+ lHj8a>aRvt%0tRt^RIt^RIt^RIHtRt]!R04t]!0RkRkRkRkR kR kR kR kR kRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkR kR!kR"kR#kR$kR%kR&kR'kR(kR)kR*kR+kR,kR-kR.kR/kR0kR1kR2kR3kR4kR5kR6kR7kR8kR9kR:kR;kRkR?kR@kRAkRBkRCkRDkREkRFkRGkRHkRIkRJkRKkRLkRMkRNkROk4t RPRQlt RRRSlt RTRUlt ] !4t ] !4t] ],t/t]^kRVRWltRXRYltRZR[ltRwR\R]lltRxtR^R_ltR`RaltRbRcltRytRdReltRzt]!RfRg04t]P:!^Rh7RiRjl4tRkRlltRwRmRnllt RoRplt!RqRrlt"]!0R{m4],] !RsRt7,t#]^k]!Ru]#44t$]^kR#)|a Secret-scrub policy for Hermes child processes: pure data + predicates for which env names are Hermes-managed credentials. The env *builders* applying it (``_make_run_env``, ``_sanitize_subprocess_env``, ``hermes_subprocess_env``) live in ``tools.environments.local``.N)Optional_HERMES_FORCE_AWS_BEARER_TOKEN_BEDROCKOPENAI_BASE_URLOPENAI_API_KEYOPENAI_API_BASE OPENAI_ORG_IDOPENAI_ORGANIZATIONOPENROUTER_API_KEYANTHROPIC_BASE_URLANTHROPIC_API_KEYANTHROPIC_TOKEN LLM_MODELGOOGLE_API_KEYVERTEX_CREDENTIALS_PATHGOOGLE_APPLICATION_CREDENTIALSDEEPSEEK_API_KEYMISTRAL_API_KEY GROQ_API_KEYTOGETHER_API_KEYPERPLEXITY_API_KEYCOHERE_API_KEYFIREWORKS_API_KEY XAI_API_KEYHELICONE_API_KEYPARALLEL_API_KEYFIRECRAWL_API_KEYFIRECRAWL_API_URLTELEGRAM_HOME_CHANNELTELEGRAM_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNELDISCORD_HOME_CHANNEL_NAMEDISCORD_REQUIRE_MENTIONDISCORD_FREE_RESPONSE_CHANNELSDISCORD_AUTO_THREADSLACK_HOME_CHANNELSLACK_HOME_CHANNEL_NAMESLACK_ALLOWED_USERSWHATSAPP_ENABLED WHATSAPP_MODEWHATSAPP_ALLOWED_USERSSIGNAL_HTTP_URLSIGNAL_ACCOUNTSIGNAL_ALLOWED_USERSSIGNAL_GROUP_ALLOWED_USERSSIGNAL_HOME_CHANNELSIGNAL_HOME_CHANNEL_NAMESIGNAL_IGNORE_STORIES EMAIL_ADDRESSEMAIL_PASSWORDEMAIL_IMAP_HOSTEMAIL_SMTP_HOSTEMAIL_HOME_ADDRESSEMAIL_HOME_ADDRESS_NAMEHERMES_DASHBOARD_SESSION_TOKENGATEWAY_ALLOWED_USERSGH_TOKEN GITHUB_APP_IDGITHUB_APP_PRIVATE_KEY_PATHGITHUB_APP_INSTALLATION_IDMODAL_TOKEN_IDMODAL_TOKEN_SECRETDAYTONA_API_KEYGATEWAY_RELAY_IDGATEWAY_RELAY_SECRETGATEWAY_RELAY_DELIVERY_KEYVERCEL_OIDC_TOKEN VERCEL_TOKENVERCEL_PROJECT_IDVERCEL_TEAM_ID NOUS_API_KEY QWEN_API_KEYHERMES_ANON_API_SECRET$HERMES_DASHBOARD_BASIC_AUTH_PASSWORD"HERMES_DASHBOARD_BASIC_AUTH_SECRETHERMES_DASHBOARD_DRAIN_SECRET#HERMES_DASHBOARD_OIDC_CLIENT_SECRETHERMES_MEET_REALTIME_KEYc0V^8dQhR\R\/#) secrets_onlyreturn)bool frozenset)formats"H/home/ubuntu/.hermes/hermes-agent/tools/environments/local_env_policy.py __annotate__rX7seeDeYec:a^RIHp\V3RlV44#)zEnv of features that left core for a catalog plugin (``hermes_cli.left_core_migration``): stripped exactly as when core shipped them, plugin installed or not.) LEFT_COREc3<"TF5pVPS'dRM VP,FpVxK K7 R#5i)N) secret_env private_env).0featurenamerRs& rW !