TdjÉ 2UdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlZddlZddlZddlmZmZddlmZddlmZmZmZmZejeZ dZ!de!Z"d Z#d Z$d Z%d Z&d Z'dZ(dZ)dZ*dZ+dZ,dZ-de.d<dddddddddZ/de.d <d!d"d#d$d%d&d#d$d'd(d)d$d*Z0d+e.d,<d-Z1de.d.<d/Z2de.d0<d1Z3de.d2<d3Z4de.d4<e5e d5e j6Z7iZ8d6e.d7<eGd8d9Z9eGd:d;Z:dd>Z;dd?ZddCZ?dDdEddIZ@dDdJddLZAddPZBddSZCddVZDddXZEdd]ZFdd_ZGdDdJddaZHddddZIddeZJdDdJddfZKddhZL dddkZMddlZNddpZOddqZPe,dddddrdd}ZQddZRddZSddZTddZUddddZVddddZWdDdddZXddZYddZZdZ[da\dge.d<ddZ]ddZ^ddZ_ddZ`dddddDddddZaddZbddddZcddDddddZdddZeddZfddZgddZhddZiddddZjddZkgdZldS)u iron-proxy (`ironsh/iron-proxy`) integration for credential-injecting egress control. Why --- Remote terminal sandboxes (Docker, Modal, SSH) currently see real upstream API credentials. A prompt-injected agent inside one of these sandboxes can ``cat ~/.config/openrouter/auth.json`` or ``printenv | grep -i key`` and exfiltrate them. iron-proxy is a TLS-intercepting egress firewall (Apache-2.0, Go binary, by ironsh). It sits between the sandbox and the internet, enforces a default-deny allowlist on outbound hosts, and *swaps proxy tokens for real credentials* on the way out. The sandbox only ever holds opaque proxy tokens — leaking them is useless, since they only work behind the configured trusted proxy boundary (the CA private key and proxy endpoint integrity are part of that boundary: if traffic can be redirected to attacker-controlled proxy infrastructure, the guarantee no longer holds). Design summary -------------- * The ``iron-proxy`` binary is auto-installed into ``/bin/iron-proxy`` on first use. Hermes pins one upstream version (``_IRON_PROXY_VERSION``) and downloads the matching tar.gz from the official GitHub Releases page, verifying the SHA-256 against the release's ``checksums.txt``. * A long-lived CA at ``/proxy/ca.{crt,key}`` is generated on first ``hermes egress setup``. Sandboxes trust this CA so iron-proxy can terminate TLS and rewrite headers. * The proxy config lives at ``/proxy/proxy.yaml``. It enumerates the per-provider allowlists and the ``secrets`` transform that does the Authorization-header swap. * Token mappings (proxy token -> real credential lookup) live alongside the config. The real credential is **never** written to the config — iron-proxy reads it from its own environment via ``{type: env, var: NAME}``. When Bitwarden Secrets Manager is configured, the real value is pulled there at proxy startup instead. * The proxy runs as a managed subprocess (``hermes egress start``), pidfile at ``/proxy/iron-proxy.pid``. Daemon output (including per-request records on v0.39) goes to ``/proxy/iron-proxy.log``; ``audit.log`` is pre-created but reserved for a future pin that supports ``log.audit_path``. * Failures (binary missing, port collision, bad config) emit a one-line warning and do *not* block agent startup. The Docker backend refuses to start a sandbox with the proxy enabled-but-down, with a clear error. This module is intentionally subprocess-driven rather than depending on any iron-proxy Python bindings — a single cross-platform binary is easier to lazy-install than a wheels-with-extension dependency, and we keep maintenance to a "bump the pinned version" loop. ) annotationsN) dataclassfield)Path)DictListOptionalTuplez0.39.0z8https://github.com/ironsh/iron-proxy/releases/download/vz checksums.txtzchecksums.txt.asczpublic-key.ascxHERMES_IRON_PROXY_MGMT_KEYi#) openrouter.ai*.openrouter.aiapi.openai.comapi.anthropic.com!generativelanguage.googleapis.comapi.x.aiapi.mistral.ai api.groq.comapi.together.xyzapi.deepseek.cominference.nousresearch.comTuple[str, ...]_DEFAULT_ALLOWED_HOSTS)rr)r)r)r)r)r)r)r)OPENROUTER_API_KEYOPENAI_API_KEY GROQ_API_KEYTOGETHER_API_KEYDEEPSEEK_API_KEYMISTRAL_API_KEY XAI_API_KEY NOUS_API_KEYzDict[str, Tuple[str, ...]]_BEARER_PROVIDERS)r)z x-api-key Authorization)hosts match_headersaliases)z*.openai.azure.comz*.cognitiveservices.azure.comz*.services.ai.azure.com)zapi-keyr')r)zx-goog-api-key)GOOGLE_API_KEY)ANTHROPIC_API_KEYAZURE_OPENAI_API_KEYGEMINI_API_KEYz%Dict[str, Dict[str, Tuple[str, ...]]]_HEADER_AUTH_PROVIDERS)AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYGOOGLE_APPLICATION_CREDENTIALS_NON_BEARER_PROVIDERS) z 127.0.0.0/8z::1/128z169.254.0.0/16z fe80::/10z 10.0.0.0/8z 172.16.0.0/12z192.168.0.0/16zfc00::/7z ::ffff:0:0/96z 100.64.0.0/10z 198.18.0.0/15_DEFAULT_UPSTREAM_DENY_CIDRS) PATHHOMETMPDIRTZLANGLC_ALLLC_CTYPENO_COLOR SSL_CERT_DIR SSL_CERT_FILE SYSTEMROOT USERPROFILE_PROXY_SUBPROCESS_ENV_ALLOWLIST) HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxyNO_PROXYno_proxy_PROXY_SUBPROCESS_ENV_STRIPSIGKILLDict[str, str]_VERSION_CACHEceZdZUdZdZded<dZded<dZded <dZded <dZ ded <dZ d ed <dZ ded<e Z ded<eeZded<eddZeddZdS) ProxyStatusz8Snapshot of the iron-proxy installation + runtime state.FboolenabledNOptional[Path] binary_path Optional[str]binary_version config_path ca_cert_path Optional[int]pid listeningint tunnel_port)default_factory List[str]warningsreturncF|jduo|jSN)rTexistsselfs D/home/thesage/.hermes/hermes-agent/agent/proxy_sources/iron_proxy.py installedzProxyStatus.installed9s$t+I0@0G0G0I0IIc|jduo:|jo!|jduo|jSrc)rWrdrXres rg configuredzProxyStatus.configured=sT  D ( + '')) +!- +!