yjM UdZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z m Z m Z mZmZmZmZddlmZddlmZejeZdZdefd Zd edefd Zehd Zd ede efd Z d edefdZ!eddhZ"eej#dej#dej#dej#dej#dej#dej#dej#dej#dh Z$ej%dej%dfZ&edhZ'dZ(ej%dZ)da*da+ee,d <defd!Z-defd"Z.dGd#Z/d$ej0ej1zdefd%Z2d edefd&Z3d'ed(edefd)Z4d edefd*Z5d edefd+Z6Gd,d-e7Z8d.ed/e9d0e:e;ee9fefdefd1ZGd3d4Z?Gd5d6Z@d7ede:e;ee9feffd8ZAd9edefd:ZBd9edefd;ZCdZDdtdtDS)z8Return True when at least one HTTP proxy env var is set.c3TK|]#}tj|V$dSN)osenvironget).0vs 6/home/ragecks/.hermes/hermes-agent/tools/url_safety.py z'_proxy_is_configured..7s0::Qrz~~a  ::::::)any_PROXY_ENV_VARSrr_proxy_is_configuredr#5s ::/::: : ::rurlct|ts|S|}|s|Stjdd|} t |}n#t $r|cYSwxYw|jdvr|S|j }|j }|rY | d d}n#t$r|}YnwxYw||kr|||d}t|jd}t|jd }t|jd }t'|j||||fS) uReturn an ASCII-safe HTTP URL for Hermes-owned URL tools. Browsers and HTTP clients expect URIs, but users and models often provide IRIs such as ``https://wttr.in/Köln``. Preserve URL syntax and existing percent escapes while encoding non-ASCII host/path/query/fragment text. This is intentionally for URL tool inputs only; arbitrary shell commands must not be rewritten. z ^([A-Za-z][A-Za-z0-9+.-]*://)\s+z\1>httphttpsidnaasciiz/%:@!$&'()*+,;=)safez/%:@!$&'()*+,;=?) isinstancestrstripresubr ValueErrorschemelowernetlochostnameencodedecode UnicodeErrorreplacerpathqueryfragmentr ) r$rawparsedr4r5 ascii_hostr:r;r<s rnormalize_url_for_requestr@:s| c3   ))++C   &4eS A AC#  }$555 ]FH= "!0077@@JJ " " "!JJJ "  ! !^^Hj!<>>H v}fdE8D E EEs$A A&%A&(C CC>x-amz-signaturex-amz-security-tokenjwttokenapikeypasswdsecretapi_keypassword signature auth_token credential session_id credentials access_token authorization client_secretawsaccesskeyidx_amz_signaturex_amz_security_tokenct|trd|vrdS t|}n#t$rYdSwxYw|jdvs|jsdSt|jdD]3\}}|r,t|tvr|cS4dS)alReturn the first sensitive query parameter name in ``url``, if any. Used before handing URLs to third-party fetch/browser backends. Prefix-based token redaction catches known credential shapes; this catches opaque magic links, OAuth codes, signed URL signatures, and custom ``?token=...`` values that do not have a recognizable vendor prefix. ?N>r&r'T)keep_blank_values) r,r-r r.r1r2r3r;rr_SENSITIVE_QUERY_PARAM_NAMES)r$r>keyvalues rsensitive_query_param_namer[s c3  3c>>t#))++&& tt }$555V\5t EEE U  WS\\''))-IIIJJJ 4s!? A  A c$t|duS)zHReturn True when ``url`` carries likely credential-bearing query params.N)r[r$s rhas_sensitive_query_paramsr^s %c * *$ 66rzmetadata.google.internalz metadata.googz169.254.169.254z 169.254.170.2z169.254.169.253z fd00:ec2::254z100.100.100.200z::ffff:169.254.169.254z::ffff:169.254.170.2z::ffff:169.254.169.253z::ffff:100.100.100.200z169.254.0.0/16z::ffff:169.254.0.0/112zmultimedia.nt.qq.com.cnz 