§ ‰eîi„ãó¾—UdZddlmZddlZddlmZddlmZeje ¦«Z ed¦«Z de d<dd „Z dad e d <dd„Zdd„Zdd„Zd d„Zdd„Zd!d„ZdS)"uaEnvironment variable passthrough registry. Skills that declare ``required_environment_variables`` in their frontmatter need those vars available in sandboxed execution environments (execute_code, terminal). By default both sandboxes strip secrets from the child process environment for security. This module provides a session-scoped allowlist so skill-declared vars (and user-configured overrides) pass through. Two sources feed the allowlist: 1. **Skill declarations** — when a skill is loaded via ``skill_view``, its ``required_environment_variables`` are registered here automatically. 2. **User config** — ``terminal.env_passthrough`` in config.yaml lets users explicitly allowlist vars for non-skill use cases. Both ``code_execution_tool.py`` and ``tools/environments/local.py`` consult :func:`is_env_passthrough` before stripping a variable. é)Ú annotationsN)Ú ContextVar)ÚIterableÚ_allowed_env_varszContextVar[set[str]]Ú_allowed_env_vars_varÚreturnúset[str]cóª— t ¦«S#t$r-t¦«}t |¦«|cYSwxYw)zGGet or create the allowed env vars set for the current context/session.)rÚgetÚ LookupErrorÚset)Úvals ú7/home/div/.hermes/hermes-agent/tools/env_passthrough.pyÚ _get_allowedr!sZ€ðÝ$×(Ò(Ñ*Ô*Ð*øÝ ðððÝ™œˆÝ×!Ò! #Ñ&Ô&Ð&؈ ˆ ˆ ðøøøs‚›4AÁAzfrozenset[str] | NoneÚ_config_passthroughÚnameÚstrÚboolcó<— ddlm}n#t$rYdSwxYw||vS)u³True if ``name`` is a Hermes-managed provider credential (API key, token, or similar) per ``_HERMES_PROVIDER_ENV_BLOCKLIST``. Skill-declared ``required_environment_variables`` frontmatter must not be able to override this list — that was the bypass in GHSA-rhgp-j443-p4rf where a malicious skill registered ``ANTHROPIC_TOKEN`` / ``OPENAI_API_KEY`` as passthrough and received the credential in the ``execute_code`` child process, defeating the sandbox's scrubbing guarantee. Non-Hermes API keys (TENOR_API_KEY, NOTION_TOKEN, etc.) are NOT in the blocklist and remain legitimately registerable — skills that wrap third-party APIs still work. r)Ú_HERMES_PROVIDER_ENV_BLOCKLISTF)Útools.environments.localrÚ Exception)rrs rÚ_is_hermes_provider_credentialr/sJ€ðØKÐKÐKÐKÐKÐKÐKøÝ ððð؈uˆuðøøøà Ð1Ð 1Ð1s ‚ ‰ –Ú var_namesú Iterable[str]ÚNonecó —|D]€}| ¦«}|sŒt|¦«rt d|¦«ŒDt ¦« |¦«t d|¦«ŒdS)uäRegister environment variable names as allowed in sandboxed environments. Typically called when a skill declares ``required_environment_variables``. Variables that are Hermes-managed provider credentials (from ``_HERMES_PROVIDER_ENV_BLOCKLIST``) are rejected here to preserve the ``execute_code`` sandbox's credential-scrubbing guarantee per GHSA-rhgp-j443-p4rf. A skill that needs to talk to a Hermes-managed provider should do so via the agent's main-process tools (web_search, web_extract, etc.) where the credential remains safely in the main process. Non-Hermes third-party API keys (TENOR_API_KEY, NOTION_TOKEN, etc.) pass through normally — they were never in the sandbox scrub list. zÓenv passthrough: refusing to register Hermes provider credential %r (blocked by _HERMES_PROVIDER_ENV_BLOCKLIST). Skills must not override the execute_code sandbox's credential scrubbing; see GHSA-rhgp-j443-p4rf.zenv passthrough: registered %sN)ÚstriprÚloggerÚwarningrÚaddÚdebug)rrs rÚregister_env_passthroughr#Es›€ð ð=ð=ˆØzŠz‰|Œ|ˆØð Ø Ý )¨$Ñ /Ô /ð Ý NŠNðAðñ  ô ð ð ݉Œ×Ò˜4Ñ Ô Ð Ý Š Ð5°tÑ<Ô<Ð<Ð<ð=ð=óúfrozenset[str]có—ttSt¦«} ddlm}|¦«}| di¦« d¦«}t |t ¦«rU|D]R}t |t¦«r;| ¦«r'|  | ¦«¦«ŒSn2#t$r%}t  d|¦«Yd}~nd}~wwxYwt|¦«atS)z9Load ``tools.env_passthrough`` from config.yaml (cached).Nr)Úread_raw_configÚterminalÚenv_passthroughz4Could not read tools.env_passthrough from config: %s)rr Úhermes_cli.configr'r Ú isinstanceÚlistrrr!rrr"Ú frozenset)Úresultr'ÚcfgÚ passthroughÚitemÚes rÚ_load_config_passthroughr3fs€õÐ&Ý"Ð"å‘u”u€Fð PØ5Ð5Ð5Ð5Ð5Ð5؈oÑԈؗg’g˜j¨"Ñ-Ô-×1Ò1Ð2CÑDÔDˆ Ý k¥4Ñ (Ô (ð -Ø#ð -ð -ݘd¥CÑ(Ô(ð-¨T¯ZªZ©\¬\ð-Ø—J’J˜tŸzšz™|œ|Ñ,Ô,Ð,øøøÝ ðPðPðPÝ Š ÐKÈQÑOÔOÐOÐOÐOÐOÐOÐOøøøøðPøøøõ$ FÑ+Ô+ÐÝ ÐsžB#Cà C1à C,Ã,C1Úvar_namecóF—|t¦«vrdS|t¦«vS)zÄCheck whether *var_name* is allowed to pass through to sandboxes. Returns ``True`` if the variable was registered by a skill or listed in the user's ``tools.env_passthrough`` config. T)rr3)r4s rÚis_env_passthroughr6|s*€ð •<‘>”>Ð!Ð!؈tØ Õ/Ñ1Ô1Ð 1Ð1r$cóV—tt¦«¦«t¦«zS)zGReturn the union of skill-registered and config-based passthrough vars.)r-rr3©r$rÚget_all_passthroughr9‡s €å •\‘^”^Ñ $Ô $Õ'?Ñ'AÔ'AÑ AÐAr$cóF—t¦« ¦«dS)z9Reset the skill-scoped allowlist (e.g. on session reset).N)rÚclearr8r$rÚclear_env_passthroughr<Œs€åN„N×ÒÑÔÐÐÐr$)rr )rrrr)rrrr)rr%)r4rrr)rr)Ú__doc__Ú __future__rÚloggingÚ contextvarsrÚtypingrÚ getLoggerÚ__name__rrÚ__annotations__rrrr#r3r6r9r<r8r$rúrEs5ððððð&#Ð"Ð"Ð"Ð"Ð"à€€€Ø"Ð"Ð"Ð"Ð"Ð"ØÐÐÐÐÐà ˆÔ ˜8Ñ $Ô $€ð/9¨jÐ9LÑ.MÔ.MÐÐMÐMÐMÑMððððð.2ÐÐ1Ð1Ð1Ñ1ð2ð2ð2ð2ð,=ð=ð=ð=ðBðððð,2ð2ð2ð2ðBðBðBðBð ðððððr$