feat: secure skill env setup on load (core #688)
When a skill declares required_environment_variables in its YAML frontmatter, missing env vars trigger a secure TUI prompt (identical to the sudo password widget) when the skill is loaded. Secrets flow directly to ~/.hermes/.env, never entering LLM context. Key changes: - New required_environment_variables frontmatter field for skills - Secure TUI widget (masked input, 120s timeout) - Gateway safety: messaging platforms show local setup guidance - Legacy prerequisites.env_vars normalized into new format - Remote backend handling: conservative setup_needed=True - Env var name validation, file permissions hardened to 0o600 - Redact patterns extended for secret-related JSON fields - 12 existing skills updated with prerequisites declarations - ~48 new tests covering skip, timeout, gateway, remote backends - Dynamic panel widget sizing (fixes hardcoded width from original PR) Cherry-picked from PR #723 by kshitijk4poor, rebased onto current main with conflict resolution. Fixes #688 Co-authored-by: kshitijk4poor <kshitijk4poor@users.noreply.github.com>
This commit is contained in:
kshitijk4poor
teknium1
parent
c097e56142
commit
ccfbf42844
34 changed files with 2419 additions and 403 deletions
|
|
@ -8,8 +8,10 @@ with the TUI.
|
|||
|
||||
import queue
|
||||
import time as _time
|
||||
import getpass
|
||||
|
||||
from hermes_cli.banner import cprint, _DIM, _RST
|
||||
from hermes_cli.config import save_env_value_secure
|
||||
|
||||
|
||||
def clarify_callback(cli, question, choices):
|
||||
|
|
@ -33,7 +35,7 @@ def clarify_callback(cli, question, choices):
|
|||
cli._clarify_deadline = _time.monotonic() + timeout
|
||||
cli._clarify_freetext = is_open_ended
|
||||
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
while True:
|
||||
|
|
@ -45,13 +47,13 @@ def clarify_callback(cli, question, choices):
|
|||
remaining = cli._clarify_deadline - _time.monotonic()
|
||||
if remaining <= 0:
|
||||
break
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
cli._clarify_state = None
|
||||
cli._clarify_freetext = False
|
||||
cli._clarify_deadline = 0
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
cprint(f"\n{_DIM}(clarify timed out after {timeout}s — agent will decide){_RST}")
|
||||
return (
|
||||
|
|
@ -71,7 +73,7 @@ def sudo_password_callback(cli) -> str:
|
|||
cli._sudo_state = {"response_queue": response_queue}
|
||||
cli._sudo_deadline = _time.monotonic() + timeout
|
||||
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
while True:
|
||||
|
|
@ -79,7 +81,7 @@ def sudo_password_callback(cli) -> str:
|
|||
result = response_queue.get(timeout=1)
|
||||
cli._sudo_state = None
|
||||
cli._sudo_deadline = 0
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
if result:
|
||||
cprint(f"\n{_DIM} ✓ Password received (cached for session){_RST}")
|
||||
|
|
@ -90,17 +92,135 @@ def sudo_password_callback(cli) -> str:
|
|||
remaining = cli._sudo_deadline - _time.monotonic()
|
||||
if remaining <= 0:
|
||||
break
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
cli._sudo_state = None
|
||||
cli._sudo_deadline = 0
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
cprint(f"\n{_DIM} ⏱ Timeout — continuing without sudo{_RST}")
|
||||
return ""
|
||||
|
||||
|
||||
def prompt_for_secret(cli, var_name: str, prompt: str, metadata=None) -> dict:
|
||||
"""Prompt for a secret value through the TUI (e.g. API keys for skills).
|
||||
|
||||
Returns a dict with keys: success, stored_as, validated, skipped, message.
|
||||
The secret is stored in ~/.hermes/.env and never exposed to the model.
