+ jHj a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI H t ^RI t ^RIHtHtHt]P$!]4tR^t]!4tR]R&]!4tR]R&]!4tR]R&/tR ]R &]!4tR]R &]!4tR]R &]!4tR]R &/tR]R&/t R]R&/t!R]R&]!4t"R]R&] PF!4t$/t%R]R&]PL!4t'] PF!4t(])!R04t*R]R&])!0R_m4t+R]R&RRlt,RRlt-RRlt.R R!lt/R"R#lt0R$R%lt1R&R'lt2R(R)lt3R*R+lt4R,R-lt5R.R/lt6R`R0R1llt7R2R3lt8RaR4R5llt9R6R7lt:R8R9lt;R:R;ltR?lt>R@RRARB/RCRDllt?RERFlt@RGRRHRRIRJ/RKRLlltARMRNltBR@R/RORPlltCRQRRltDRSRTltERURVltFRWR/RXRYlltGRZR[ltHR\R]ltIR#)bzFHelpers for loading Hermes .env files consistently across entrypoints.) annotationsN)Path)atomic_replaceload_yaml_file_readonlymkstemp_besideset[str] _WARNED_KEYS_WARNED_UTF32_PATHS_SCOPED_SKIP_LOGGEDdict[str, str]_SECRET_SOURCES_SOURCE_SUPPLIED_NAMES_LOADED_DOTENV_KEYS_MANAGED_DOTENV_KEYSzdict[str, dict[str, str]]_SECRET_SOURCE_VALUES_BY_HOME_SECRET_SOURCE_RESTORE_BY_HOMEz1dict[str, dict[str, tuple[str, str, str | None]]]_SECRET_SOURCE_WRITES_BY_HOME_APPLIED_HOMESz&dict[str, tuple[str | None, str, int]]_DOTENV_PUBLISHEDHERMES_DASHBOARD_SESSION_TOKENfrozenset[str]_SPAWN_CREDENTIAL_KEYS_PROFILE_MANAGED_ENV_KEYSc V^8dQhRRRR/#)pathrreturnr)formats":/home/ubuntu/.hermes/hermes-agent/hermes_cli/env_loader.py __annotate__r `s$$d$x$c0^RIHp\V!V44#)uKEY names assigned in a dotenv file (including empty ``KEY=``), via the same tokenizer that installs profile scopes — a key the installer sees is a key the dashboard scrub sees (BOM'd first line included). load_env_file)agent.secret_scoper$set)rr$s& r_env_keys_defined_in_dotenvr'`s1 }T" ##r!c V^8dQhRRRR/#rrrrNoner)rs"rr r hs       r!cVP4'gR#\V4p\F3pW!9gK V\P9gK"\PVK5 R#)a0After ``.env`` loaded with override, delete inherited ``_PROFILE_MANAGED_ENV_KEYS`` it does not define. Deliberately NARROW: only keys that change *which provider path* is used. Does **not** run when the ``.env`` file does not exist (bare-profile case, which follows ``#66930`` / ``#67027`` semantics). N)existsr'rosenviron)rdefinedkeys& r%_clear_known_keys_missing_from_dotenvr1hsB ;;==)$/G(  #"3 3)r!c V^8dQhRRRR/#)renv_varstrr str | Noner)rs"rr r ws((s(z(r!c,\PV4#)uSource label that supplied ``env_var`` (``"bitwarden"`` …), None for .env/shell keys. Metadata only — never authorization to persist the raw value.)r get)r3s&rget_secret_sourcer8ws   w ''r!cV^8dQhRR/#)rrrr)rs"rr r }shr!c\VP4pVPFpVPVP4K \ PV4V#)uEvery name *report*'s sources supplied — applied, or skipped because a value already existed — recorded into ``_SOURCE_SUPPLIED_NAMES`` so the routed-child scrub knows the source owns it.)r& provenancesourcesupdateskipped_existingr )reportsuppliedsrcs& r_record_supplied_namesrB}sG6$$%H~~,,-!!