߲jWJUdZddlmZddlZddlZddlZddlZddlZddlZddl m Z dZ de d<dd d d d d ddZ de d<dZde d<ded d,dZdad-dZd.dZd/dZd0dZd1dZd2dZd3dZd4dZd-d Zd5d!Zd6d"Zd-d#Zd7d8d$Zd9d%Zd:d&Zd;daDependency-light venv recovery that runs BEFORE hermes_cli.main's imports. Deliberately **stdlib-only** so importing it can never fail on a corrupted venv. ``hermes_cli.main`` calls :func:`recover_if_needed` at the very top of its module body, before any third-party import. Scope: repair only enough for ``hermes_cli.main`` to become importable again (force-reinstall of the known-fragile core packages, using the pins from pyproject.toml). ) annotationsN)Path))yaml SafeDumper)dotenv load_dotenv)clickCommand)certificontents)richprint) cryptography __version__)jwtencodeztuple[tuple[str, str], ...]LAZY_REFRESH_IMPORT_PROBESPyYAMLz python-dotenvr r r rPyJWT)rrr r r rrzdict[str, str]LAZY_REFRESH_REPAIR_PACKAGES)rdiituple[int, ...]QUARANTINE_RESTORE_BACKOFF_MS)stream backoff_msc|tj}g}|D]C\}}d}|D]x} tjj |stjj |sd}n5|rt j |dz tj||d}n||j||ftjjt|} | jjdr| ddn| } td| d|jj dtjjt|d| d |d |d | F|S#t$r }|}Yd}~Od}~wwxYw) aNRename quarantined shims back, retrying a lock instead of giving up. A pair is not a failure when ``original`` already exists or ``quarantined`` has gone: the installer wrote a fresh shim, or a concurrent sweep won the race. Both are silent, so two processes sweeping the same orphan cannot produce a spurious error. Ng@@z.exeu ✖ FAILED to restore z (u!) — it is still quarantined as z. `zZ` will NOT be on PATH until it is put back. Run this, then re-run the update: move "z" ""file)sysstderrospathexiststimesleeprenameOSErrorappendbasenamestrlowerendswithr __class____name__) movedrrfailedoriginal quarantinedlast_excdelay_msexcnamestems ?/home/ubuntu/.hermes/hermes-agent/hermes_cli/_early_recovery.pyrestore_quarantined_shimsr</sr~&(F!& +#'" H 77>>(+277>>+3N#HJJx&01 +x0     x-.wwH . JJL11&9tCRyt &tf-""++,-''""3{#34566&-s8*A  7  ' 8 M!  sAE (2E  E6)E11E6Fc@txstjdddgk(S)uTrue inside any ``hermes update`` process (and its import probes). Every dotenv load in the process — ``hermes_cli.main``, ``run_agent``, ``cli`` — consults this, so the updater never resolves external secret sources: on Windows they map ``cryptography._rust.pyd`` into the process replacing that venv, and everywhere a slow ``op``/``bws``/command helper (up to 120s per source) would run inside the updater's 120s critical-module import probe and be reported as an import-health timeout. Profile flags are stripped before ``hermes_cli.main`` loads dotenv, so ``argv[1]`` is the authoritative subcommand. update)_UPDATE_RETRY_RECOVEREDr"argvr;$_should_skip_external_secret_sourcesrEbs  # Achhqmz&AArDcdttjjjSN)r__file__resolveparentrCrDr; _project_rootrKps! > ! ! # * * 1 11rDc|dz }|jsy ddl}t|d5}|j|j di}dddt tr|SdS#1swYxYw#t $rYywxYw)zQ``[project]`` table of ``root/pyproject.toml``; ``None`` when missing/unreadable.pyproject.tomlNrrbproject)is_filetomllibopenloadget Exception isinstancedict)root pyprojectrQfrOs r;_load_pyproject_projectr[ts''I     )T " 9all1o)))R8G 9!$/79T9  9 9 s(A2"A& A2&A/+A22 A>=A>c |jddj}|sy ddl}t |j |j ddS#t$rYywxYw#ttf$rYywxYw)uOAttempt counter from a marker's opportunistic JSON body; corrupt/missing → 0.utf-8replaceencodingerrorsrNattempts) read_textstripr*jsonintloadsrT ValueErrorAttributeError) marker_pathrawres r;_read_marker_attemptsrls##WY#GMMO 4::c?&&z1566   's"!A-A$ A! A!$A65A6cz tjtjddddg|dy#t$rYywxYw)u\Best-effort pip bootstrap — a killed install can leave the venv with no pip module at all.