߲jt UdZddlmZddlZddlZddlZddlZddlZddlm Z m Z gdZ dZ e hdZhdZd/d Zej"d k(Zd Zd0d Zd1d ZdZdZdZd2dZd2dZd2dZd3dZd4dZdZddddej>dddddd Z d5dZ!iZ"de#d<d6d Z$d7d8d!Z%d9d"Z&d:d#Z'd;d$Z(dd%dd,Z,d3d-Z-d?d.Z.y)@uWindows subprocess compatibility helpers. * ``["npm", ...]`` — on Windows ``npm`` is ``npm.cmd``, a batch shim; ``Popen`` fails with WinError 193 because CreateProcessW can't run a ``.cmd`` without ``shell=True``/PATHEXT. * ``start_new_session=True`` — POSIX ``os.setsid()`` detach; silently ignored on Windows, whose equivalent is the ``CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW`` creationflags bundle. ) annotationsN)MappingSequence) IS_WINDOWSresolve_node_commandsplit_command_linesuppress_platform_ver_consolewindows_detach_flags&windows_detach_flags_without_breakawaywindows_hide_flagswindows_detach_popen_kwargsbounded_git_probebounded_probe_runnoninteractive_git_envNO_DRIVER_DIFF_FLAGS pid_is_hermes)z --no-ext-diffz --no-textconv>logdiffshowblame>-C-c --git-dir --exec-path --namespace --work-treect|}d}|t|krU||}|tvr|dz }!|jdr|dz }8|tvr!|d|dztt z||dzdzS|S|S)aCopy of subcommand-first git *args* (no leading ``"git"``) with :data:`NO_DRIVER_DIFF_FLAGS` inserted right after a diff-rendering subcommand; other subcommands are returned unchanged. Pair with :func:`noninteractive_git_env`: the env layer disables fsmonitor/hooks/pager/editor/ credential sinks, this closes the one class (attacker-named attribute drivers) env cannot reach. r-N)listlen_GIT_VALUE_OPTS startswith_DIFF_RENDERING_SUBCOMMANDSr)argsoutitoks B/home/ubuntu/.hermes/hermes-agent/hermes_cli/_subprocess_compat.pyharden_git_argvr+4s t*C A c#h,!f / ! FA  >>#  FA  - -wQ<$';"<tj|}|xs|g|S)uAResolve a Node-ecosystem command name (``npm``, ``npx``, ``yarn``…) to an absolute-path argv. On Windows these ship as ``.cmd`` batch shims that CreateProcessW won't execute by bare name; ``shutil.which`` resolves via PATHEXT to a fully-qualified path whose extension routes it through ``cmd.exe /c``. )shutilwhich)nameargvresolveds r*rris%||D!H   $t $$r,iiic8tsyttztzS)uWin32 creationflags detaching a child from the parent console/group; 0 elsewhere. Pair with the default ``start_new_session=False`` (POSIX uses ``start_new_session=True``). CREATE_NEW_PROCESS_GROUP stops Ctrl+C propagating; CREATE_NO_WINDOW gives the child a hidden console descendants (git, gh, cmd, node, …) inherit so they don't flash — deliberately replacing the old DETACHED_PROCESS approach, which re-created the per-descendant console-flash bug (#54220/#56747) at every spawn; CREATE_BREAKAWAY_FROM_JOB escapes Electron/Tauri job objects. A job that forbids breakaway yields PermissionError from Popen — callers catch OSError and fall back to :func:`windows_detach_flags_without_breakaway`. Rationale: This both detaches it from the parent's console lifetime (closing the launching terminal doesn't CTRL_CLOSE it) AND gives every console-subsystem descendant (git, gh, cmd, node, …) a console to inherit, so they don't allocate visible flashing ones. This deliberately replaces the old ``DETACHED_PROCESS`` approach: MSDN specifies CREATE_NO_WINDOW is *ignored* when combined with DETACHED_PROCESS, and a truly console-less daemon re-creates the per-descendant console-flash bug (#54220/#56747) at every spawn — see the note on ``_DETACHED_PROCESS`` above. Electron (Desktop app) and Tauri (bootstrap installer) wrap