Teknium
98d11c95f4
Nobody should have to learn `hermes vault add` or find a toggle before "log into GitHub" works. - browser_vault_save_login: when the agent reaches a sign-in page with no saved login it asks the user on THEIR surface (CLI two-step panel on the sudo modal: identifier shown, password masked; Desktop card with labelled Email/username + Password fields). The answer goes to the encrypted vault bound to the page origin and is filled at once; the model gets back only the handle and identifier. Declining returns save_declined; headless sessions get prompt_unavailable. Never a password in chat. - Vault tools ride with the browser toolset (check_browser_requirements) instead of appearing only once the vault has items — an empty vault is exactly when save_login is needed. browser_vault_list hints at it when empty. - 1Password / Bitwarden are login sources as soon as their CLI is installed; `vault.<name>.enabled` is opt-OUT only. Settings shows Detected/Locked/Unlocked/Off/Not detected with a switch only for installed managers; `hermes vault sources` reports detection, `--disable`/`--enable` flip the opt-out. - Desktop nav/page renamed "Passwords & Logins"; empty state tells the user they do not need to add anything; all five locales updated. Docs rewritten from "how it works" to "say log into X". - New per-thread SaveLoginPrompt callback (agent/vault_backends/unlock.py) installed beside the unlock prompt on every CLI site and the gateway bridge (vault.save_login.request/respond/expire), propagated to worker threads via tools.thread_context. Live: CLI PTY (real model, packaged Chromium, local login server) — panel shown, identifier + masked password typed, server received the correct password, password absent from terminal transcript and from every file under HERMES_HOME outside vault/. Native Electron (headless, isolated HOME/HERMES_HOME, own Vite + CDP port) — card shown, "Save & sign in", server received the password, Settings lists the saved item, password absent from the rendered UI.
74 lines
3.2 KiB
Python
74 lines
3.2 KiB
Python
"""Propagate agent-turn context into worker threads that dispatch Hermes tools.
|
|
|
|
A bare ``threading.Thread`` / ``ThreadPoolExecutor`` worker starts with an empty
|
|
``contextvars.Context`` and no thread-local approval/sudo callbacks, so tool dispatch inside it
|
|
silently loses the approval ContextVars (gateway sessions then auto-approve dangerous commands)
|
|
and the CLI callbacks (``prompt_dangerous_approval`` cannot reach the user, GHSA-qg5c-hvr5-hjgr).
|
|
Call :func:`propagate_context_to_thread` **on the parent thread** (it snapshots at call time) and
|
|
use the result as the worker target; callbacks are installed for the worker's lifetime and
|
|
always cleared on exit.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import contextvars
|
|
import logging
|
|
from typing import Callable
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def _callback_api():
|
|
"""(getter, setter) pairs for every thread-local prompt callback a tool may need mid-dispatch
|
|
(lazy: terminal_tool imports tools.approval at load, so a top-level import risks a cycle).
|
|
Add a new per-thread prompt here — a callback missing from this table is silently absent on
|
|
every parallel/timeout worker, so the tool believes nobody can answer."""
|
|
from agent.vault_backends import unlock as vault_unlock
|
|
from tools import terminal_tool as tt
|
|
|
|
return ((tt._get_approval_callback, tt.set_approval_callback),
|
|
(tt._get_sudo_password_callback, tt.set_sudo_password_callback),
|
|
(vault_unlock.get_unlock_prompt_callback, vault_unlock.set_unlock_prompt_callback),
|
|
(vault_unlock.get_save_login_prompt_callback, vault_unlock.set_save_login_prompt_callback))
|
|
|
|
|
|
def propagate_context_to_thread(target: Callable) -> Callable:
|
|
"""Wrap *target* to run with the *current* thread's ContextVars and per-thread prompt callbacks
|
|
(approval, sudo, password-manager unlock).
|
|
|
|
Fail-closed: if callback installation raises they stay ``None`` — dangerous commands are then
|
|
denied by ``prompt_dangerous_approval`` and the gateway approval queue blocks.
|
|
"""
|
|
ctx = contextvars.copy_context()
|
|
# (setter, parent callback) pairs; None when the callback API could not be captured.
|
|
installs = None
|
|
try:
|
|
installs = tuple((setter, getter()) for getter, setter in _callback_api())
|
|
except Exception:
|
|
logger.debug("Could not capture parent approval/sudo callbacks", exc_info=True)
|
|
|
|
def _runner(*args, **kwargs):
|
|
def _inner():
|
|
if installs is None:
|
|
return target(*args, **kwargs)
|
|
try:
|
|
for setter, cb in installs:
|
|
if cb is not None:
|
|
setter(cb)
|
|
except Exception:
|
|
logger.debug("Failed to install propagated approval/sudo callbacks; "
|
|
"dangerous-command approval will fail closed", exc_info=True)
|
|
try:
|
|
return target(*args, **kwargs)
|
|
finally:
|
|
try:
|
|
for setter, _cb in installs:
|
|
setter(None)
|
|
except Exception:
|
|
logger.debug("Failed to clear propagated approval/sudo callbacks",
|
|
exc_info=True)
|
|
|
|
return ctx.run(_inner)
|
|
|
|
return _runner
|