`gj)pdZddlmZddlmZmZmZgdZddZddZ ddZ dd  dd Z dd Z dd Z y )u Unified provider-credential lifecycle across every store Hermes reads. A provider API key can live in up to THREE stores at once: 1. ``~/.hermes/.env`` — the canonical secret store 2. ``~/.hermes/auth.json`` → ``credential_pool.[*]`` — env-seeded pool entries (``source == "env:"``) persisted by the pool loader 3. ``~/.hermes/config.yaml`` — inline mirrors written by the custom-endpoint flows (``model.api_key``, ``auxiliary..api_key``, ``custom_providers[*].api_key``) Historically the desktop/dashboard endpoints (PUT/DELETE ``/api/env``) and the TUI-gateway RPCs only mutated store 1. That divergence is the root cause of a whole bug family: * #51071 / #59761 — deleting a key removes it from ``.env`` but the stale ``credential_pool`` entry (and ``provider_models_cache.json`` row) survives, so the provider keeps appearing in the model picker, even across restarts (the pool loader is additive-only). * #62269 — updating a key rewrites ``.env`` but leaves the OLD key in a higher-precedence ``config.yaml`` mirror (``model.api_key`` wins over env at client construction), producing persistent 401s with a key the UI no longer shows. This module is the single choke point: every surface that saves or removes a provider credential should route through :func:`save_provider_env_credential` / :func:`remove_provider_env_credential` so all three stores stay consistent. OAuth preservation contract: removal only prunes credential-pool entries whose ``source`` is exactly ``env:``. OAuth/device-code/manual/borrowed entries (``device_code``, ``manual*``, ``gh_cli``, ``claude_code``, ``oauth``, …) and the ``providers.`` OAuth token blocks in auth.json are never touched — deleting an API key must not revoke an OAuth grant for the same provider. Secrecy contract: no function in this module logs, prints, or returns a credential value. Results carry key NAMES and config PATHS only. ) annotations)AnyDictList)save_provider_env_credentialremove_provider_env_credentialpurge_env_credential_referencesc ddlm}g}|jD])\}} ||jxsdvr|j |+|S#t$rgcYSwxYw#t$rYJwxYw)zCProvider ids whose registered api_key_env_vars include ``env_var``.r)PROVIDER_REGISTRY)hermes_cli.authr Exceptionitemsapi_key_env_varsappend)env_varr hitspidcfgs R/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/credential_lifecycle.py_providers_for_env_varr3s5D%++-S 3//526 C  K     s"A#A AA A%$A%c $ddlm}m}m}d|}g}|5|}|j d}t |t s |cdddSd}t|jD]} || } t | ts| D cgc](} t | t r| j d|k(s| *} } t| t| k(rdd}|j| | r| || <|| =|r||ddd|Scc} w#1swY|SxYw) uDrop ``credential_pool`` entries seeded from ``env:``. Operates across ALL providers in the pool (the source string names the env var unambiguously, and shared vars like GITHUB_TOKEN may seed more than one provider). Entries with any other source — OAuth, device-code, manual, borrowed-CLI — are preserved verbatim, as are the ``providers.`` OAuth blocks. Returns the list of provider ids that had entries pruned. r)_auth_store_lock_load_auth_store_save_auth_storeenv:credential_poolNFsourceT) r rrrget isinstancedictlistkeyslenr) rrrrrpruned auth_storepoolchangedproviderentriesentrykepts r_prune_env_pool_entriesr-Cs)UTG9 FF  )%' ~~/0$% )) TYY[) #H8nGgt,%"5$/EIIh4G64QD 4yCL(G MM( #!