Bj*UdZddlmZddlZddlZddlmZddlmZddl m Z dZ e Z ded <ddd Zdd Zdd Zdd Zddd ddZy)zFHelpers for loading Hermes .env files consistently across entrypoints.) annotationsN)Path) load_dotenv)atomic_replace)_API_KEY_TOKEN_SECRET_KEYzset[str] _WARNED_KEYScg}|D]^}t|dkDsdt|d}|jr |d|dz }||vr|j|t||k\s^ndj |S)zEReturn a compact 'U+XXXX ('c'), ...' summary of non-ASCII codepoints.zU+04X ()z, )ord isprintableappendlenjoin)valuelimitseenchlabels :/home/ubuntu/.hermes/hermes-agent/hermes_cli/env_loader.py_format_offending_charsrsD r7S=R &E~~2bV1%D  E"4yE! 99T?c bttjjD]0\}t fdt Ds |j d2y#t$rYnwxYw|j ddjd}|tj<tvrtjt|t|z }t|xsd}tdd|d|d k7rd nd d |d tjtdtj)a!Strip non-ASCII characters from credential env vars in os.environ. Called after dotenv loads so the rest of the codebase never sees non-ASCII API keys. Only touches env vars whose names end with known credential suffixes (``_API_KEY``, ``_TOKEN``, etc.). Emits a one-line warning to stderr when characters are stripped. Silent stripping would mask copy-paste corruption (Unicode lookalike glyphs from PDFs / rich-text editors, ZWSP from web pages) as opaque provider-side "invalid API key" errors (see #6843). c3@K|]}j|yw)N)endswith).0suffixkeys r z/_sanitize_loaded_credentials..5sKF3<<'Ksasciiignore)errorsz non-printablez Warning: z contained z non-ASCII charactersru8) — stripped so the key can be sent as an HTTP header.)filea@ This usually means the key was copy-pasted from a PDF, rich-text editor, or web page that substituted lookalike Unicode glyphs for ASCII letters. If authentication fails (e.g. "API key not valid"), re-copy the key from the provider's dashboard and run `hermes setup` (or edit the .env file in a plain-text editor).N)listosenvironitemsany_CREDENTIAL_SUFFIXESencodeUnicodeEncodeErrordecoder addrrprintsysstderr)rcleanedstrippeddetailr#s @r_sanitize_loaded_credentialsr<(s2::++-. UK6JKK   LL !   "   ,,wx,8??H! 3 ,  u:G ,(/B? #k(3G!ms,Bvh71 2   1  s A A)(A)c t||dty#t$rt||dYtywxYw)Nutf-8) dotenv_pathoverrideencodingzlatin-1)rUnicodeDecodeErrorr<)pathr@s r_load_dotenv_with_fallbackrDTsCMx'J!" Mx)L !"Ms ??c|jsy ddlm}ddd} t |fi|5}|j }ddd|}||k7rddl}|jt|jdd \}} tj|d d 5}|j||jtj|jdddt!||yy#t$rYywxYw#1swYxYw#1swY2xYw#t"$r' tj$|#t&$rYwxYwwxYw#t($rYywxYw) uPre-sanitize a .env file before python-dotenv reads it. python-dotenv does not handle corrupted lines where multiple KEY=VALUE pairs are concatenated on a single line (missing newline). This produces mangled values — e.g. a bot token duplicated 8× (see #8908). We delegate to ``hermes_cli.config._sanitize_env_lines`` which already knows all valid Hermes env-var names and can split concatenated lines correctly. Nr)_sanitize_env_linesz utf-8-sigreplace)rAr'z.tmpz.env_)dirr"prefixwr>)rA)existshermes_cli.configrF ImportErroropen readlinestempfilemkstempstrparentr-fdopen writelinesflushfsyncfilenor BaseExceptionunlinkOSError Exception) rCrFread_kwforiginal sanitizedrPfdtmps r_sanitize_env_file_if_neededrcas] ;;=9')C?D E DD E $D:9E : EE EE  E EE) hermes_home project_envcg}t|xs+tjdtjdz }|dz }|r t|nd}|j r t ||r|j r t ||j rt |d|j||r/|j rt || |j||S)a[Load Hermes environment files with user config taking precedence. Behavior: - `~/.hermes/.env` overrides stale shell-exported values when present. - project `.env` acts as a dev fallback and only fills missing values when the user env exists. - if no user env exists, the project `.env` also overrides stale shell vars. HERMES_HOMEz.hermesz.envNT)r@)rr-getenvhomerKrcrDr)rdreloaded home_pathuser_envproject_env_paths rload_hermes_dotenvrnsF[UBIImTYY[9=T$UVI6!H,7tK(T$X.,335$%56"8d; h,335"#3&jI &' Mr))rrRrintreturnrR)rqNone)rCrr@boolrqrr)rCrrqrr)rdstr | os.PathLike | Nonerertrqz list[Path])__doc__ __future__rr-r7pathlibrdotenvrutilsrr1setr __annotations__rr<rDrcrnrrr}spL"  A  h ) X #* ^-1,0!)!*! !r