46 lines
1.2 KiB
Python
46 lines
1.2 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""Keep Atlas runtime credentials out of Hermes-spawned subprocesses."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
import argparse
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
|
||
|
|
BEFORE = ''' upper = key.upper()
|
||
|
|
if upper.startswith("AUXILIARY_") and (
|
||
|
|
'''
|
||
|
|
|
||
|
|
AFTER = ''' upper = key.upper()
|
||
|
|
if upper in {
|
||
|
|
"API_SERVER_KEY",
|
||
|
|
"CLAUDE_CODE_OAUTH_TOKEN",
|
||
|
|
"GITEA_TOKEN",
|
||
|
|
"HERMES_IMAGE_BROKER_KEY",
|
||
|
|
}:
|
||
|
|
return True
|
||
|
|
if upper.startswith("AUXILIARY_") and (
|
||
|
|
'''
|
||
|
|
|
||
|
|
|
||
|
|
def patch(source: Path, destination: Path) -> None:
|
||
|
|
"""Apply the runtime-credential boundary and fail on upstream drift."""
|
||
|
|
content = source.read_text(encoding="utf-8")
|
||
|
|
if content.count(BEFORE) != 1:
|
||
|
|
raise RuntimeError("Hermes subprocess secret boundary context changed")
|
||
|
|
destination.parent.mkdir(parents=True, exist_ok=True)
|
||
|
|
destination.write_text(content.replace(BEFORE, AFTER, 1), encoding="utf-8")
|
||
|
|
|
||
|
|
|
||
|
|
def main() -> int:
|
||
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
||
|
|
parser.add_argument("source", type=Path)
|
||
|
|
parser.add_argument("destination", type=Path)
|
||
|
|
args = parser.parse_args()
|
||
|
|
patch(args.source, args.destination)
|
||
|
|
return 0
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
raise SystemExit(main())
|