Ë
    ÿ`gjŽ  ã                  óÆ   — U d Z ddlmZ ddlZddlmZ ddlmZ ddlm	Z	  ej                  e«      Z ed«      Zded	<   dd
„Zdaded<   dd„Zdd„Zdd„Zdd„Zdd„Zdd„Zy)ua  Environment variable passthrough registry.

Skills that declare ``required_environment_variables`` in their frontmatter
need those vars available in sandboxed execution environments (execute_code,
terminal).  By default both sandboxes strip secrets from the child process
environment for security.  This module provides a session-scoped allowlist
so skill-declared vars (and user-configured overrides) pass through.

Two sources feed the allowlist:

1. **Skill declarations** â€” when a skill is loaded via ``skill_view``, its
   ``required_environment_variables`` are registered here automatically.
2. **User config** â€” ``terminal.env_passthrough`` in config.yaml lets users
   explicitly allowlist vars for non-skill use cases.

Both ``code_execution_tool.py`` and ``tools/environments/local.py`` consult
:func:`is_env_passthrough` before stripping a variable.
é    )ÚannotationsN)Ú
ContextVar)ÚIterable)Úcfg_getÚ_allowed_env_varszContextVar[set[str]]Ú_allowed_env_vars_varc                 óŒ   — 	 t         j                  «       S # t        $ r$ t        «       } t         j                  | «       | cY S w xY w)zGGet or create the allowed env vars set for the current context/session.)r   ÚgetÚLookupErrorÚset)Úvals    úH/root/.hermes/venv/lib/python3.12/site-packages/tools/env_passthrough.pyÚ_get_allowedr   "   s?   € ðÜ$×(Ñ(Ó*Ð*øÜò Ü›ˆÜ×!Ñ! #Ô&ØŠ
ðús   ‚ –*AÁAzfrozenset[str] | NoneÚ_config_passthroughc                óˆ   — 	 ddl m}m}  || «      ry| |v S # t        $ r!}t        j                  d| |«       Y d}~yd}~ww xY w)uÙ  True if ``name`` is a Hermes-managed provider credential (API key,
    token, or similar) per ``_HERMES_PROVIDER_ENV_BLOCKLIST``.

    Skill-declared ``required_environment_variables`` frontmatter must
    not be able to override this list â€” that was the bypass in
    GHSA-rhgp-j443-p4rf where a malicious skill registered
    ``ANTHROPIC_TOKEN`` / ``OPENAI_API_KEY`` as passthrough and received
    the credential in the ``execute_code`` child process, defeating the
    sandbox's scrubbing guarantee.

    Non-Hermes API keys (TENOR_API_KEY, NOTION_TOKEN, etc.) are NOT
    in the blocklist and remain legitimately registerable â€” skills that
    wrap third-party APIs still work.

    Fail closed: if the authoritative blocklist cannot be imported (partial
    install, import-time error, etc.) we treat the name as a protected
    provider credential and refuse passthrough, rather than fall open and
    let a skill tunnel a Hermes credential into the execute_code child.
    r   )Ú_HERMES_PROVIDER_ENV_BLOCKLISTÚ_is_hermes_internal_secretz}env passthrough: provider credential blocklist import failed; failing closed and refusing passthrough registration for %r: %sNT)Útools.environments.localr   r   Ú	ExceptionÚloggerÚwarning)Únamer   r   Úes       r   Ú_is_hermes_provider_credentialr   0   sT   € ð(÷	
ñ" " $Ô'ØØÐ1Ð1Ð1øô ò Ü‰ðNàØô		
ô ûðús   ‚ —	A <¼Ac                óÚ   — | D ]f  }|j                  «       }|sŒt        |«      rt        j                  d|«       Œ8t	        «       j                  |«       t        j                  d|«       Œh y)uä  Register environment variable names as allowed in sandboxed environments.

    Typically called when a skill declares ``required_environment_variables``.

