߲jUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ddlmZmZddlmZddlZej(eZehdZd~d ed ed efd Zdded ed efdZdej:d dfdZde d dfdZde d dfdZ de ddddd dfdZ!ddZ"de ddd dfdZ#de ddd dfdZ$ejJdk(Z&ehdZ'd Z(d!Z)d"Z*ejVejXfZ-d#e.d efd$Z/d%ed&ed dfd'Z0d%ed&ed dfd(Z1d)eee fd*eee fd efd+Z2deee fd dfd,Z3dd-deee fd.ed dfd/Z4d0dd1ddd2de d3ed4eddd5ed6ed7ed dfd8Z5dde d9dd:ed dfd;Z6d0ded4ed?ed@ed9dddd7ed dfdAZ7de8d?eddd7ed df dCZ9dDedEddFedGe:d df dHZ;dIddddJdeee fdDedEed ddMdeee fdNedOej~dzd efdPZ@GdQdRejZBdddddSdeee fdDedTedUedVedzd9dd dfdWZCde fdXZDddYde dVdZd dfd[ZEdeee fd\ed ed dfd]ZFehd^ZGd ed efd_ZHdd`deee fdae:dbdZd dfdcZIddded ed efdeZJeKedfdxs ejZMdged efdhZNiZOe:ePdi<ejZRdeee fd efdjZSdkefdlZTddked e1onyestrueFvaluedefaultreturnc||St|tr$|jjtvSt |S)zDCoerce bool-ish values using the project's shared truthy string set.) isinstancestrstriplowerTRUTHY_STRINGSbool)r r s */home/ubuntu/.hermes/hermes-agent/utils.pyis_truthy_valuers: }%{{}""$66 ;namecDttj||dS)zBReturn True when an environment variable is set to a truthy value.Fr rosgetenv)rr s renv_var_enabledr "s 299T73U CCrstztuple[int, int, int, int]c^|j|j|j|jfS)u6Change-detection key for a stat result: ``(st_mtime_ns, st_size, st_ino, st_ctime_ns)``. mtime + size alone miss a replacement that preserves both (``cp -p``, ``rsync -t``, a tar restore, a script pinning the timestamp with ``os.utime``). The inode changes on an atomic replace and ctime cannot be backdated from user space, so the pair catches those writers. On Windows ``st_ino`` may be 0 and ``st_ctime_ns`` is the creation time — both stable across an in-place rewrite, so the key degrades to mtime + size there rather than misfiring. ) st_mtime_nsst_sizest_ino st_ctime_ns)r!s rfile_signaturer''s# NNBJJ 2>> BBrpath int | Nonec |jr-tj|jjSdS#t$rYywxYw)z6Permission bits of *path* if it exists, else ``None``.N)existsstatS_IMODEst_modeOSError)r(s r_preserve_file_moder03sA48KKMt||DIIK//0KtK s !g{Gz?g?excc8txrt|ddtvS)zctj||tt5tj||dddtt5t |d5}t j|jddddddt j|y#1swYoxYw#1swY3xYw#1swY7xYw)zCCopy/fsync/unlink fallback for cross-device and bind-mount renames.NrX) shutilcopyfilerr/copystatrZrr`filenorb)rUrVfs r_copy_fallbackrns OOGY' ' ,+, ' DD1Q IIg ,,s/B+ C!$B7C+B47C <CC tmp_pathtargetc t|}tjj|rtjj |n|}t|} tj |||S#t $rE}t|}|jtvr|s|rddl m }tdtdzD]}tj||t t" tj |||ccYd}~S#t $r2} | }| jtvrd}Yd} ~ nt| sYd} ~ d} ~ wwxYwt$j'd||t)|ddxs8tj*j-|jxsd|j|rd nd |rt.nt0||Yd}~|Sd}~wwxYw) uAtomically move *tmp_path* onto *target*, preserving symlinks. Resolves a symlink first so ``os.replace`` writes the real file in place and the symlink survives. Otherwise identical to ``os.replace`` unless the rename fails with EXDEV/EBUSY (cross-device, bind-mount, busy file: copy/fsync/unlink immediately — these never clear on retry) or a Windows rename contended by another open handle (winerror 5/32/33: bounded retry, then in-place rewrite). r)jittered_backoffr:) base_delay max_delayNFz;atomic_replace: %s -> %s failed with %s; falling back to %srPzin-place rewritecopy)rrr(islinkrealpathreplacer/rTerrno_CROSS_DEVICE_ERRNOSagent.retry_utilsrrrange_REPLACE_RETRY_ATTEMPTStimesleep_REPLACE_RETRY_BASE_DELAY_S_REPLACE_RETRY_MAX_DELAY_SloggerdebugrR errorcodegetrgrn) rorp target_strrVrUrN contendedrrattempt retry_excs ratomic_replacersVJ02z0J  ,PZI(mGQ 7I& Q7< 990 0   : $;a$?