_left_core_env..;s<eg!(!3!3\rwObOb!c!c!cs A%A)hermes_cli.left_core_migrationr[rU)rRr[sd rW_left_core_envrf7s%9 ee eerYc$V^8dQhR\/#rQrSrU)rVs"rWrXrX?s##y#rYc\\4\RR7,p^RIHpVP 4FspVP VP4VPR8XdVP \4VP'gKXVPVP4Ku ^RI HpVP4FPwrEVP!R4pVR 9g#VR8XgK&VP!R4'gK?VPV4KR VP#R 4\%V4# \dLi;i \dL:i;i) z=Derive the blocklist from provider, tool, and gateway config.FrR)PROVIDER_REGISTRYaws_sdk)OPTIONAL_ENV_VARScategorysettingpasswordCLAUDE_CODE_OAUTH_TOKEN>tool messaging)set_STATIC_PROVIDER_ENV_BLOCKLISTrfhermes_cli.authrlvaluesupdateapi_key_env_vars auth_type_AWS_SDK_CREDENTIAL_ENV_VARSbase_url_env_varadd ImportErrorhermes_cli.configrnitemsgetdiscardrU)blockedrlpconfigrnrbmetadataros rW_build_provider_env_blocklistr?s:;nZ_>``G  5(//1G NN733 4  I-;<''' G445 2 7/557ND||J/H00 )hll:.F.F D! 8" OO-. W 1        s6A)D6D607E,EE6 EE EEc$V^8dQhR\/#rhri)rVs"rWrXrXes9rYcaa^RIHoHpHoHp^RIHp0RmpVPV3RlVP444W1!RRR7,pVPV3RlV!444\V4#) aSSecrets the messaging adapters declare, process-wide: core ``password`` messaging entries of OPTIONAL_ENV_VARS, the bundled platform plugin manifests' secret entries, and the secret-named keys the gateway env-override table reads (WEIXIN_TOKEN, FEISHU_ENCRYPT_KEY, ...). Declared names only: a user's own ``SLACK_USER_TOKEN`` or ``LOCAL_LLM_API_KEY`` is not Hermes's. A profile's user-installed platform plugins are per home: :func:`_home_adapter_secret_env`. Nothing here fails soft: an unreadable bundled manifest or env table fails the import rather than dropping its secrets from the policy.)CORE_DECLARED_ENV_NAMESrnPLATFORM_SECRET_ENV_SUFFIXESplatform_manifest_secret_envs)config_env_table_keysc3<"TFQwrVS9gKVPR4R8XgK&VPR4'gK?VP4xKS R#5i)rortrqN)rupper)r`rbmetars& rWrc,_build_adapter_secret_env..wsUS0I*$33XXj)[8=AXXj=Q0Is AAAAbundledT)sourcestrictc3<"TF;qP4PS4'gK)VP4xK= R#5iNrendswithr`nrs& rWrcr{s/p$;qwwy?Q?QRn?o$;s &AA>QQ_STT_API_KEYYUANBAO_APP_KEYFEISHU_ENCRYPT_KEYMSGRAPH_CLIENT_SECRETFEISHU_VERIFICATION_TOKENMSGRAPH_WEBHOOK_CLIENT_STATE) rrrnrrhermes_cli.profile_channelsrryrrU)rnrrnamesrrs @@rW_build_adapter_secret_envrestqqA ]E LLS0A0G0G0ISS *)D IIE LLp$9$;pp U rYc$V^8dQhR\/#rhri)rVs"rWrXrXs)rYcV^RIHpHp^RIHpHpV!4pV!V4V!V4re\ PV4pVeV^,eV^,V8wdJV!V4wrV\,pV 'gVeW^,,pV 'dTMRV3pV\ V&V^,#)aSecrets declared by the bound profile's own user-installed platform plugins. Per home, not process-wide: under multiplex profile A's plugin must neither strip a same-named value from profile B's children nor be missing from A's. Cached per home and keyed