`gj!UdZddlmZddlZddlmZmZddlmZddl m Z m Z m Z da ded <dd Zdd Zed d Zded <GddeZddZddZddZehdZdZddZd d!dZd"dZd#dZy)$uProfile-scoped credential resolution for multi-profile gateway multiplexing. The multiplexing gateway serves many profiles from one process. Each profile has its own ``.env`` with its own provider keys and platform tokens, so we **cannot** union them into the process-global ``os.environ`` (that would leak profile A's keys to profile B's turns, and to every subprocess spawned with ``env=dict(os.environ)``). This module provides a fail-closed, context-local secret scope: - ``set_secret_scope(mapping)`` installs the active profile's secrets for the current task (a contextvar, so it propagates into the agent's worker thread via ``copy_context()`` exactly like the HERMES_HOME override). - ``get_secret(name)`` reads from that scope. When multiplexing is **active** and no scope is set, it RAISES rather than silently falling back to ``os.environ`` — an un-migrated or newly-added call site fails loud at that exact line instead of leaking another profile's value. When multiplexing is **off** (the default), it transparently reads ``os.environ`` so the single-profile gateway and every non-gateway caller behave exactly as before. Design rationale lives in ``docs/design/multiplexing-gateway.md`` (Workstream A). ) annotationsN) ContextVarToken)Path)DictMappingOptionalFbool_MULTIPLEX_ACTIVEct|ay)zMark whether the process is running as a profile multiplexer. Called once at gateway startup. When True, ``get_secret`` fails closed on an unscoped read instead of falling back to ``os.environ``. N)r r )actives E/root/.hermes/venv/lib/python3.12/site-packages/agent/secret_scope.pyset_multiplex_activer'sV ctS)z?Return whether the process is running as a profile multiplexer.)r rris_multiplex_activer1s r _SECRET_SCOPE)defaultz'ContextVar[Optional[Mapping[str, str]]]ceZdZdZy)UnscopedSecretErroraRaised when a secret is read in multiplex mode with no scope installed. This is the fail-closed signal: it means a credential read reached ``get_secret`` without a profile scope active, which in a multiplexer would otherwise leak whichever profile's value happened to be in ``os.environ``. The fix is to wrap the call path in ``set_secret_scope(...)`` (the per-turn / per-adapter profile scope), not to widen the allowlist. N)__name__ __module__ __qualname____doc__rrrrr<srrc,tj|S)zInstall the active profile's secret mapping for the current context. Returns a token for ``reset_secret_scope``. Pass ``None`` to clear. )rset)secretss rset_secret_scoperGs   W %%rc.tj|y)z"Restore the previous secret scope.N)rreset)tokens rreset_secret_scoper#Osrc*tjS)zEReturn the active secret mapping, or None when no scope is installed.)rgetrrrcurrent_secret_scoper&Ts    r>TZPWDHOMELANGPATHUSERSHELLLC_ALLTMPDIR PYTHONPATH HERMES_HOME VIRTUAL_ENV SSL_CERT_FILEHERMES_PROFILE_HERMES_GATEWAYHERMES_KANBAN_DBHERMES_MAX_TOKENSHERMES_API_TIMEOUTHERMES_KANBAN_BOARDHERMES_MAX_ITERATIONSHERMES_REDACT_SECRETSHERMES_GATEWAY_LOCK_DIRHERMES_NOUS_TIMEOUT_SECONDSHERMES_KANBAN_WORKSPACES_ROOT)HERMES_KANBAN_HERMES_TELEGRAM_ TERMINAL_cFtvrytfdtDS)zGReturn True for genuinely process-global (non-profile-secret) env vars.Tc3@K|]}j|ywN) startswith).0pnames r z!_is_global_env..xs@atq!@s)_GLOBAL_ENV_EXACTany_GLOBAL_ENV_PREFIXES)rHs`r_is_global_envrMts!    @+?@ @@rc0t|r%tjj|}||S|Stj}||j|}||S|St rt d|dtjj|}||S|S)uZResolve a credential by env-var name, honoring the active profile scope. Resolution order: 1. Genuinely-global vars (``_is_global_env``) always read ``os.environ`` — they are deployment settings, not profile secrets. 2. When a secret scope is installed (multiplexed turn), read from it; an absent key returns ``default``. The scope is authoritative — we do NOT fall through to ``os.environ``, because in a multiplexer ``os.environ`` may hold another profile's value. 3. No scope installed: - multiplex INACTIVE (default deployment): read ``os.environ`` — identical to the legacy ``os.getenv`` behavior every caller had before. - multiplex ACTIVE: FAIL CLOSED. Raise ``UnscopedSecretError`` so the missing scope is caught loudly instead of leaking a cross-profile value. z get_secret(a1) called with no profile secret scope active while multiplexing is on. This credential read must run inside a set_secret_scope(...) block (the per-turn / per-adapter profile scope). Reading os.environ here would risk leaking another profile's value. See docs/design/multiplexing-gateway.md (Workstream A).)rMosenvironr%rr r)rHrvalscopes r get_secretrS{s"djjnnT"os272    E iioos272!$"    **.. C/3.w.rci} |jd}|j D]}|j }|r|j dr'|j dr|tddj}d|vrY|jd\}}}|j }|s|j }t|dk\r|d|d k(r |dd vr|d d }|||<|S#tttf$r|cYSwxYw) urParse a ``.env`` file into a plain dict WITHOUT touching ``os.environ``. Used to load a profile's secrets into an isolated mapping for ``set_secret_scope``. Mirrors python-dotenv's basic parsing (KEY=VALUE, ``export`` prefix, ``#`` comments, optional matching quotes) but never mutates the process environment — that isolation is the whole point. zutf-8)encoding#zexport N=r)'") read_textFileNotFoundErrorOSErrorUnicodeDecodeError splitlinesstriprElenlstrip partition)env_pathrtextrawlinekey_values r load_env_filerms!G!!7!3 yy{ts+  ??9 %I(//1D d? s+ Qiik   u:?uQx594qZ9O!BKE " N) w(: ;sC%%C>=C>c0tt|dz S)u)Build a profile's secret mapping from its ``/.env``. Returns a fresh dict (safe to install via ``set_secret_scope``). Genuinely global vars are intentionally NOT copied in — ``get_secret`` reads those from ``os.environ`` directly, so the scope holds only profile secrets. z.env)rmr) hermes_homes rbuild_profile_secret_scoperps k*V3 44r)r r returnNone)rqr )rOptional[Mapping[str, str]]rqr)r"rrqrr)rqrs)rHstrrqr rD)rHrtr Optional[str]rqru)rfrrqDict[str, str])rorrqrv)r __future__rrO contextvarsrrpathlibrtypingrrr r __annotations__rrr RuntimeErrorrrr#r& frozensetrJrLrMrSrmrprrrr~s,# )** 4% :DT: 6 ,&   A%/PD5r