+ jHjS2Rt^RIt^RIt^RIt^RIt^RIHt^RIHt^RI H t ^RI H t ]P!]4tRt]!4tRtRt!R R ]4tRR ltRtR tR tRtRtRtRtRtRt R t!Rt"Rt#Rt$Rt%Rt&Rt'R!Rlt(Rt)Rt*R!Rlt+R#)"zOBorrow frozen config credentials from the existing profile source, not a vault.N)asdict)Path)fingerprint_secret_value)RuntimeStoreErrorzprofile-config-v1:cTpVFp\V\4'd?\V4\Jd,^Tu;8:d\ V48g\ u#\ u#M$\V\ 4'dW29d \ u#W#,pK V#)zVThe value *root* defines at *path*, else ``_ABSENT`` when the key is simply not there.) isinstancelisttypeintlen_ABSENTdict)rootpathvaluekeys&& G/home/ubuntu/.hermes/hermes-agent/gateway/session_policy_credentials.py_definedrss E eT " "tCyC'7(c%j())E4((C,<N   Lc^RIHpHp\P!VP 4p\ VPR4\4'dVPR4M/pVUu0uFpRV3kK pp\ VPR4\4'd"VP\VR,44\VPR4;'gR4pVP4P4R8XdV!VPR4V4pMV!Ws4pV'd \W84M\ p \ V \4'd YiU u0uF qV 3,kK up ,pV#uupiuup i)zSecret paths the session's own route authenticates with: its ``model:`` block, a direct alias's key (``api_key_from``) and the one ``providers:`` / ``custom_providers:`` entry the runtime's own named-provider selection routes its provider through.#custom_provider_config_path_for_url!named_custom_provider_config_pathmodel api_key_fromprovidercustombase_url)"hermes_cli.runtime_provider_customrrjsonloads config_jsonrgetr raddtuplestrstriplowerrr ) policyrrconfigrrpathsrselectedentryfields & r _route_pathsr/s"W ZZ** +F#-fjj.A4#H#HFJJw bE', -ugs^uE -%))N+T22 %n-./599Z(..B/H~~8+6uyy7LfU4XF*2HV &E% 595%eX%%599 L .:s % E2E7c"]tRt^5tRtRtRtRtR#)RecoveredSecretszThe frozen secrets still valid, plus ``dropped``: the paths whose value changed or was removed in config.yaml since the session started (never supplied; the policy disables what used them).N)__name__ __module__ __qualname____firstlineno____doc__droppedsession__static_attributes__r2rrr1r15sfGGrr1c\V4pVPR4VPR4VPR4fVPRR4VPR4'gVPRR4R F*pVPV4eKVPVR4K, VPR4'gVPRR4VPRR4R8XdVPRR4VFpVPVR4K \P!\ P !VRR 7P44P4#) credential_refconfig_secret_refeditor_mcp_jsonNcoding_postureclient_env_remoteedit_approval_policyaskT sort_keys)client_env_jsonclient_env_rules_json) rpopr#hashlibsha256r dumpsencode hexdigest)r)unhasheddatanames&& rpolicy_identityrP<s &>DHH HH ! xx!"* "D) 88$ % % !4(< 88D> ! HHT4 = 88' ( ( $d+ xx&.%7 '. t >>$**TT:AAC D N N PPrc ^RIHp\UUu.uFwr#\W4V8XgKVNK ppp\ \ V4^,4UUu0uFqQ!WE4Fp\ W4kK K upp#uuppiuuppi)zEvery whole-policy hash a gateway older than ``bound`` could have stamped for *policy*: the current hash, plus each subset of the later fields dropped while they are at their defaults.) combinations) itertoolsrR_LATER_POLICY_FIELDSgetattrranger rP)r)rRrOdefaultunsetsizer8s& r_legacy_identitiesrZ[s''; `';mdwv?TX_?