4KCKE V #uupiuupiuupiuupi \d\ PRT RR7Ki;i) zEnabled sources: ``secrets.sources`` order first, then registration order (mapped-vs-bulk precedence is applied on top by :func:`apply_all`).rr:z7secrets.sources names unknown source(s): %s (known: %s)z, nonez0Secret source '%s' is_enabled() raised; skippingTr)rrrgrQr7rrcrdjoinrHfromkeys is_enabledrappendr) rrXrr:explicitenamesr^unknownorderenabledrs &$ r*_ordered_enabled_sourcesr s^2>E1JK1Jv{{F"1JGKy)H;EhPT;U;U 71Jq#$6QQ 7[]E4%QG#3qq%G4Pyy)499W+=+G+G I MMerrHrrr? frozensetr!)r@s"r*rArA"s&nndntn nr)c \V\4'dTM/p\R\V\ V4R744#)aNames of the sources :func:`apply_all` would fetch for *home_path* right now (registered and enabled). A source missing here was removed or disabled, so a value it injected earlier is no longer backed by anything and must be revoked, not kept as process residue.c38"TFqPxK R#5irD)r)r]rs& r*r`'enabled_source_names..'sm%lVV%lsr)rQrHrrr)rrs&&r*enabled_source_namesr"s7",K!>!>+BK m%=kQ`ajQk%lm mmr)c V^8dQhRRRR/#)r>rzOptional[Path]r?rr!)r@s"r*rArA*s  N s r)c.VeE\V4pVPPR8XdVP'd VP#RFFp\PP VR4P 4pV'gK;VR8wgKDVu# R#)zPActive profile name (``~/.hermes/profiles/``); "" for the default profile.profilesrMdefault)HERMES_PROFILE_NAMEHERMES_PROFILE)rparentrosrrgstrip)rresolvedenv_namevalues& r*_active_profile_namer*sr ? ??  : -(---== = x,224 5Ui'L> r)c$V^8dQhRRRRRR/#)r>varrprofiler?rKr!)r@s"r*rArA<s&eeseSe]er)c RVPRR4P4,pV'dVPV4'gR#VR\V4)pV'd/\ V4'dVP\ 4'dV#R#)zBMap ``FOO_`` to ``FOO`` for the active profile when safe.rN-N)rRupperendswithlenr_ALIAS_SUFFIXES)rrsuffixaliass&& r*_profile_alias_targetr<sm 7??3,224 4F #,,v.. 3v;, E/665>>/;Z;Z5d`ddr)c>]tRtRtRtRRltRRltRRltR tR #) _ApplieriEzPApply phase state for one orchestrated pass: sequential, first-wins, attributed.c ,V^8dQhRRRRRRRRR R /#) r>envrreportr9 protectedrpreserverr?rr!)r@s"r*rA_Applier.__annotate__Hs3**4*k***6?*DH*r)c NWW43wVnVnVnVn/VnR#rD)rrrrclaimed)rErrrrs&&&&&r*__init___Applier.__init__Hs$?BI?_<$+t~t}') r)c 0V^8dQhRRRRRRRRR R R R /#) r>rr rrHr.r rrsupplied_directlysetr?rr!)r@s"r*rArMsApp<pdpKp!p69p>Bpr)c  \VPVP;'g VPVR7pVPPP V4VP 'gR#VPV4pVPP4Fwr\V\4'd\V \4'gK3VPWaWxV 4'd V'gKV\W4p V 'gKkW9gKsWP9gKVPWaWzV 4'gKVP P RV RV RV: R24K R# \dRpLi;i))rr-r.NFzapplied profile-scoped z as z (active profile ))r,rr-rr:rokoverride_existingrsecretsrirQr _try_applyrrwarnings) rErrr.rrsroverriderrrs &&&&&& r* apply_source_Applier.apply_sourceMs v{{&,,2M2M&++V\ ] ""2&yyy  //4H!....0JCc3''z%/E/E??2xeDDG)#7E%8U,,=VHUKK&&)@T%Pabiallm'no1 H s1E(( E87E8c 0V^8dQhRRRRRRRRR RR R/#) r>r r,rr r rrrrr?r!)r@s"r*rArbs9\<4$',0r)c \V4'gVPPV4R#W@P9dVPPV4R#W@P 9dgVP PV4VPPPV RVP V, RVP R24R#\VPPV44pV'd6W@P9g V'gVPPV4R#WPPV&VPVP V&VPPV4\!YBPVP"TT;'dW@P9R7VPP$V&R#)z=Apply one var through the shared guard chain. True = applied.Fz: kept value from z; uW also supplies it (first source wins — remove one binding or reorder secrets.sources))rr T)rr6rrr5rr4rr<rrrrgrr3r2rrr;)rEr rr rrexisteds&&&&&& r*r_Applier._try_applybs\!%%    % %c * ..  ' ' , ,,     % %c * KK ! ! ( (C50B4<rrHrrrz"Optional[MutableMapping[str, str]]r?r9r!)r@s"r*rArA}s*5545D595EP5r)c ^VeTM\Pp\4p\V\4'dTM/p\ V\ V4R7pV'gV#VPR4p\V\4'd\RV44M \4pVPRR4'd \V4MRpVU u.uFqPR8XgKV NK up VU u.uFqPR8XgKV NK up ,p .p /p V Flp \W P4p\WW4pV PWV34V P!V4FpV P#VV P4K! Kn V UUUu0uFHwppVP&'gKVP(Fp\V\*4'gKVkK KJ pppp\-W4W4pV FwrpVP/WWV4K V#uup iuup i \$dEKi;iuupppi) ukFetch from every enabled source and apply the merged result to ``environ`` (default ``os.environ``). Precedence per env var, most-specific intent first: (1) ``secrets.preserve_existing`` names always keep a pre-existing value, even against ``override_existing: true``; (2) pre-existing .env/shell value, unless the winning source has ``override_existing: true``; (3) mapped sources in configured order; (4) bulk sources in configured order. First claim wins: a later source carrying the same var gets ``skipped_claimed`` plus a conflict warning — never a silent clobber, and ``override_existing`` never applies across sources. Profile aliasing: under a named profile an applied ``FOO_`` (credential-shaped suffixes only) also hydrates canonical ``FOO``, under the same guards; disabled with ``secrets.profile_alias: false``. 1. 2. 3. 4. See #58073. See #51447. rpreserve_existingc3"TFEp\V\4'gKVP4'gK3VP4xKG R#5irD)rQrr)r]r^s& r*r`apply_all..s3LqJq#!>+BK&{/):TUG  ??#67L(t<<LBK+ 1<RV1W1W"9-]_G"9'QWW%8qq'9G "I{KK0$V)AV,- 005$$S&++66 +2c'wq!QQTT199aPZ[\^aPb9'csI8G&VV&;LM ' M):r6s # (77>   8 $%' !&"$$6838"         = =  =  % %  % UTY+/>(D( YtY04$-4- % d !#L0 $.n Ie55p55r)