100.64.0.0/10F_cached_allow_privatecttStrtSdatatS)a Return True when the user has opted out of private-IP blocking. Checks (in priority order): 1. ``HERMES_ALLOW_PRIVATE_URLS`` env var (``true``/``1``/``yes``) 2. ``security.allow_private_urls`` in config.yaml 3. ``browser.allow_private_urls`` in config.yaml (legacy / backward compat) The single-profile result is cached for the process lifetime. Multiplexed profile turns bypass that process-global cache because their config root is context-local; ``read_raw_config()`` already provides path/mtime caching. NT)r _resolve_allow_private_urls_allow_private_resolvedr`r"rr_global_allow_private_urlsrdsB" !!-*,,,%$$"799  rctjdd}|dvrdS|dvrdS ddlm}|}|d i}t|tr&t|d d rdS|d i}t|tr&t|d d rdSn#t$rYnwxYwdS) zFResolve the effective private-URL toggle from the active config scope.HERMES_ALLOW_PRIVATE_URLS>1yestrueT>0nofalseFr)read_raw_configsecurityallow_private_urls)defaultbrowser) rgetenvr.r3hermes_cli.configrnrr,dictr Exception)env_valrncfgsecrrs rrbrbsDi3R88>>@@FFHHG&&&t&&&u 555555oggj"%% c4  _ GG( ) )5& & &  4'')R(( gt $ $  KK, - -u* * *  4       5sAC:(AC:: DDcdadadS)u+Reset the cached toggle — only for tests.FN)rcr`r"rr_reset_allow_private_cacher{s$!ripc.t|tjrA|j:|j}|jp+|jp$|jp|jp|jp|j p|tvS|js|js|js|jrdS|js|j rdS|tvrdSdS)z.is800!c 000000rzDBlocked request to cloud metadata address (always-blocked floor): %sr%u>Unparseable IP address %r for hostname %s — skipping addressc3 K|]}|vV dSrr")rrresolveds rrz(is_always_blocked_url..s866$'C666666rzJBlocked request to cloud metadata address (always-blocked floor): %s -> %sz&is_always_blocked_url error for %s: %s)r r5r.r3rstrip_BLOCKED_HOSTNAMESloggerwarningr~ ip_addressr1_ALWAYS_BLOCKED_IPSr _ALWAYS_BLOCKED_NETWORKSsocket getaddrinfo AF_UNSPEC SOCK_STREAMgaierrorsplitrvdebug) r$r>r5 addr_info_family_sockaddrip_strexcr|rs @@ris_always_blocked_urlr7s:C#O)r002288::AA#FF 5 ) ) ) NNQ   4 %h//BB   BBB  >(((C0000%=000--(1 t5 *$ 0&2DII   55 +4   &GQ1ha[Ff}}c**1- $/77   _aijkalnvwww ...#6666+C66633.7  tt/u   =sCHHHuuuuu sAG6$G6>BG6 B"G6!B""A G60+DG6D/+G6.D//4G6$E98G69,F(%G6'F((A G63G66 H'H""H'r5r2c |dko|tvS)zGReturn True when a trusted HTTPS hostname may bypass IP-class blocking.r')_TRUSTED_PRIVATE_IP_HOSTS)r5r2s r_allows_private_ip_resolutionrs W  F-F!FFrc t|}|jpdd}|jpd}|dvrt d|pddS|sdS|tvrt d|dSt}t||} tj |dtj tj}n#tj$rwd } t!j|n#t$$rd}YnwxYw|s,t'rt d |Yd St d |YdSwxYw|D]\}} } } } | d } d | vr| d d } t!j|  n4#t$$r't d| d |YdSwxYw t,vs t/ fdt0Drt d|| dS|s0|s.t3 rt d|| dS|rt d|n|rt d|d S#t4$r'} t d|| Yd} ~ dSd} ~ wwxYw)uReturn True if the URL target is