    Variables that are Hermes-managed provider credentials (from
    ``_HERMES_PROVIDER_ENV_BLOCKLIST``) are rejected here to preserve
    the ``execute_code`` sandbox's credential-scrubbing guarantee per
    GHSA-rhgp-j443-p4rf. A skill that needs to talk to a Hermes-managed
    provider should do so via the agent's main-process tools (web_search,
    web_extract, etc.) where the credential remains safely in the main
    process.

    Non-Hermes third-party API keys (TENOR_API_KEY, NOTION_TOKEN, etc.)
    pass through normally â€” they were never in the sandbox scrub list.
    zÓenv passthrough: refusing to register Hermes provider credential %r (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Skills must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.zenv passthrough: registered %sN)Ústripr   r   r   r   ÚaddÚdebug)Ú	var_namesr   s     r   Úregister_env_passthroughr    [   sg   € ð  ò =ˆØz‰z‹|ˆÙØÜ)¨$Ô/ÜN‰NðAð ôð Ü‹×Ñ˜4Ô Ü‰Ð5°tÕ<ñ=ó    c                 óÔ  — t         t         S t        «       } 	 ddlm}  |«       }t	        |dd«      }t        |t        «      rk|D ]f  }t        |t        «      r|j                  «       sŒ$|j                  «       }t        |«      rt        j                  d|«       ŒV| j                  |«       Œh t        | «      a t         S # t        $ r }t        j                  d|«       Y d}~Œ5d}~ww xY w)z9Load ``tools.env_passthrough`` from config.yaml (cached).Nr   )Úread_raw_configÚterminalÚenv_passthroughzôenv passthrough: refusing to register Hermes provider credential %r from config.yaml (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Operator configuration must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.z4Could not read tools.env_passthrough from config: %s)r   r   Úhermes_cli.configr#   r   Ú
isinstanceÚlistÚstrr   r   r   r   r   r   r   Ú	frozenset)Úresultr#   ÚcfgÚpassthroughÚitemr   r   s          r   Ú_load_config_passthroughr/   |   sÚ   € ô Ð&Ü"Ð"ä“u€FðPÝ5ÙÓˆÜ˜c :Ð/@ÓAˆÜk¤4Ô(Ø#ò !Ü! $¬Ô,°D·J±J´LØØ—z‘z“|ô 2°$Ô7Ü—N‘Nð/ð ôð Ø—
‘
˜4Õ ð)!ô0 $ FÓ+ÐÜÐøô	 ò PÜ‰ÐKÈQ×OÑOûðPús   ˜BB> Â>	C'ÃC"Ã"C'c                ó4   — | t        «       v ry| t        «       v S )zÄCheck whether *var_name* is allowed to pass through to sandboxes.

    Returns ``True`` if the variable was registered by a skill or listed in
    the user's ``tools.env_passthrough`` config.
    T)r   r/   )Úvar_names    r   Úis_env_passthroughr2   ¤   s    € ð ”<“>Ñ!ØØÔ/Ó1Ð1Ð1r!   c                 ó>   — t        t        «       «      t        «       z  S )zGReturn the union of skill-registered and config-based passthrough vars.)r*   r   r/   © r!   r   Úget_all_passthroughr5   ¯   s   € ä”\“^Ó$Ô'?Ó'AÑAÐAr!   c                 ó4   — t        «       j                  «        y)z9Reset the skill-scoped allowlist (e.g. on session reset).N)r   Úclearr4   r!   r   Úclear_env_passthroughr8   ´   s   € äƒN×ÑÕr!   )Úreturnzset[str])r   r)   r9   Úbool)r   zIterable[str]r9   ÚNone)r9   zfrozenset[str])r1   r)   r9   r:   )r9   r;   )Ú__doc__Ú
__future__r   ÚloggingÚcontextvarsr   Útypingr   r&   r   Ú	getLoggerÚ__name__r   r   Ú__annotations__r   r   r   r    r/   r2   r5   r8   r4   r!   r   ú<module>rD      sv   ðòõ& #ã Ý "Ý Ý %à	ˆ×	Ñ	˜8Ó	$€ñ /9Ð9LÓ.MÐ Ð+Ó Móð .2Ð Ð*Ó 1ó(2óV=óB%óP2óBô
r!   