((**  rirarQ)__name__ __module__ __qualname____doc__rR__annotations__rTrVrWrXrZr[_DEFAULT_TUNNEL_PORTr]rlistr`propertyrhrkr(rirgrPrP+sBBG"&K&&&&$(N(((("&K&&&&#'L''''CI+K++++%555H5555 JJJXJ   X   rirPcNeZdZUdZded<ded<ded<dZded<d Zded <d S) TokenMappinguLMap a sandbox-visible proxy token to a real upstream credential lookup. ``real_env_name`` is the env-var name iron-proxy reads at egress time. When Bitwarden is configured as the credential source for the proxy, iron-proxy's *own* environment is populated from bws on startup — the sandbox still sees only ``proxy_token``. ``match_headers`` names the request headers iron-proxy scans for the proxy token (default: ``Authorization`` for bearer providers; e.g. ``("x-api-key", "Authorization")`` for Anthropic native). ``alias_env_names`` are additional env-var names the SANDBOX receives the same proxy token under (e.g. ``GOOGLE_API_KEY`` for ``GEMINI_API_KEY``). They do not appear in the iron-proxy config — only one secrets rule is emitted per mapping, keyed on ``real_env_name``. str proxy_token real_env_namerupstream_hostsr'r*r(alias_env_namesN)rmrnrorprqr*r|r(rirgrvrvGsd$####%7M7777')O))))))rirvrarc(ddlm}|dz S)Nrget_hermes_homebinhermes_constantsrr~s rg_hermes_bin_dirrgs'000000 ?  u $$ric(ddlm}|dz S)uReturn the proxy state dir without creating it. Read-only callers (status probes, pidfile reads, version queries) use this — there's no reason to materialize ``~/.hermes/proxy/`` just to check whether a pidfile exists. rr~proxyrr~s rg_proxy_state_dir_rorms)100000 ?  w &&rict}|dd |dn#t$rYnwxYw|S)uReturn the proxy state dir, creating it with 0o700 if absent. Writable callers (CA gen, config write, mappings write, start_proxy) use this. We force 0o700 — the dir holds the CA signing key, audit log, and pidfile, so traversal by other local users is undesirable. The chmod is unconditional so a pre-existing dir with a slack umask gets tightened on first access. Tparentsexist_ok)rmkdirchmodOSError)ds rg_proxy_state_dirrysd AGGD4G(((         Hs= A  A rwc8tjdkrdndS)NWindowsziron-proxy.exe iron-proxy)platformsystemr(rirg_platform_binary_namers '00I==  <OricHtj}tj}|dkr|dvrdnd}dtd|dS|dkr|dvrdnd}dtd |dS|d krt d td t d |d|)uMap (uname, arch) → upstream release asset filename. iron-proxy ships ``iron-proxy___.tar.gz``. Windows builds aren't published upstream as of v0.39.0; we raise a clear error for callers on Windows. Linux)arm64aarch64ramd64z iron-proxy__linux_z.tar.gzDarwin_darwin_rz8iron-proxy does not ship native Windows binaries as of vz5. Run the proxy on a Linux/macOS host, or inside WSL.z2Unsupported platform for iron-proxy auto-install:  )rrmachinelower_IRON_PROXY_VERSION RuntimeError)rrarchs rg_platform_asset_namers_  F  &&((G !%999wwwF0FFFFFF !%999wwwG0GG$GGGG  #      OVOOgOO  riFinstall_if_missingrrQrSc|ttz }|r!tj|tjr|St jd}|rt|S|rB tS#t$r&}t d|Yd}~dSd}~wwxYwdS)uiReturn a path to a usable ``iron-proxy`` binary, or None. Resolution order: 1. ``/bin/iron-proxy`` (our managed copy — preferred) 2. ``shutil.which("iron-proxy")`` (system PATH) When ``install_if_missing`` is True and neither resolves, calls :func:`install_iron_proxy` to download and verify the pinned version. rz"iron-proxy auto-install failed: %sN) rrrdosaccessX_OKshutilwhichrinstall_iron_proxy Exceptionloggerwarning)rmanagedrexcs rgfind_iron_proxyrs"7"9"99G~~BIgrw77 \, ' 'F F|| %'' '    NN? E E E44444  4s; B B9B44B9)forcerc @t}|dd|tz }|r|s|St }t d|}t dt }tjd5}t|}||z }|t z } t d|t||t|| t|| t| |} t|} | | krt#d|d| d | t%j|d 5} t)| t} | | |d n&#t,$r| | |YnwxYw|| jz }d d d n #1swxYwYtjt3|d\}}t5j|t9j||t5j|t>j t>j!zt>j"zt>j#zt>j$zt>j%zt>j&zt5j'||d d d n #1swxYwYtP)t3|d t dtT||S)aUDownload, verify, and install the pinned ``iron-proxy`` binary. Returns the path to the installed executable. Raises on any failure (network, checksum, extraction). Callers in the auto-install path catch these; the user-facing ``hermes proxy install`` surface lets them propagate so the wizard can show a clear error. Tr/zhermes-iron-proxy-prefixzDownloading %szChecksum mismatch for z : expected z, got zr:gzdata)filterNz .iron-proxy_)dirrzInstalled iron-proxy %s at %s)+rrrrdr_IRON_PROXY_RELEASE_BASE_IRON_PROXY_CHECKSUM_NAMEtempfileTemporaryDirectoryrrinfo_http_download_verify_checksums_signature_expected_sha256 _sha256_filerrtarfileopen_pick_tar_memberextract TypeErrornamemkstemprwrclosercopy2rstatS_IRUSRS_IWUSRS_IXUSRS_IRGRPS_IXGRPS_IROTHS_IXOTHreplacerNpopr)rbin_dirtarget asset_name asset_url checksum_urltmpdirtmp archive_path checksum_pathexpectedactualtfmember extractedfdstageds rgrrsG MM$M... ,.. .F }}u %''J+::j::I.LL1JLLL  $,@ A A A5#V6llZ' 77  $i000y,///|]333 $C777#M:>>l++ >>  v||~~ - -555$55,255  \, / / *2%b*?*A*ABBF  ( 63v 6666 ( ( ( 63'''''  ( fk)I * * * * * * * * * * * * * * *$%#g,,~NNN F   Y'''   L4< '$, 6l !\ *l !