+ lHj 7Rt^RIHt^RIt^RIt^RIt]P !R4tRtRt Rt RR0t ] !0R m4t R R ltR R ltR!R RlltRRlt] !R4tRRltRRltRRltRRltRRltRRltRRltR#)"aEgress-proxy (iron-proxy) plumbing for the Docker backend. Builds the mount/env/host args that route a sandbox through the host-side credential firewall, and guards the three config surfaces (docker_forward_env, docker_env, docker_extra_args) that could otherwise weaken or bypass it. ) annotationsNztools.environments.dockerz hermes-egressz#/etc/ssl/certs/hermes-egress-ca.crt"_HERMES_EGRESS_NODE_OPTIONS_APPEND--use-openssl-caz--use-bundled-cacV^8dQhRR/#)returnz+tuple[list[str], dict[str, str], list[str]])formats"E/home/ubuntu/.hermes/hermes-agent/tools/environments/docker_egress.py __annotate__r sT3T3'RT3ca^RIHp^RIHpT!4PR4;'g/pTPR4'g./.3#TP4p\TPRR44oR T3R llpTP'g T!R 4#TP'dTP'gT!R TP R 24#TPe!TPP4'gT!RTP R24#TP!4pT'g T!R4#RTP R\" R2.pRTP 2pRTP^, 2p RTRTRT RT RRRRR\"R\"R\"R\"R R!\$R"/ p TFcp T P&YP(&T P&T R#T P( 2&\+T R$R'4;'gR'Fp T P&Y&K Ke R%R&.p YzT 3# \d&p\ P RT4./.3uRp?#Rp?ii;i)(u``(volume_args, env_overrides, host_args)`` for routing through iron-proxy; all empty when the proxy is disabled/unconfigured/not running. Under ``proxy.enforce_on_docker`` (default) any half-configured state raises so the sandbox refuses to start unprotected; otherwise it warns and continues. Only ImportError is swallowed — a broken config must fail visibly rather than silently disable enforcement. load_config iron_proxyz%Egress proxy plumbing unavailable: %sNproxyenabledenforce_on_dockerTcV^8dQhRR/#)rmsgstrr)r s"r r 3_egress_proxy_args_for_docker..__annotate__1ssr c`<S'd \V4h\PRV4./.3#)u:%s — continuing without proxy (enforce_on_docker=false). RuntimeErrorloggerwarning)renforces&r _degraded0_egress_proxy_args_for_docker.._degraded1s- s# #SUXYB|r zvproxy.enabled is true but iron-proxy is not configured. Run `hermes egress setup` to mint tokens and write proxy.yaml.z.iron-proxy is enabled but not running on port z&. Start it with `hermes egress start`.z!iron-proxy CA cert vanished from z0. Re-run `hermes egress setup` to regenerate it.ziron-proxy is configured but mappings.json is empty or corrupt. Re-run `hermes egress setup` to mint provider tokens before starting a sandbox.z-v:z:rozhttp://host.docker.internal: HTTPS_PROXY https_proxy HTTP_PROXY http_proxyNO_PROXYz127.0.0.1,localhost,::1no_proxyREQUESTS_CA_BUNDLE SSL_CERT_FILECURL_CA_BUNDLENODE_EXTRA_CA_CERTSHERMES_EGRESS_PROXY1rHERMES_PROXY_TOKEN_alias_env_namesz --add-hostz!host.docker.internal:host-gatewayr)hermes_cli.configragent.proxy_sourcesr ImportErrorrdebugget get_statusbool configuredpid listening tunnel_port ca_cert_pathexists load_mappings _CONTAINER_CA_NODE_OPTIONS_SENTINEL proxy_token real_env_namegetattr)ripexc proxy_cfgstatusrmappings volume_args proxy_urlplain_http_url env_overridesmalias host_argsrs @r _egress_proxy_args_for_dockerrOs} 18  !!'*00bI == # #B| ]]_F9==!4d; > !H  01 1 F//0-DEK/v/A/A.BCI3F4F4F4J3KLN yynn-- m-}s 2%%4M,)* oo&AB +AOO+<=>Q 126<<"8I>Ic(V^8dQhRRRRRRRR/#)rrH list[str]rKdict[str, str]rNrrr)r s"r r r ts2DDD+9DFODTWDr cV'gV'g V'gR#\P!RVRVRV/RR R7p\P!VP R44P 4R,#) z@Stable Docker-label value for the egress posture of a container.offrHrKrNT) sort_keys separatorszutf-8:NN),r!)jsondumpshashlibsha256encode hexdigest)rHrKrNpayloads&&& r _egress_reuse_fingerprintr`tsZ =Ijj  _m[R[\:/G >>'..1 2 < < >s CCr c V^8dQhRRRR/#)rdefaultr6rr)r s"r r r s  t t r c ^RIHp\V!4PR4;'g/PRV44# \\ 3dTu#\ d#p\PRT4TuRp?#Rp?ii;i)zIRead proxy.enforce_on_docker; any config failure fails safe to *default*.rrrz:Could not read proxy config for egress collision check: %sN) r0rr6r4r2OSError Exceptionrr)rbrrDs& r _egress_enforce_on_dockerrfsp1[]&&w/552::;NPWXYY  ! SUXYs.'AABBB A=7B=Bc V^8dQhRRRR/#)rrKrRrset[str]r)r s"r r r sKKnKKr cP\\4R0,\V4,#)agEnv names that would weaken or bypass enforced egress if overridden. Every name the egress layer writes is critical: mapped tokens land under arbitrary ``real_env_name``/``alias_env_names`` entries from mappings.json, so a suffix heuristic would silently unprotect any mapped credential not ending in ``_API_KEY``/``_TOKEN`` (e.g. ``AWS_SECRET_ACCESS_KEY``). NODE_OPTIONS)set_PROXY_CONTROL_ENV)rKs&r _critical_egress_env_namesrms" ! "n%5 5M8J JJr ditPqc V^8dQhRRRR/#)rargrrztuple[str, str | None] | Noner)r s"r r r s!>r cVPR4'd4VPR4wrpVR 9dVR,V'dV3#R3#R#VPR4'gR#\VR,4FFwrEV\9dKVR8Xd-W^,RpVP R4pRT;'gR3u#R# R#) z``("env"|"env-file", inline_value)`` when ``arg`` spells a docker env flag under pflag parsing, else ``None``. ``inline_value`` is the joined value (``--env=N=v``, ``-eN=v``) or ``None`` when the flag consumes the next arg (``-e``, ``--env``, ``-ite``).--=:rNNN-:NNeenv)z--env --env-file) startswith partition enumerate_DOCKER_RUN_BOOL_SHORTHANDS removeprefix)rpflagsepinlineposchrests& r _env_flag_valuers  ~~dMM#.6 * *8sV4 44 4 >>#  SW% , ,  9Qwx=D$$S)D$,,$& && r c$V^8dQhRRRRRR/#)r extra_argsrQcritical_namesrhrr)r s"r r r s"##i##V_#r c~VUu0uFq"P4kK pp.p^pV\V48dW,pVR8XdM\V4pVeVwrVR8XdVPR4MmV eT M'V^,\V48dW^,,MRp V P R^4^,p V P4V9dVPV 4YYe^M^, pKVP R4^,R9dVPV4V^, pEK\ \V44#uupi)zCReturn docker_extra_args entries that can override egress controls.rrzenv-filerxrs)z --networkz--net)upperlenrappendsplitrzsortedrk) rrncritical_folded collisionsirpparsedkind inline_valuevaluenames && r _extra_args_egress_collisionsrs  +99.Qwwy.O9J A c*o m $;  %  !' Dz!!!,/(4(@ )*QZ)@J1u%b{{3*1-::/check_forward_env_collisions..sO;a'')2N;s( (z@docker_forward_env would inject real egress-protected variables zgRemove these names from docker_forward_env or disable enforce_on_docker to opt out of egress isolation.z?Explicit docker_forward_env values will override egress tokens.rrrN)rrr)rrrrrrs&&& @r check_forward_env_collisionsrsX+33(Qwwy(3OO;OOJNzl [5Y  [4sAc(V^8dQhRRRRRRRR/#)ruser_envrR egress_envrr6rrr)r s"r r r s*....n._c.hl.r c<aaaa\4o^RIHpVP4Uu0uFqDPkK upoRVVV3Rllo\ V3Rl\S,44pV'd\RV 2VRRR7R #R #uupi \ dL[i;i) zReject docker_env overrides of proxy-control vars or real provider keys (read from the live token mappings; for those ANY override collides since a real key bypasses the swap).rc V^8dQhRRRR/#)rrrrr6r)r s"r r 1check_docker_env_collisions..__annotate__s@@S@T@r c<VS9dR#VS9d!VS9;'gSV,SV,8g#VS9;'dSV,SV,8g#)Fr)rr provider_keysrs&r _collides.check_docker_env_collisions.._collidessU H  J&FF(1+A*F FJ??8A;*Q-#??r c3H<"TFpS!V4'gKVxK R#5irr)rrrs& r r.check_docker_env_collisions..sX$Fa9UV<$Fs" "z;docker_env in config.yaml overrides egress-proxy variables z^Remove these keys from docker_env or disable enforce_on_docker to opt out of egress isolation.zTFalling back to docker_env values; sandbox traffic will NOT route through the proxy.rN) rkr1rr=rArerrlr)rrrrCrLrrrsff& @@r check_docker_env_collisionsrs"eM 8242B2B2DE2DQ2DE @@X$6$FXXJI* V*-  .F    s!B BB B BBc(V^8dQhRRRRRRRR/#) rrrQrrhrr6rrr)r s"r r r s0JJIJJTXJ]aJr cT\W4pV'd\RV 2VRRR7R#R#)z7docker_extra_args would override egress-proxy controls zNRemove these args or disable enforce_on_docker to opt out of egress isolation.z.Extra Docker args may bypass egress isolation.rN)rr)rrrrs&&& r check_extra_args_collisionsr s0.zDJEj\ RcH  Jr c(V^8dQhRRRRRRRR/#)rrrRrrr6rr)r s"r r r s*~>TX]kr cV'dV'd/VCVCM/VCVCpVP\R4pV'dVP4pVPRR4P 4pV\ 9dgVUu.uFqw\ 9gKWu8wgKVNK ppV'd\ PRW4VUu.uFqw\ 9g Wu8XgKVNK ppWV9dVPV4RPV4P4VR&VR,'gVPRR4V#uupiuupi)zMerge docker_env with egress overrides (egress wins under enforcement, docker_env otherwise) and resolve the NODE_OPTIONS sentinel: the flag is APPENDED to the operator's NODE_OPTIONS after stripping conflicting CA-mode flags so it wins deterministically.NrjrzOverriding conflicting NODE_OPTIONS CA-mode flag(s) %s with egress-required %s to keep Node routed through the egress CA store. ) popr?stripr4r_CA_MODE_FLAGSrrrjoin) rrrmerged raw_append append_tokentokenstdroppeds &&& r merge_egress_envrs,3z ' 'J 'Ga*GaX`GaF2D9J!'') NB/557 > )"(V&Q,?qADUqq&GV'(/?"(XAN+BaFWaaFX  % MM, '!$&!1!7!7!9~n%% JJ~t , MW Ys: D8 D8D8=D=D=> r&r'r$r%r"r#r)r*r(r+)T)__doc__ __future__rr[rYlogging getLoggerr_EGRESS_LABEL_KEYr>r?r frozensetrlrOr`rfrmr|rrrrrrrrr r rs#    6 7#5 =$&89 T3nD K(04#D/ [.8Jr