i&UdZddlmZddlZddlZddlmZddlmZddl m Z dZ e Z ded <dd dZd!dZd"dZd#dZdddd$dZdS)%zFHelpers for loading Hermes .env files consistently across entrypoints.) annotationsN)Path) load_dotenv)atomic_replace)_API_KEY_TOKEN_SECRET_KEYzset[str] _WARNED_KEYSvaluestrlimitintreturncg}|D]s}t|dkr^dt|d}|r |d|dz }||vr||t||krntd|S)zEReturn a compact 'U+XXXX ('c'), ...' summary of non-ASCII codepoints.zU+04X ()z, )ord isprintableappendlenjoin)r rseenchlabels :/home/ubuntu/.hermes/hermes-agent/hermes_cli/env_loader.py_format_offending_charsr sD r77S==&R&&&E~~ &b%D   E"""4yyE!! 99T??Nonec ttjD]&\}t fdt Ds' |d>#t$rYnwxYw|ddd}|tj<tvrt t|t|z }t|pd}tdd|d|d krd nd d |d tjtdtj(dS)a!Strip non-ASCII characters from credential env vars in os.environ. Called after dotenv loads so the rest of the codebase never sees non-ASCII API keys. Only touches env vars whose names end with known credential suffixes (``_API_KEY``, ``_TOKEN``, etc.). Emits a one-line warning to stderr when characters are stripped. Silent stripping would mask copy-paste corruption (Unicode lookalike glyphs from PDFs / rich-text editors, ZWSP from web pages) as opaque provider-side "invalid API key" errors (see #6843). c3BK|]}|VdS)N)endswith).0suffixkeys r z/_sanitize_loaded_credentials..5s/KKF3<<''KKKKKKr!asciiignore)errorsz non-printablez Warning: z contained z non-ASCII charactersru8) — stripped so the key can be sent as an HTTP header.)filea@ This usually means the key was copy-pasted from a PDF, rich-text editor, or web page that substituted lookalike Unicode glyphs for ASCII letters. If authentication fails (e.g. "API key not valid"), re-copy the key from the provider's dashboard and run `hermes setup` (or edit the .env file in a plain-text editor).N)listosenvironitemsany_CREDENTIAL_SUFFIXESencodeUnicodeEncodeErrordecoder addrr printsysstderr)r cleanedstrippeddetailr(s @r_sanitize_loaded_credentialsrA(s2:++--..  UKKKK6JKKKKK    LL ! ! ! !    D ,,wx,88??HH! 3 ,   u::G ,(//B?  2# 2 2( 2 2!mmss 2 2/5 2 2 2      1      +  sA++ A87A8pathroverrideboolc t||dn"#t$rt||dYnwxYwtdS)Nutf-8) dotenv_pathrCencodingzlatin-1)rUnicodeDecodeErrorrA)rBrCs r_load_dotenv_with_fallbackrJTsnMx'JJJJJ MMMx)LLLLLLM!"""""s 44c|sdS ddlm}n#t$rYdSwxYwddd} t |fi|5}|}dddn #1swxYwY||}||krddl}|t|j dd \}} tj |d d 5}| || tj|dddn #1swxYwYt!||dS#t"$r( tj|n#t&$rYnwxYwwxYwdS#t($rYdSwxYw) uPre-sanitize a .env file before python-dotenv reads it. python-dotenv does not handle corrupted lines where multiple KEY=VALUE pairs are concatenated on a single line (missing newline). This produces mangled values — e.g. a bot token duplicated 8× (see #8908). We delegate to ``hermes_cli.config._sanitize_env_lines`` which already knows all valid Hermes env-var names and can split concatenated lines correctly. Nr)_sanitize_env_linesrFreplace)rHr,z.tmpz.env_)dirr'prefixw)rH)existshermes_cli.configrL ImportErroropen readlinestempfilemkstemprparentr2fdopen writelinesflushfsyncfilenor BaseExceptionunlinkOSError Exception) rBrLread_kwforiginal sanitizedrVfdtmps r_sanitize_env_file_if_neededrhasl ;;==9999999 #i88G $ " "' " " %a{{}}H % % % % % % % % % % % % % % %''11  OOO&& $$VG'GB Yr3999)QLL+++GGIIIHQXXZZ((()))))))))))))))sD)))))    IcNNNND   ! "      s -- E9A$ E9$A((E9+A(,AE92E AD% E%D))E,D)-E E4 E"!E4" E/,E4.E//E44E99 FF) hermes_home project_envristr | os.PathLike | Nonerj list[Path]c(g}t|p(tjdtjdz }|dz }|rt|nd}|rt ||r#|rt ||r&t |d|||r;|r't || |||S)a[Load Hermes environment files with user config taking precedence. Behavior: - `~/.hermes/.env` overrides stale shell-exported values when present. - project `.env` acts as a dev fallback and only fills missing values when the user env exists. - if no user env exists, the project `.env` also overrides stale shell vars. HERMES_HOMEz.hermesz.envNT)rC)rr2getenvhomerQrhrJr)rirjloaded home_pathuser_envproject_env_paths rload_hermes_dotenvrus"F[UBImTY[[9=T$U$UVVI6!H,7AtK(((T/$X...7,33557$%5666 "8d;;;; h(,3355("#3&jIIII &''' Mr!)r )r rrrrr)rr")rBrrCrDrr")rBrrr")rirkrjrkrrl)__doc__ __future__rr2r<pathlibrdotenvrutilsrr6setr __annotations__r rArJrhrur!rr~sLLL""""""  A       ) ) ) ) X # # # #* * * * ^-1,0!!!!!!!!r!