\ *   66"""k5#5#5#5#5#5#5#5#5#5#5#5#5#5#5#vs6{{D))) KK/1DfMMM Ms\C K /G" F&%G"& G G"G  G" K "G& &K )G& *CK  KKurldestNonectj|ddi} tj|t5}t |d5}t j||dddn #1swxYwYddddS#1swxYwYdS#tjj $r}td|d||d}~wwxYw)Nz User-Agentz hermes-agent)headerstimeoutwbzFailed to download : ) urllibrequestRequesturlopen_DOWNLOAD_TIMEOUTrr copyfileobjerrorURLErrorr)rrreqrespfrs rgrr%sd . |^.L M MCH ^ # #C1B # C C ,tdD!! ,Q"4+++ , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , < HHH=====>>CGHs_&B# BA>2 B>B BB B B#BB#BB##C7C  Crrctjd}|stddStdt }tdt }|t z }|t z } t||t||n3#t$r&}td|Yd}~dSd}~wwxYw|dz }| dd |d t|d d g} tj g| dt|d d} | j dkr>td| jdddddStj g| dt|t|d d} | j dkr3td| jddddtdd S)uBest-effort GPG verification of ``checksums.txt`` (maxpetrusenko P1). Downloads the detached signature (``checksums.txt.asc``) and the release signing key (``public-key.asc``), imports the key into an ephemeral keyring, and verifies the signature over ``checksum_path``. Returns True when the signature is verified. Returns False (with a warning) when verification is unavailable — ``gpg`` not installed, or the signature / public-key assets are missing from the release. Raises RuntimeError ONLY when verification actively FAILS (a present-but-bad signature), which is a tamper signal we must not ignore. Rationale for graceful degradation on "unavailable": the SHA-256 check against ``checksums.txt`` remains in force regardless, and many install hosts (CI, minimal containers) won't have gpg. We harden when we can and never make gpg a hard dependency for a working install. gpguugpg not found on PATH — skipping iron-proxy release-signature verification (SHA-256 checksum check still enforced).Fru{iron-proxy release signature assets unavailable (%s) — skipping GPG verification (SHA-256 checksum check still enforced).NgnupgrT)moderz --homedirz--batchz--no-ttyz--import<)capture_outputrrubCould not import iron-proxy signing key — skipping GPG verification (SHA-256 still enforced): %sutf-8rz--verifyu~iron-proxy checksums.txt failed GPG signature verification — refusing to install (possible release-channel tampering). gpg: i,z0Verified iron-proxy checksums.txt GPG signature.)rrrrr_IRON_PROXY_CHECKSUM_SIG_NAME_IRON_PROXY_PUBKEY_NAMErrrrw subprocessrun returncodestderrdecoder) rrrsig_url pubkey_urlsig_path pubkey_pathr gnupg_homebase_cmdimpverifys rgrr/s[$ ,u  C  D   u)KK,IKKG,HH/FHHJ22H//Kw)))z;////  HIL   uuuuu wJ%$///[#j//9jIH .1(1J1K 0 01R   C ~ 8 J  gy 1 1$3$ 7   u ^B(BJBH Bs=/A/ABRFA EM(()< ``.rr)encodingerrorsrrzNo checksum entry for z in ) read_text splitlinesstripsplitlenrr)rrtextlinepartss rgrrxs  " "GI " F FD!! ""$$ u::??uRyJ668OOO EEE1CEE  ripathctj}t|d5tfddD]}|| dddn #1swxYwY|S)Nrbc.dS)Ni)read)rsrgz_sha256_file..s!&&--riri)hashlibsha256riterupdate hexdigest)r!hchunkrs @rgrrsA dD  Q////55  E HHUOOOO  ;;==s,AA"%A"rtarfile.TarFile binary_nametarfile.TarInfoc g}|D]}|s|jdsdt |jjvrMt |jj|kr|||s:td|dd|ddDd|d |d S) aFind the binary inside the upstream tar. iron-proxy's archive is typically flat (binary at root) but we tolerate a top-level directory. Members must be regular files with a leaf name matching ``binary_name``, no absolute paths, and no ``..`` traversal. rz..zCould not find z% inside downloaded archive (members: cg|] }|j Sr()r.0ms rg z$_pick_tar_member..s>>>Q!&>>>riNr z...)c*t|jSrc)rr)r5s rgr&z"_pick_tar_member..s#af++ri)keyr) getmembersisfiler startswithrr appendrsort)rr/ candidatesrs rgrrs)+J--//&&}}   ; ! !# & & $$v{2C2C2I*I*I     ![ 0 0   f % % %   Ek E E>>"--//"1"*=>>> E E E   OO--O... a=ribinaryc t|}t|}||S i}tj}t D]}||vr ||||<t jt|dgddddt|}n#tt j f$rYdSwxYw|j p|j pd }|r |t|<|S)aReturn ``iron-proxy --version`` output, stripped. Empty on failure. Cached by binary path: ``get_status`` is called per Docker container create, but the version string is constant for a given binary. A single subprocess invocation is plenty. Nz --versionTrr)rrrrrenv)rwrNgetrenvironrBrr _RUN_TIMEOUTrTimeoutExpiredstdoutr r)r?r8cached minimal_envparentrresouts rgiron_proxy_versionrMs f++C    $ $F  ') 3 1 1Dv~~$*4L D!n [[+ &       Z. /rr : ) )r 0 0 2 2C  "!s JsABB B Tuple[Path, Path]ct}|dz }|dz }|r|r|s||fStjdt dt jd5}t|}|dz }|dz }tj ddd t|d gd d d tj ddddddt|dddddddddd t|gd d d | }| } | |j dz} tjtjztjz} t%tdr| tjz} | n#t*$rYnwxYwtjt| | d} tj| d5} | |dddn #1swxYwYn5#t2$r( tj| n#t6$rYnwxYwwxYwtj| ||| tj|t>j t>j!zt>j"zt>j#zdddn #1swxYwYtH%d|||fS) u*Generate (or return existing) iron-proxy CA cert + key. Uses the host's ``openssl`` binary. We don't try to bind to a Python crypto library — openssl is universally available on the platforms we support, and it sidesteps cryptography-package licensing/distribution surface. ca.crtzca.keyopensslNzpopenssl not found on PATH. Install OpenSSL (apt: `openssl`, brew: `openssl`) to generate the iron-proxy CA cert.zhermes-proxy-ca-rgenrsaz-out4096Tr)checkrrrz-x509z-newz-nodesz-keyz-sha256z-days3650z-subjz/CN=hermes iron-proxy CAz-addextz!basicConstraints=critical,CA:TRUEzkeyUsage=critical,keyCertSignz.staged O_NOFOLLOWrzGenerated iron-proxy CA at %s)&rrdrrrrrrrrrw read_bytes with_suffixsuffixrO_WRONLYO_CREATO_TRUNChasattrrVunlinkFileNotFoundErrorrfdopenwriterrrr write_bytesrrrrrrrr)rstateca_crtca_keyrrtmp_keytmp_crt key_bytes crt_bytes key_staged open_flagsrrs rgensure_ca_certrms   E X F X F }}6==??5v~ |I& C     $,> ? ? ??T66ll.. &#g,, ?     