their children in job objects; without breakaway, those children die when the parent process exits even though they have their own console. This was the missing flag that made the post-update gateway respawn watcher silently die alongside the Tauri updater after the Electron Desktop's update flow finished. r)r_CREATE_NEW_PROCESS_GROUP_CREATE_NO_WINDOW_CREATE_BREAKAWAY_FROM_JOBr,r*r r s,  $'8 8;U UUr,c*tsyttzS)zS:func:`windows_detach_flags` minus ``CREATE_BREAKAWAY_FROM_JOB``; 0 on non-Windows.r)rr?r@rBr,r*r r s  $'8 88r,ctrtSdS)aXWin32 creationflags hiding the child's console without detaching it; 0 elsewhere. For short-lived synchronous helpers (``taskkill``, ``where``, version probes): no flash, but the child stays in the parent's process group and job so Ctrl+C and job teardown still propagate. Stdio is inherited, so ``capture_output=True`` works. r)rr@rBr,r*r r s!+ 11r,cntsy ddl}t|dr dd}||_yy#t$rYywxYw)uStub ``platform._syscmd_ver`` on Windows so it never flashes a console. No-op elsewhere. ``platform.win32_ver()`` shells out ``cmd /c ver`` without CREATE_NO_WINDOW, so a windowless parent (pythonw gateway, kanban workers) flashes a cmd window whenever a dependency touches ``platform.uname()`` at import. With the stub, ``win32_ver()`` takes its documented fallback to ``sys.getwindowsversion()`` — same data, in-process. Call before heavy imports. Nr _syscmd_verc |||fSNrB)systemreleaseversionsupported_platformss r*_quiet_syscmd_verz8suppress_platform_ver_console.._quiet_syscmd_versw//r,)rNrN)r-win16dos)rplatformhasattrrF Exception)rQrMs r*r r sJ    8] +AC6O 0$5H ,    s ( 44c.tr dtiSddiS)zPopen kwargs detaching a child on Windows, or ``start_new_session=True`` on POSIX. Bare ``start_new_session=True`` is accepted but has no effect on Windows: the child stays attached to the parent console and dies when it closes. creationflagsstart_new_sessionT)rr rBr,r*r r s! !5!788  &&r,)GIT_CONFIG_KEY_GIT_CONFIG_VALUE_rNfalsecattruezssh -o BatchMode=yes) zcredential.helperz core.askPasszcore.fsmonitorzcore.untrackedCachezcore.hooksPathz core.pagerz core.editorzsequence.editorz diff.externalzcore.sshCommandc|jdd}|jdxs tjj|d}|jdxsd|jdxs tjj|dtjj|d d f}g}|D]1} |j tj |j 3|jd|jd|jd ||jd|jd g|S#t$r|j d YwxYw)zEverything that decides which files ``git config --system/--global`` reads, plus the global candidates' mtimes so an edit to ``~/.gitconfig`` is picked up without a restart.HOMErNXDG_CONFIG_HOMEz.configGIT_CONFIG_SYSTEMz/etc/gitconfigGIT_CONFIG_GLOBALz .gitconfiggitconfigNGIT_CONFIG_NOSYSTEMPATH)getospathjoinr6stat st_mtime_nsOSError)envhomexdg candidatesstampsrgs r*_safe_directory_cache_keyrqs* 7762 D ''# $ E T9(EC #$8(8 #$H T<(H  S%*J F  MM"''$-33 4 #$cgg.A&BCGGLaDb cgg'(#''&/ >%{z)noninteractive_git_env..osM5&.MsrWrX)rrfenvironrr!r$rrdevnull_GIT_CONFIG_OVERRIDESitemsrstrr" enumerate)baserlsafe_directoriesr overridesidxrs r*rr8s\2 t'tRZZ 8C.d6FdBJJW!$C$CCy ) )S^^ ddlm}||S#t$rYywxYw)z@The repository's stable process-start fingerprint, if available.r)get_process_start_timeN)gateway.statusrrS)pidrs r*_process_start_timerws'9%c** s  cjtdtjd|jDS)u True when *text* names Hermes at a path-segment / token boundary. A bare ``"hermes" in text`` substring test would also match unrelated processes whose paths merely contain the letters (``...\shermesa\...