-m ensurepipz --upgradez --default-pipT)cwdcapture_outputN) subprocessrunr" executablerUrXs r;_run_ensurepiprvs; k;X 6    s +. ::cT|dkrytjdk(r/ ddl}d}|jdd}|j|j |jg|j _|j|j _ |j|jg|j_|j|j_ |jg|j_|j |j_ |j |d|}|s|jd k(S |j|dd k(|j|S tj|dy#|j|wxYw#t$rYywxYw#t $rYyt"$rYyt$$rYywxYw) aBest-effort stdlib-only process liveness probe. ``os.kill(pid, 0)`` is not a no-op on Windows, so use the Win32 process handle API there. An access-denied result counts as live: racing an elevated updater is worse than postponing recovery for one launch. rFwin32Nikernel32T)use_last_errori)r"platformctypesWinDLLc_ulongc_int OpenProcessargtypesc_void_prestypeWaitForSingleObject CloseHandleget_last_errorrUr$killProcessLookupErrorPermissionErrorr*)pidr} synchronizeryhandles r;_pid_is_runningrsv ax ||w  $K}}Z}EH-3^^V\\6>>,ZH )+1??H (5;__fnn4UH ( ( 139>>H ( ( 0-3__,=H )+1<#E$$V, Q $$V,     sHDE8$E"8E8 F"E55E88 FF F'F'F'&F'c4 |jdd}|jD]R}|jd\}}}|s|j dk(s/ t t |j cSy#t$rYywxYw#t$rYywxYw)z?True when a legacy update marker names a process still running.r]r^r_F=r)rcr* splitlines partitionrdrrfrh)markerbodylinekey separatorvalues r;_marker_owner_is_liversC! $s 3Y - &s5;;='9::     s#A;!B ; BB BBct|}||Si}|jdgxsgD]}|jdddj}|}dD]}||vs|j|dd}n|jjdddjj }|s|||<|D cgc]"} |j| j | $c} Scc} w)uMap bare package names to their pinned specs from pyproject.toml. Naive requirement-head parsing on purpose — ``packaging`` may itself be broken in the failure state this module exists for. Unknown packages fall back to their bare name. dependencies;r>r)z==z>=z<=z~=>>##Cv{{}'<'??9$)?)A!"IJJ # M  #.228t9  << rDc ddl}t|jd}|dz jxs|jdz jS#t $rYywxYw)acTrue when ``sys.executable`` is a uv/standalone-builds managed install. Those ship an ``EXTERNALLY-MANAGED`` marker next to their stdlib (PEP 668), so ``python -m pip install`` aborts with ``externally-managed-environment``; the early repair must then go through uv (or explicitly override pip) or the venv stays broken. See #83569. rNstdlibzEXTERNALLY-MANAGEDF) sysconfigrget_pathr&rJrU)rrs r;'_base_interpreter_is_externally_managedr#sei((23..668CMM$88@@B D sAA AAc H tj||dddd|}|j d k(ry|j xs|jxsd d d}|rt|tj y #t$r+}td|d|tj Yd}~y d}~wwxYw) zQRun one installer command; captured output is replayed to stderr only on failure.Tr]r^)rprqtextr`raenvu& ✗ Early venv repair could not run z: r NFri0)rrrsrUrr"r# returncodestdout)toolcmdrXrresultr8tails r;_run_installerr7sdX_'0c; A MM 0V]] 0b%& 9D  d$   6tfBseD3::VsA-- B!6!BB!ct}|rt}|rZitjdt |dz i}|j dd|j ddt d|ddd g|||Std tj t|tjd ddd g}|r|jd t d||z|S)a``uv pip`` (or stdlib ``pip``) force-reinstall of the given specs. Never raises. Streams nothing to stdout (``hermes acp`` speaks JSON-RPC on stdout). uv is preferred when the base interpreter is externally managed; without uv, pip runs with the PEP 668 override. VIRTUAL_ENVvenv PYTHONHOMEN PYTHONPATHrpipinstallz--force-reinstalluw ⚠ Base interpreter is externally managed and no uv binary was found; retrying repair via pip with PEP 668 override.r rnz--break-system-packages) rrr$environr-poprrr"r#rvrtr+)specsrexternally_managedrrpip_cmds r;_run_repair_installrGs AB   KRZZKL64I0JKC GGL$ ' GGL$ '!