epj2UdZddlmZddlZddlZddlmZmZddlm Z ddl m Z m Z m Z daded <d+d Zd,dZeddZded<GddeZd-dZd.dZd/dZehdZdZd0dZd1d2d"Zd3d$Zd4d(Zd5d*ZdS)6uProfile-scoped credential resolution for multi-profile gateway multiplexing. The multiplexing gateway serves many profiles from one process. Each profile has its own ``.env`` with its own provider keys and platform tokens, so we **cannot** union them into the process-global ``os.environ`` (that would leak profile A's keys to profile B's turns, and to every subprocess spawned with ``env=dict(os.environ)``). This module provides a fail-closed, context-local secret scope: - ``set_secret_scope(mapping)`` installs the active profile's secrets for the current task (a contextvar, so it propagates into the agent's worker thread via ``copy_context()`` exactly like the HERMES_HOME override). - ``get_secret(name)`` reads from that scope. When multiplexing is **active** and no scope is set, it RAISES rather than silently falling back to ``os.environ`` — an un-migrated or newly-added call site fails loud at that exact line instead of leaking another profile's value. When multiplexing is **off** (the default), it transparently reads ``os.environ`` so the single-profile gateway and every non-gateway caller behave exactly as before. Design rationale lives in ``docs/design/multiplexing-gateway.md`` (Workstream A). ) annotationsN) ContextVarToken)Path)DictMappingOptionalFbool_MULTIPLEX_ACTIVEactivereturnNonec$t|adS)zMark whether the process is running as a profile multiplexer. Called once at gateway startup. When True, ``get_secret`` fails closed on an unscoped read instead of falling back to ``os.environ``. N)r r )r s 8/home/thesage/.hermes/hermes-agent/agent/secret_scope.pyset_multiplex_activer(sV ctS)z?Return whether the process is running as a profile multiplexer.)r rris_multiplex_activer2s r _SECRET_SCOPE)defaultz'ContextVar[Optional[Mapping[str, str]]]ceZdZdZdS)UnscopedSecretErroraRaised when a secret is read in multiplex mode with no scope installed. This is the fail-closed signal: it means a credential read reached ``get_secret`` without a profile scope active, which in a multiplexer would otherwise leak whichever profile's value happened to be in ``os.environ``. The fix is to wrap the call path in ``set_secret_scope(...)`` (the per-turn / per-adapter profile scope), not to widen the allowlist. N)__name__ __module__ __qualname____doc__rrrrr=srrsecretsOptional[Mapping[str, str]]rc6t|S)zInstall the active profile's secret mapping for the current context. Returns a token for ``reset_secret_scope``. Pass ``None`` to clear. )rset)rs rset_secret_scoper"Hs   W % %%rtokenc:t|dS)z"Restore the previous secret scope.N)rreset)r#s rreset_secret_scoper&Psrc4tS)zEReturn the active secret mapping, or None when no scope is installed.)rgetrrrcurrent_secret_scoper)Us     r>TZPWDHOMELANGPATHUSERSHELLLC_ALLTMPDIR PYTHONPATH HERMES_HOME VIRTUAL_ENV SSL_CERT_FILEHERMES_PROFILEAPI_SERVER_HOSTAPI_SERVER_PORT_HERMES_GATEWAYHERMES_KANBAN_DBHERMES_MAX_TOKENSAPI_SERVER_ENABLEDHERMES_API_TIMEOUTHERMES_KANBAN_BOARDHERMES_MAX_ITERATIONSHERMES_REDACT_SECRETSAPI_SERVER_CORS_ORIGINSHERMES_GATEWAY_LOCK_DIRHERMES_NOUS_TIMEOUT_SECONDSHERMES_KANBAN_WORKSPACES_ROOT)HERMES_KANBAN_HERMES_TELEGRAM_ TERMINAL_namestrcZtvrdStfdtDS)zGReturn True for genuinely process-global (non-profile-secret) env vars.Tc3BK|]}|VdSN) startswith).0prIs r z!_is_global_env..s/@@atq!!@@@@@@r)_GLOBAL_ENV_EXACTany_GLOBAL_ENV_PREFIXES)rIs`r_is_global_envrU}s8    t @@@@+?@@@ @ @@rr Optional[str]ct|r%tj|}||n|St}|G||}||St r|Stj|}||n|St rt d|dtj|}||n|S)u=Resolve a credential by env-var name, honoring the active profile scope. Resolution order: 1. Genuinely-global vars (``_is_global_env``) always read ``os.environ`` — they are deployment settings, not profile secrets. 