not a private/internal address. Resolves the hostname to an IP and checks against private ranges. Fails closed: DNS errors and unexpected exceptions block the request. When ``security.allow_private_urls`` is enabled (or the env var ``HERMES_ALLOW_PRIVATE_URLS=true``), private-IP blocking is skipped. Cloud metadata endpoints (169.254.169.254, metadata.google.internal) remain blocked regardless — they are never legitimate agent targets. rgr>r&r'u.Blocked request — unsupported URL scheme: %szFz(Blocked request to internal hostname: %sNTu]DNS resolution failed for %s — proxy configured, allowing through for proxy-side resolutionu1Blocked request — DNS resolution failed for: %srru=Blocked request — unparseable IP address %r for hostname %sc3 K|]}|vV dSrr"rs rrzis_safe_url..s'/^/^cc /^/^/^/^/^/^rz3Blocked request to cloud metadata address: %s -> %sz5Blocked request to private/internal address: %s -> %szKAllowing private/internal resolution (security.allow_private_urls=true): %szAAllowing trusted hostname despite private/internal resolution: %su5Blocked request — URL safety check error for %s: %s)r r5r.r3rr2rrrrdrrrrrrr~rr1r#rrrr rrrv)r$r>r5r2allow_all_privateallow_private_ipr_is_literal_ipfamilyrrrrr|s @r is_safe_urlrs]#O)r002288::AA#FF-%2,,..4466 * * * NNKVM`W` a a a5 5 ) ) ) NNEx P P P578886JJ *8T6;KVM_``II   "N '$X.... ' ' '!& '! &:&<&<  A tt NNNPX Y Y Y553 6*3   %FAq!Xa[Ff}}c**1- )&11   ^`hij`kmuvvvuuu  (((C/^/^/^/^E]/^/^/^,^,^(Ifuu$ -= .QSBTBT Kfuu   LL]      LLS    t  NPSUXYYYuuuuu sBK"K&$K K++DKF)D>=F> E  F E  .F;K>FKF4KG'&K',HKHA K#0K.Cs'+Z+Z#B#I+Z+Z+Z+Z+Z+Zrz:Blocked request to cloud metadata address during connect: z -> zP>P 'exee]cee    #h--2G"G"G OOF # # # HHV    b#$`V^$`$`aaa Os0+B44CCC!D66 E!EE!c eZdZdefdZ ddedededzdedzded ef d Z dd ededzded efd Z d ed dfdZ dS)_SSRFGuardedAsyncNetworkBackendschemes_by_origin_varc>ddlm}||_||_dS)Nr) AutoBackend)httpcore._backends.autor_backend_schemes_by_origin_var)selfrrs r__init__z(_SSRFGuardedAsyncNetworkBackend.__init__W/777777#  &;###rNrrtimeout local_addresssocket_optionsrcpKddl}|ji}t|||}t jt |||d{V} d} | D]I} |j| ||||d{VcS#|j |j f$r } | } Yd} ~ Bd} ~ wwxYw| | td|Nr)rrrz2Blocked request - DNS returned no usable IPs for: ) httpcorerrrrrrr connect_tcp ConnectErrorConnectTimeoutr rrrrrrrrr2ipslast_excr|rs rrz+_SSRFGuardedAsyncNetworkBackend.connect_tcp]s3  7;;B??%dD2CDD%&@$fUUUUUUUU%)  B !]66#"/#1 7)8+BC      N#$_Y]$_$_```s$BBBBr:c$KtdNz5Blocked Unix socket connection in SSRF-safe transportrrr:rrs rconnect_unix_socketz3_SSRFGuardedAsyncNetworkBackend.connect_unix_socket|s $$[\\\rsecondscJK|j|d{VdSrrsleeprrs rrz%_SSRFGuardedAsyncNetworkBackend.sleeps4m!!'