(+ Or!cV^8dQhRR/#rrztuple[str, ...]r)rs"rr r s""_"r!c \\4#)uUEvery env-var name some profile's external secret source APPLIED (names only — the map is process-wide, so a value must be resolved through the active profile's secret scope). Consumers that forward source values into a child (MCP stdio env) want exactly these; see ``source_supplied_names`` for the wider set the routed-child scrub needs.)tupler rr!rsecret_source_namesrGs  !!r!cV^8dQhRR/#rDr)rs"rr r sHHHr!cZ\\\\4\,44#)uEvery env-var name an external source supplied for any home — applied, or lost to a pre-existing process value (``skipped_existing``). The launch value in ``os.environ`` is still not a routed profile's to inherit, so the strip must see the skipped names too.)rFsortedr&r r rr!rsource_supplied_namesrKs O,/EEF GGr!cV^8dQhRR/#rrrr)rs"rr r s**N*r!c \\4#)zKEY names any NON-managed dotenv file loaded into this process's ``os.environ`` so far (see ``_LOADED_DOTENV_KEYS``); the launch profile's residue set for routed children.) frozensetrrr!rlaunch_dotenv_keysrPs ( ))r!cV^8dQhRR/#rMr)rs"rr r s++^+r!c \\4#)zKEY names the administrator-managed ``.env`` loaded (see ``_MANAGED_DOTENV_KEYS``). Policy for every profile: never stripped from a routed child, and re-applied over the routed scope.)rOrrr!rmanaged_dotenv_keysrSs ) **r!c V^8dQhRRRR/#r hermes_homezstr | os.PathLikerr r)rs"rr r sYY*;YYr!c \\P\\ V4P 44/44#)z>Return the external-secret value snapshot for ``hermes_home``.)dictrr7r4rresolverVs&rget_secret_source_valuesr[s/ -11#d;6G6O6O6Q2RTVW XXr!c V^8dQhRRRR/#rUr)rs"rr r sBB0ABnBr!c\;_uu_4\\V44uuRRR4# +'giR#;i)aResolve one profile's configured sources without mutating ``os.environ``: multiplex gateways route turns to profiles that never ran the process-global dotenv path, so resolve against a private mapping seeded from that ``.env`` and record the per-home snapshot for ``build_profile_secret_scope()``. Fail-open / once-per-home like ``_apply_external_secret_sources``; never returns plaintext .env entries.N)_SECRET_SOURCE_CACHE_LOCK_hydrate_profile_secret_sourcesrrZs&rhydrate_profile_secret_sourcesr`s& # ".tK/@A # " " "s. ? c V^8dQhRRRR/#rhomerrr r)rs"rr r s==$=>=r!c^RIHpV!4e/#\VP44pV\9d \ V4#\ PVR4\PVR4\V4pT'g/#^RI H pH p^RIHp\ P"P%4UUu/uFwrxT!T4'gKYxbK p ppT P'T!TR, 44TR, p T P)4'd1T!T 4P%4FwrT P+Y4K \T4T R&T!Y0T R7p T P,'g/#\.;QJd&R T P,4F 'dK R M R M!R T P,44'd\P1T4\3T 4/pT P4P%4F3wrT P7T4pTfKTP8\:T&YT&K5 T\ T&\=T4# \d/u#i;iuuppi \d/u#i;i) zALocked implementation for :func:`hydrate_profile_secret_sources`.worker_config_snapshotN)_is_global_envr$) apply_all.env.op.env HERMES_HOME)r.c3L"TFqPPxK R#5iN)resultok).0rAs& r 2_hydrate_profile_secret_sources..s 3NS::==Ns"$FT)agent.safe_worker_policyrfr4rYrr[rpopr_load_secrets_config Exceptionr%rgr$agent.secret_sources.registryrhr-r.itemsr=r, setdefaultr<alladdrBr;r7sourcer rX)rcrfhome_keycfgrgr$rhnamevalue local_envop_env_name_valuer?valuesapplieds& rr_r_s?