on every manifest's file signature, so an edit, replacement or deletion takes effect on the next spawn. A plugin manifest under ``plugins/platforms/`` that cannot be read raises. A partial scan (a plugin dir or flat manifest unreadable or unparsable) keeps the names this home already had and is not cached, so a failed discovery never releases a known denial and recovery is seen at once.)platform_manifest_secret_scanplatform_manifest_stamp)get_hermes_homehermes_home_keyN) rrrhermes_constantsrr_HOME_ADAPTER_SECRET_CACHEr_ADAPTER_SECRET_ENV) rrrrhomekeystampcachedrcompletes rW_home_adapter_secret_envrsYA  D &(?(E ' + +C 0F ~*fQi5.@7= $$F. AY E#%u5*0"3' !9rYc$V^8dQhR\/#rhri)rVs"rWrXrXsJJiJrYcba^RIHp^RIHo\ V3RlVP 444#)a4Secret-named ``required_env`` of the adapters registered in the current profile scope. Tier 2 only: ``required_env`` is an unchecked setup list, so a plugin naming OPENAI_API_KEY must not strip it from credentialed children. No blanket fallback: a registry error surfaces instead of an empty (fail-open) set.platform_registry)rc3<"TF<pVP4PS4'gK*VP4xK> R#5irrrs& rWrc/_registry_adapter_secret_env..s8J(N1 **+GHQWWYY(Ns 'AA)gateway.platform_registryrrrrUrequired_env_names)rrs @rW_registry_adapter_secret_envrs2 <> J(9(L(L(NJ JJrYc$V^8dQhR\/#rhri)rVs"rWrXrXsGG GrYc4\4\4,#)zPer-call adapter secrets: the bound profile's user-plugin declarations (Tier 1, see :func:`_home_adapter_secret_env`) plus the registered adapters' (Tier 2, :func:`_registry_adapter_secret_env`).)rrr]rYrW_registered_adapter_secret_envrs ( ),D,F FFrYcJV^8dQhR\R\R,R\/#)rQrb _registeredNrS)strrUrT)rVs"rWrXrXs, _ _s _T9I _UY _rYczVP4pV\9g V\9dR#Y!f \49#T9#)a``name`` is a blocklisted provider/tool credential or adapter secret, matched the way the platform's environment resolves names: exact plus case-folded. On Windows the environment block is case-insensitive, so ``openai_api_key`` IS ``OPENAI_API_KEY``; consistent with ``_is_hermes_internal_secret``, which already folds (``key.upper()``). Loops pass ``_registered`` so the registry is read once per env, not once per key.T)r_HERMES_PROVIDER_ENV_BLOCKLISTr)rbrrs&& rW_is_provider_env_blocklistedrs> JJLE --:X1X 9L35 ^^R] ^^rYc0V^8dQhR\R\/#rQrbrSrrT)rVs"rWrXrXsGGsGtGrYcHVP4P\4#)u]Pure name check (``BUZZ_*``), regardless of session context — the snapshot exclusion must stay conservative even when the carve-out is inactive. Case-folded: on Windows the env block is case-insensitive, so a lowercase-stored ``buzz_private_key`` IS the credential; it needs the carve-out (and the snapshot exclusion) just