|
||||
"""
|
||||
if not getattr(cli, "_app", None):
|
||||
if not hasattr(cli, "_secret_state"):
|
||||
cli._secret_state = None
|
||||
if not hasattr(cli, "_secret_deadline"):
|
||||
cli._secret_deadline = 0
|
||||
try:
|
||||
value = getpass.getpass(f"{prompt} (hidden, Enter to skip): ")
|
||||
except (EOFError, KeyboardInterrupt):
|
||||
value = ""
|
||||
|
||||
if not value:
|
||||
cprint(f"\n{_DIM} ⏭ Secret entry cancelled{_RST}")
|
||||
return {
|
||||
"success": True,
|
||||
"reason": "cancelled",
|
||||
"stored_as": var_name,
|
||||
"validated": False,
|
||||
"skipped": True,
|
||||
"message": "Secret setup was skipped.",
|
||||
}
|
||||
|
||||
stored = save_env_value_secure(var_name, value)
|
||||
cprint(f"\n{_DIM} ✓ Stored secret in ~/.hermes/.env as {var_name}{_RST}")
|
||||
return {
|
||||
**stored,
|
||||
"skipped": False,
|
||||
"message": "Secret stored securely. The secret value was not exposed to the model.",
|
||||
}
|
||||
|
||||
timeout = 120
|
||||
response_queue = queue.Queue()
|
||||
|
||||
cli._secret_state = {
|
||||
"var_name": var_name,
|
||||
"prompt": prompt,
|
||||
"metadata": metadata or {},
|
||||
"response_queue": response_queue,
|
||||
}
|
||||
cli._secret_deadline = _time.monotonic() + timeout
|
||||
# Avoid storing stale draft input as the secret when Enter is pressed.
|
||||
if hasattr(cli, "_clear_secret_input_buffer"):
|
||||
try:
|
||||
cli._clear_secret_input_buffer()
|
||||
except Exception:
|
||||
pass
|
||||
elif hasattr(cli, "_app") and cli._app:
|
||||
try:
|
||||
cli._app.current_buffer.reset()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
while True:
|
||||
try:
|
||||
value = response_queue.get(timeout=1)
|
||||
cli._secret_state = None
|
||||
cli._secret_deadline = 0
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
if not value:
|
||||
cprint(f"\n{_DIM} ⏭ Secret entry cancelled{_RST}")
|
||||
return {
|
||||
"success": True,
|
||||
"reason": "cancelled",
|
||||
"stored_as": var_name,
|
||||
"validated": False,
|
||||
"skipped": True,
|
||||
"message": "Secret setup was skipped.",
|
||||
}
|
||||
|
||||
stored = save_env_value_secure(var_name, value)
|
||||
cprint(f"\n{_DIM} ✓ Stored secret in ~/.hermes/.env as {var_name}{_RST}")
|
||||
return {
|
||||
**stored,
|
||||
"skipped": False,
|
||||
"message": "Secret stored securely. The secret value was not exposed to the model.",
|
||||
}
|
||||
except queue.Empty:
|
||||
remaining = cli._secret_deadline - _time.monotonic()
|
||||
if remaining <= 0:
|
||||
break
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
cli._secret_state = None
|
||||
cli._secret_deadline = 0
|
||||
if hasattr(cli, "_clear_secret_input_buffer"):
|
||||
try:
|
||||
cli._clear_secret_input_buffer()
|
||||
except Exception:
|
||||
pass
|
||||
elif hasattr(cli, "_app") and cli._app:
|
||||
try:
|
||||
cli._app.current_buffer.reset()
|
||||
except Exception:
|
||||
pass
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
cprint(f"\n{_DIM} ⏱ Timeout — secret capture cancelled{_RST}")
|
||||
return {
|
||||
"success": True,
|
||||
"reason": "timeout",
|
||||
"stored_as": var_name,
|
||||
"validated": False,
|
||||
"skipped": True,
|
||||
"message": "Secret setup timed out and was skipped.",
|
||||
}
|
||||
|
||||
|
||||
def approval_callback(cli, command: str, description: str) -> str:
|
||||
"""Prompt for dangerous command approval through the TUI.