+ 4<<>"H>!'--"%%h5"&&x6"4(  D;46JJ4D4D4F_4F[T.Y]J^[T[4F _tf}56  ! ==??!.v!6! $$U3"?#&t9 - 3i8 >>>  s 3FNN 3sss 3FNN 3338$6"F**002  d# =  't 3 /5!(+ <Y  `  s=. I/I3I IBI III I*)I*c V^8dQhRRRR/#)rrVstr | os.PathLike | Nonerr*r)rs"rr r s77+C7t7r!cVf{\P4\P4\P4\P4\ P4\ P4R#\\V4P44p\PV4\PVR4\ PVR4R#)uForget applied homes so the next load re-pulls (tests, long-running processes after config edits). ``hermes_home`` limits the reset to ONE home: a multiplex gateway keeps every profile's snapshot in this process, and a per-fire cron re-pull or a plugin-discovery refresh for one home must not wipe a sibling's hydrated snapshot — the sibling's next scope build would run empty until it re-hydrated (#102041).N) rclearr r rrrr4rrYdiscardrt)rVr}s& rreset_secret_source_cachers$$&%++-&,,.%++-4 $,,./H8$!%%h5"&&x6r!c V^8dQhRRRR/#)rr3r4rr)rs"rr r sr!c\V4pV'gR#VR8XdR#^RIHpV!V4pVe#VP'dRVP R2#RT R2# \dLi;i)zc``" (from Bitwarden)"``-style suffix; ``""`` for .env/shell keys (only external sources are named). bitwardenz (from Bitwarden) get_sourcez (from ))r8rwrlabelrv)r3r|r registereds& rformat_secret_source_suffixrs{ w 'F  " <'  !j&6&6&6Z--.a0 0VHA     s#AA A('A(c$V^8dQhRRRRRR/#)rrr4limitintrr)rs"rr r s!  3 s 3 r!c.pVFqp\V4^8gKR\V4R 2pVP4'dVRV: R2, pWB9dVPV4\V4V8gKqM RP V4#)z>Compact ``U+XXXX ('c'), ...`` summary of non-ASCII codepoints.zU+04X (rz, )ord isprintableappendlenjoin)rrseenchrs&& r_format_offending_charsrs~D r7S=R &E~~2bV1%  E"4yE! 99T?r!cV^8dQhRR/#)rrr*r)rs"rr r 's  d r!c a\\PP44EF<wop\;QJd#V3Rl\ 4F 'gK RM RM!V3Rl\ 44'gKQVP 4'dKiVPRRR7PR4pV\PS&S\9dK\PS4\V4\V4, p\V4;'gRp\RS R T R V^8wdR MR R V R2 \PR7\R\PR7EK? R#)aeStrip non-ASCII from credential env vars (``_CREDENTIAL_SUFFIXES``) so the codebase never sees them. Emits a one-line warning to stderr when characters are stripped. Silent stripping would mask copy-paste corruption (Unicode lookalike glyphs from PDFs / rich-text editors, ZWSP from web pages) as opaque provider-side "invalid API key" errors (see #6843). c3F<"TFpSPV4xK R#5irm)endswith)rpsuffixr0s& rrq/_sanitize_loaded_credentials../sK6JF3<<''6Js!TFasciiignore)errorsz non-printablez Warning: z contained z non-ASCII charactersrru8) — stripped so the key can be sent as an HTTP header.filea@ This usually means the key was copy-pasted from a PDF, rich-text editor, or web page that substituted lookalike Unicode glyphs for ASCII letters. If authentication fails (e.g. "API key not valid"), re-copy the key from the provider's dashboard and run `hermes setup` (or edit the .env file in a plain-text editor).N)listr-r.rxany_CREDENTIAL_SUFFIXESisasciiencodedecoderr{rrprintsysstderr)rcleanedstrippeddetailr0s @r_sanitize_loaded_credentialsr's2::++-. UsK6JKsssK6JKKK  ==?? ,,wx,8??H! 3 ,  u:G ,(/BB? C5 H:5I A 2.b934:=** F  1   /r!c V^8dQhRRRR/#)rrrrlist[tuple[str, str | None]]r)rs"rr r Hs__T_&B_r!c@VP4pVPR4p^RIHp\V!R\P!V4RR7P44# \d4TP\P 4pTPR4pLyi;i)zT``(name, raw value)`` assignments of one dotenv file, uninterpolated, in file order. utf-8-sigzlatin-1)DotEnvNF) dotenv_pathstream interpolate) read_bytesrUnicodeDecodeError removeprefixcodecsBOM_UTF8 dotenv.mainrrioStringIOparse)rrawtextrs& r_parse_dotenv_filerHs // C%zz+& # 4 D0AuU[[] ^^ %v/zz)$%sA;BBc V^8dQhRRRR/#)r load_pass int | Nonerr r)rs"rr r Ys  *  r!c\\P4p\P 4F5wpwr4pWP8wgKVP V4V8XgK)VfWK1W1V&K7 V#)u``os.environ`` with every value an earlier pass (any pass, for ``None``) published peeled back to its baseline — what ``${VAR}`` resolves against (see ``_DOTENV_PUBLISHED``). Caller holds the lock.)rXr-r.rrxr7)r lookup_envrbaseline publishedpublished_passs& r_dotenv_lookup_envrYsbbjj!J7H7N7N7P33xN  &:>>$+?9+L$#+4 8Q r!c(V^8dQhRRRRRRRR/#) r assignmentsrrr overrideboolrzdict[str, str | None]r)rs"rr r fs,-;IX\r!ca^RIHp/pVFBwrVVe6V'd/VCVCM/VCVCoRPV3RlV!V444pWdV&KD V#)zExpand ``${VAR}`` / ``${VAR:-default}`` like ``dotenv.main.resolve_variables``, minus the live ``os.environ``: a line sees *lookup_env* and the file's earlier lines (earlier lines win under *override*, the environment otherwise).)parse_variablesrc3D<"TFqPS4xK R#5irm)rY)rpatomlookups& rrq._resolve_dotenv_assignments..rsT=STLL00=Ss )dotenv.variablesrr)rrrrresolvedrrrs&&$ @r_resolve_dotenv_assignmentsrfsf 1&(H"   3;/ /h/A[HA[PZA[FGGT_U=STTE # Or!c V^8dQhRRRR/#rbr)rs"rr r wsd~r!c^RIHpVP4pVR, .Ve VR, .M.Op\;_uu_4\ R4pRRR4/pVFBp\ V4p\TXRR7P4FwrT fK T ;YH&YX&K KD V# +'giL\;i \ dKii;i)aWhat ``load_hermes_dotenv`` would publish from *home*'s dotenv layers, read-only: the home's ``.env`` then the administrator-managed ``.env``, both with override and ``${VAR}`` expanded by the same rules against the process's own environment (this process's dotenv output peeled back), each layer seeing the one before. External secret sources and the project ``.env`` are not included. managed_scoperiNTr) hermes_clirget_managed_dir _DOTENV_LOCKrrOSErrorrrx) rcr managed_dirlayersroutrrrrs & rresolve_home_dotenvrws )//1KVm Z9P f 45VX ZF '-  C ,T2K7{JY]^ddfKD /44  39g  J     s B B2 B/ 2 CCrmanagedFc ,V^8dQhRRRRRRRRRR /#) rrrrrrrrrr*r)rs"rr r s4## #!