like the canonical name.)r startswith"_TERMINAL_FIRST_PARTY_ENV_PREFIXESrbs&rW$_matches_terminal_first_party_prefixrs ::< " "#E FFrYc$V^8dQhR\/#rh)rT)rVs"rWrXrXstrYc\PPR4'dR#^RIHpV!RR4P 4P 4R8H# \dR#i;i)uTrue when this process/session operates as a Buzz agent: ``BUZZ_MANAGED_AGENT`` in the process env (set only by Buzz Desktop's buzz-acp harness), or the live session's platform is ``buzz`` via the gateway ContextVar — authoritative under a concurrent multi-session host, so a sibling Telegram session resolves its OWN platform. Gateway / CLI / cron / kanban processes never carry it. See #76243. BUZZ_MANAGED_AGENTTget_session_envHERMES_SESSION_PLATFORMbuzzF)osenvironrgateway.session_contextrstriplower Exceptionrs rW_buzz_terminal_context_activers[ zz~~*++;8"=CCEKKMQWWW s-A A&%A&c0V^8dQhR\R\/#rr)rVs"rWrXrXsZZsZtZrYc<\V4;'d \4#)z``name`` is a first-party platform credential (``BUZZ_*``) AND the current process/session context entitles it to reach terminal children.)rrrs&rW_is_terminal_first_party_envrs 0 5 Y Y:W:YYrYc0V^8dQhR\R\/#)rQrrSr)rVs"rWrXrXs ` `C `D `rYcVP4pVPR4'dVPR4'dR#VPR4;'dVPR4#)a}True for Hermes-internal secrets injected under *dynamic* names the static blocklist cannot enumerate: ``AUXILIARY__API_KEY``/``_BASE_URL`` (per-task side-LLM credentials) and ``GATEWAY_RELAY_*_SECRET``/``_KEY``/``_TOKEN`` (relay auth; non-secret routing hints stay visible). Stripped on every spawn path regardless of env_passthrough registration or ``inherit_credentials``. AUXILIARY_TGATEWAY_RELAY_)_API_KEY _BASE_URL)_SECRET_KEY_TOKEN)rrr)rrs& rW_is_hermes_internal_secretrsV IIKE  %%%..9R*S*S   , - _ _%..A^2__rYGATEWAYQQ)maxsizec$V^8dQhR\/#rhri)rVs"rWrXrX9s K K9 KrYc<\\4p^RIHpVP RVP P 444VP4wr#VP V4VP V4\RV44# \dLi;i)uBuilt-in ``Platform`` values plus bundled platform plugins (directory names and manifest aliases) — fixed for the life of the process, so scanned once.)Platformc38"TFqPxK R#5ir)value)r`ms& rWrc,_static_gate_env_prefixes..?sD&CWW&Csc3"TF7q'gK \V4P4PRR4xK9 R#5i-_Nrrreplacer`rs& rWrcrEs/Ju!5SV\\^++C55u A1A) ru_EXTRA_GATE_ENV_PREFIXESgateway.configrry __members__rx_scan_bundled_plugin_platformsrrU)rrraliasess rW_static_gate_env_prefixesr8s ( )E + Dh&:&:&A&A&CDD#BBD W W JuJ JJ    sA*B BBc$V^8dQhR\/#rhri)rVs"rWrXrXHs  Y rYc\\44p^RIHpVP RVP 444\V4# \ dLi;i)uUpper-cased owners of authorization gates: the static set plus runtime-registered plugin adapters (``platform_registry``, dynamic and profile-scoped, so read per call — a cheap set union under the registry lock).rc3"TF7q'gK \V4P4PRR4xK9 R#5irrrs& rWrc._platform_gate_env_prefixes..Os2i?c!gh5SV\\^++C55?cr)rurrrryregistered_namesrrU)rrs rW_platform_gate_env_prefixesrHsW )+ ,E ? i?P?a?a?cii U     s,A AAcRV^8dQhR\R\\,R\/#)rQrb _prefixesrS)rrrUrT)rVs"rWrXrXUs+ F Fc Fhy.A FT FrYcaVP4oSPR4'gSPR4'dR#\;QJd#V3Rl\4F 'gK RM RM!V3Rl\44'gR#VeTM \ 4p\;QJdV3RlV4F 'gK R# R#!V3RlV44#)ulTrue for a platform authorization gate (``DISCORD_ALLOWED_CHANNELS``, ``TELEGRAM_ALLOW_ALL_USERS``, ``GATEWAY_ALLOWED_USERS``, ``WHATSAPP_GROUP_ALLOW_FROM`` ...) — profile-scoped policy a child acting for ANOTHER profile must never inherit. A gate is a platform prefix AND a gate-shaped suffix; an operator variable that merely contains ``_ALLOWED_`` is not one.HERMES_rFc3,<"TF qS9xK R#5irr])r`markerrs& rWrc&is_profile_gate_env..]sG-F6-FsTc3T<"TFpSPVR,4xK R#5i)rN)r)r`prefixrs& rWrcr `s#EH&u --Hs%()rrany_PROFILE_GATE_ENV_MARKERSr)rbrprefixesrs&& @rWis_profile_gate_envrUs JJLE  ""e&6&6s&;&; 3G-FG333G-FG G G%1y7R7TH 3EHE33E3E3EHE EErYc0V^8dQhR\R\/#)rQenvrS)dict)rVs"rWrXrXcsrYc\4pVUu.uFp\W!4'gKVNK upFpWK V#uupi)zTDrop every authorization gate from *env* in place (see :func:`is_profile_gate_env`).)rr)rrkrs& rWstrip_profile_gate_envrcs>*,HC3a"5a"B3C HD JDs;;c$V^8dQhR\/#rhri)rVs"rWrXrXks   rYcT^RIHpV!4# \d\4u#i;i)zCredential env keys owned by plugin-registered terminal backends (Tier-1: stripped from every spawned subprocess). Computed at call time because plugins register after import; fail-soft to empty.plugin_strip_env_keys)agent.terminal_env_registryrrrUrs rW_plugin_terminal_env_strip_keysrks*E$&& {s ''Trkc#@"TFqP4xK R#5ir)r)r`rs& rWrcrcs0WDVqDVscV^8dQh/^\9d\\\3,;R&^\9d\\,;R&^\9d\\,;R&#)rQr_ALWAYS_STRIP_KEYS_ALWAYS_STRIP_FOLDED)__conditional_annotations__rrtuplerU)rVs"rWrXrXscbbH21De,1Ibr ==IcN=s bZ XWinW[ brYr)BUZZ_) VIRTUAL_ENV CONDA_PREFIX PYTHONHOME) _ALLOWED_ _ALLOW_ALL_ _ALLOW_FROM _ALLOW_BOTS_ALLOW_PUBLIC__IGNORED_CHANNELS_NO_THREAD_CHANNELS_FREE_RESPONSE_CHANNELS_BACKFILL_CHANNELS_GROUP_ALLOWED>r: GITHUB_TOKENr;r3r>r@SLACK_APP_TOKENSLACK_BOT_TOKENrADISCORD_BOT_TOKENr?TELEGRAM_BOT_TOKENrBSLACK_SIGNING_SECRETr9GATEWAY_ALLOW_ALL_USERSrCr=r<rMr8rLrNrK)&r$__doc__ functoolsrtypingr!_HERMES_PROVIDER_ENV_FORCE_PREFIXrUr|rvrfrr_PROVIDER_ENV_BLOCKLISTrrrrrrrrrrr_ACTIVE_VENV_MARKER_VARSrrr lru_cacherrrrrr"r#rX)r$s@rWrBsMb %5! )*D)EF!*!,!,'!,):!,R!,!, 5!,7I!,!,.!,0A!,CS!,!,9!,;P!, !!, !8!!,"#!,"&#!,"(9#!,";L#!,$%!,$4%!,$6V%!,&'!,&('!,&*9'!,&;X'!,(!)!,(#3)!,(5I)!,*+!,**+!,*,B+!,,!-!,,#6-!,,8F-!,./!,.*/!,67!,6#7!,<=!,<E=!,>)?!,>+J?!,@*A!,@,FA!,!"He#L889/1!8;N!N/11.JG _`&0"G$Z,I `. %i%67 Q K  K  F &/0&&'&&*t<'&==((10WDV0W'WWrY