@  +G@[hBCD JJw 2$$#C *>>$) >yIJ    RT[]fS*d3eu7J7J399>XY[^[d[d7e+4'& B 6F:8F?> D9D4F:# D4/F:4D99A;F::F?c tjdk(ry tj|tjt tddz} t t 5tj|dddtj|y#t $rYywxYw#1swY.xYw#tj|wxYw)uEBest-effort fsync of a directory entry so a just-renamed file survives power loss. No-op on Windows (directories can't be opened with ``os.open``; the file fsync still applies) and on any OSError — durability of the directory entry is never worth failing a write that has already been replaced into place. rIN O_DIRECTORYr) rrrZO_RDONLYrRr/rr`ra)r(res rfsync_directoryrs ww$ WWT2;;]A)FF G g   HHRL       s56B B+B2B+ BBB($B++C) ignore_errorsrcd} tj||y#t$rtj||YywxYw#t$r|sYywxYw)aL``shutil.rmtree`` that can also delete read-only trees. ``shutil.rmtree`` stops at the first entry it cannot unlink. Git marks loose object files read-only on Windows (``WinError 5``), and package installs (Nix store, deb/rpm) are copied ``r--r--r--`` into ``0555`` directories on POSIX, where unlinking needs a writable *parent*. Clear the write bit on the failing path and on its parent, then retry the exact operation that failed. Only ``PermissionError`` is retried: every other failure keeps ``shutil.rmtree``'s semantics (and ``ignore_errors``). ct|tr|dn|}t|ts|tjj ||fD]r}|st t5tj|tj|jtjztjzdddt||y#1swYxYw)Nr:) rtuplePermissionErrorrr(dirnamerr/r<r,r.S_IWUSRS_IXUSR)funcfpathexc_inforN candidates r _on_errorz"rmtree_readonly.._on_errors'%8hqkh#/I''//%0%8 bIg&bHHY (:(B(BT\\(QTXT`T`(`abb b U bbs AC  C )onexc)onerrorN)rirmtree TypeErrorr/)r(rrs rrmtree_readonlyrsW   3 MM$i 0 3 MM$ 2 3  s& AAAA AAutf-8T)encodingr7preserve_ownerbinary fsync_dirprefixrrrrc6ddlm}||j||js t }|r t |nd} t jt|j|d\} } tj| |rdnd|rdn|5} |4ttd r$tj| j||| | jtj| jdddt!t#| |} t%| | ||rt'| jyy#1swYDxYw#t($r;t+t,5tj.| ddd#1swYxYwwxYw) u,Temp file + fsync + :func:`atomic_replace`, then re-apply owner/mode. *write(f)* emits the payload into the open handle (text, or bytes when *binary*). The temp file is created by ``mkstemp`` — ``O_CREAT|O_EXCL`` at 0600 regardless of umask — so a secret is never readable at process umask, not even between create and chmod. *mode* is fchmod'd onto the temp fd BEFORE the replace so the target never transits through mkstemp's 0600 (fchmod is Unix-only; the post-replace chmod is the sole path on Windows). With no *mode* a NEW target gets what ``open(path, "w")`` would have given it (process umask) — the callers this replaced wrote at umask, and silently tightening every fresh cache/state file to 0600 breaks shared volume mounts; an existing target with no *mode* keeps mkstemp's bits, as before. *fsync_dir* also fsyncs the resolved target's parent so the rename itself is durable. The temp file is removed on any failure — ``BaseException`` on purpose, so KeyboardInterrupt / SystemExit still clean up. rmkdir_under_hermes_homeNz.tmp)dirrsuffixwbwrfchmod)hermes_constantsrparentr+rBr5tempfilemkstemprrfdopenr;rrlflushr`rrr=r BaseExceptionrr/rb)r(r^rrr7rrrroriginal_ownerrerormreplaceds r _atomic_writersA&9DKK( |DKKM$&3A)$/tN##DKK(8PVWLB YYr64sVTQY Z !