5'68G 7F3>:G   &&&(( &&(( '' (ABB [2:- :  2| $ $ ( "- 'J             D  WS__j% 8 8 2t$$ # """ # # # # # # # # # # # # # # #             :v&&& 9%%%  4t|CdlRSSS?T?T?T?T?T?T?T?T?T?T?T?T?T?T?TB KK/888 6>s?DKF,+K, F96K8F99&K H#5H H#H H#H H#"K# I.II I IIIA3KKK hermes-proxyrc|dtjtjdddS)uMint a fresh opaque token to hand to the sandbox. The token has no internal structure beyond a recognizable prefix — iron-proxy matches on exact equality. We use a 128-bit random suffix (32 hex chars from a SHA-256 of 32 bytes of os.urandom). At that entropy the birthday-bound collision probability is below 2^-64 for up to 2^32 tokens, which is plenty for a proxy-scoped namespace. - N)r'r(rurandomr+rs rgmint_proxy_tokenrs<s? H Hw~bjnn55??AA#2#F H HHric$tdz S)Nmanagement.tokenrr(rirg_management_token_pathrwIs    2 22ric t}|sR|r> |d}|r|Sn#t$rYnwxYwt d}t jt|t j t j zt j ztt ddzd} t j |dn#ttf$rYnwxYw t j||dt j|n#t j|wxYw|S)a[Return the management-API bearer key, minting it on first call. Stored at ``/proxy/management.token`` with 0600 perms. The daemon receives it via the ``HERMES_IRON_PROXY_MGMT_KEY`` env var (named in the generated config's ``management.api_key_env``); ``hermes egress reload`` reads the same file to authenticate. rrz hermes-mgmtrrVrrW)rwrdrrrrsrrrwr[r\r]getattrfchmodAttributeErrorrbencoder)rpexistingtokenrs rgensure_management_tokenrMsU   A QXXZZ {{G{44::<C ::<<t tt~~cmmWm==>> T^ $ttzr|,,2 7 7 A A GRF fc " "c&7&7t'',,OD!V6{{ tt  K &&s00 >>)A,,BB'C77 DDc t}|rt|stdt}|tdt }|stdddl}ddl}|\}}|jd|d|dd d d |id } |j |t5}|j dkr ddddStd|j #1swxYwYdS#|j j $r}d} |dddd} n#t $rYnwxYw|jdkrtd| ||jdkrtd|td|jd| |d}~w|j jt f$r}td|d|d|d|d}~wwxYw) uHot-reload the running daemon's ruleset via the management API. POSTs to ``/v1/reload`` on the loopback management listener; the daemon re-reads proxy.yaml and atomically swaps the transform pipeline — validation failures leave the running config untouched (HTTP 422). Returns True on a successful reload. Raises ``RuntimeError`` with an actionable message when the daemon isn't running, the config predates management-API support (no ``management`` block → restart required), or the reload is rejected. uLiron-proxy is not running — nothing to reload. Run `hermes egress start`.NzThe generated proxy.yaml has no management listener (written before reload support). Re-run `hermes egress setup` and use `hermes egress restart` this one time.u[management.token is missing — re-run `hermes egress setup`, then `hermes egress restart`.rzhttp://rz /v1/reloadPOSTr'zBearer ri)methodrrrrTz*management API returned unexpected status rBrrriizZiron-proxy rejected the new config (validation failed; the running ruleset is unchanged): iumanagement API rejected our key (401). The running daemon was started with a different management.token — run `hermes egress restart`.zmanagement reload failed (HTTP z): z&could not reach the management API at z (zV). If the daemon was started before reload support, run `hermes egress restart` once.) _read_pid _pid_aliverrr urllib.errorurllib.requestrrr_MGMT_RELOAD_TIMEOUTstatusr HTTPErrorr%r rcoder) rZmgmtrrrrrrrbodys rg reload_proxyrs ++C  joo  )    / 0 0D | 5   # $ $E   ,   JD$ . )$))))) "3E"3"34  !  C " ^ # #C1E # F F ${c!!        JT[JJ            < ! 88::$$WY$??EDD    D  8s??=6:==  8s??/    Ach A A4 A A    L !7 + ,T , ,D , ,C , , ,    ss%!D C7 D C77C;;D>C;?DG$F,1EF, EF,EAF,,G$GG$r]r\r_ctjdkr8t}|r|dkr|d|gStdd|gS)uBuild the single host:port bind the proxy should listen on. iron-proxy v0.39 supports exactly ONE ``proxy.http_listen`` bind per daemon process, so this returns a one-element list and the choice of host matters: * **Linux:** bind the docker bridge gateway (``172.17.0.1`` by default). Sandboxes reach the proxy via ``host.docker.internal:host-gateway``, which Docker resolves to exactly this bridge gateway IP on Linux — a loopback-only bind is unreachable from inside containers there. The bridge IP is still host-local (it's an address on the host's ``docker0`` interface), so host-side tooling and the status probe can reach it too. When no docker bridge is detected (docker not installed / not started), fall back to loopback — there are no sandboxes to serve in that state, and the operator gets a warning. * **macOS / Windows Docker Desktop:** ``host.docker.internal`` resolves via VPNkit to the host, so a loopback bind is reachable from containers and is the least-exposed choice. We never bind ``0.0.0.0`` — that would expose the proxy (and, with a leaked sandbox token, the user's API quota) to anyone on the local network. The bridge-gateway bind is reachable by other containers on the default bridge network, which is unavoidable given v0.39's single-bind limit; requests still require a minted proxy token and an allowlisted upstream. rrruNo docker bridge (docker0) detected — binding iron-proxy to loopback only. Docker sandboxes will NOT be able to reach the proxy until it is restarted with docker running. 127.0.0.1:)rr_detect_docker_bridge_iprr)r] bridge_ips rg_default_http_listenrsz:G##,..  