teknium1
a9a8a3fa2e
`hermes config get providers`, `config get providers.<p>.api_key`, `config get <PROVIDER>_API_KEY` (the .env-routed branch) and `config get mcp_servers.<s>.env.X_API_KEY` all printed the full credential. The agent runs this command from sessions whose transcripts persist and get forwarded (a Gemini key surfaced in a Discord DM log), so `print` output is a leak path the logging redactor never sees. `get_config_value` now applies the structural masker used by `config show` before printing, honouring `security.redact_secrets` (default on), with a `--raw` flag for operators/scripts that need the real value. `_is_secret_config_key` extends the exact-name set with the same `*_API_KEY / *_TOKEN / *_SECRET / *_PASSWORD` suffixes `_is_env_config_key` already routes to .env, so env-map leaves under `mcp_servers.*.env` mask too, and the `config set` echo uses the same predicate. Slim redo of #84153 by @webtecnica (same direction: mask in get_config_value; dropped the redact_url_query_params re-export and the separate redaction-enabled reader in favour of agent.redact._redact_enabled, which already resolves the profile-scoped policy). Fixes #110758 Fixes #84106
45 lines
2.1 KiB
Python
45 lines
2.1 KiB
Python
"""``hermes config`` subcommand parser."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Callable
|
|
|
|
from hermes_cli.subcommands._shared import add_json_flag
|
|
|
|
|
|
def build_config_parser(subparsers, *, cmd_config: Callable) -> None:
|
|
"""Attach the ``config`` subcommand to ``subparsers``."""
|
|
config_parser = subparsers.add_parser(
|
|
"config", help="View and edit configuration",
|
|
description="Manage Hermes Agent configuration")
|
|
config_subparsers = config_parser.add_subparsers(dest="config_command")
|
|
|
|
config_subparsers.add_parser("show", help="Show current configuration")
|
|
config_subparsers.add_parser("edit", help="Open config file in editor")
|
|
|
|
config_get = config_subparsers.add_parser("get", help="Print a resolved configuration value")
|
|
config_get.add_argument("key", nargs="?", help="Configuration key (e.g., model)")
|
|
add_json_flag(config_get, "Print value as JSON")
|
|
config_get.add_argument(
|
|
"--raw", action="store_true",
|
|
help="Print credential values unmasked (default masks api_key/token/secret-shaped values)")
|
|
|
|
config_set = config_subparsers.add_parser("set", help="Set a configuration value")
|
|
config_set.add_argument(
|
|
"key", nargs="?", help="Configuration key (e.g., model, terminal.backend)")
|
|
config_set.add_argument("value", nargs="?", help="Value to set")
|
|
config_set.add_argument(
|
|
"--force", action="store_true",
|
|
help="Skip the unknown-key notice printed after writing a key the "
|
|
"running version doesn't recognize (the value is saved either way).")
|
|
|
|
config_unset = config_subparsers.add_parser("unset", help="Remove a configuration value")
|
|
config_unset.add_argument("key", nargs="?", help="Configuration key to remove")
|
|
|
|
config_subparsers.add_parser("path", help="Print config file path")
|
|
config_subparsers.add_parser("env-path", help="Print .env file path")
|
|
config_subparsers.add_parser("check", help="Check for missing/outdated config")
|
|
config_subparsers.add_parser("migrate", help="Update config with new options")
|
|
|
|
config_parser.set_defaults(func=cmd_config)
|