_TT';E `c%j1n- X-\%=V' F ,=V -- XX a XsA6A6"A<c|\\V\4'dV4#\P!VRR74#)TrC)rrr&r rJ)rs&r _fingerprintr\ds. #Zs-C-CE kkTYeiIj kkrcjV^,\VR,4r2\VPR4\4'dVPR4M/p\VPR4\4'd#\VR,4\V48XdR #VR8Xd-VR,R 8Xd\ V4^8d RRV^,3#R #VR8Xd\ V4^8d RV^,3#VR 9dU\VPV4\4'd-V'd%\ V^,4\Jd W#^,3#V3#VR8Xdc\ V4^8dSV^,pV^,R8Xd8\ V4^8d(\ V^,4\JdRVRV^,3#RV3#R #) aThe config path of the ROUTE block a secret at *path* rides with, else None. Every route shape a consumer reads: ``model:`` and its aliases (``model.aliases.``, ``model_aliases.``), both fallback sections in dictionary (one route) and list form, and each ``auxiliary.`` route with its ``fallback_chain`` entries. A secret nested deeper in a route (headers, extra_body) rides with it.NNrr:Nr_Naliases model_aliases auxiliaryfallback_chainN)r)r`)fallback_modelfallback_providers)r%rr#r rr r r )r*rheadrestrtasks&& r _route_ownerrissm a%R/$#-fjj.A4#H#HFJJw bE%))N+T22uU>=R7SW\]aWb7b w 8| #D A YQ0 0 3t9q=a)) 77 fjj& - -$4Q=C;Oq'? "w {s4y1}Aw 7& &3t9q=T$q']c=Q'7aA AT"" rc\W4pVeV#V^,\9d\VR,4#\VRR4#)zThe config path of the block whose endpoint the secret at *path* authenticates: a route block (_route_owner) or a provider entry as a whole, else the secret's own parent block.NNN)ri_ENTRY_SECTIONSr%)r*rroutes&& r _owner_blockrpsD  &E   Aw/!T"X cr rc^RIHpV^,R8Xd\VPR4;'gR4P 4P 4pV\ 9d|\VPR4;'gR4P 4'gD\VPR4\4'dVPR4M/pR.V!WR4O#\V!W44#)zN``(provider_identity, url)`` the route *block* at *owner* is actually sent to.)resolved_routerbrrrrmain) gateway.session_route_identityrrr&r#r'r(_AUX_FOLLOWS_MAINrr r)ownerblockr*rrrrss&&& r _resolvedrxs= Qx;uyy,22399;AAC ( (UYYz5J5P5Pb1Q1W1W1Y1Y*4VZZ5H$*O*O6::g&UWD:^D9: : u- ..rc`^RIHpT!\T;'gR4P44#))normalize_route_base_urlr)hermes_cli.route_identityr{r&r')rr{s& r_urlr}s$B #C $4$:$:$< ==rc\V'dV^,e \W4MRpV'd \W4M\p\V\4'd&\ Uu/uFqDV9gK WCV,bK upM/p\V\4'dA\ W4e4\W#V4VR&\VR,R,4VR,R&MB\V\4'd-V^,\9d^RI H p\V!V44VR&\F=p\VPV4\4'gK*\WW,4WW&K? \P !\"P$!\'V4V.RR7P)44P+4#uupi)zDigest of the endpoint the secret at *path* authenticates in the frozen *config* (a terminal-scope secret, ``path[0] is None``, authenticates no endpoint).Nresolved) _entry_urlTrCrm)rprr rr _ENDPOINT_KEYSrirxr}rnrr _URL_KEYSr#r&rHrIr rJrrKrL)r*rrvrwkendpointrrs&& r_bindingrs:+/473FL &DE',HV #'EFPQVX\F]F]^B^Ez 8 ^BceH%<#=#I(v>#'(>$**d4j(%;tLSSU V ` ` bbCs F)% F)c\VPP4P4Pp\ P !VP4p\\ P!R\V4RVPRTR\V4RVUu.uFp\V4\WV4.NK upRVP4UUu.uFwrg\V4\!V4.NK upp/RR7,#uupiuuppi)homeprofiler9r)boundentriesTrC)rdbdb_pathresolveparentr r!r"PREFIXrJr& profile_idrPrritemsr\) authority session_idr)secretsrr*rrs&&&& rconfig_referencers  $$ % - - / 6 6D ZZ** +F DJJD 9i>R>R :x)@7K744:x567KY+$T$Ze!45Y  [   LYs C= !D"c2RPRV44#).c3B"TFqfK\V4xK R#5iN)r&).0parts& r _field..sC$$ICII$s)join)rs&r_fieldrs 88C$C CCrcR\V43RVP33F#wrVW,V8wgK\RVRV 2R7h RV9d(VR,\V49d\RRR R7hR #\P !VP 4pVR,FRwrV^,V9gK\P!