***********rNNNNN rrrrrr-intfloatrrrr"rrrrVsddlm}||_||_dS)Nr) SyncBackend)httpcore._backends.syncrrr)rrrs rrz#_SSRFGuardedNetworkBackend.__init__rrNrrrrrrc>ddl}|ji}t|||}t |||} d} | D]C} |j| ||||cS#|j|jf$r } | } Yd} ~ r&r')r$rrr2)rrrr2s r_origin_scheme_contextrsK ; D ; D [ F 4<61B#B#B 4L& !!rkwargsc xddl}ddl}|dGfdd|j}|di|S)zLReturn an httpx async transport that pins direct TCP connects to vetted IPs.rN hermes_ssrf_async_origin_schemesc>eZdZdeffd Zdedeffd ZxZS)2ssrf_safe_async_http_transport.._Transporttransport_kwargscltjdi|t|j_dSNr")superrr_pool_network_backendrr __class__rs rrz;ssrf_safe_async_http_transport.._Transport.__init__s> EGG  0 0/ 0 0 0*I%++DJ ' ' 'rrrcKt|} t|d{V |S#|wxYwr)rrrhandle_async_requestresetrrrDrrs rr zGssrf_safe_async_http_transport.._Transport.handle_async_requests)--.DW.M.MNNE 3"WW99'BBBBBBBBB%++E2222%++E2222s &A$$A;)rrrrrr  __classcell__rrs@r _Transportrs{ s         3c 3c 3 3 3 3 3 3 3 3 3 3 3rrr") contextvarshttpx ContextVarAsyncHTTPTransportrrrrrs @rssrf_safe_async_http_transportrs|LLL'223UVV 3 3 3 3 3 3 3U- 3 3 3 :    rc xddl}ddl}|dGfdd|j}|di|S)zKReturn an httpx sync transport that pins direct TCP connects to vetted IPs.rNhermes_ssrf_origin_schemesc>eZdZdeffd Zdedeffd ZxZS),ssrf_safe_http_transport.._Transportrcltjdi|t|j_dSr)rrrrrrs rrz5ssrf_safe_http_transport.._Transport.__init__s> EGG  0 0/ 0 0 0*D%++DJ ' ' 'rrrct|} t||S#|wxYwr)rrrhandle_requestr r s rrz;ssrf_safe_http_transport.._Transport.handle_requestsk)--.DW.M.MNNE 3ww--g66%++E2222%++E2222s AA2)rrrrrrr r s@rrrs{ s         3# 3# 3 3 3 3 3 3 3 3 3 3 3rrr")rrr HTTPTransportrs @rssrf_safe_http_transportrs|LLL'223OPP 3 3 3 3 3 3 3U( 3 3 3 :    r transportrc|t|dini}||ddrdS|d}|t|dstdt |_t|ddtddt d t ffd }||_d |_dS) N__dict___hermes_ssrf_guardedFrrz:Unsupported async httpx transport cannot be made SSRF-safer rrcKt|} |d{V |S#|wxYwrrrr )rrDr rs rguarded_handle_async_requestzL_install_ssrf_guard_on_async_transport..guarded_handle_async_requests}%))*@*I*IJJ /--g66666666 6 ! ' ' . . . . ! ' ' . . . .s AA%T) getattrrhasattrrrrrr r!)rrstatepoolr$r s ` @r&_install_ssrf_guard_on_async_transportr)s2;2GGIz2 . . .REEII&.guarded_handle_requestsc%))*@*I*IJJ /!>'** ! ' ' . . . . ! ' ' . . . .s AAT) r%rr&rrrrrr!)rrr'r(r,rs ` @r _install_ssrf_guard_on_transportr- s2;2GGIz2 . . .REEII&rPs|6  [[[[[[[[[[[[[[[[[[555555!!!!!!  8 $ $ ;d;;;; -F3-F3-F-F-F-Fn )y***  0CHSM,7C7D7777Y  iI*++I))I*++I))I*++I122I/00I122I122 !  I)**I122&I' &%o66  #t###!D!!!!8TD""""y,y/DD,`s`t````FGCGGGGGG hShThhhhV555555RRRRRJRRRWsW#W$uSRUXX[G[B\WadWWWW8S88S8T#Y8888v/+/+/+/+/+/+/+/+d/%/%/%/%/%/%/%/%d"C"DsCx#1E,F"""" S S    0 s s    0*c*RU*Z^****2**C*TX****2#$ C C     ccCHSMr