`gj*? UdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z ejeZedGd d Zed d d ddedhffdddfZded<edGddZd+dZef d,dZd-dZd.dZd/dZd0dZd1dZd2d Zd!Zd"Zd3d#Zd4d$Z d5d%Z!ed& d6d'Z"d7d(Z#d8d)Z$d8d*Z%y)9a1 Security advisory checker for Hermes Agent. Detects known-compromised Python packages installed in the active venv (supply-chain attacks like the Mini Shai-Hulud worm of May 2026 that poisoned ``mistralai 2.4.6`` on PyPI) and surfaces remediation guidance to the user. Design goals: - **Cheap.** A single ``importlib.metadata.version()`` call per advisory package. Safe to run on every CLI startup. - **Loud when it matters, silent otherwise.** If no compromised package is installed, the user sees nothing. - **Acknowledgeable.** Once the user has read and acted on an advisory they can dismiss it via ``hermes doctor --ack ``; the ack is persisted to ``config.security.acked_advisories`` and survives restart. - **Extensible.** Adding a new advisory is one entry in ``ADVISORIES``; adding a new compromised version is a one-line edit. No code changes needed when the next worm hits. The check is invoked from three places: 1. ``hermes doctor`` (and ``hermes doctor --ack ``) 2. CLI startup banner (one short line, then full guidance via ``hermes doctor``) 3. Gateway startup (logged to gateway.log; first interactive message gets a one-line operator banner) This module is intentionally dependency-free beyond the stdlib so it can run in environments where the rest of Hermes failed to import. ) annotationsN) dataclass)Path)IterableOptionalT)frozencjeZdZUdZded<ded<ded<ded<ded<d ed <d Zded <d Zded<y)Advisoryu(One security advisory entry. Attributes: id: stable identifier used for acks (e.g. ``shai-hulud-2026-05``). Lowercase-hyphen, never reused. title: one-line headline shown in banners. summary: 1-3 sentence description of what was compromised and how. url: reference URL (Socket advisory, GitHub advisory, PyPI page). compromised: tuple of ``(package_name, frozenset_of_versions)`` pairs. Empty frozenset means "any version of this package is considered suspect" — use sparingly. remediation: ordered list of steps the user should take. First step should be the uninstall command; subsequent steps the credential audit / rotation guidance. published: ISO date string for sort order. stridtitlesummaryurlz&tuple[tuple[str, frozenset[str]], ...] compromisedztuple[str, ...] remediation publishedhighseverityN)__name__ __module__ __qualname____doc____annotations__rrQ/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/security_advisories.pyr r Bs=" G J L H77  IsHcrr zshai-hulud-2026-05u<Mini Shai-Hulud worm — mistralai 2.4.6 compromised on PyPIu`PyPI quarantined the mistralai package on 2026-05-12 after a malicious 2.4.6 release. The worm steals credentials from environment variables and credential files (~/.npmrc, ~/.pypirc, ~/.aws/credentials, GitHub PATs, cloud SDK tokens) and exfils them to a hardcoded webhook. If you ran any Python process that imported mistralai 2.4.6 — including hermes when configured with provider=mistral for TTS or STT — assume those credentials are exposed. PyPI has since removed 2.4.6 and the project ships clean releases again (2.4.7, 2.4.8); this advisory only fires if the compromised 2.4.6 is still installed.z1https://socket.dev/blog/mini-shai-hulud-worm-pypi mistralaiz2.4.6)zARun: pip uninstall -y mistralai (or: uv pip uninstall mistralai)zlRotate API keys in ~/.hermes/.env (OpenRouter, Anthropic, OpenAI, Nous, GitHub, AWS, Google, Mistral, etc.).zAudit ~/.npmrc, ~/.pypirc, ~/.aws/credentials, ~/.config/gh/hosts.yml, and any other credential files for tokens that may have been read.zgCheck GitHub for unexpected new SSH keys, deploy keys, or webhook additions on repos you have admin on.zOAfter cleanup: hermes doctor --ack shai-hulud-2026-05 to dismiss this warning.z 2026-05-12critical)r r rrrrrrztuple[Advisory, ...] ADVISORIESc0eZdZUdZded<ded<ded<y) AdvisoryHitz.One package-version match against an advisory.r advisoryr packageinstalled_versionN)rrrrrrrrr"r"s8 Lrr"c ddlm}m} ||S#t$rYywxYw#|$rYyt$rt j d|dYywxYw)zReturn the installed version of ``pkg_name``, or None if not installed. Uses ``importlib.metadata`` so we don't depend on pip being importable inside the active venv (uv-created venvs may lack pip). r)PackageNotFoundErrorversionNz%importlib.metadata.version(%s) raisedTexc_info)importlib.metadatar'r( ImportError Exceptionloggerdebug)pkg_namer'r(s r_installed_versionr1sb Dx       CFLLN ::  > Nu  ;s BC6C*CCc|j}|sy ddlm}m} |}|jdi}|jdxsg}t|tsg}||vr|j|||d<||y#t$rt j dYywxYw#t$rt jd|YywxYw) u|Persist an ack for ``advisory_id``. Returns True on success. Idempotent — acking an already-acked ID is a no-op. Fr)r: save_configz-Could not import config module to persist ackr;r<Tz%Failed to persist advisory ack for %s) rBr=r:rIr-r.warning setdefaultr?r@rAr3 exception) advisory_idr:rIrCrDexistings r ack_advisoryrOs ##%K > mnnZ,77-.4"(D)H h & OOK (&.C" #   FG @+Ns#BA"B%B"!B"%CCcz|sgSt}|Dcgc]}|jj|vs|c}Scc}w)z=Return only hits whose advisories the user has not dismissed.)rGr#r )r5ackedhs rfilter_unackedrSs4  OE :!qzz}}E9A :: :s88ctjjdrytjj syy)NNO_COLORFT)osenvironr?sysstdoutisattyrrr_term_supports_colorr[s+ zz~~j! ::    rc 8|sgS|d}d|jjd|jjd|jd|jdg}t |dkDr5|j ddt |dz d t |d kDrd nd d |S)zReturn 1-3 short lines suitable for a startup banner. Caller is responsible for color/styling. Always names the worst hit explicitly so the user knows what's wrong without running doctor. rzSECURITY ADVISORY [z]: z Detected: ==z, Run 'hermes doctor' for remediation steps.z (z additional advisoriesyz also active.))r#r r r$r%leninsert)r5primaryliness rshort_banner_linesrfs  1gG g..112#g6F6F6L6L5MN w'r'*C*C)DE6 E  4y1} Q#c$i!m_,?#&t9q=%c:.J K Lrch|j}d|jdd|jd|jd|jd|j d|j d|jd |jd d g}t|jd D]\}}|jd |d ||S)z@Return a multi-line block describing the advisory + remediation.z=== z ===z ID: z Severity: z Published: z Detected: r]z Reference: rz Remediation:r^z z. ) r#r r rrr$r%rr enumeraterr3)hitareisteps rfull_remediation_textrm$s A qwwit addV>!**_Q[[MR ckk]"S%:%:$;< aeeW    EQ]]A.'4 r!Btf%&' Lradvisory_banner_seenc ddlm}t|dz }|jdd|tz S#t $rYywxYw)Nr)get_hermes_homecacheT)parentsexist_ok)hermes_constantsrqrmkdir_BANNER_CACHE_FILEr-)rq cache_dirs r_banner_cache_pathryGsJ4*+g5 t4--- s47 AAcdt}||jsiSi} |jdjD]J}|j }|s|j dd}t |dk7r7|\}} t|||<L |S#t$rY[wxYw#t$ricYSwxYw)Nutf-8encodingr^r_) ryexists read_text splitlinesrBsplitrbfloat ValueErrorr-)poutlinepartsrMtss r_read_banner_cacherQsAy  CKKK1<<> D::z&gateway_log_message..s<qzz}}N>N=OPzz~~&( )5zlYYC DEr)r0r return Optional[str])r4zIterable[Advisory]rlist[AdvisoryHit])rzset[str])rMr rbool)r5rrr)rr)r5rr list[str])rir"rr)rzOptional[Path])rdict[str, float])rrrNone)r5rrintrr)r5rrztuple[bool, list[str]])r5rrr)&r __future__rloggingrVrX dataclassesrpathlibrtypingrr getLoggerrr.r frozensetr rr"r1r8rGrOrSr[rfrmrw_BANNER_REPEAT_HOURSryrrrrrrrrrrsOB# !%   8 $. $: L 8 @ )WI. /   ? "$ "T $,&0"F;(:;(>,.M-  F$" Er