#.8#JN# #r!c\V4p\;_uu_4Vf\\4p\ V\ V4VR7pVP 4FwrgVeV'gV\P9dK(\PPV4p\PV4p V RJ;'d W^,8Hp V\9dV'd V 'gKV 'd V ^,MTp V\PV&WV3\V&K RRR4V'd\M\PRV44\4R# +'giLF;i)u3Load one dotenv file into ``os.environ`` like ``dotenv.load_dotenv`` — same parser, same ``${VAR}`` / ``${VAR:-default}`` / precedence rules — except that ``${VAR}`` resolves against the value VAR had before this process's earlier passes published it (see ``_DOTENV_PUBLISHED``). ``load_pass`` groups the layered files of one ``load_hermes_dotenv`` call: within a pass a later layer (project, managed) still sees the earlier layer's output, as it always did; only OTHER passes' output is peeled. A bare call (``hermes send``'s direct reload) is its own pass.Nrc3*"TF wrVxK R#5irmr)rprrs& rrq-_load_dotenv_with_fallback..sEk_j|td_js)rrnext_DOTENV_PASSESrrrxr-r.r7rrrrr=r) rrrrrrrrcurrentrecordoursrs &$$$ r_load_dotenv_with_fallbackrs%T*K   ^,I.{>+KD}X$"**2DjjnnT*G&**40F%>>'AY*>D--'$$(vaygH$BJJt '/ &B d #, &%*=EEEk_jEkk ") s+A E&AE<EE# E--E E( c V^8dQhRRRR/#r)r)rs"rr r sC C tC C r!cVP4'gR#^RIHpTP 4pRpTP \P4'g&TP \P4'dR\TP44pT\9d,\PT4\PRT4R#TP \P 4'g&TP \P"4'dS\$P&!\$P(!T4RRR7;_uu_4pTP+4pRRR4RpMX\/TRR R 7;_uu_4pTP+4pRRR4X'd!T^,P R 4'dR#XUu.uFqwP1R R 4NK ppT!T4p Y8wg T'd\3TRRR7wr\4P6!T RRR7;_uu_4pTP9T 4TP;4\4P<!TP?44RRR4\AY4R#R# \dR#i;i \ dR#i;i +'giELV;i \,dR#i;i +'giELI;i \ dR#i;iuupi +'giL;i \Bd+\4PD!T 4h \Fdhi;ii;i \ dR#i;i)aPre-sanitize a .env file before python-dotenv reads it. Sniffs a leading BOM *before* any text decode: UTF-16 (Notepad "Unicode") is rewritten as clean UTF-8; UTF-32 is refused (left untouched) so we never fall through to the errors=replace corruption path.N)_sanitize_env_linesFz^Skipping .env sanitize for %s: UTF-32 BOM detected; leaving file untouched to avoid corruptionzutf-16)encodingnewlineTrreplace)rru�rz.tmpz.env_)rprefixwzutf-8)r)$r,hermes_cli.configr ImportErrorrrv startswithr BOM_UTF32_LE BOM_UTF32_BEr4rYr r{loggerwarning BOM_UTF16_LE BOM_UTF16_BEr TextIOWrapperBytesIO readlinesropenrrr-fdopen writelinesflushfsyncfilenor BaseExceptionunlinkr) rrrforce_utf8_rewritepath_keyforiginalliner sanitizedfdtmps & r_sanitize_env_file_if_neededr%s ;;==9oo  ~~f))**cnnV=P=P.Q.Qt||~& . .  # #H - NNHIM O ~~f))**cnnV=P=P.Q.Q !!"**S/HdSSWX;;=T" d[CCq;;=D  ..x88  9ABLL,B'1  $6$T&IGB YYr399QLL+GGIHHQXXZ(:s)%7Y  $TSS!    DCC   C :9 ! IIcN     sJJ5KJ,K+K&KK&MK8!M9M !L+AK=1L JJ J)(J), J= 7K=K KK K# K&#K&& K54K58M= L L ML32M3 M>MMMM MMrV project_envload_external_secretsTc(V^8dQhRRRRRRRR/#)rrVrr&r'rrz list[Path]r)rs"rr r s8nn)n*n n  nr!cv^RIHpV!4e.#^RIHpV'd \ V4MV!4p^RIHp^RIHpHp\4P4p V!4'dV!4eVP4V 8wgV!4P4V 8wd\VP44p V \9d,\PV 4\PRV4V'd(^RIHp V P%4'g \'V4.#.p VR, p V'd \ V4MRp\)\*4pV P-4'd \/V 4V'd"VP-4'd \/V4V P-4'd+\1V R VR 7V P3V 4\5V 4VR , pVP-4'd4\6P8P;R 4'g\1VR VR 7V'd:VP-4'd$\1W'*VR 7V P3V4\<'d\<P;\VP44/4P?4F?wpp\6P8P;V4V8wgK,V\6P8V&KA ^RIHp V'd"V P%4'g \AV4\CVR7\EV4V #)zLoad Hermes env files: ``~/.hermes/.env`` overrides stale shell exports; project ``.env`` is a dev fallback that only fills gaps when the user env exists (and overrides shell vars when it does not).reN)get_process_hermes_home)is_multiplex_active)get_hermes_homeget_hermes_home_overridezumultiplex: skipping process-global dotenv load for routed profile home %s (credentials resolve via the profile scope))_early_recoveryriT)rrrjOP_SERVICE_ACCOUNT_TOKENF)r)#rsrfhermes_constantsr*rr%r+r,r-_process_hermes_homerYr4r r{rdebugrr.