%XN! #"  Z (1)2 M)2 Ms$*D 8D-D2ADDDcsgSddlm}m}ddlm}m}|}|j sgS t|d5}||xsi}dddttsgSgdfd } | |jdd|jd } t| tr$| jD]\} } | | d | |jd } t| tr t| D]\}}| |d |n4t| tr$| jD]\}}| |d |r|||||d S#1swYxYw#t$rgcYSwxYw)u;Reconcile config.yaml api_key mirrors that hold ``old_value``. Value-matched on purpose: we only touch a config entry when it provably holds the SAME credential that just changed in ``.env`` — an independent key the user configured for a different endpoint is left alone. ``new_value=None`` removes the mirror field; a string replaces it. Operates on the RAW user config (never the defaults-merged view) so the write doesn't bake defaults into the user's file. Returns the dotted paths that were updated (names only — never values). r)atomic_yaml_writefast_safe_load)get_config_path$require_readable_config_before_writezutf-8)encodingNct|tsydD]Z}|j|}t|ts%|k(s+r||<n|j |dj |d|\y)N)api_keyapi.)r r!rstrpopr)sectionkey_pathfieldcurrent new_value old_valuetoucheds r_fixz(_scrub_config_yaml_mirrors.._fixso'4( ' 6Ekk%(G'3'Gy,@%.GENKKt,(1UG45 6model auxiliaryz auxiliary.custom_providerszcustom_providers.F) sort_keys)r:rr;r8returnNone)utilsr/r0hermes_cli.configr1r2existsopenrr r!rrr" enumerate)r?r>r/r0r1r2 config_pathf user_configrAauxtaskslot_cfgcustomidxr+namer@s`` @r_scrub_config_yaml_mirrorsrWns  7 "#K      + 0 2A(+1rK 2 k4 ( G 6  !7+ //+ &C#t!iik 0ND( Zv. / 0__/ 0F&$#F+ 3JC +C51 2 3 FD !!<<> 4KD% +D62 3 4,[9+{eD NQ 2 2  s( E& E E&E#E&& E43E4T)clear_models_cachect|}tt|tt|z} ddlm}|D]}||d| |r|r ddlm}|D] }||  ||dS#t $rY+wxYw#t $rYwxYw)aRemove non-.env references to an env-var credential. Prunes ``credential_pool`` env-seeded entries and (optionally) the affected providers' rows in ``provider_models_cache.json`` so the model picker stops advertising a provider whose key is gone (#59761). r)suppress_credential_sourcer)clear_provider_models_cache) pool_pruned providers) r-sortedsetrr rZrhermes_cli.modelsr[)rrXr%r]rZr)r[s rr r s%W -Fs6{S)?)H%IIJI  >! CH &x4y1A B Ci  E% 6+H5 6 " ::       s#A0A?0 A<;A<? B  B cddlm}m}|j|}|||g}|r|r||k7r t ||} ddlm}t|D]}||d| d||dS#t$rYwxYw)aSave/update a credential in ``.env`` and reconcile every mirror. After the ``.env`` write, any config.yaml mirror that held the PREVIOUS value of this var (``model.api_key`` etc.) is updated to the new value so a stale higher-precedence copy cannot shadow the rotation (#62269). Suppressed ``env:`` pool sources are re-enabled so a deliberate re-add through the UI behaves like ``hermes auth add``. r)load_envsave_env_value)unsuppress_credential_sourcerT)okkeyconfig_updates) rJrbrcrrWr rdrr)rvaluerbrcr?rgrdr)s rrrs; w'I7E" "N yE13IuE  @.w7 EH (T'3C D E w. II    s"A)) A54A5c ddlm}m}|j|}||}t |}|r t |dng}d|||d|d|t |xs |dxs|dS)u4Remove a credential from EVERY store it lives in. Clears the ``.env`` entry (and process env), prunes env-seeded ``credential_pool`` entries, drops the affected providers' model-cache rows, and removes any config.yaml mirror holding the same value. OAuth/device-code/manual credentials are preserved (see module docstring). ``found`` is True when ANY store held the credential — callers that previously 404'd on ".env miss" should key off this instead so a stale pool-only entry can still be cleaned up through the same button. r)rbremove_env_valueNTr\r])rerfremovedr\r]config_scrubbedfound)rJrbrjrr rWbool)rrbrjr?removed_from_envrefsrls rrrs~= w'I'0 *7 3DEN0DATVO#M*+&*&P$}*=PQ rBN)rr8rG List[str])r?r8r>z str | NonerGrq)rr8rXrnrGDict[str, Any])rr8rhr8rGrr)rr8rGrr)__doc__ __future__rtypingrrr__all__rr-rWr rrr rBrrws^%N#""   (VAJ15 ;  ;)- ; ;FJ@rB