yj2$UdZddlmZddlZddlmZddlmZddlm Z ej e Z edZ ded <d d Zdad ed<d!dZd"dZd#dZd$dZd#dZ d%d&dZd'dZdS)(uEnvironment variable passthrough registry. Skills that declare ``required_environment_variables`` in their frontmatter need those vars available in sandboxed execution environments (execute_code, terminal). By default both sandboxes strip secrets from the child process environment for security. This module provides a session-scoped allowlist so skill-declared vars (and user-configured overrides) pass through. Two sources feed the allowlist: 1. **Skill declarations** — when a skill is loaded via ``skill_view``, its ``required_environment_variables`` are registered here automatically. 2. **User config** — ``terminal.env_passthrough`` in config.yaml lets users explicitly allowlist vars for non-skill use cases. Both ``code_execution_tool.py`` and ``tools/environments/local.py`` consult :func:`is_env_passthrough` before stripping a variable. When profile multiplexing is active, their forwarded values are resolved through the current profile's secret scope rather than the process environment. ) annotationsN) ContextVar)Iterable)cfg_get_allowed_env_varszContextVar[set[str]]_allowed_env_vars_varreturnset[str]c tS#t$r-t}t||cYSwxYw)zGGet or create the allowed env vars set for the current context/session.)rget LookupErrorset)vals ;/home/ragecks/.hermes/hermes-agent/tools/env_passthrough.py _get_allowedr$sZ$((*** !!#&&& s4AAzfrozenset[str] | None_config_passthroughnamestrboolc ddlm}m}n4#t$r'}td||Yd}~dSd}~wwxYw||rdS||vS)uTrue if ``name`` is a Hermes-managed provider credential (API key, token, or similar) per ``_HERMES_PROVIDER_ENV_BLOCKLIST``. Skill-declared ``required_environment_variables`` frontmatter must not be able to override this list — that was the bypass in GHSA-rhgp-j443-p4rf where a malicious skill registered ``ANTHROPIC_TOKEN`` / ``OPENAI_API_KEY`` as passthrough and received the credential in the ``execute_code`` child process, defeating the sandbox's scrubbing guarantee. Non-Hermes API keys (TENOR_API_KEY, NOTION_TOKEN, etc.) are NOT in the blocklist and remain legitimately registerable — skills that wrap third-party APIs still work. Fail closed: if the authoritative blocklist cannot be imported (partial install, import-time error, etc.) we treat the name as a protected provider credential and refuse passthrough, rather than fall open and let a skill tunnel a Hermes credential into the execute_code child. r)_HERMES_PROVIDER_ENV_BLOCKLIST_is_hermes_internal_secretz}env passthrough: provider credential blocklist import failed; failing closed and refusing passthrough registration for %r: %sNT)tools.environments.localrr Exceptionloggerwarning)rrres r_is_hermes_provider_credentialr2s(            N     ttttt"!$''t 1 11s <7< var_names Iterable[str]Nonec |D]}|}|st|rtd|Dt |td|dS)uRegister environment variable names as allowed in sandboxed environments. Typically called when a skill declares ``required_environment_variables``. Variables that are Hermes-managed provider credentials (from ``_HERMES_PROVIDER_ENV_BLOCKLIST``) are rejected here to preserve the ``execute_code`` sandbox's credential-scrubbing guarantee per GHSA-rhgp-j443-p4rf. A skill that needs to talk to a Hermes-managed provider should do so via the agent's main-process tools (web_search, web_extract, etc.) where the credential remains safely in the main process. Non-Hermes third-party API keys (TENOR_API_KEY, NOTION_TOKEN, etc.) pass through normally — they were never in the sandbox scrub list. zenv passthrough: refusing to register Hermes provider credential %r (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Skills must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.zenv passthrough: registered %sN)striprrrradddebug)rrs rregister_env_passthroughr&]s ==zz||   )$ / /  NNA     4    5t<<<<==frozenset[str]c@ttSt} ddlm}|}t |dd}t |t r|D]}t |tr|s,|}t|rt d|k| |n2#t$r%}td|Yd}~nd}~wwxYwt|atS)z9Load ``tools.env_passthrough`` from config.yaml (cached).Nr)read_raw_configterminalenv_passthroughzenv passthrough: refusing to register Hermes provider credential %r from config.yaml (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Operator configuration must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.z4Could not read tools.env_passthrough from config: %s)rrhermes_cli.configr*r isinstancelistrr#rrrr$rr% frozenset)resultr*cfg passthroughitemrrs r_load_config_passthroughr5~sL&""uuFP555555oc:/@AA k4 ( ( !# ! !!$,,DJJLLzz|| 2$77 NN/  4    PPP KQOOOOOOOOP$F++ sB9C D"DDvar_namecF|tvrdS|tvS)zCheck whether *var_name* is allowed to pass through to sandboxes. Returns ``True`` if the variable was registered by a skill or listed in the user's ``tools.env_passthrough`` config. T)rr5)r6s ris_env_passthroughr8s* <>>!!t /11 11r'cVtttzS)zGReturn the union of skill-registered and config-based passthrough vars.)r0rr5r'rget_all_passthroughr;s \^^ $ $'?'A'A AAr'fallback str | Nonecddlm}m}m}m}||r||S|}|}||r ||S|S|||rdn|S)aResolve an allowlisted variable without crossing profile boundaries. ``fallback`` is the value the caller would have forwarded before profile secret scopes existed (typically a snapshot of ``os.environ`` or the current profile's ``.env``). An active multiplex scope is authoritative: a missing key returns ``None`` and never falls back to the process-global environment. An unscoped read while multiplexing is active raises the fail-closed ``UnscopedSecretError`` from :mod:`agent.secret_scope`. Outside multiplexing, an installed scope keeps the existing overlay semantics and an unscoped caller keeps its already-resolved fallback. r)_is_global_envcurrent_secret_scope get_secretis_multiplex_activeN)agent.secret_scoper?r@rArB)rr<r?r@rArBscopemultiplex_actives rresolve_passthrough_valuerFs ~d 4 " "E**,, }  $:d## # :d$4BDD( C CCr'cFtdS)z9Reset the skill-scoped allowlist (e.g. on session reset).N)rclearr:r'rclear_env_passthroughrIsNNr')r r )rrr r)rr r r!)r r()r6rr r)N)rrr<r=r r=)r r!)__doc__ __future__rlogging contextvarsrtypingrr-r getLogger__name__rr__annotations__rrrr&r5r8r;rFrIr:r'rrRsm*#"""""""""""%%%%%%  8 $ $/9j9L.M.MMMMM.21111(2(2(2(2V====B%%%%P2222BBBB $D$D$D$D$DNr'