$_should_skip_external_secret_sourcesr`rrr,r%rrr1r-r.r7rrx_apply_external_secret_sources_apply_managed_env_reapply_terminal_config_bridge)rVr&r'rfr* home_pathr+r,r- launch_homer}r.loadeduser_envproject_env_pathrrrrs$$$ rload_hermes_dotenvr<s_@+ 9%0[!6M6OI7J&(002K":"<"H""$ 37H7P7P7RVa7ay((*+ . .  # #H - LLWXa c 2"GGII.y9 F6!H,7tK(T^$I$X.,3355$%56"8diP h-h7  "F }}rzz~~.HII"6EYO,3355"#3jT]^ &' &%9==c)BSBSBU>VXZ[aacKD%zz~~d#u,#( 4 d+_%Y%Y%[%[&y1+$I. Mr!c V^8dQhRRRR/#rr7rrr*r)rs"rr r gs   t    r!c\V4P4\4P48wdR#^RIHpV!RR7R# \ dR#i;i)zRe-assert config.yaml's explicit ``terminal.*`` keys over reloaded .env via the single shared bridge ``apply_terminal_config_to_env`` (also used by terminal_tool and the TUI/dashboard launchers) so the semantics can't drift between sites.N)apply_terminal_config_to_env)env)rrYr1r r@rv)r7r@s& rr6r6gsI  ? " " $(<(>(F(F(H H B$.    s4A A AAc V^8dQhRRRR/#)rrrrr*r)rs"rr r us^^Z^4^r!c^RIHpVP4pTfR#TR, pTP 4'gR#\ T4\ TRTRR7R# \dR#i;i)zApply the managed-scope .env last, with override, so it beats user/shell. Does NOT stop the agent from later mutating os.environ (v1 relies on filesystem permissions). Fail-open: never blocks startup.rNriT)rrr)rrrrvr,r%r)rrr managed_envs$ rr5r5usj,#335 &K      -{TYX\] sA A*)A*c V^8dQhRRRR/#r>r)rs"rr r s$:$:D$:d$:r!ca a a \\V4P44o \P S 4pV'gR#^RIHp\V!\V4R, 44\,p/pVP4EF%wo wo rgV!S S 4'd S Wg3VS &K"S V9d]\PP S 4V8Xd9Vf"\PPS R4MV\PS &\;QJd3V V V 3Rl\P44F 'gK RM( RM$!V V V 3Rl\P444p\P S 4S 8XgEKV'dEK\PS R4EK( V'd V\S &R#\PS R4R# \d\\4pELi;i)a Take back what a source wrote into ``os.environ`` for *home_path* once nothing backs it. ``keep(name, source)`` says which recorded writes are still owned. Every other write is revoked, but only while ``os.environ`` still holds exactly the value the source wrote: a value another owner replaced since (the profile's ``.env``, the administrator-managed ``.env``, a shell export, a later source) is theirs and stays. A revoked name gets back the value it held before the source's first write, or is removed when it had none.Nr#ric3r<"TF,wrVS8wgKVPSR4^,S8HxK. R#5i)rN)r)r7)rpr0otherr}rr|s& rrq/_revoke_secret_source_writes..s8XC sh 0EIIdE "1 % /Cs 7$7TF)r4rrYrr7r%r$r&rrvrxr-r.rtrr ) r7keepwritesr$owned_by_dotenvkeptrpriorstill_attributedr}rr|s &$ @@@r_revoke_secret_source_writesrPs4 ?