^_GB$9 !((*d+ !H GGI HHQXXZ  ! x67x>  HOO ,  ! !  g  IIh     s>3 EA2EAEE EF,F  F F F create_modepreservecL|r t|nd}||jr|S|S)zXExisting permission bits of *path* (when *preserve*), else *create_mode* for a new file.N)r0r+)r(rrr7s r_mode_for_writer3s)(0 t $dD#t{{}4E+Erz.tmp_)r tmp_prefix preserve_moderr7rcontentrrc ft|}t|fd||||n t|||||y)aWrite *content* to *path* via temp file + fsync + atomic rename. The target is never left partially written on crash/interrupt. Shared by every destructive file rewrite (memory store, skill manager, agent importer, ...). *mode* forces the final permission bits (secret files: ``0o600``) regardless of what exists; *create_mode* applies only when the target is new and *preserve_mode* carries an existing file's bits and owner across. c&|jSrDr^rmrs rz#atomic_write_text..D!'''"2rN)r)rrr7rr)rrr)r(rrrrrr7rs ` ratomic_write_textr9s: :D$2:PX#/t_T;an5o!.)Er)rr7rc `t|}t|fd|dd||n t||y)zKBytes variant of :func:`atomic_write_text` (encrypted blobs, key material).c&|jSrDrrs rrz$atomic_write_bytes..MrrTFN)rrrr7r)rrr0)r(rrr7rs ` ratomic_write_bytesrIs6 :D$2:dch#/t5H5NZcerrdindent ensure_ascii dump_kwargsc tj|f||d|} |j|y#t$r+|jtj|f|dd|YywxYw)ur``json.dump`` that survives surrogate-escaped strings. ``os.fsdecode`` of a non-UTF-8 filename/argv yields lone surrogates (``'\udcff'``); a utf-8 text handle rejects them with ``UnicodeEncodeError`` — a ValueError, which callers guarding ``except OSError`` never see. ``ensure_ascii=True`` escapes them as ``\udcff`` and ``json.loads`` restores the identical str, so the retry round-trips; ``surrogateescape`` would emit a raw 0xFF byte that the reader's utf-8 decode rejects. Serializing to a str first keeps the failure before any byte reaches the file, so no partial payload is left behind. )rrTN)jsondumpsr^UnicodeEncodeError)rdrmrrrtexts r _dump_jsonrQsa ::d T6 T TDS  S  4QTQ[QRSs-1A! A!)rr7rrc t|}t|fdd|jd||n t||y)aWrite JSON to *path* atomically (temp file + fsync + replace). Surrogate-escaped strings (non-UTF-8 argv/paths) are always persisted: the write falls back to ``ensure_ascii=True`` escapes for that payload only, so normal content keeps its raw UTF-8 bytes. ``mode=0o600`` is the private-credential form: the temp file is 0600 from creation (mkstemp), so the payload is never umask-readable. c$t|S)N)rrr)r)rmrdrrrs rrz#atomic_json_write..ns*T1VR^lw"xr._N)rr7r)rrstemr0)r(rdrr7rrrs `` ` `ratomic_json_writerbs> :D$xTYYKq)8HNabfNg%'rc tjt|jd}t |tr|SiS#tt f$ricYSwxYw)u1The JSON object at *path*, or ``{}`` when the file