\Wx4V 4'dK=\R\V4R R7h R #) a.Refuse, by name, a reference from another home or profile, or a secret whose endpoint the policy moved without re-binding it. A change to anything else in the policy (model name, reasoning, toolsets, an unrelated provider or MCP server, a policy field a later release added) is not a credential change.rrlaunch_credentials_unavailablez0the frozen config credentials belong to another r.detailrr)r=z6stamped by an older gateway for another session policyNz:its endpoint moved in the session policy without a re-bind) r&rrrZr r!r"hmaccompare_digestrr) rsourcer)rskiprOminer*rdigests &&&&& r _check_scopersD *Y 8L8L,MN  <4 #$DD-]^b]c+df fOf ( #5f#= =#$DL_+ce e ZZ** +Fw  7$ t':':8F;QSY'Z'Z#$DFSWL+gi i(rc VeVP\4'gR#V'd.\P!V\ \4R4R,M.pVUUu/uF!wrEV^,V9gK\ V4VbK# pppYaP 4UUu/uFwrGV\V4bK upp8g#uuppiuuppi)zWhether *secrets* (the private values of *sections*, as the profile has them now) differ from the ones the durable reference *ref* froze there, by fingerprint. Unknown for an in-memory reference: False.NFr) startswithrr r!r r%rr\)refrsectionsrr fingerprintfrozenrs&&& r secrets_movedrs s~~f55:=djjS[\*+I62G@G _+<44PQ7V^K^&eDk;&F _ ==?S?KDdL//?S SS`SsB85B8B>c VVf^RIHpVP'dTMRpVPpVP \ 4'g`\ VR/4PV4pVf \R4hVP4UUu/uFwrgV^,V9gKWgbK upp#\P!V\\ 4R4p\VPP4P!4P"p \%WWV4\ VR/4PV4p V e5V P4UUu/uFwrgV^,V9gKWgbK upp#^RIHp VR,U u.uFq^,^,V9gKV NK p p \*;QJdRV 4F 'gK RM R M !RV 44'dV !V R , 4M/pRp\-4.ppRpV EFswppYppV^,R 8Xd]\V4^8dM\/V^,4\0Jd3Vf!\P!VP24MTp\5VW4pV^,f^R IHpV!V 4VR ,pp\;VV4pV\<JdRM \?V4pVe\@PB!VV4'gVf \EV4p\GV4V9d+\R\IV4V\<JdRMRR,R7h\JPMRVPR4V4VPO\GV44EKfWu\GV4&EKv \GV4VPR4uVn(Vn)V#uuppiuuppiuup i \dh\T\V\X\Z\\3dUp\JPMR\/T4P^4\RRR\/T4P^ R2R7ThRp?ii;i)zThe frozen config secrets; entries under a *skip* section are neither re-read nor checked. Every caller of a following session skips its followed sections: the live profile supplies them, so a key rotation there is not a revoked launch credential.N)FOLLOW_SECTIONS_local_config_secretsr)_load_gateway_configrc3<"TFwrV^,RJxK R#5i)rzNr2)rr_s& rr)recover_config_secrets.. s Bnfm[b[_47RVCVfmsTFz config.yamlcustom_providers)build_profile_terminal_scoper^z removed fromz changed inz' config.yaml since this session startedrzUSession %s: frozen config secret %s no longer matches the profile config; skipping itr9z&Frozen config reference unreadable: %sr=z unreadable ()r2)0gateway.session_policyrfollows_profiler=rrrUr#rrr r!r rrrrrr gateway.runranyr1r r r"_current_custom_pathtools.terminal_scoperrr r\rrr/r%rloggerwarningappendr8r9KeyError TypeError ValueErrorAttributeErrorOSErrorr3)rr)rrrvaluesrrrrcachedrr-rr*ror8rrlookupractualexcs&&& rrecover_config_secretsrs |:"("8"8"8b  " "C >>& ! !