+ jHj$a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t ^RI H t HtHt^RIHtHtHtHt]P*!]4tRt^+t^tRtR tR sR ]R &R RltR]/RRllt !RR]] 4t!RRlt"RRlt#RRlt$R#)urDrainSecretProvider — shared-bearer-secret auth for the drain-control endpoint. Non-interactive token capability of the ``DashboardAuthProvider`` ABC (``verify_token`` + the ``token_auth`` middleware seam): ``nous-account-service`` provisions a per-agent unique secret (``HERMES_DASHBOARD_DRAIN_SECRET``, env-only — it is a credential); an inbound bearer is compared constant-time and vouched for as the ``drain-control`` principal. Fail-CLOSED entropy gate at registration (length, distinct chars, Shannon bits); interactive ABC methods raise. Knobs ``scope`` / ``min_secret_chars`` live under ``dashboard.drain_auth``. ) annotationsN)Counter)Optional)DashboardAuthProviderSessionTokenPrincipal)NonInteractiveMixinSkipRegistrationload_config_sectionregister_providerzdashboard-auth-draing`@z/api/gateway/drainstrLAST_SKIP_REASONc V^8dQhRRRR/#)valuer returnfloat)formats"J/home/ubuntu/.hermes/hermes-agent/plugins/dashboard_auth/drain/__init__.py __annotate__r'scaV'gR#\V4o\V3Rl\V4P444)pVS,#)zJTotal Shannon entropy (bits) of ``value`` over its character distribution.gc3x<"TF/qS, \P!VS, 4,xK1 R#5iN)mathlog2).0cns& r _shannon_bits..,s*P8O1UdiiA...8Os7:)lensumrvalues)rper_charr s& @r _shannon_bitsr''s<  E AP8M8M8OPPPH a<r min_charsc$V^8dQhRRRRRR/#)rsecretr r(intrz Optional[str]r)rs"rrr0s"3cZgrcV'gR#\V4V8dR\V4 RV R2#\\V44pV\8dRV R\ R2#\V4pV\8dRVR R \R R 2#R #) zHuman-readable rejection reason if ``secret`` is too weak, else ``None``. Checks, in order: length >= ``min_chars``, distinct chars >= ``_MIN_DISTINCT_CHARS``, Shannon entropy >= ``_MIN_SHANNON_BITS``.zsecret is emptyzsecret too short: z chars (need >= z]; use a >=256-bit value, e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`)zsecret has only z distinct characters (need >= z); looks structured/low-entropyzsecret entropy too low: z.0fz bits (need >= z); looks structured/repeatedN)r#set_MIN_DISTINCT_CHARSr'_MIN_SHANNON_BITS)r*r(distinctbitss&$ rassess_secret_strengthr20s   6{Y V -=i[I3 3 43v;H%%!(+IJ]I^^}~~  D )$s?CTUXBYYuvv rcv]tRt^DtRtRtRtRtRtRt Rt RR /R R llt R R lt RRlt RRltRRltRtR#)DrainSecretProviderz@Non-interactive shared-bearer-secret provider for drain control.z drain-secretz"Drain Control (service credential)TFzrCs&$r verify_token DrainSecretProvider.verify_tokenYsR T((g)> @S@ST[@\]]!OdiiY]YdYdXfg grc V^8dQhRRRR/#)r access_tokenr rzOptional[Session]r)rs"rrr9bsc6Grc R#rr)r>rOs&$rverify_session"DrainSecretProvider.verify_sessionbsrc V^8dQhRRRR/#)r refresh_tokenr rrr)rs"rrr9gs9999rc ,\VP4hr)NotImplementedError_NOT_INTERACTIVEr>rTs&$rrefresh_session#DrainSecretProvider.refresh_sessiongs!$"7"788rc V^8dQhRRRR/#)rrTr rr8r)rs"rrr9jsstrc R#rrrXs&$rrevoke_session"DrainSecretProvider.revoke_sessionjsr)r=r<N)__name__ __module__ __qualname____firstlineno____doc__rK display_namesupports_tokensupports_sessionrW_NO_START_LOGINr@rLrQrYr]__static_attributes__rrrr4r4DsJJ D7LNUlO'G' 9rr4cV^8dQhRR/#rrdictr)rs"rrrpsHHHrc.\\\RR4#) dashboard drain_auth)r logger_TAGrrr_load_config_drain_auth_sectionrqps vt[, GGrcV^8dQhRR/#rjr)rs"rrrts..4.rc\PPRR4P4pV'g \ R4h\ 4p\ VPRR4;'gR4P4;'gRp\VPR\44p\WR7pVe\ RV R 2R R 7hR VRV/# \\3d \pL@i;i) zPResolve DrainSecretProvider kwargs from env/config; raises ``SkipRegistration``.HERMES_DASHBOARD_DRAIN_SECRETr zHERMES_DASHBOARD_DRAIN_SECRET is not set. Set a per-agent >=256-bit secret (e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`) to enable NAS-driven drain coordination; leave it unset to disable the drain endpoint.r5r6min_secret_chars)r(u+HERMES_DASHBOARD_DRAIN_SECRET rejected — z2. The drain endpoint stays disabled (fail-closed).warning)levelr*) osenvirongetstripr rqr r+_DEFAULT_MIN_SECRET_CHARS TypeErrorr;r2)r*sectionr5r(r?s r _settingsrts ZZ^^;R @ F F HF  [\ \./G  GW-88 9 ? ? A L LWE. $68QRS $F @F 9&As t  fgu -- z ".- .s CC*)C*cV^8dQhRR/#)rrr8r)rs"rrrs++T+rc*Rs\V\\\\ 4wpsVfR#^RIHpV!\4\PRVR,\4R# \d&p\PR\T4Rp?LORp?ii;i)zRegister ``DrainSecretProvider`` when a strong secret is set; no-op (records a skip reason) when ``HERMES_DASHBOARD_DRAIN_SECRET`` is unset or fails the entropy gate. On success also registers the drain route as token-authable via the generic seam.r N)register_token_routez;dashboard-auth-drain: could not register token route %s: %szWdashboard-auth-drain: registered drain service-credential provider (scope=%s, route=%s)r5) rr rorpr4r$hermes_cli.dashboard_auth.token_authrDRAIN_ROUTE_PATH Exceptionrvinfo)ctxkwargsrexcs& rregisterrs 0fdDWYbcF  ~mM-. KKaw)+ mTVfhkllmsA"" B-B  B)%__conditional_annotations__rc __future__rrHloggingrrx collectionsrtypingrhermes_cli.dashboard_authrrrplugins.dashboard_auth._sharedrr r r getLoggerr_rorpr|r.r/rr__annotations__r'r2r4rqrr)rs@rrs#  TTxx   8 $(#