**,-H * . .x 8F 44mDOf,DEFI]]46D(. $$vu f   %/DJ   &2::>>$+?5+H} tT*#( 4 3X;AACX333X;AACXX   t $ .7G7G   d +)7 26%h/%))(D9) 4234s2GG=<G=c V^8dQhRRRR/#r>r)rs"rr r s"^@^@d^@t^@r!c a\\V4P44pV\9dR#\ V4pT'g\ TRR7R#\;QJd*RTP44F 'gK RM RM!RTP444pT'g\ TRR7R#^RI H pH pT!Y 4oSe\ TT3R lR7\\P4pT!Y 4pTP 'gR#\P#T4TP$'dA\'4TP(P+4FwrT P,\.T&K /p \1T4p T F3pT\P9gK\PT,Y&K5 \3YY4T 'd T \4T&TP(P+4U U u/uF*wrT P6'gKY9gK!YT ,bK, up p \8T&TP EFupTP:'d^\=R TP> R \ATP:4 R \ATP:4^8wdR MR 2\BPDR7TPFPH'd\=R TP> RTPFPH 2\BPDR7\KTPLTPFPNY!R7pT'd,\=R TP> RT 2\BPDR7TPFPPF.p\=R TP> RT 2\BPDR7K0 EKx TPRF!p\=RT 2\BPDR7K# R# \ dR#i;i \dR#i;i \ dRoELZi;i \ dR#i;iuup p i)ucPull secrets from every enabled external source into env — AFTER dotenv (sources need .env bootstrap tokens), BEFORE Hermes reads credentials; failures never block startup. Precedence/conflicts/provenance live in ``registry.apply_all``; this wrapper owns the once-per-home guard, the post-apply ASCII sweep, the ``_SECRET_SOURCES`` map and status lines.NcR#Frr_sources&&r0_apply_external_secret_sources..Er!rJc3x"TF0p\V\4;'dVPR4RJxK2 R#5i)enabledTN) isinstancerXr7)rpvs& rrq1_apply_external_secret_sources..s2]P\1jD)FFaeeI.>$.FFP\s::TFcR#rTrrUs&&rrWrXrYr!)rhenabled_source_namesc<VS9#rmr)rr|actives&&rrWrXs 6U[K[r!z z : applied z secretrrrz: scopeu: → z Secret sources: )*r4rrYrrurvrPrrrwrhrar rXr-r.r<r{ applied_anyrr;rxr|r rB_record_secret_source_writesr authoritativerrrrrrrrnerror_remediation_hintr error_kindwarnings conflicts)r7r}r~ any_enabledrhraenviron_beforer?rrrr@narAhintwarnconflictrcs& @rr4r4sX 4 ?**,-H>! "9- $Y5QR #]PSPZPZP\]###]PSPZPZP\]]K $Y5QRQ %c5$Y5[\"**%N3* >>> x  $&#..446MD$+NNOD !7 F%f-H 2:: ::d+FL!8L 28%h/!'!2!2!8!8!:0_!:aoo RSR] !9 !:0_"8,~~ ;;; BsyykC ,<+=>"%ckk"2a"73R@BHK  T ::    BsyykCJJ$4$4#56SZZ H$SXXszz/D/DcZD399+VD62DJJ''D BsyykD6* <($$ "8*-CJJ?%_ &   >0_sY O5>PP>P-P?P?$ P?5 PP PP P*)P*- P<;P<c(V^8dQhRRRRRRRR/#) rr}r4r@rrorXrr*r)rs"rr r s*::3:(:\`:ei:r!caaa SPUu0uF,qDPP'dK VPkK. upo \P V/4p\ \V4V VV3RlR7\P V/4P4UUu/uFGwrgVSP9gK\PP V4V^,8XgKEWgbKI pppSPP4FwriV\P9dKVP V4p VP V4p V eV ^,V 8Xd V ^,MT p V P\PV,V 3W&K V'd V\V&R#\PVR4R#uupiuuppi)aRefresh ``_SECRET_SOURCE_WRITES_BY_HOME`` after one process-global pass, revoking a write its still-enabled source has stopped supplying (rotated out, mapping removed). A source whose fetch FAILED this pass keeps its earlier writes: a transient vault outage is not a revocation.cV<VSP9;'gVS9;'gVS9#rm)r;)rr|failedr?r@s&&rrW._record_secret_source_writes..s/$&*;*;";"c"ctx?O"c"cSY]cSc"cr!rZN)r<rnrorrr7rPrrxr;r-r.r|rt)r}r?r@rorApreviousrrecrKrbeforeearlierrNrxs&ff& @rrgrgsf#).. F.3 hchh. FF,002>H  X ce*G)J)J8UW)X)^)^)`S)`IDV...35::>>$3G3q63Qdi)`FS**002  rzz ! ##D),,t$%1gajF6J PV 4(8%@ 328%h/%))(D9%G SsF:F: F?:(F?'F?rec(V^8dQhRRRRRRRR/#)r source_namer4 secrets_cfgrXrer5rr)rs"rr r (s*  3  Q[ gj r!c ^RIHpV!WR7pVfR#VPV4p\V\4'dTM/p\ VP W4;'gR4P4# \dR#i;i)zbThe failed source's one-line fix-it hint; a plugin remediation() could raise and startup must not.rrdr) rwrr7r]rXr4 remediationstriprv)rrkrrerr|src_cfgs&&&$ rrjrj(sv <K5 >//+.'66'B6%%j:@@bAGGII sA4AA4A44 BBc V^8dQhRRRR/#)rr7rrrXr)rs"rr r 7s%%D%T%r!crVR, pVP4'g/#V\48Xd4^RIHpV!4;'g/pVP R4;'g/#\ V4;'g/pTP R4;'g/# \ dL>i;i \ d/u#i;i)zeRead just the ``secrets:`` section of config.yaml, isolated so a malformed config can't break dotenv.z config.yaml)read_raw_configsecrets)r,r1r rr7rvr)r7 config_pathrdatas& rruru7sm+K      (**  9"$**D88I&,," ,&{399r 88I  $ $"$     s5BB!B%B&7B& B#"B#& B65B6cV^8dQhRR/#)rrrr)rs"rr r Ns''d'r!cx^RIHpV!4# \d \P!4R, u#i;i)uThe HERMES_HOME the running process was launched under. Must be the *true* process home, ignoring any context-local ``set_hermes_home_override`` a per-request task has installed. Both callers depend on that: * ``_reapply_terminal_config_bridge`` guards "only re-bridge config into the shared ``os.environ`` when THIS load is for the process's own profile". If this followed the task override, a per-turn handler scoped to a *secondary* profile (the multiplex dashboard serving every profile from one process) would satisfy the guard and bridge that profile's ``terminal.backend`` into the shared env — e.g. a ``local`` sibling profile clobbering the launch profile's ``TERMINAL_ENV=ssh`` while leaving its ``TERMINAL_SSH_*`` untouched, so the session silently runs commands locally (cross-profile terminal-backend leak). * ``_load_secrets_config`` uses it to decide whether the shared (mtime,size)-keyed config cache is safe to reuse; under an override it must fall through to an isolated parse of the scoped profile. ``hermes_constants.get_routing_process_hermes_home()`` is the override-immune resolver built for exactly this; delegate to it. It is also immune to a host that mirrors the served profile into the live ``HERMES_HOME`` env var (``pin_process_hermes_home``): without that, the mirrored profile satisfied the guard above and bridged ITS ``terminal.*`` into the shared env. get_routing_process_hermes_homez.hermes)r0rrvrrcrs rr1r1Ns34'D.00 'yy{Y&&'s '99)_API_KEY_TOKEN_SECRET_KEY>COPILOT_CLI_PATHCOPILOT_ACP_BASE_URLHERMES_ACP_AUTH_METHODHERMES_ACP_AUTO_APPROVEHERMES_COPILOT_ACP_ARGSHERMES_COPILOT_ACP_COMMANDrm))J__conditional_annotations____doc__ __future__rrr itertoolsloggingr-r threadingpathlibrdotenvutilsrrr getLogger__name__rrr&r__annotations__r r r r rrrrrrRLockr^rcountrrrOrrr'r1r8rBrGrKrPrSr[r`r_rrrrrrrrrr%r<r6r5rPr4rgrjrur1)rs@rrs&L"   II   8 $A h #X% #X%#%$ $'5( !$X%"%h&;=8=<> 9>TVPU5 %OO-=?9>" *34T3U)VV -67-> $  ( "H* + Y B=@7*&  B_" ".#;?#QV#DC Ln,0n-1n#' nb  ^$^$$:N^@B:2 ^b %.'r!