is missing, unreadable, malformed or not an object. The read half of every ``read → merge → atomic_json_write`` config store (memory-provider ``save_config``), so a corrupt sidecar degrades to defaults instead of taking the provider down.z utf-8-sigr)rloadsr read_textr/ ValueErrorrdict)r(rds rread_json_or_emptyrssX zz$t*.. .DEdD)41r1 Z  s.AAA)labellogrrc`t|} |jj}tj dk7s$|tj tjzzsy|xstjd|r|dnd|j tj||y#t$rYywxYw)aWarn when a credential file is group/world-readable; True when a warning was emitted. Hand-made secret files (or ones older Hermes wrote without an explicit mode) commonly end up 0o644 under the default umask; call this before loading any token/credential file. No-op on non-POSIX (Windows ACLs don't map onto group/other bits; st_mode there is synthesized), when the file is missing, or when permissions are already tight. Fr2zO%s%s is group/world-readable (mode 0%o) and contains secrets. Run: chmod 600 %s rT) rr,r.r/rrS_IRGRPS_IROTHrwarningr-)r(rrp file_modes r(warn_if_credential_file_broadly_readablers T AFFH$$  ww')t||dll/J"K]Fm+0ugQKb!&&$,,yBY[\^  sB!! B-,B-c$eZdZdZdfd ZxZS) IndentDumperaPyYAML dumper that indents list items under mapping keys (2-space). PyYAML emits "indentless" sequences while ruamel (:func:`atomic_roundtrip_yaml_update`) indents them; mixing both in one ``config.yaml`` makes stricter parsers like ``js-yaml`` reject it, so every write path is forced to the same shape. Forcing ``indentless=False`` aligns the two serializers so all write paths emit byte-identical layouts (#31999). c$t||dS)NF)superincrease_indent)selfflow indentless __class__s rrzIndentDumper.increase_indentsw&tU33r)FF)__name__ __module__ __qualname____doc__r __classcell__)rs@rrrs44rr)default_flow_style sort_keys extra_contentrrrrc t|}dfd }t||d|jdt||y)z>Write YAML to *path* atomically (temp file + fsync + replace).Ncltj|tdr|jyy)NT)Dumperrr allow_unicode)yamldumprr^)rmrdrrrs r_writez!atomic_yaml_write.._writes2 $,CUajz~  GGM " rrrrr7rN)rrrr)r(rdrrrrrs ```` ratomic_yaml_writers= :D##$499+Q'7odT_>`arc,ddlm}ddlm}|d}d|_d|_d|_|jdd d d|_|jr!|j|jd nd }|t||r|fS||xsifS)z``(yaml_rt, CommentedMap)``: a ruamel round-trip loader keeping quotes/Unicode with 2-space indents, plus *path* loaded through it (empty map when missing/blank).r)YAML CommentedMaprt)typTFrrM)mappingsequenceoffsetrrN) ruamel.yamlrruamel.yaml.commentsr preserve_quotesrrrallow_duplicate_keysr+loadrr)r(rr yaml_rtrds r_roundtrip_loadrs!1tnG"G G!&G NN1qN3$(G =A[[]7<<8 9PTD Jt\:D XX TZUW@X XXrrz str | Nonecfdfd }t||d|jdt|y)NcRj|r|jyyrD)rr^)rmconfigrrs rrz_roundtrip_dump.._writes% VQ  GGM " rrrrr)rrr0)r(rrrrs ``` r_roundtrip_dumprs,# $499+Q'7>QRV>WXrkey_pathcddlm}ddlm}m}t |}ddlm}||jt|\}}|} ||} d} | | d} |t| | xs| ddf\} }| |zt| k(r|| j| dn|| | <n4| j| }t||s|y|}|| | <|} | |z } t|||y)aUpdate one dotted YAML key while preserving comments, ordering, quoting and Unicode. Narrower than :func:`atomic_yaml_write` on purpose: for user-edited config files