mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-06-21 10:22:18 +00:00
f538470cf4
The credential gate. When multiplexing is active, a profile's secrets resolve from a context-local scope, never the process-global os.environ (which in a multiplexer may hold another profile's keys, and is inherited by every subprocess spawned with env=dict(os.environ)). - agent/secret_scope.py: get_secret() backed by a secret-scope contextvar. FAIL-CLOSED: when multiplex is active and no scope is installed, an unscoped read RAISES UnscopedSecretError instead of falling back to os.environ — a missed/new call site crashes loudly at that line rather than leaking a cross-profile value. Genuinely-global vars (HERMES_*, PATH, kanban paths, …) keep reading os.environ via an allowlist. load_env_file/build_profile_ secret_scope parse a profile .env into an isolated dict WITHOUT mutating os.environ. Off by default => transparent os.getenv behavior. - hermes_cli/runtime_provider.py: all credential/provider/base-url reads go through _getenv -> get_secret. - agent/credential_pool.py: env fallbacks route through get_secret (the ~/.hermes/.env-first preference is preserved and already profile-correct via the home override). - tools/mcp_tool.py: MCP config interpolation resolves through get_secret, so a server's picks up the routed profile's value. - gateway/run.py: set_multiplex_active() at GatewayRunner init; per-turn .env reload is a no-op for credentials in multiplex mode (secrets come from the scope, not global env); _profile_runtime_scope context manager combines the HERMES_HOME override + secret scope; _run_agent wraps _run_agent_inner in that scope (resolved via _resolve_profile_home_for_source) when multiplexing. Propagates into the agent worker thread for free via the existing copy_context() in _run_in_executor_with_context. Tests: 13 unit (fail-closed, scope isolation, global allowlist, .env parsing without environ mutation) + 7 E2E (runtime_provider + MCP interpolation prove two profiles isolated, unscoped read raises, globals still read environ).
88 lines
3.5 KiB
Python
88 lines
3.5 KiB
Python
"""End-to-end credential isolation proof for multiplex mode (Workstream A).
|
|
|
|
These exercise the REAL resolution path (runtime_provider, secret scope, MCP
|
|
interpolation) rather than mocking it, proving the property that matters: two
|
|
profiles with different keys never see each other's, and an unscoped read in
|
|
multiplex mode fails closed instead of leaking.
|
|
"""
|
|
import pytest
|
|
|
|
from agent import secret_scope as ss
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _reset(monkeypatch):
|
|
ss.set_multiplex_active(False)
|
|
yield
|
|
ss.set_multiplex_active(False)
|
|
|
|
|
|
class TestRuntimeProviderUsesScope:
|
|
"""hermes_cli.runtime_provider._getenv resolves through the secret scope."""
|
|
|
|
def test_getenv_reads_scope_under_multiplex(self, monkeypatch):
|
|
from hermes_cli.runtime_provider import _getenv
|
|
monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-global-leak")
|
|
ss.set_multiplex_active(True)
|
|
tok = ss.set_secret_scope({"ANTHROPIC_API_KEY": "sk-profileA"})
|
|
try:
|
|
assert _getenv("ANTHROPIC_API_KEY") == "sk-profileA"
|
|
finally:
|
|
ss.reset_secret_scope(tok)
|
|
|
|
def test_getenv_two_profiles_isolated(self, monkeypatch):
|
|
from hermes_cli.runtime_provider import _getenv
|
|
ss.set_multiplex_active(True)
|
|
|
|
tok_a = ss.set_secret_scope({"OPENAI_API_KEY": "sk-A"})
|
|
try:
|
|
assert _getenv("OPENAI_API_KEY") == "sk-A"
|
|
finally:
|
|
ss.reset_secret_scope(tok_a)
|
|
|
|
tok_b = ss.set_secret_scope({"OPENAI_API_KEY": "sk-B"})
|
|
try:
|
|
assert _getenv("OPENAI_API_KEY") == "sk-B"
|
|
finally:
|
|
ss.reset_secret_scope(tok_b)
|
|
|
|
def test_getenv_fails_closed_unscoped(self, monkeypatch):
|
|
from hermes_cli.runtime_provider import _getenv
|
|
monkeypatch.setenv("OPENROUTER_API_KEY", "sk-leak")
|
|
ss.set_multiplex_active(True)
|
|
with pytest.raises(ss.UnscopedSecretError):
|
|
_getenv("OPENROUTER_API_KEY")
|
|
|
|
def test_getenv_global_var_still_reads_environ(self, monkeypatch):
|
|
from hermes_cli.runtime_provider import _getenv
|
|
monkeypatch.setenv("HERMES_MAX_ITERATIONS", "42")
|
|
ss.set_multiplex_active(True)
|
|
# global var: no scope needed, no raise
|
|
assert _getenv("HERMES_MAX_ITERATIONS") == "42"
|
|
|
|
|
|
class TestMcpInterpolationUsesScope:
|
|
"""MCP config ${VAR} interpolation resolves through the secret scope."""
|
|
|
|
def test_interpolation_reads_scope(self, monkeypatch):
|
|
from tools.mcp_tool import _interpolate_env_vars
|
|
monkeypatch.setenv("MY_MCP_TOKEN", "global-token")
|
|
ss.set_multiplex_active(True)
|
|
tok = ss.set_secret_scope({"MY_MCP_TOKEN": "profile-token"})
|
|
try:
|
|
cfg = {"env": {"TOKEN": "${MY_MCP_TOKEN}"}}
|
|
assert _interpolate_env_vars(cfg) == {"env": {"TOKEN": "profile-token"}}
|
|
finally:
|
|
ss.reset_secret_scope(tok)
|
|
|
|
def test_interpolation_unset_keeps_placeholder(self, monkeypatch):
|
|
from tools.mcp_tool import _interpolate_env_vars
|
|
monkeypatch.delenv("UNSET_MCP_VAR", raising=False)
|
|
# multiplex off: unset var keeps literal placeholder (legacy behavior)
|
|
assert _interpolate_env_vars("${UNSET_MCP_VAR}") == "${UNSET_MCP_VAR}"
|
|
|
|
def test_interpolation_off_reads_environ(self, monkeypatch):
|
|
from tools.mcp_tool import _interpolate_env_vars
|
|
monkeypatch.setenv("MY_MCP_TOKEN", "env-token")
|
|
# multiplex off: legacy os.environ resolution
|
|
assert _interpolate_env_vars("${MY_MCP_TOKEN}") == "env-token"
|