2k11 00;001 1 C   ' & & ''ricd} tjgdddddd}|jdkr|jD]q}|}t |D]G\}}|d kr<|d zt|kr&||d zd d}nH|nrn#ttj f$rYdSwxYw|sdS tj |}n#tj tf$rYdSwxYw|js#|js|js|js|js|jrt(d |dSt-|S) uReturn the docker0 bridge IPv4, if present, else None. Best-effort: we try ``ip -4 addr show docker0`` first. Anything that fails, doesn't parse as a strict IPv4, or parses as an address we must NOT bind to (unspecified, loopback, multicast, reserved, public) returns None — callers handle that as "no bridge bind". SECURITY: a hostile ``ip`` shim earlier on the operator's PATH used to be able to inject ``0.0.0.0`` here and re-open INADDR_ANY binding that the rest of the bind-policy work explicitly closed. We validate via :mod:`ipaddress` and reject anything that isn't plausibly a docker bridge IP (private + non-special). N)ipz-4-oaddrshowdocker0TrrrrrrrrrinetrzORefusing suspicious docker bridge IP %s reported by `ip`; skipping bridge bind.)rrr rGrr enumeraterrrF ipaddress IPv4AddressAddressValueErrorris_unspecified is_loopback is_multicast is_reserved is_link_local is_globalrrrw) candidaterKrr itokrs rgrr s $In 9 9 9dWYXY    >Q   --//   '..FAsf}}QU););$)!a%L$6$6s$;$;A$> (E) Z. /tt t$Y//  ' 4tt               >   $%.   t t99s$B2B77CCC..DD)r] audit_log allowed_hostsupstream_deny_cidrs http_listenmappingsList[TokenMapping]ca_certrfrrOptional[List[str]]rrrc t|pt}|D]%} | jD]} | |vr|| &g} |D]S} t| jpd} | d| jd| j| ddddd| jDdT|tt} nt|} |rt|nt|}|r|d nd |}| d d d pd}|d |d z}ddi}|}ddd||ddd d| dddid |tztdt|t|ddddd|iddd| idg|dS) uRBuild the iron-proxy YAML config (as a dict) for a given mapping set. The dict is YAML-serializable via ``yaml.safe_dump``. iron-proxy reads real secrets from its OWN environment via ``source: {type: env, var: ...}``; the sandbox never sees them. Bind policy: the sandbox-facing listeners (``tunnel_listen`` on ``tunnel_port``, plain-HTTP ``http_listen`` on ``tunnel_port + 1``) bind the docker bridge gateway on Linux (``172.17.0.1`` or whatever ``docker0`` resolves to — that's what ``host.docker.internal`` resolves to inside containers there) and loopback on macOS / Windows Docker Desktop. We do NOT bind ``0.0.0.0`` — a LAN peer with a leaked sandbox token could otherwise spend the operator's API quota against any allowlisted upstream. SSRF policy: ``upstream_deny_cidrs`` defaults to a conservative deny list covering loopback, link-local (incl. AWS/GCP/Azure IMDS at 169.254.169.254), and RFC1918. Pass an explicit ``[]`` to opt out of the deny list entirely (only sensible in hermetic tests). Schema mirrors the official iron-proxy schema as of v0.39.0. Notable points: * The ``dns`` section is required by the binary even when we only use the CONNECT tunnel. We point it at loopback so it doesn't conflict with anything else and disable the listener. * The ``proxy.tunnel_listen`` is what sandboxes hit via ``HTTPS_PROXY``. ``http_listen`` / ``https_listen`` are present (loopback only) so the proxy boots; sandboxes never route directly to them. * ``allowlist`` transform takes ``domains:`` and ``cidrs:``, not ``hosts:``. * ``secrets`` transform takes ``secrets:`` (plural), each with a ``source``, a ``replace.proxy_value`` (the sandbox-visible token), and a list of ``rules`` saying which hosts the swap should fire on. r{rA)typevarTF) proxy_valuer* match_query match_bodyrequirecg|]}d|iS)rr()r4r,s rgr6z&build_proxy_config..s<<CCrc ddl}n"#t$r}td|d}~wwxYwt}|dz }|dz }t |dd5}|||d d dddn #1swxYwYt j|tj tj zt j |||S) zSerialize the config dict to ``/proxy/proxy.yaml``. Uses ``yaml.safe_dump`` so we never emit Python tags. rNzGPyYAML is required to write the iron-proxy config but is not installed.rz.proxy.yaml.tmpwrryF)default_flow_style sort_keys) rrrrr safe_dumprrrrrr)rrrrdrLtmp_pathrs rgwrite_proxy_configrOs4         E , C((H hg . . .M! vqUeLLLMMMMMMMMMMMMMMMHXt|dl2333Jx Js" &!&A99A=A=cXt}|dz }dd|Dd}|dz }t|dd5}tj||d d d d n #1swxYwYt j|t jt jzt j |||S) uPersist the sandbox-visible proxy tokens to ``mappings.json``. The Docker backend reads this file to inject the right tokens as env vars when starting a sandbox. The file is NOT read by iron-proxy itself — the mapping is already baked into ``proxy.yaml``. mappings.jsonrc g|]J}|j|jt|jt|jt|jdKS))rxenv_namerzr*r|)rxryrsrzr*r|r3s rgr6z"write_mappings..xsd     !}O"&q'7"8"8!%ao!6!6#'(9#:#:       ri)versiontokensz.mappings.json.tmprrryr)indentN) rrjsondumprrrrrr)rrdrLpayloadrrs rgwrite_mappingsr ls   E / !C         G++H hg . . .(! '1Q''''((((((((((((((( HXt|dl2333Jx JsAA"%A"ct}|dz }|sgS tj|d}n@#t tjf$r'}td|gcYd}~Sd}~wwxYwg}| dgD]} | t|d|dt| d pd t| d pd t| d pd #ttf$rYwxYw|S)z;Read mappings.json, if it exists. Empty list on any error.rrryz+Failed to read iron-proxy mappings.json: %sNrrxrrzr(r*r{r|rxryrzr*r|)rrdrloadsrrJSONDecodeErrorrrrCr<rvtupleKeyErrorr)rdrr rrLitems rg load_mappingsrs   E A 88:: *Q[['[::;; T) *DcJJJ !C Hb))    JJ| /":.$TXX.>%?%?%E2FF$DHH_$=$=$SASTT %dhh/@&A&A&GR H H       )$    H  Js0(AB*B B B/BE  EE)available_env_namesrc B|t|n(dtjDg}tD]c\}}|vr |t t| dd||dtD]\}}t| dpd}|vrtfd |DsI|t t| dd|t|d t|d | |S) a1Mint a TokenMapping for every known provider whose env var is set. Pass ``available_env_names`` to override the lookup source (used by the Bitwarden adapter so we mint mappings for keys that *will* be in the proxy's environment even if they aren't in the host process env right now). Nch|] \}}|| Sr(r(r4kvs rg z-discover_provider_mappings..!777tq!Q7777ri_api_keyrBr)rxryrzr+r(c3 K|]}|vV dSrcr()r4anamess rg z-discover_provider_mappings..s',I,IAQ%Z,I,I,I,I,I,Irir)r*r )setrrDitemsr&r<rvrsrrr0rrCany)rrrr)specr+rs @rgdiscover_provider_mappingsr$s&'((77rz//11777#%H,2244  % 5  (0@0@0H0HUW0X0XYYY"        16688  $++1r22 5 ,I,I,I,I,I,I,I)I)I  (0@0@0H0HUW0X0XYYY" g//_ 566#         Oric|t|n(dtjDfdtDS)u3Return env-var names for providers we recognize but can't proxy. AWS Bedrock (SigV4) and GCP Vertex (SDK-minted OAuth) can't be swapped by a static header replacement. When any of these are configured, the sandbox is holding real credentials that the proxy can't strip — the isolation guarantee is incomplete for those providers. The wizard and ``hermes egress status`` use this to print a warning. (Anthropic / Azure OpenAI / Gemini used to be here; they're now first-class swapped providers via ``_HEADER_AUTH_PROVIDERS``.) Nch|] \}}|| Sr(r(rs rgrz/discover_uncovered_providers..rricg|]}|v| Sr(r()r4nrs rgr6z0discover_uncovered_providers..s ; ; ;!U A ri)r rrDr!r4)rrs @rgdiscover_uncovered_providersr)sW &'((77rz//11777 ; ; ; ;, ; ; ;;ri)rotater discoveredr*c d|D}g}|D]v}||j}|C|sA|t|j|j|j|j|ja||w|S)uCombine an existing mapping set with freshly discovered providers. By default this PRESERVES tokens for providers already in ``existing`` — re-running ``hermes egress setup`` should not invalidate the tokens baked into containers that are already running. Only newly added providers get freshly minted tokens. When ``rotate=True``, every token in the result is freshly minted regardless of overlap. The wizard exposes this via ``--rotate-tokens`` for the rare case where the operator wants to roll all tokens deliberately (e.g. after a suspected token leak). Providers that are in ``existing`` but no longer in ``discovered`` (operator removed the env var since last setup) are dropped. ci|] }|j| Sr()ryr3s rg z"merge_mappings.. s444aq444riNr )rCryr<rvrxrzr*r|)rr+r*by_namerLrpriors rgmerge_mappingsr1s,548444G C  AO,,  V  JJ|!-#1 /o ! 1      JJqMMMM Jric$tdz S)Niron-proxy.pidrvr(rirg_pidfiler4"s    0 00rirYctdz }|sdS t|d}n#t t f$rYdSwxYw|dkr|ndS)Nr3rryr)rrdr\rrrr)pfrZs rgrr&s   !1 1B 99;;t",,,00668899 Z tt''33t#s5AA43A4HERMES_IRON_PROXY_NONCE _proxy_noncerZc( td|dd}n#t$rYdSwxYw|d}|dkrdS||dzd}t |d krdS|d S) zReturn /proc//stat[21] (starttime) on Linux, else None. Comparing starttime is the standard cheap way to detect PID recycling without relying on cmdline scanning. When None, callers fall back to the cmdline + nonce check. /proc/z/statrryN)rr)rrrrfindrr)rZrrparenfieldss rg_pid_proc_starttimer@<s'S'''((22G2DD tt ZZ__F zzt &1*++  $ $ & &F 6{{bt ":s '* 88c$tdz S)a7Path to the on-disk sibling of the pidfile that stores the nonce. Written by ``_write_pidfile_safely`` after ``start_proxy`` plants the nonce in the iron-proxy child env, read by ``_pid_alive`` in a later CLI invocation (``stop`` / ``status``) so cross-process PID-recycling defense holds. ziron-proxy.nonce)rr(rirg_persisted_nonce_pathrBUs  #5 55rict} tj}ttdr|tjz}tjt ||}n#t$rYdSwxYw tj|}ttdr3|j tj kr tj |dSn#t$rYnwxYwtj |ddd}|pd tj |S#tj |wxYw)uRead the on-disk nonce written next to the pidfile. Returns None when the file is missing, unreadable, or empty — callers fall back to argv0 basename matching in that case. rVNgetuidrignorer)rBrO_RDONLYr^rVrrwrfstatst_uidrDrr|r%r r)r~flagsrstrs rg_read_persisted_noncerL`sE A    2| $ $ # R] "E WSVVU # # tt  "Br8$$ bikk)A)A      D wr3&&wx&@@FFHH|t   s>AA## A10A16ACD8 C D8C  AD88Ec|dkrdS ddl}||sdSn^#t$rQtjdkrn6 t j|dn#tttf$rYYdSwxYwYnwxYwg}tr| tt}|r||vr| ||ra td|d}|D]'}td|}||vrdS(n#t$rYnwxYw td|d }|r~|d }|rS|dd d } t j| } | drdSdSn#t$rYnwxYw t/jddt3|ddgddd dd} | jdkrM| jpd} t j| dSn#tt.jf$rYnwxYwdS)a#Return True iff ``pid`` is alive AND is an iron-proxy process. Defends against PID reuse via three signals (in priority order): 1. ``/proc//environ`` contains our nonce (most reliable, Linux) 2. ``/proc//cmdline`` basename matches the managed binary 3. ``ps -p `` command line contains the binary path The legacy ``"iron-proxy" in cmdline`` match was loose enough to match ``tail iron-proxy.log`` or an editor with that file open. We tighten on argv[0] basename plus an in-process nonce instead. rFNrr:z/environ=Tz/cmdlinerrFrrpsz-przcomm=rrrrB)psutil pid_existsrrrrkillProcessLookupErrorPermissionErrorrr8r<rLrrX_HERMES_IRON_PROXY_NONCE_ENVr}rdrr r!basenamer;rrrwr rGrrF) rZrQnonce_candidateson_disk env_bytesnonceneedle cmdline_pathrargv0 argv0_baserKcomms rgrrs9 axxu    %% 5      ?   ) )  Q&A   uuu  ,#%. ---#%%G)7"222((( 3c33344??AAI)  8BB5BBIIKKY&&44'     D   2S22233     !,,..44W==F q (((BBW--e44 ((66 45         n 4S4 1dWYXY    >Q  J$"++--D7##D))44\BB B  Z. /     4sr&"B ABA;6B:A;;BBA D#!D## D0/D04B!G G'&G'+BI00J J T)r?rW extra_envrrefresh_secrets_from_bitwardenbitwarden_configraOptional[Dict[str, str]]rbrcOptional[Dict]c & t}|rt|rtS|pt|}|t d|pt dz }|st d|dt|||} t|t| t<tj tjdat | t"<t d z } tjtjztjz} t+td r| tjz} tjt1| | d } n)#t2$r} t d | d | d| d} ~ wwxYw tj| d n#t2$rYnwxYw tj| }t+tdrK|jtjkr/tj| t d| d|jdn#t>$rYnwxYw tA| tBj"| tBj#}tIj%dkrd|d<tCj&t1|dt1|gfi|n9#t2$r,} tj| t d| | d} ~ wwxYw tj| n:#t2$rYn.wxYw# tj| w#t2$rYwwxYwxYwtO tQj)n #t$rtUdwxYwtW}||\}}n dtX}}d}fd}d}d}tIj%dko%t[j.t[j/u}|r>taj0t`j1|}taj0t`j2|} tgj3thz} 5Qtm| d} 7n#tp$rYnwxYwt d j9d!|tu||rd}n-tgj3|krntgj;d"|r>taj0t`j1|taj0t`j2|nF#|r?taj0t`j1|taj0t`j2|wwxYw5Qtm| d} 7n#tp$rYnwxYwt d j9d!||shtm| d}tUd 7n#tp$rYnwxYwt d#|d$|d%thd&|tx=d'j)|tS)(uLSpawn iron-proxy as a managed background subprocess. Idempotent — if the proxy is already running with the expected PID, just returns the live status. ``refresh_secrets_from_bitwarden=True`` re-fetches upstream secrets via ``bws secret list`` at startup and injects them into the child env. This delivers the rotation promise that distinguishes ``credential_source: bitwarden`` from ``credential_source: env``. Without this flag (or with ``bitwarden_config=None``) the proxy still starts but uses whatever the host process env happens to contain. rNu@iron-proxy binary not available — run `hermes egress install`.rziron-proxy config not found at z". Run `hermes egress setup` first.rarefresh_from_bitwardenrcziron-proxy.logrVrWz!Refusing to write iron-proxy log r'. Remove that path manually and retry.rDziron-proxy log  has unexpected owner uid=z; refusing to write.)rAstdinrGr rTstart_new_sessionz-configzfailed to spawn iron-proxy: r grace_secondsrFctd n#t$rYnwxYwt)Nrrn)_kill_and_waitr_r`KeyboardInterrupt)_signum_framepidfileprocs rg_interrupt_handlerz'start_proxy.._interrupt_handlers\ t1----  NN         D !!!s ) 66linesz$iron-proxy exited immediately (code z). Last log lines: 皙?ziron-proxy did not bind rz within z)s. Process was killed. Last log lines: z#Started iron-proxy pid=%s config=%s)>rr get_statusrrrrd_build_proxy_subprocess_envrrrr'r(rrrr+r8rVr[r\rr^rVrrwrr{rHrIrDrr|dictrDEVNULLSTDOUTrrPopenr4_write_pidfile_safelyrZrq_read_http_listen_from_configrr threadingcurrent_thread main_threadsignalSIGINTSIGTERMtime_STARTUP_GRACE_SECONDSpoll _tail_logr_r`r _port_listeningsleeprr)r?rWrarrbrcrbin_pathrrAlog_pathlog_open_flagslog_fdrrK popen_kwargs listen_hp probe_hostr]r[rw prev_sigint prev_sigterminstall_handlersdeadlinetailrurvs @@rg start_proxyrs0{{HJx((||O"*R..11;;==L(4C$%!!$44H[2:- ;Nr<  ("-'X>>  3 3 3C 3 3 3      &%           Xf   2x  RY")++%=%= HV   7(77y777        "$$    ?   ) )04L, - ]]Is3xx 0     JJJ ?#??@@cIJ   HV        D   HV        D jjGgtx0000 t1---- ".//I"+ KK"-/CK I""""""KLY& B  $ & &)*?*A*A AImFM3EFF }V^5GHH 89;;!77 yy{{& 444NN$$$$(D"/4?//(,//z;77  y{{h&& JsOOO! $  8 M&- 5 5 5 M&., 7 7 7  8 M&- 5 5 5 M&., 7 7 7 7 8  yy{{,,,  NN         D  '4? ' ' $ ' '      ,,,t1----  NN         D  'z ' 'K ' '% ' ' $ ' '    KK5txEEE <<s'#F F1F,,F15G GGA4I II"A2KL5 L 'LL  L5L%% L21L25M7M  M MMMM.NN! AUR$#U$ R1.U0R11AUAV;W WWX44 YYrucJtjtjztjz}t tdr|tjz} tjt||d}n#t$rt}|r%t|rtd|d|d | n#t$rYnwxYwtjt||d}Yn(t$r}td|d|d|d }~wwxYw tj|}t td r6|jtjkrtd |d |jn#t$$rYnwxYwtj|t|d tj|n#tj|wxYwt,r$|d}d} tjtjztjz} t tdr| tjz} tjt|| d}tj|t,d n#t$rYnwxYw|dkr( tj|d S#t$rYd SwxYwd S#|dkr& tj|w#t$rYwwxYwwxYwd S)uWrite ``pid`` to ``pidfile`` with O_EXCL + O_NOFOLLOW + ownership check. O_EXCL means "another start is in progress" if the file already exists with a live owner — we cleanly fail rather than racing. When the existing pidfile points at a dead pid (stale crash), we explicitly unlink it before retrying once. Side effect: also persists the in-process nonce to disk so cross-CLI-invocation ``_pid_alive`` checks (start in one process, stop in another) can still defeat PID recycling. rVrWz pid z4). Run `hermes egress stop` if that proxy is stuck.zRefusing to write pidfile rrjNrDzpidfile rkrz.noncerr)rr[r\O_EXCLr^rVrrwFileExistsErrorrrrr_r`rrHrIrDr|rbr}rr8rYr]) rurZrlr existing_pidrrK noncefilenfdnopens rgrrsrz)BI5Jr<  $bm#  WS\\:u 5 5 666!{{  J|44 D#DD-9DDD    NN         D  WS\\:u 5 5  3 3 3C 3 3 3     "Br8$$ bikk)A)A"MwMM")MM    D  SXX__W--...   ''11  K"*,rz9Er<(( '&'#i..%77C HS,--g66 7 7 7 7    D  axxHSMMMMMDDxsaxxHSMMMMDs #A00?D0CD CDC&D: DDD$AFG FGF8GG4BJ21K22 J?<K2>J??K2 K K-,K-2L :LL  LL LL rnrv'subprocess.Popen'rocV |n#t$rYdSwxYw ||dS#tj$rX |n#t$rYnwxYw ||YdS#tj$rYYdSwxYwwxYw)u<Best-effort SIGTERM → wait → SIGKILL for a child we own.Nr) terminaterwaitrrFrS)rvros rgrqrq&s    - (((((  $  IIKKKK    D   IImI , , , , , ,(    DDD sY %%AB(A&%B(& A30B(2A33B(7BB$B(#B$$B(rgrhci}tj}tD]}||vr ||||<i}t}t D]?}||j|jrt|j||j<@|D]M}||vr ||||<| |dD]$} | | r || ||<n%N|r|r ddl m } | dd} | | d } | dd} | r| r| | | dd \}}t|t|z }|D]}||vr ||||<|rE|pi d std |d t d ||r(t dt%|n@|pi d stdt dnZ#t&f$rL}|pi d std|t d|Yd}~nd}~wwxYw|r||t*D]}||d|dd|S)uConstruct the minimal env for the iron-proxy subprocess. Allowlists infrastructure vars (PATH, HOME, locale) plus the env vars named in ``load_mappings()`` (the real upstream secrets the proxy needs to do the swap). Everything else is stripped — see ``_PROXY_SUBPROCESS_ENV_STRIP`` for proxy chain protection. When ``refresh_from_bitwarden=True`` AND ``bitwarden_config`` is populated, fetches upstream secrets via the BSM SDK at startup and merges them in. This is what delivers the rotation guarantee promised by ``credential_source: bitwarden`` — without it, rotating a key in the Bitwarden web app doesn't reach the proxy. r(r) bitwardenaccess_token_envBWS_ACCESS_TOKENrB project_idF) access_tokenrcache_ttl_seconds use_cacheallow_env_fallbackz-Bitwarden refresh did not return secrets for z. Either add the secrets to your BWS project, switch to credential_source: env via `hermes egress setup --no-bitwarden`, or set `proxy.allow_env_fallback: true` in config.yaml to opt into the legacy host-env fallback.uwBitwarden refresh did not return secrets for %s — falling back to host env for those names (allow_env_fallback=true).z[Bitwarden refresh produced %d warning(s); run `hermes secrets bitwarden status` for detail.zcredential_source=bitwarden but the access-token env or project_id is empty. Either set both, switch to credential_source: env, or set `proxy.allow_env_fallback: true` to opt into the legacy fallback behaviour.ucredential_source=bitwarden but access-token env or project_id is empty — proxy will fall back to parent env (allow_env_fallback=true).aBitwarden refresh module unavailable at proxy start (credential_source=bitwarden with proxy.allow_env_fallback: false). Either fix the import, switch to credential_source: env, or set `proxy.allow_env_fallback: true` to opt into the legacy fallback behaviour.zmBitwarden refresh module unavailable at proxy start, falling back to parent env (allow_env_fallback=true): %sNr=1)rrDrBr raddryr|rrCagent.secret_sourcesrrfetch_bitwarden_secretssortedrrrrrr*rKr setdefault)rarhrcrArJr alias_sourcesneededr5aliasbwaccess_token_namerrrr`missingr(rs rgr}r}9s(C ZF/%% 6>>t CI13M UUF __FF 1?###  F-213D-E-EM!/ * 6>>t CII&**444  ::e$$ &u CIEa"2a`  < < < < < < 0 4 4"$6!! "::&7<<BBDDL)--lB??JD  D $&$>$>!-)&'# %?%%!!#g,,!677,,AG||!(A-2778LMM*I&IIINN5 NNLH ).B334HII&91 ~   %*//0DEE "1 NNK        ! 2 9, dNN:s### JsEH== JAJJcd d}t}|rt|s|dadSt|} t j|t jn#t$r|daYdSwxYwtj dz}tj |kr;t|sntj dtj |k;t|}|duo |duo||kpt| }|rt d|n, t j|tn#t$rYnwxYw|datd |d S) z=Stop the managed iron-proxy. Returns True if it was running.rarctd tdS#t$rYdSt$rYdSwxYw)z1Best-effort cleanup of pidfile + persisted nonce.T) missing_okN)r4r_rBr`rr(rirg_cleanup_state_filesz(stop_proxy.._cleanup_state_filess{ T***  ! # # * * , , , , ,     DD    DD s A A  A A NFg@r{z?iron-proxy pid=%s appears recycled before SIGKILL; not killing.zStopped iron-proxy pid=%sTrar)rrr8r@rrSrrrTrrrr _KILL_SIGNALr)rrZstarttime_beforerstarttime_afterrecycleds rg stop_proxyrs  ++C joo u +3// V^$$$$  uu y{{S H )++ #   3 )++ .c22 D ( 4t+ 4 O3!C    NN #      \****%    L KK+S111 4s$A""A<;A<3E EEct}t}| |\}|_nd}t|_t d}|r||_t ||_t}|dz }|dz }| r||_ | r||_ t}|r0t|r!||_t||j|_|S)u3Snapshot the current proxy state — does NOT start anything. Crucially, this is called per Docker-container-create when egress enforcement is on. It must not have side-effects (no mkdir, no binary version subprocess that takes 30s on a hung binary). The state dir is read-only here. NrFrrrP)rPrr]rrrrTrMrVrrdrWrXrrrZrr[)rrrr?rdrcarZs rgr|r| s]]F-//I)2& F&& 1  6 6 6F ;#!36 : :  ! !E , C  B zz||!  yy{{!  ++C Kz#K +:v7IJJ Mric6t}|dS|dS)Nr)r)rs rg_read_tunnel_port_from_configrK s! * , ,F ~t !9ricFtdz }|sdS ddl}n#t$rYdSwxYw ||d}n#t |jf$rYdSwxYw|pidpi}|dp|dpd }t|trd |vrdS| d \}}} t|}n#t$rYdSwxYw|pd |fS) uReturn ``(host, port)`` of the configured sandbox-facing listener. Reads ``proxy.tunnel_listen`` — the CONNECT/MITM listener sandboxes hit via ``HTTPS_PROXY`` — falling back to ``proxy.http_listen`` for configs written before the tunnel/http listener-role split. The bind host matters for liveness probes: on Linux the daemon binds the docker bridge gateway (e.g. ``172.17.0.1``), where a loopback connect would report "not listening" for a perfectly healthy daemon. rNrrryrrrrBrrr) rrr proxy_blockrrrrrs rgrrR sn   , .C ::<<t tt~~cmmWm==>> T^ $tt:2""7++1rK ___ - - U1O1O USUF fc " "c&7&7t'',,OD!V6{{ tt  K &&s0. <<)A**A?>A?<D DDrrcddl} |||fd5 ddddS#1swxYwYdS#t$rYdSwxYw)uDCheap TCP connect probe — True iff something accepts on host:port.rNg?rTF)socketcreate_connectionr)rrrs rgrry sMMM  % %tTlC % @ @                     uus';. ;2;2; A A rxryrzc,|sdS |dd}d|dd| dS#t $r}d|dcYd}~Sd}~wwxYw) Nz (no log file)i rrrz(could not read log: r;)rdrXjoinr rr)r!rzrrs rgrr s ;;==.  (yyWY??JJLLeVWWUVVV ...-s---------.sA A99 BBBBc<tdadS)uClear module-level caches so tests get a fresh start. This module owns two mutable globals that need reset between tests: - ``_VERSION_CACHE`` — subprocess output cache keyed by binary path. - ``_proxy_nonce`` — the strong-proof token written by ``start_proxy`` and read by ``_pid_alive`` to defeat PID recycling. Today the repo's tests run each file in its own subprocess (per AGENTS.md) so leakage is bounded, but any in-process caller (notebooks, ad-hoc scripts, ``pytest -p no:xdist``) would otherwise see whichever values were probed first regardless of subsequent ``install_iron_proxy(force=True)`` or ``start_proxy`` calls. N)rNclearr8r(rirg_reset_for_testsr s LLLri)rPrvrr$r)rrmrrr|rrMrr1rsrrrr r)rar)rarw)rrQrarS)rrQrar)rrwrrrar)rrrrrarQ)rrrrwrarw)r!rrarw)rr.r/rwrar0)r?rrarw)rrQrarN)rn)rrwrarw)rrQrarw)rarUrc)rWrSrarrl)r]r\rar_)rrrrrfrr]r\rrSrrrrrrrar)rrrar)rrrar)rrrar)rar)rrrar)rrrar_)rrr+rr*rQrar)rarY)rZr\rarU)rZr\rarQ)r?rSrWrSrardrrQrbrQrcrerarP)rurrZr\rar)rvrror\rar)rardrhrQrcrerarM)rarP)rar)rrwrr\rarQ)r!rrzr\rarwr)mrp __future__rr'rrloggingrrrrrrrrrrrrr dataclassesrrpathlibrtypingrrr r getLoggerrmrrrrrrrrErrrrrrrrqr&r0r4r5rBrKrzrrrNrPrvrrrrrrrrrrrrrMrmrsrwrrrrrrrrrr rr$r)r1r4rrVr8r@rBrLrrrrqr}rr|rrrrr__all__r(rirgrsc777r#"""""    ((((((((............  8 $ $U?RTT, !4* 1  +    "?)%--* 3 1 1    <(7 68,&+AAT*14 4    &0wvy&.99 "$####          6 ******* *>%%%% ' ' ' '    *PPPPD388).RRRRRRjHHHHFFFFR    2,,,,h%*ZZZZZZD I I I I I3333.3D#''''''6MMMM`&(&(&(&(R@@@@P, $)-/3'+WWWWWWt####L:D@04,,,,,,b04<<<<<<8 ''''''^1111 $ $ $ $$ 9" """"26666B[[[[@""&*.#+0'+qqqqqqhPPPPfFG*+/#('+ ``````F@@@@F))))X$'$'$'$'N    +-......*   ri