``) — the false-positive class this prevents. c3>K|]}|jdyw))hermesz.hermesN)r$)rtokens r*rz%_text_names_hermes..s&G 56Gsz[\\/\s=,;\"']+)anyrer5lower)r}s r*_text_names_hermesrs4 GHH%6 EG GGr,c ddl}|j|}dj|jxsg}|j xsd}t |d|S#t $rYywxYw)z8Best-effort check that *pid* currently runs Hermes code.rN rNF)psutilProcessrhcmdlineexerrS)rrprocesscommand executables r*_process_command_is_hermesrsj..%((7??,23[[](b !WIQzl";<< sAA A*)A*)expected_start_timect|trt|ts|dkryts|y t ||k(S t |}|y|||k7ry t |S#t $rYywxYw#t $rYywxYw#t $rYywxYw)aAWhether it is safe to use ``taskkill`` for *pid*. The PID must be valid, currently exist, and identify a Hermes process. When the caller captured a start-time fingerprint before the destructive action, the live process must still have the same ``(pid, start_time)`` identity. Any ambiguity fails closed. rFT) isinstanceintboolrrrSr)rrcurrent_start_times r*rrs c3 :c4#8C1H   & &s+/BB B05!&+=AT+T)#..    s5 A" A1 B" A.-A.1 A=<A= B  B c ddlm}||j |j y#t$rt |YywxYw#t $rYywxYw)ueBest-effort terminate *proc* and its descendants on both platforms; never raises. ``proc.kill()`` alone only terminates the direct child. This is cleanup on an already-failing path whose contract is to fail open, so every failure (access denied, already reaped) is swallowed rather than escaping the caller's ``except``. On Windows a suspended descendant (e.g. ``git.exe``) can survive holding duplicates of the captured pipe handles, which keeps the pipes from reaching EOF and leaks two reader threads + the process per fired timeout — ``taskkill /T /F`` takes the whole tree down so the bounded drain that follows can actually reach EOF. On POSIX the same class exists: killing the launcher leaves descendants (credential helpers, ``git-remote-https``, hook children) running and holding the pipe write ends. Callers spawn the child in its own process group (``process_group=0``, Python ≥3.11), so when — and only when — the child leads its own group (``pgid == pid``), the entire group is signalled with ``os.killpg``. The ownership check means a fallback spawn that shares our group can never cause us to kill unrelated processes. Ported from openai/codex#36793 ("Terminate timed-out Git process trees"); generalized for the shell-hook runner via openai/codex#37527 ("Terminate timed-out hook process trees"). r)kill_process_treeN)agent.deadlinerrrS_legacy_kill_process_treekillrk)r_deadline_kill_trees r*rrsS$KDHH%   !$'    s ,AAA AAc tsS ddl}tj|j}||jk(r tj ||j  |jtrh tjddddt|jgtjtjtjddt yy#t$rYwxYw#t$rYwxYw#t$rYywxYw) zULocal tree-kill fallback when agent.deadline is unavailable (partial install, cycle).rNtaskkillz/Tz/Fz/PIDrF)rstderrrrrrU)rsignalrfgetpgidrkillpgSIGKILLrSrrkrrrrr )r_signalpgids r*rrs   $::dhh'Dtxx $0    NNJdFCMJ","4"4Z=O=O!+!3!3Qe);)= ?            s7ACC)2A&C8 C&%C&) C54C58 DDrzF)rrlcwdraise_on_spawn_failurec 6tr dtinddi}d} ddlm}|t |ft j t j t jdd|| t|nd|d|\} } | j| \} } t|t jt || j| | S#t$r|rYywxYw#t$r<t|t|  | jd Yy#t$rYYywxYwwxYw) u Deadlock-safe ``subprocess.run(argv, capture_output=True, timeout=…)`` for fail-open probes. Returns a ``CompletedProcess`` when the child finished within *timeout* (any exit code), or ``None`` on spawn failure or timeout. With ``raise_on_spawn_failure=True`` the ``Popen`` exception propagates instead, so callers that treat a *timeout* as a verdict can still tell "our own probe never started" apart from "the child hung". Why not ``subprocess.run``: on Windows, ``run()``'s