$UI?R([UZ([".5 5 FLOJJ X< ~~tUI7JKG01 %5, ??rDcdtjvxr4|ttj j j k(S)u~True under pytest when ``root`` is this module's own checkout — the venv running the suite. Lifecycle tests spawn real subprocesses that import ``hermes_cli.main`` with recovery armed and inherit ``PYTEST_CURRENT_TEST``; without this guard a broken dev venv would get a REAL ensurepip + force-reinstall from inside a running suite. tmp_path roots are unaffected. PYTEST_CURRENT_TEST)r$rrrHrIrJrus r;_pytest_owns_live_checkoutr_s6 !BJJ . a44>;Q;Q;S;Z;Z;a;a3aarDc` |tjddn|}| tn|}t|ry|dz }|dz }|j s|j sy|dz j sy|j rt |ryt||rd|vrdayd|vryt}|syt|sy t||}tdd j|tj t||r&tstd tj nZtd tj td tj ddj|ztj t#|y#t#|wxYw#t$$rYywxYw)alRepair wiped core packages so ``hermes_cli.main`` can import at all. Fast path (no marker present) is two ``lstat`` calls. Only acts when a recovery marker from a prior ``hermes update`` exists AND an import probe confirms a core package is actually broken. Never raises: on any failure the import of main.py proceeds and surfaces the real error. Nr>z.update-incompletez.lazy-refresh-incompleterMr@TuQ⚠ Core package(s) broken by an interrupted update — repairing before launch: z, r u ✓ Core packages repaired.u9 ✗ Automatic repair incomplete. Recover manually with:z z" -m pip install --force-reinstall  )r"rBrKrr&rPr_complete_pending_core_installrAr_claim_recovery_lockrrjoinr#rrt_release_recovery_lockrU)rrBargsrX core_marker lazy_markerrrs r;recover_if_neededris8 #|sxx|"."6}L %d + 11 77 !!#K,>,>,@ ''002     $[1-dK@XQUEU*.'  t  ') $D)  )!&$/E ..2ii.?-@BHK  T"5$/8N8P5CJJGQX[XbXbcS^^,,NORURZRZ[`Raa::' #4 ( "4 (    sS0F!*F!F!2F!F!!F!& F!3 F!CF F! FF!! F-,F-c|dz } tj|tjtjztjz}tj |tj djtj|y#t$rV tj|jjz dkDr|jYy#t$rYYywxYwt$rYywxYw)z?Single-flight claim on the shared recovery lock. Never raises..update-incomplete.lock TiF)r$rRO_CREATO_EXCLO_WRONLYwritegetpidrcloseFileExistsErrorr'rst_mtimeunlinkr*)rX lock_pathfds r;rrs00I WWY RYY 6 D E  }B'..01    yy{Y^^-666=  "    s1BB D&AC** C73D6C77 DDcJ |dz jy#t$rYywxYw)z0Best-effort release of the shared recovery lock.rN)rr*rus r;rrs+ ) )113    s  ""c  ddlm}t|}|tk\r t d|dt j yt|sy t dt j |j| t| |jt d t j y#t$ri}|j|}t d|d td |t j t d t j Yd }~t|yd }~wwxYw#t|wxYw#t$rYwxYw#t$rYywxYw)uRun the pending core install BEFORE main.py can import native modules. Never raises: any failure leaves the marker for the post-import path and returns ``False``. Returns ``True`` only after the install succeeds. ``recover_if_needed`` invokes this when ``.update-incomplete`` exists — a prior ``hermes update`` (or the self-lock preflight, #83569) left the dependency sync deliberately unfinished. Completing it here matters on Windows: the deferral exists precisely because the process that wrote the marker had a native venv extension mapped; this process, running before ``hermes_cli.main``'s third-party imports, maps nothing yet, so the installer can replace ``.pyd`` files without hitting the lock. r)_install_repairu:⚠ Pending interrupted-update install has already failed uJ times in the early pass — leaving it for the post-import recovery path.r Fu⚠ A previous `hermes update` was interrupted mid-install — finishing dependency installation now (before any native extensions load)...u; ✗ Early interrupted-install completion failed (attempt /z): z] The next launch will retry; hermes will keep working from the current venv in the meantime.Nu: ✓ Dependency installation completed in the early pass.T) hermes_clirrl _EARLY_CORE_INSTALL_MAX_ATTEMPTSrr"r#rrun_core_installrUbump_marker_attemptsrrr*)rXrirrbr8 new_attemptss r;rrsM"4)5 7 7 NJ//58ZZ A#D) ) (.1jj :    % #4 (      JQTQ[Q[\ 22;?L O!N!$D#ESOUXU_U_ a 6D??E E E)r2list[tuple[Path, Path]]rrreturnr)rbool)rr)rXrr dict | None)rjrrrf)rXrrNone)rrfrr )rrrr )r list[str]rrrr )rr )rz str | NonerG) rr-rr rXrrr rr )rr rrrr )rXrrr )NN)rz Path | NonerBzlist[str] | Nonerr )rXrrrrr )%__doc__ __future__rrr$rrrr"r'pathlibrr__annotations__rrr<rArErKr[rlrvrrrrrrrrrrrrrrrrCrDr;rs#  ;7 'i N70n2JI/3"?) ")))`  B2 :   &R  D.$, (  @0bA N$% ( .rD