+ lHju%a0t$Rt^RIHt^RIt^RIHt^RIHtH t ]P!] 4t ] !4tR]R&RRlt/tR ]R &R R ltR RltRRltRRltRRltRRltRRRlltRRltRRltR#)aEnvironment variable passthrough registry: the session-scoped allowlist of vars a skill's ``required_environment_variables`` (registered by ``skill_view``) or ``terminal.env_passthrough`` in config.yaml may forward into sandboxed children (execute_code, terminal), which strip secrets by default. Under profile multiplexing, forwarded values resolve through the profile's secret scope, not the process env.) annotationsN)Iterable)cfg_getread_raw_configset[str]_allowed_env_varscV^8dQhRR/#)returnr)formats":/home/ubuntu/.hermes/hermes-agent/tools/env_passthrough.py __annotate__r#shc\#)z1Get the process-wide skill passthrough allowlist.)rr rr _get_allowedr#s rzdict[str, frozenset[str]]_config_passthroughc V^8dQhRRRR/#)r namestrr boolr )r s"r rr.sRRRRrc^RIHpHpT!T4;'g T!T4# \d"p\P RY4Rp?R#Rp?ii;i)uTrue if ``name`` is a Hermes-managed provider credential per ``_HERMES_PROVIDER_ENV_BLOCKLIST`` or a dynamic Hermes-internal secret (AUXILIARY_*_API_KEY / _BASE_URL, GATEWAY_RELAY_*). Skill-declared ``required_environment_variables`` must not override this — that was the GHSA-rhgp-j443-p4rf bypass (a skill registered ``OPENAI_API_KEY`` and received it in the ``execute_code`` child); non-Hermes keys (TENOR_API_KEY, …) stay registerable. Fails closed when the blocklist cannot be imported.)_is_hermes_internal_secret_is_provider_env_blocklistedz}env passthrough: provider credential blocklist import failed; failing closed and refusing passthrough registration for %r: %sNT)#tools.environments.local_env_policyrr Exceptionloggerwarning)rrres& r _is_hermes_provider_credentialr.sU F &d + Q Q/KD/QQ  NOS X s" AA  Ac V^8dQhRRRR/#)r var_names Iterable[str]r Noner )r s"r rrDs = = =$ =rc\RV4R4F2p\4PV4\P RV4K4 R#)u.Register env var names as allowed in sandboxed environments (typically a skill's ``required_environment_variables``). Hermes-managed provider credentials are rejected (GHSA-rhgp-j443-p4rf) — such skills should use the main-process tools (web_search, web_extract, …); third-party keys pass normally.c3@"TFqP4xK R#5iN)strip).0ns& r +register_env_passthrough..Is8i7799iszenv passthrough: refusing to register Hermes provider credential %r (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Skills must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.zenv passthrough: registered %sN) _acceptedraddrdebug)r!rs& r register_env_passthroughr/DsA 8i8 9 4  5t<rcV^8dQhRR/#)r refusal_msgrr )r s"r rrSs  # rc#"VF9pV'gK \V4'd\PW4K5VxK; R#5i)z~Yield non-empty *names* that are not Hermes provider credentials; refused names are logged with *refusal_msg* (``%r`` = name).N)rrr)namesr1rs&& r r,r,Ss6  )$ / / NN; -  sAAcV^8dQhRR/#r r zfrozenset[str]r )r s"r rr_s)).)rc^RIHpV!4p\P V4pVeV#\ 4p\\4RR4p\V\4'dTMR pVP\RV4R44\!V4\V&\V,# \\3dRpLi;i \d!p\PRT4Rp?L^Rp?ii;i) zLoad ``tools.env_passthrough`` from config.yaml (cached). Same credential filter as register_env_passthrough: operator config must not tunnel provider credentials into sandbox children either (GHSA-rhgp-j443-p4rf).)hermes_home_keyNterminalenv_passthroughc3r"TF-p\V\4'gKVP4xK/ R#5ir&) isinstancerr')r(is& r r*+_load_config_passthrough..qs# PEqZ3=OEs77zenv passthrough: refusing to register Hermes provider credential %r from config.yaml (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Operator configuration must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.z4Could not read tools.env_passthrough from config: %sr )hermes_constantsr7 RuntimeErrorOSErrorrgetsetrrr<listupdater,rrr. frozenset)r7home_keycachedresult passthroughitemsrs r _load_config_passthroughrL_s1"$! $ $X .F  uF Po/=NO )+t<< " i PE P #  %.f$5! x ((+ ' "$ P KQOOPs)B%AB>%B;:B;> C) C$$C)c V^8dQhRRRR/#)r var_namerr rr )r s"r rrs>>>>rcvV\49;'gV\49;'d\V4'*#)aXTrue if *var_name* was registered by a skill or listed in config and is not a Hermes-managed credential NOW. Ownership changes after acceptance (a platform plugin registered later declares the name in its ``required_env`` or manifest), so the refusal applied at registration is re-applied here, where every child builder consumes the allowlist.)rrLr)rNs&r is_env_passthroughrPs9  ' Q Q87O7Q+Q = =28<<>rcV^8dQhRR/#r5r )r s"r rrsBB^Brcf\R\\44\4,44#)zReturn the union of skill-registered and config-based passthrough vars, minus names that have become Hermes-managed credentials since they were accepted.c3L"TFp\V4'dKVxK R#5ir&)r)r(rs& r r*&get_all_passthrough..s"B&\d:4@T&\s$ $)rFrrLr rr get_all_passthroughrUs1 Bi &?BZB\&\B BBrc$V^8dQhRRRRRR/#)r rrfallbackz str | Noner r )r s"r rrs&DDCD:DDrc^RIHpHpHpHpV!V4'dVeV#V!4pV!4fV'd V!V4#T#T!Y'dR4#T4#)aResolve an allowlisted variable without crossing profile boundaries. ``fallback`` is what the caller would have forwarded before secret scopes existed (a snapshot of ``os.environ`` / the profile ``.env``). An active multiplex scope is authoritative: a missing key returns ``None``, never the process-global env, and an unscoped read raises the fail-closed ``UnscopedSecretError``. Outside multiplexing an installed scope keeps overlay semantics and an unscoped caller keeps its fallback.)_is_global_envcurrent_secret_scope get_secretis_multiplex_activeN)agent.secret_scoperYrZr[r\)rrWrYrZr[r\multiplex_actives&& r resolve_passthrough_valuer_saOOd 4*,%#3z$AA d$4D CC( CCrc V^8dQhRRRR/#)r presentr"r zdict[str, str]r )r s"r rrs-Nrc^RIHpHpV!4pV'g/#\V4p/p\ 4F4pWP9gV!V4'dKVP V4pVfK0WdV&K6 V#)uIDeclared passthrough names the bound profile secret scope supplies but the env being filtered (*present*) lacks. A routed profile's ``.env`` and hydrated sources never enter ``os.environ`` (``load_hermes_dotenv`` skips the process-global load for a routed home), so a name-by-name filter over the process env can only forward a declared name the LAUNCH profile also happens to define — the served profile's own value has no way in (#114209). Reads the bound scope alone: never ``os.environ``, never another profile. Empty without a scope, so single-profile spawns are byte-identical.)rYrZ)r]rYrZrCrUrB)rarYrZscope additionsrvalues& r scoped_passthrough_additionsrfsgH "E  'lG "I#% ?nT22  $  #dO & rcV^8dQhRR/#)r r r#r )r s"r rrstrc6\4P4R#)zReset the skill-registered allowlist (e.g. on session reset). Clears the process-wide set; a later ``skill_view`` re-registers its vars on demand, so recovery is a single skill load.N)rclearr rr clear_env_passthroughrjs Nrr&)__conditional_annotations____doc__ __future__rloggingtypingrhermes_cli.configrr getLogger__name__rrCr__annotations__rrrr/r,rLrPrUr_rfrj)rks@r rts}U #6   8 $&"e8#24.3R, = )@>BD&.r