where a single setting mutation must not disturb the rest. Still writes via temp file + atomic replace. ``value=None`` removes the key (a ``key: null`` leftover reads as absent everywhere but litters the file and diverges from whole-document writers that drop the key). rr)_greedy_literal_match_split_key_pathrNr:)rr hermes_cli.configrrrrrrrrr]poprrr)r(rr r rrrrrrAkeysi remainingsegconsumed next_values ratomic_roundtrip_yaml_updater's2 I :D8DKK(%d+OGVG 8 $D A H -d7mYG\IVWLZ[K\ X x<3t9 $} C&$ [[% *l3}%J%GCL X ! "D'6*r> ny~nor offr nullr falsecFddlm}m}ddlm}t |t r/|}|jD]\}}t|||<|St |ttfr|d|DSt |tr|jtvr||S|S)uPlain Python value → ruamel node: YAML 1.1-ambiguous strings force-quoted at every depth (a bare ``off`` inside a list reads back as ``False`` just like one at the top level).rr  CommentedSeq)DoubleQuotedScalarStringc32K|]}t|ywrD) _rt_value).0vs r z_rt_value.. s8QIaL8s)rr r1ruamel.yaml.scalarstringr2rritemsr4listrrr_YAML11_AMBIGUOUS_WORDS)r r r1r2nodekr6s rr4r4s@A%~KKM #DAqlDG # %$'8%888%%++-3J"J'.. Lr)extra_content_on_create new_stater>c ddlmm ddlm}t |}ddlm}||j|||j xs!|jdj }t|\}}dtdtd tfd  d d td d f fd d fd d d t d d f fd  ||t#||||r|y d y )uPPersist a full config-state dict while preserving comments and ordering. THE writer for ``config.yaml`` (every production caller reaches it through ``hermes_cli.config.atomic_config_write``): the on-disk document is loaded through ruamel round-trip mode and *new_state* is merged onto it, so comments, key order, quotes, blank lines and readable Unicode survive. Only nodes whose value actually changed are reassigned; an untouched scalar or list keeps its inline comments and formatting. Keys absent from *new_state* are deleted ("explicit absence": ``cfg.pop(k)`` + save removes ``k`` from disk). ``extra_content_on_create`` (commented example blocks) is appended only when the file is being created — re-appending it on every rewrite is how the stock boilerplate replaced users' own comments (#92554). rr0)$require_readable_config_before_writerrrrAr rcP||k(xr t|tt|tuSrD)rr)rAr s r _unchangedz.atomic_roundtrip_yaml_save.._unchanged*s&%XJw$=ESWAX$XXrdstrcNct|D]8\}}|t|kr ||||jt|:|t|d=yrD) enumerater]appendr4)rDrcr"r _merge_items r _merge_seqz.atomic_roundtrip_yaml_save.._merge_seq.sQ!# -HAu3s8|CE* 9U+,  - C Nrc||}t|trt|r ||yt|trt|r ||y||st|||<yyrD)rrr:r4) rDkeyr rAr r1_mergerIrCs rrHz/atomic_roundtrip_yaml_save.._merge_item7scc( eT "z'<'H 7E " t $G\)J w &GU+ 'CH,rc|jD]"\}}||vr |||t|||<$|Dcgc] }||vs| c}D]}||=ycc}wrD)r9r4)rDrcrKr r=rHs rrLz*atomic_roundtrip_yaml_save.._mergeAsi))+ ,JCczCe,$U+C  , #3!aslA3 CC 3s AArr)rr r1rrArrrrr+rrrrrr:rr)r(r?r>rArcreatingrexistingr r1rLrHrIrCs @@@@@@ratomic_roundtrip_yaml_saverPs@F :D8DKK((.;;= P(H(N(N(P$PH'-GXYCYYY 4D((Lt 8YD'8V^;Ridhirrcz tj|S#tjttf$r|cYSwxYw)z3Parse JSON, returning *default* on any parse error.)rrJSONDecodeErrorrr)rr s rsafe_json_loadsrSNs7zz$  )Z 8s  :: CSafeLoaderstreamc8tj|tS)zX``yaml.safe_load`` (same