|
||||
|
||||
|
|
@ -123,7 +243,7 @@ def approval_callback(cli, command: str, description: str) -> str:
|
|||
}
|
||||
cli._approval_deadline = _time.monotonic() + timeout
|
||||
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
while True:
|
||||
|
|
@ -131,19 +251,19 @@ def approval_callback(cli, command: str, description: str) -> str:
|
|||
result = response_queue.get(timeout=1)
|
||||
cli._approval_state = None
|
||||
cli._approval_deadline = 0
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
return result
|
||||
except queue.Empty:
|
||||
remaining = cli._approval_deadline - _time.monotonic()
|
||||
if remaining <= 0:
|
||||
break
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
|
||||
cli._approval_state = None
|
||||
cli._approval_deadline = 0
|
||||
if hasattr(cli, '_app') and cli._app:
|
||||
if hasattr(cli, "_app") and cli._app:
|
||||
cli._app.invalidate()
|
||||
cprint(f"\n{_DIM} ⏱ Timeout — denying command{_RST}")
|
||||
return "deny"
|
||||
|
|
|
|||
|
|
@ -14,7 +14,9 @@ This module provides:
|
|||
|
||||
import os
|
||||
import platform
|
||||
import re
|
||||
import stat
|
||||
import sys
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
|
|
@ -22,6 +24,7 @@ from pathlib import Path
|
|||
from typing import Dict, Any, Optional, List, Tuple
|
||||
|
||||
_IS_WINDOWS = platform.system() == "Windows"
|
||||
_ENV_VAR_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
|
||||
|
||||
import yaml
|
||||
|
||||
|
|
@ -984,6 +987,9 @@ def load_env() -> Dict[str, str]:
|
|||
|
||||
def save_env_value(key: str, value: str):
|
||||
"""Save or update a value in ~/.hermes/.env."""
|
||||
if not _ENV_VAR_NAME_RE.match(key):
|
||||
raise ValueError(f"Invalid environment variable name: {key!r}")
|
||||
value = value.replace("\n", "").replace("\r", "")
|
||||
ensure_hermes_home()
|
||||
env_path = get_env_path()
|
||||
|
||||
|
|
@ -1026,6 +1032,8 @@ def save_env_value(key: str, value: str):
|
|||
raise
|
||||
_secure_file(env_path)
|
||||
|
||||
os.environ[key] = value
|
||||
|
||||
# Restrict .env permissions to owner-only (contains API keys)
|
||||
if not _IS_WINDOWS:
|
||||
try:
|
||||
|
|
@ -1048,6 +1056,16 @@ def save_anthropic_api_key(value: str, save_fn=None):
|
|||
writer("ANTHROPIC_TOKEN", "")
|
||||
|
||||
|
||||
def save_env_value_secure(key: str, value: str) -> Dict[str, Any]:
|
||||
save_env_value(key, value)
|
||||
return {
|
||||
"success": True,
|
||||
"stored_as": key,
|
||||
"validated": False,
|
||||
}
|
||||
|
||||
|
||||
|
||||
def get_env_value(key: str) -> Optional[str]:
|
||||
"""Get a value from ~/.hermes/.env or environment."""
|
||||
# Check environment first
|
||||
|
|
@ -1075,7 +1093,6 @@ def redact_key(key: str) -> str:
|
|||
def show_config():
|
||||
"""Display current configuration."""
|
||||
config = load_config()
|
||||
env_vars = load_env()
|
||||
|
||||
print()
|
||||
print(color("┌─────────────────────────────────────────────────────────┐", Colors.CYAN))
|
||||
|
|
@ -1231,7 +1248,7 @@ def edit_config():
|
|||
break
|
||||
|
||||
if not editor:
|
||||
print(f"No editor found. Config file is at:")
|
||||
print("No editor found. Config file is at:")
|
||||
print(f" {config_path}")
|
||||
return
|
||||
|
||||
|
|
@ -1436,7 +1453,7 @@ def config_command(args):
|
|||
if missing_config:
|
||||
print()
|
||||
print(color(f" {len(missing_config)} new config option(s) available", Colors.YELLOW))
|
||||
print(f" Run 'hermes config migrate' to add them")
|
||||
print(" Run 'hermes config migrate' to add them")
|
||||
|
||||
print()
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue