yj .UdZddlmZddlZddlZddlZddlZddlmZddl m Z m Z ddl Z ej eZedZejZiZded<iZded <d'd Zd(dZd)dZd*dZd+dZd,dZd-dZd,dZd.d/d!Zd0d"Zd1d$Z d2d&Z!dS)3uaManaged scope — IT-pushed, user-immutable config & env layer. A system-level directory (default ``/etc/hermes``, root-owned and not user-writable) supplies ``config.yaml`` and ``.env`` values that WIN over the user's ``~/.hermes/config.yaml`` and ``~/.hermes/.env`` on a per-leaf-key basis. This is DISTINCT from ``hermes_cli.config.is_managed()`` / ``HERMES_MANAGED``, which is a coarse package-manager write-lock (declarative-distro / formula installs). That lock blocks all mutation; this layer injects specific immutable values. The two are independent and may coexist. v1 enforcement is filesystem permissions only — see ``docs/design/managed-scope.md`` §7. v1 is Linux/POSIX-first; ``get_managed_dir()`` is the single seam for adding macOS / Windows native locations later. Attribution: do not reference any third-party product by name in this file. ) annotationsN)Path)DictOptionalz /etc/hermesDict[str, tuple] _CONFIG_CACHE _ENV_CACHEreturnboolcdtjvS)alTrue when running inside the test suite. Used to ignore the system default ``/etc/hermes`` during tests so a real managed scope on a developer/CI box can't leak policy into the suite. Tests that exercise managed scope set ``HERMES_MANAGED_DIR`` explicitly, which is still honored (the override path below runs before this guard takes effect). PYTEST_CURRENT_TEST)osenviron>/home/ragecks/.hermes/hermes-agent/hermes_cli/managed_scope.py _under_pytestr)s !BJ ..rOptional[Path]ctjdd}|r't |}|r|ndSt rdStrtndS)ujResolve the managed-scope directory, or None when no scope is present. Resolution (highest priority first): 1. ``$HERMES_MANAGED_DIR`` — deployment/bootstrap path override (IT-only; never persisted to any .env). Honored only when set to a non-empty value AND the directory exists. 2. ``/etc/hermes`` — POSIX default, when it exists. Ignored under pytest so a real system managed scope can't leak into the test suite. A non-existent directory at either tier resolves to None (no managed scope), which is the common case and must be cheap + side-effect-free. HERMES_MANAGED_DIRN)rrgetstripris_dirr_DEFAULT_MANAGED_DIR)overrideps rget_managed_dirr4s~z~~2B77==??H) NNHHJJ(qqD(t#7#>#>#@#@ J  dJrNonect5ttddddS#1swxYwYdS)z@Drop cached managed config/env. For tests and post-edit reloads.N) _CACHE_LOCKrclearr rrrinvalidate_managed_cacher#Js s3AA A pathrcachec |}n#t$rYdSwxYw|j|jf}t |}t 5||}|4|dd|kr&tj|dcdddSdddn #1swxYwY t|d5}||}dddn #1swxYwYn4#t$r'} t d|| Yd} ~ dSd} ~ wwxYwt 5|d|dtj|f||<dddn #1swxYwY|S)uNShared (mtime_ns, size)-keyed read. Returns a deepcopy of the parsed value. Returns ``None`` when the file is absent or fails to parse (fail-open). A parse failure is logged LOUDLY — the admin needs to know their policy isn't being applied — but never raises, so a malformed managed file can't brick startup. Nzutf-8)encodingumanaged scope: failed to parse %s: %s — IGNORING this managed file. Admin policy from this file is NOT being applied. Fix and restart.r) statOSError st_mtime_nsst_sizestrr!rcopydeepcopyopen Exceptionloggerwarning) r$r%parsestkeypath_keyhitfparsedexcs r _cached_readr=Qsh YY[[ tt >2: &C4yyH ))ii!! ?s2A2w#~~=Q(()))))))))))))))))))))))  $ ) ) ) QU1XXF                 Q      ttttt BBq63q64=+@+@AhBBBBBBBBBBBBBBB Msl %% ?B$$B(+B(0C% C C%CC% C!C%% D/DD 'EEEdictct}|iSt|dz td}t|tr|niS)zDParsed managed config.yaml, or {} when absent/malformed (fail-open).Nz config.yamlc.tj|piS)N)yaml safe_load)r:s rz%load_managed_config..{s$.##)rr)rr=r isinstancer> managed_dirr;s rload_managed_configrGssS!##K m#))F  -- 56625rDict[str, str]ct}|iSt|dz tt}t |t r|niS)z?Parsed managed .env (KEY=VALUE), or {} when absent (fail-open).Nz.env)rr=r _parse_envrDr>rEs rload_managed_envrKsG!##K +. J G GF-- 56625rconfigc` t}|s|Sddlm}m}m}|||}t |dtrt|}d|di|d<|||S#t$r!t dd|cYSwxYw)uOverlay administrator-pinned config values on top of an already-built dict. The single, shared way for any config loader that builds its own dict (rather than going through hermes_cli.config.load_config) to honor managed scope. Mirrors hermes_cli.config._load_config_impl's managed merge exactly: * expand the managed config's ``${VAR}`` refs against the PROCESS env only (never user-config-defined refs), so a user cannot shadow a managed literal via a ${VAR} they control; * normalize the managed config's root ``model`` key (a bare ``model: x/y`` string is promoted to ``model.default``) so it can't clobber the dict shape callers expect; * leaf-level deep-merge managed ON TOP, so managed wins per-leaf while sibling keys stay user-controlled. Fail-open: returns ``config`` unchanged if no managed scope is present or on any error — managed scope must never break a caller's startup. Mutates and returns ``config`` (callers pass a dict they own). r) _deep_merge_expand_env_vars_normalize_root_model_keysmodeldefaultz-managed scope: failed to apply config overlayT)exc_info) rGhermes_cli.configrNrOrPrDrr.r>r2r3r4)rLmanagedrNrOrPmanaged_expandeds rapply_managed_overlayrWs(%'' M__________556F6Fw6O6OPP &**733S 9 9 O#$455 )24DW4M(N W %{6#3444 FQUVVV sBA-B(B-,B-ci}|D]}|}|r|dsd|vr2|d\}}}|d||<|S)N#=z"')r startswith partition)r:outliner7_values rrJrJsC66zz|| ts++ s$ s++ Q ;;==..u55CIIKK Jrrdprefixr.setct}|D]]\}}|r|d|nt|}t|tr|r|t ||z}H||^|S)N.)rcitemsr.rDr> _flatten_keysadd)rarbkeyskvdotteds rrgrgsD 1$*6FQA a   1  M!V,, ,DD HHV     Krc8ttS)zGDotted leaf keys pinned by the managed config (e.g. {'model.default'}).)rgrGrrrmanaged_config_keysrns ,.. / //r dotted_keyc"|tvS)zCTrue if the exact dotted config key is pinned by the managed layer.)rn)ros ris_key_managedrqs ,.. ..rnamec"|tvS)z=True if the env var name is pinned by the managed .env layer.)rK)rrs ris_env_managedrts #%% %%r)r r )r r)r r)r$rr%r)r r>)r rH)rLr>r r>)r)rar>rbr.r rc)r rc)ror.r r )rrr.r r )"__doc__ __future__rr/loggingr threadingpathlibrtypingrrrA getLogger__name__r3rLockr!r__annotations__r rrr#r=rGrKrWrJrgrnrqrtrrrrs"#"""""  !!!!!!!!  8 $ $tM**in "$ $$$$! !!!!////KKKK,D 6 6 6 66666((((V0000 //// &&&&&&r