inputs, same result) using the libyaml C loader when available.)Loader)rr_fast_yaml_loader)rUs rfast_safe_loadrY\s 99V$5 66r_YAML_FILE_CACHEct|}t|j}t|}t5t j |}||d|k(r|dcdddSdddt|d5}t|}dddt5|ft |<ddd|S#1swYFxYw#1swY1xYw#1swYSxYw)u ``fast_safe_load`` of a file, re-parsed only when its :func:`file_signature` changes. Returns the cached object itself — callers must never mutate it. Parse errors propagate and are not cached; a missing file raises ``FileNotFoundError`` like ``open`` does.Nrr:rr) rr'r,r_YAML_FILE_CACHE_LOCKrZrrZrY)r(sigrKcachedrmrds rload_yaml_file_readonlyr_es :D  %C d)C !%%c*  &)s"2!9 dW %!a ! ,!$d , K!!, Ks#$B)9 B5 C)B25B>C rKctj|dj} |r||S|S#ttf$r|cYSwxYw)Nr)rrrrr)rKr castraws r _env_numberrcxsJ ))C  " " $CtCy,W,  "s 22AAc$t||tS)z:Read an environment variable as an integer, with fallback.)rcintrKr s renv_intrgs sGS ))rc$t||tS)z7Read an environment variable as a float, with fallback.)rcfloatrfs r env_floatrjs sGU ++rcDttj|d|S)z*Read an environment variable as a boolean.rrrrfs renv_boolrls 299S"-w ??r) HTTPS_PROXY HTTP_PROXY ALL_PROXY https_proxy http_proxy all_proxy proxy_urlct|xsdj}|jjdrd|t ddS|xsdS)zaNormalize proxy URLs for httpx/aiohttp: WSL/Clash export ``socks://``, httpx needs ``socks5://``.rzsocks://z socks5://N)rrr startswithr])rsrs rnormalize_proxy_urlrvsSIO$**,I##J/9S_%56788  rctD]?}tj|d}t|}|s'||k7s-|tj|<Ay)zARewrite supported proxy env vars to canonical URL forms in-place.rN)_PROXY_ENV_KEYSrrrvenviron)rKr normalizeds rnormalize_proxy_env_varsr{sB) #r"(/ *-(BJJsO )rbase_urlcb|xsdj}|rtd|vr|Sd|SdS)zF``urlparse`` that tolerates a bare ``host[:port][/path]`` (no scheme).rz://z//N)rr)r|rbs r_parse_base_urlr~s: >r "C>rmodelc|xsdjjjddd}|jdS)zYTrue for OpenAI families that reject ``max_tokens`` (HTTP 400 ``unsupported_parameter``).rrr:)zgpt-4ozgpt-4.1zgpt-5o1o3o4)rrrsplitru)rms r"model_forces_max_completion_tokensrs? "##%,,S!4R8A <<H IIrct|}t|}|sy|jxsdj} |j}|||dddj |dfS|fS#t $rYywxYw)u``(scheme, hostname, effective_port)`` for a base URL; ``("", "", 0)`` on no host/bad port. Origin, not just host: ``https://h`` vs ``http://h`` and two ports on one host are different trust boundaries, so handing a bearer secret to a new URL must compare all three — hostname alone would authorise an HTTPS→HTTP downgrade. Port defaults to 443/80 so ``https://h`` equals ``https://h:443``. )rrrriP)httpshttpr)r~rschemerportrr)r|rrrrs rbase_url_originrsX &FF#H mm!r ( ( *F{{ H4<R8<rs0   !   8 $563$D#DDTD Cr~~ C*E Cd|2t2(@2 ! !.F !l !_c ! &.d.+C..-T--$-ggo %.k$:! "  U[[1_W__ sst,CCD'U39-'uS$Y7G'C'T%T *t(FK %T * d t FFMcg)-eW\(((s(T`("&(7;(PT(ae(VF$F\FTFUaF PWjq,1tjn(- EE#t), Es E Edg E%) E@L E[g E!% E26 E U\,0EeU39-eece)e=AeNReSSS SDSW[S`dS$9:d%' T '"%'25'ADt''+/'HK' '" 2U39- 2$ 2VXvz5d3Cs^e^l^los^s@D( 44?? 4X]pu26TX bE#t), bC bPT bim b%(4Z bEQ b]a b Y$Y$SWY$Y<Y[_Y(+uS$Y'7(+3(+s(+W[(+^$$fgSS&HL:jU39%5:j$:j8D:jPT:jz#sD-6I$//73737 $& (%T "2s&S**s*3* ,3,,, @#@@@ g3:#*)JcJ ICI333?C?C?JcJdJ ccceCcM&:c(aCaaar