2. When a secret scope is installed (multiplexed turn), read from it. Under multiplexing the scope is authoritative — an absent key returns ``default`` and we do NOT fall through to ``os.environ``, because in a multiplexer ``os.environ`` may hold another profile's value. When multiplexing is OFF, a scope miss falls through to ``os.environ``: single-profile deployments legitimately provide credentials via the process environment (systemd ``Environment=``, secret-manager wrappers like ``pass-cli run`` / ``op run``, plain shell exports) rather than ``/.env``, and the scope — installed unconditionally around e.g. every cron job — must stay a ``.env`` overlay, not a blindfold. 3. No scope installed: - multiplex INACTIVE (default deployment): read ``os.environ`` — identical to the legacy ``os.getenv`` behavior every caller had before. - multiplex ACTIVE: FAIL CLOSED. Raise ``UnscopedSecretError`` so the missing scope is caught loudly instead of leaking a cross-profile value. Nz get_secret(a1) called with no profile secret scope active while multiplexing is on. This credential read must run inside a set_secret_scope(...) block (the per-turn / per-adapter profile scope). Reading os.environ here would risk leaking another profile's value. See docs/design/multiplexing-gateway.md (Workstream A).)rUosenvironr(rr r)rIrvalscopes r get_secretr\s.d3jnnT""oss72     E iioo ?J  NjnnT""oss72 ! $       *..  C/33w.rvaluec|}|s|S|d}|dvrd}|t|kr{||}|dkr |dkr|dz }-||krC||dzd}|dr |d|dzS|S|dz }|t|k{|St jd |d dS) a-Strip a dotenv-style inline comment from a raw ``.env`` value. Mirrors python-dotenv (1.2.2) semantics, verified empirically: - Quoted values: scan for the matching close quote (backslash-escape-aware for double quotes, since ``save_env_value`` writes ``\"``/``\\`` escapes). Everything through the close quote is kept; a trailing ``# ...`` remainder after it is discarded, so ``KEY="has # inside" # trailing`` yields ``has # inside``. Non-comment trailing junk leaves the value untouched (lenient, unlike dotenv's hard parse error). - Unquoted values: truncate only at a ``#`` PRECEDED BY WHITESPACE, so ``KEY=foo#bar`` keeps ``foo#bar`` while ``KEY=value # comment`` keeps ``value``. A value that *starts* with ``#`` (``KEY=#leading``) is kept. r)'"r`\N#z\s+#)maxsplit)striplenlstriprNresplit)r]quoteich remainders r_strip_inline_commentros KKMME  !HE  #e**nnqB||d QU{{!!a%&&M0022 '',,* 1q5>) FA#e**nn 8GUQ / / / 2 8 8 : ::renv_pathrDict[str, str]c&i} |d}n#tttf$r|cYSwxYwddlm}|D]}|}|r|dr.|dr)|tdd }d|vrq| d\}}}|}|s|t|||<|S) uParse a ``.env`` file into a plain dict WITHOUT touching ``os.environ``. Used to load a profile's secrets into an isolated mapping for ``set_secret_scope``. Parses the small KEY=VALUE subset Hermes writes itself (``export`` prefix, ``#`` comments — full-line and dotenv-compatible inline, matching quotes with the writer's ``\"``/``\\`` escapes reversed — the same semantics as ``hermes_cli.config._parse_env_value``) but never mutates the process environment — that isolation is the whole point. Encoding is ``utf-8-sig`` so a leading UTF-8 BOM (Windows Notepad / PowerShell ``Set-Content -Encoding UTF8``) does not prefix the first key as ``\ufeffNAME`` and make ``get_secret('NAME')`` miss under scope. z utf-8-sig)encodingr)_parse_env_valuerdzexport N=) read_textFileNotFoundErrorOSErrorUnicodeDecodeErrorhermes_cli.configrt splitlinesrfrNrgrh partitionro) rprtextrtrawlinekey_r]s r load_env_filers?!G!!;!77 w(: ;322222  F Fyy{{ ts++   ??9 % % 2I(//11D d?? s++ Qiikk  ''(=e(D(DEE Ns 77 hermes_homect|}t|dz } ddlm}||}n#t$ri}YnwxYw|D]\}}t |r|||<|S)u)Build a profile's secret mapping from its ``/.env``. Returns a fresh dict (safe to install via ``set_secret_scope``). Genuinely global vars are intentionally NOT copied in — ``get_secret`` reads those from ``os.environ`` directly, so the scope holds only profile secrets. z.envr)get_secret_source_values)rrhermes_cli.env_loaderr ExceptionitemsrU)rhomerrexternal_secretsrr]s rbuild_profile_secret_scopers   DD6M**GBBBBBB33D99 ',,.. U #     Ns5 AA)r r r r)r r )rrr r)r#rr r)r r)rIrJr r rM)rIrJrrVr rV)r]rJr rJ)rprr rq)rrr rq) r __future__rrXri contextvarsrrpathlibrtypingrrr r __annotations__rrr RuntimeErrorrr"r&r) frozensetrRrTrUr\rorrrrrrs,#""""" ))))))))********** %%%% :DT:::  ,&&&& I(AAAA6/6/6/6/6/r";";";";J++++\r