`gj .UdZddlmZddlZddlZddlZddlZddlmZddl m Z m Z ddl Z ejeZedZej"ZiZded<iZded <dd Zdd Zdd Zdd ZddZddZddZddZdddZddZd dZ d!dZ!y)"uaManaged scope — IT-pushed, user-immutable config & env layer. A system-level directory (default ``/etc/hermes``, root-owned and not user-writable) supplies ``config.yaml`` and ``.env`` values that WIN over the user's ``~/.hermes/config.yaml`` and ``~/.hermes/.env`` on a per-leaf-key basis. This is DISTINCT from ``hermes_cli.config.is_managed()`` / ``HERMES_MANAGED``, which is a coarse package-manager write-lock (declarative-distro / formula installs). That lock blocks all mutation; this layer injects specific immutable values. The two are independent and may coexist. v1 enforcement is filesystem permissions only — see ``docs/design/managed-scope.md`` §7. v1 is Linux/POSIX-first; ``get_managed_dir()`` is the single seam for adding macOS / Windows native locations later. Attribution: do not reference any third-party product by name in this file. ) annotationsN)Path)DictOptionalz /etc/hermesDict[str, tuple] _CONFIG_CACHE _ENV_CACHEc&dtjvS)alTrue when running inside the test suite. Used to ignore the system default ``/etc/hermes`` during tests so a real managed scope on a developer/CI box can't leak policy into the suite. Tests that exercise managed scope set ``HERMES_MANAGED_DIR`` explicitly, which is still honored (the override path below runs before this guard takes effect). PYTEST_CURRENT_TEST)osenvironK/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/managed_scope.py _under_pytestr)s !BJJ ..rctjjddj}|rt |}|j r|SdSt rytj rtSdS)ujResolve the managed-scope directory, or None when no scope is present. Resolution (highest priority first): 1. ``$HERMES_MANAGED_DIR`` — deployment/bootstrap path override (IT-only; never persisted to any .env). Honored only when set to a non-empty value AND the directory exists. 2. ``/etc/hermes`` — POSIX default, when it exists. Ignored under pytest so a real system managed scope can't leak into the test suite. A non-existent directory at either tier resolves to None (no managed scope), which is the common case and must be cheap + side-effect-free. HERMES_MANAGED_DIRN)r r getstripris_dirr_DEFAULT_MANAGED_DIR)overrideps rget_managed_dirr4s`zz~~2B7==?H NHHJq(D(#7#>#>#@ JdJrct5tjtjdddy#1swYyxYw)z@Drop cached managed config/env. For tests and post-edit reloads.N) _CACHE_LOCKrclearr rrrinvalidate_managed_cacherJs2 s )9Acd |j}|j|jf}t |}t 5|j |}|)|dd|k(r!tj|dcdddSddd t|d5}||}dddt 5|d|dtjf||<ddd|S#t$rYywxYw#1swYixYw#1swYVxYw#t$r!} tjd|| Yd} ~ yd} ~ wwxYw#1swYSxYw)uNShared (mtime_ns, size)-keyed read. Returns a deepcopy of the parsed value. Returns ``None`` when the file is absent or fails to parse (fail-open). A parse failure is logged LOUDLY — the admin needs to know their policy isn't being applied — but never raises, so a malformed managed file can't brick startup. Nzutf-8)encodingumanaged scope: failed to parse %s: %s — IGNORING this managed file. Admin policy from this file is NOT being applied. Fix and restart.r) statOSError st_mtime_nsst_sizestrrrcopydeepcopyopen Exceptionloggerwarning) pathcacheparsestkeypath_keyhitfparsedexcs r _cached_readr9Qs2 YY[ >>2:: &C4yH )ii! ?s2Aw#~==Q()))  $ ) Q1XF  Bq63q64==+@AhB M+ ))     Q    B MsXC3C  C8 C,C8%"D% CC C),C51C88 D"DD"%D/cpt}|iSt|dz td}t|tr|SiS)zDParsed managed config.yaml, or {} when absent/malformed (fail-open).z config.yamlc4tj|xsiS)N)yaml safe_load)r6s rz%load_managed_config..{s$..#)rr)rr9r isinstancedict managed_dirr7s rload_managed_configrCssC!#K m#)F  -6525rcvt}|iSt|dz tt}t |t r|SiS)z?Parsed managed .env (KEY=VALUE), or {} when absent (fail-open).z.env)rr9r _parse_envr?r@rAs rload_managed_envrFs<!#K +. J GF-6525rc t}|s|Sddlm}m}m}|||}t |j dtrt|}d|di|d<|||S#t$rtjdd|cYSwxYw)uOverlay administrator-pinned config values on top of an already-built dict. The single, shared way for any config loader that builds its own dict (rather than going through hermes_cli.config.load_config) to honor managed scope. Mirrors hermes_cli.config._load_config_impl's managed merge exactly: * expand the managed config's ``${VAR}`` refs against the PROCESS env only (never user-config-defined refs), so a user cannot shadow a managed literal via a ${VAR} they control; * normalize the managed config's root ``model`` key (a bare ``model: x/y`` string is promoted to ``model.default``) so it can't clobber the dict shape callers expect; * leaf-level deep-merge managed ON TOP, so managed wins per-leaf while sibling keys stay user-controlled. Fail-open: returns ``config`` unchanged if no managed scope is present or on any error — managed scope must never break a caller's startup. Mutates and returns ``config`` (callers pass a dict they own). r) _deep_merge_expand_env_vars_normalize_root_model_keysmodeldefaultz-managed scope: failed to apply config overlayT)exc_info) rChermes_cli.configrHrIrJr?rr(r@r,r-r.)configmanagedrHrIrJmanaged_expandeds rapply_managed_overlayrRs(%'M__56Fw6OP &**73S 9#$45 )24DW4M(N W %6#344 FQUV s A%AA%%"B  B ci}|D]o}|j}|r|jdsd|vr+|jd\}}}|jjd||j<q|S)N#=z"')r startswith partition)r6outliner3_values rrErEstC6zz|ts+s$ s+ Q ;;=..u5CIIK 6 Jrct}|jD]L\}}|r|d|n t|}t|tr|r|t ||z}<|j |N|S)N.)setitemsr(r?r@ _flatten_keysadd)dprefixkeyskvdotteds rr`r`siD 1$*F81QCA a 1 M!V, ,D HHV   Krc(ttS)zGDotted leaf keys pinned by the managed config (e.g. {'model.default'}).)r`rCrrrmanaged_config_keysris ,. //rc|tvS)zCTrue if the exact dotted config key is pinned by the managed layer.)ri) dotted_keys ris_key_managedrls ,. ..rc|tvS)z=True if the env var name is pinned by the managed .env layer.)rF)names ris_env_managedros #% %%r)returnbool)rpzOptional[Path])rpNone)r/rr0r)rpr@)rpzDict[str, str])rOr@rpr@)r)rbr@rcr(rpr^)rpr^)rkr(rprq)rnr(rprq)"__doc__ __future__rr)loggingr threadingpathlibrtypingrrr< getLogger__name__r-rLockrr__annotations__r rrrr9rCrFrRrEr`rirlrorrrr}s"#  !   8 $M*inn "$ $! !/K,D 66(V0 / &r