eiUdZddlmZddlZddlZddlmZddlmZdZ e Z de d<dddZ d dZd!dZd"dZdddd#dZdS)$zFHelpers for loading Hermes .env files consistently across entrypoints.) annotationsN)Path) load_dotenv)_API_KEY_TOKEN_SECRET_KEYzset[str] _WARNED_KEYSvaluestrlimitintreturncg}|D]s}t|dkr^dt|d}|r |d|dz }||vr||t||krntd|S)zEReturn a compact 'U+XXXX ('c'), ...' summary of non-ASCII codepoints.zU+04X ()z, )ord isprintableappendlenjoin)r rseenchlabels 7/home/div/.hermes/hermes-agent/hermes_cli/env_loader.py_format_offending_charsrsD r77S==&R&&&E~~ &b%D   E"""4yyE!! 99T??Nonec ttjD]&\}t fdt Ds' |d>#t$rYnwxYw|ddd}|tj<tvrt t|t|z }t|pd}tdd|d|d krd nd d |d tjtdtj(dS)a!Strip non-ASCII characters from credential env vars in os.environ. Called after dotenv loads so the rest of the codebase never sees non-ASCII API keys. Only touches env vars whose names end with known credential suffixes (``_API_KEY``, ``_TOKEN``, etc.). Emits a one-line warning to stderr when characters are stripped. Silent stripping would mask copy-paste corruption (Unicode lookalike glyphs from PDFs / rich-text editors, ZWSP from web pages) as opaque provider-side "invalid API key" errors (see #6843). c3BK|]}|VdS)N)endswith).0suffixkeys r z/_sanitize_loaded_credentials..4s/KKF3<<''KKKKKKr asciiignore)errorsz non-printablez Warning: z contained z non-ASCII charactersru8) — stripped so the key can be sent as an HTTP header.)filea@ This usually means the key was copy-pasted from a PDF, rich-text editor, or web page that substituted lookalike Unicode glyphs for ASCII letters. If authentication fails (e.g. "API key not valid"), re-copy the key from the provider's dashboard and run `hermes setup` (or edit the .env file in a plain-text editor).N)listosenvironitemsany_CREDENTIAL_SUFFIXESencodeUnicodeEncodeErrordecoder addrrprintsysstderr)r cleanedstrippeddetailr's @r_sanitize_loaded_credentialsr@'s2:++--..  UKKKK6JKKKKK    LL ! ! ! !    D ,,wx,88??HH! 3 ,   u::G ,(//B?  2# 2 2( 2 2!mmss 2 2/5 2 2 2      1      +  sA++ A87A8pathroverrideboolc t||dn"#t$rt||dYnwxYwtdS)Nutf-8) dotenv_pathrBencodingzlatin-1)rUnicodeDecodeErrorr@)rArBs r_load_dotenv_with_fallbackrISsnMx'JJJJJ MMMx)LLLLLLM!"""""s 44c|sdS ddlm}n#t$rYdSwxYwddd} t |fi|5}|}dddn #1swxYwY||}||krddl}|t|j dd \}} tj |d d 5}| || tj|dddn #1swxYwYtj||dS#t"$r( tj|n#t&$rYnwxYwwxYwdS#t($rYdSwxYw) uPre-sanitize a .env file before python-dotenv reads it. python-dotenv does not handle corrupted lines where multiple KEY=VALUE pairs are concatenated on a single line (missing newline). This produces mangled values — e.g. a bot token duplicated 8× (see #8908). We delegate to ``hermes_cli.config._sanitize_env_lines`` which already knows all valid Hermes env-var names and can split concatenated lines correctly. Nr)_sanitize_env_linesrEreplace)rGr+z.tmpz.env_)dirr&prefixw)rG)existshermes_cli.configrK ImportErroropen readlinestempfilemkstempr parentr1fdopen writelinesflushfsyncfilenorL BaseExceptionunlinkOSError Exception) rArKread_kwforiginal sanitizedrUfdtmps r_sanitize_env_file_if_neededrg`sn ;;==9999999 #i88G $ " "' " " %a{{}}H % % % % % % % % % % % % % % %''11  OOO&& $$VG'GB Yr3999)QLL+++GGIIIHQXXZZ((())))))))))))))) 3%%%%%    IcNNNND   ! "      s -- E>A$ E>$A((E>+A(,AE>2E AD% E%D))E,D)-E E9E'&E9' E41E93E44E99E>> F  F ) hermes_home project_envrhstr | os.PathLike | Noneri list[Path]c(g}t|p(tjdtjdz }|dz }|rt|nd}|rt ||r#|rt ||r&t |d|||r;|r't || |||S)a[Load Hermes environment files with user config taking precedence. Behavior: - `~/.hermes/.env` overrides stale shell-exported values when present. - project `.env` acts as a dev fallback and only fills missing values when the user env exists. - if no user env exists, the project `.env` also overrides stale shell vars. HERMES_HOMEz.hermesz.envNT)rB)rr1getenvhomerPrgrIr)rhriloaded home_pathuser_envproject_env_paths rload_hermes_dotenvrts"F[UBImTY[[9=T$U$UVVI6!H,7AtK(((T/$X...7,33557$%5666 "8d;;;; h(,3355("#3&jIIII &''' Mr )r )r r rrrr )rr!)rArrBrCrr!)rArrr!)rhrjrirjrrk)__doc__ __future__rr1r;pathlibrdotenvrr5setr __annotations__rr@rIrgrtr rr|sLLL"""""" A       ) ) ) ) X # # # #* * * * ^-1,0!!!!!!!!r