post-timeout cleanup calls an *unbounded* ``communicate()`` after killing the direct child. Killing it can leave a descendant (``git.exe`` under a launcher shim, ``conhost.exe`` under wmic/powershell) holding duplicates of the captured stdout/stderr handles, so the pipes never reach EOF and the reader-thread join blocks forever. The wmic / ``Get-CimInstance Win32_Process`` gateway scan hit exactly this during ``hermes update`` on slow-WMI machines (#87134); the git probes hit it first (#68609 / #66037). rU process_grouprN) spawn_serverTry)rrrr}r~rrlr)rr )rr "hermes_cli.local_runtime.processesrr!rPIPErrrS communicate _close_jobrCompletedProcessr) r<rrrlrr _popen_kwargsjobrrrrs r*rrs4&FP?,>,@AVeghUiM C D JR)zjN`N` _S $CRDQR c ))'):sO  & &tDz4??FF SS%  !    3$    Q  '    s<AC6C CCD3D DDDDcJ|y |jy#t$rYywxYwrH)closerS)rs r*rr's* {     s  ""ct||t}||jdk7ry|jxsdj S)uRun a short ``git`` probe and return stripped stdout, or ``""`` on ANY failure. On Windows ``run()``'s post-timeout cleanup calls an unbounded ``communicate()``; a suspended descendant git.exe holding the pipe handles then blocks forever. Here: bounded ``communicate``, tree-kill plus a 1s drain, then abandon the pipes; on POSIX the probe gets its own process group so cleanup also takes down credential/remote helpers. Security (GHSA-7x36-8jrh-v4pw): these probes run automatically against whatever directory the session sits in, before any tool call or trust prompt, and an index refresh executes the repo-configured ``core.fsmonitor`` program. Every probe therefore runs under :func:`noninteractive_git_env`; diff-rendering callers additionally pass :data:`NO_DRIVER_DIFF_FLAGS` (attribute-scoped drivers can't be disabled via env). Killing the PATH-resolved launcher can leave a suspended descendant ``git.exe`` holding duplicates of the captured stdout/stderr handles, so the pipes never reach EOF and the reader-thread join blocks forever. On the Desktop agent-build path (``_start_agent_build → _session_info → branch() → run_git``) that turned an optional branch label into ``agent initialization timed out`` (issues #68609 / #66037). The normal-path spawn contract mirrors the previous ``run`` call byte-for-byte: PIPE/PIPE/DEVNULL, ``text`` with UTF-8 ``errors="replace"`` decoding, and the hidden-window ``creationflags`` on Windows only. On POSIX the probe is additionally placed in its own process group (``process_group=0``, Python ≥3.11) so timeout cleanup can take down descendants — credential helpers, ``git-remote-https``, hook children — with the launcher instead of orphaning them (see :func:`kill_process_tree`; port of openai/codex#36793). ``process_group`` only changes which group the child belongs to; it does not detach the terminal or alter the fast path. )rrlrrN)rrrrstrip)r<rresults r*rr0sC4tW:P:R SF ~**a/ MM R & & ((r,)r& Sequence[str]return list[str])r7rrr)r;rr<rrr)rr)rNone)rr)rl'Mapping[str, str]'rtuple)rrrrrH)r'Mapping[str, str] | None'rzdict[str, str])rrr int | None)r}rrr)rrrr)rrrrrr)rz'subprocess.Popen'rr)r<rrfloatrrrlrrz'str | os.PathLike[str] | None'rrrz)'subprocess.CompletedProcess[str] | None')r<rrrrr)/__doc__ __future__rrfrr9rsystypingrr__all__r frozensetr%r#r+rQr_WINDOWS_GATEWAY_BREAKAWAY_ENVrrr?r@rAr r r r r rrrrqrr__annotations__rrrrrrrrrrrrBr,r*rs}#  $ .:((HIY.\\W $ "=0%' (V692 .'G"jj .$,13-21h<~G BF< @:;D&*SW#(2T 2T%*2T472T #2T1P2T!2T/ 2Tj )r,