$;R@DDSI >#$DE E/5||~U~ aPTAT  ~UU,VCF -.ILL(()113::Yd;$;R@DDSI  39<<>Y>KDT!WTXEXKDK>Y Y4&,Y&7S&7U8A;d;R55&7S?BsBnfmBnsssBnfmBn?n?n%d]&:;tv*,b!( D+"6EAw,,TQ4Q=TWCW;A>F$6$67v-ffCAwM  i^W EV?cASAST @H[)5d3i6H6H5I'KMRU VVspNN(BN)NN"N)&N)7N$N$N)9N)C.identity8sj%&&uyy/@/@EIInD]D]#C &(9(?(?R$@#eiiP^F_FeFeceBfggrrN:rlNN)r_normalize_base_url_for_match) hermes_cli.providersrr#rrr enumeraterrrr ) rr*rrheldrcurrentindexr-rurlrs &&& @rrr0sT :h ::( )D&0t&<&<d1gAYPSTXPYAY8DaM "_cDjj+,G |:gt44 DG"c'l"xQ0@'AT'I !'*  E?d "GU.T"X. .+dDG"c'l"z'q'2BD'I'IJwAw/01SDaM9R5SS GS\ -DH --rc^RIHpHp\VP R4;'gR4P 4pVP 4R8XdV!VP R4V4#V'd V!WA4#R#)zXThe ``providers:`` / ``custom_providers:`` entry a fallback entry authenticates through.rrrrrN)rrrr&r#r'r()r-r*rrrs&& r_entry_owner_pathrNseW599Z(..B/557H~~8#2599Z3H&QQBJ ,X >TPTTrc XaV'gV#^RIHp\VPR4\4'dVPR4M/p\ VUu0uF-qU^,R8XgK\ V4^8gK$V^,kK/ up\R7FpVPV4p\V\4'gK,/VP4UU u/uFwrW9gK VR8wgKWbK up pCRR/CWF&\PRW&4K VUu0uF-qU^,R9gK\ V4^8gK$VR,kK/ p pREFp VPV 4p \V \4'dV .R rM%\V \4'd\V 4R rMKU.p\V 4EF&wppV'dV 3MV V3o\;QJdV3R lV4F 'gK R M R M!V3R lV44p\V\4'dV 'd \VV4MR pV'gVe\V4V 9d~\PR T\V\4'dT;'g/PR4MR\V\4'dT;'g/PR4MR4EKVP!V4EK) V'd,V'dV^,W &EKVP#V R 4EKWV &EK V#uupiuup piuupi)aDisable, in the session's effective *config*, whatever authenticated with a *dropped* frozen secret, instead of leaving it with a null key (null means 'resolve another credential' and would send another account's key). A fallback using it is removed from the chain; an ``auxiliary.`` override using it is replaced by the session's primary route (``provider: main``). Never substitutes.)_AUX_ROUTE_KEYSrb)rrcrrsz}Session %s: auxiliary task %s returned to the primary route: its credential changed in config.yaml since this session startedrkTFc3D<"TFqR\S4S8HxK R#5ir)r )rrprefixs& rr*disable_dropped_secrets..usGwtH&RIO NNOPW _ k$+ m741g9Z.Zh_bcg_hkl_lhd2hh7F m;jj! c4 "eTV T " ""3iV %g.LE5#)gZ/?F#GwG###GwGGC8B5$8O8OTZ%eV4`dEu(U5\V-C <=D@J5RV@W@W 00<]`=Gt=T=T 009Z]_ KK / "&q' 7D)"7O5<6 MIa"=ns6L' L9 L L! "L! +L! L'. L' L')r2)) skills_promptN) kanban_jsonN) safe_modeF)ignore_user_configF)rrapircommandargsapi_moder)rautors)rrrr),r7rHrr logging dataclassesrpathlibragent.credential_persistencerhermes_state_runtimer getLoggerr3rrobjectr rr/r r1rPrTrZr\rrnrurirprxrr}rrrrrrrrrr2rrrsU A2   8 $  ( .tQ27 XlW3):/ ' > c& Di.T9Vx.<U-r