߲jUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ddlmZmZddlmZddlmZddlmZdd lmZmZmZdd lmZmZdd lmZdd l m!Z!m"Z"dd l#m$Z$m%Z%m&Z&m'Z'ddl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1ddl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDejeFZGejejejhZKdZLdeMfdZNdeOdeMdePeOeMeQffdZRdeSdeOdeMdeMdeOf dZTdZUeVhdZWdZXdeQfdZYejdejZ\ejdejZ]deOd eSdeOfd!Z^d"eOdeQfd#Z_dd$eOd%eOe zdzdeQfd&Z`d"eOd'eOdeOfd(Zadd'eOdeMfd*Zbd+ecdeQfd,ZdejZfiZgeSehd-<d.eOd'eOfd/Zidd'eOdefd0Zjdd'eOfd1Zkejd2fejd3fejd4fejd5ffZpdeOdzfd6Zqd"eOdeMd7eMd'eOdeOdzf d8Zrd9eSd:ePd"eOdeOfd;ZsdeOdeMd7eMd:ePd?eQd@eQdAeMdzdeMfdBZtdCed)fd"eOdeMd7eMd'eOdeOf dDZud$eOd'eOdeOdzfdEZvdFeweOdGeweOd'eOdHeQdeOdzf dIZxdFeweOd eSd'eOdeweOfdJZyd'eOdFeweOd eSdKeOdzddf dLZzdMZ{dNZ|dOZ}d'eOdPeOdzdQeOdeOdzfdRZ~ dd"eOdeOd'eOdHeQdKeOdzdeOf dSZdeOdePeweOeweOfeOzfdTZ ddVeOd"eOdWeOdXeOdYeQdeOd'eOdHeQdKeOdzdeOfdZZ dd^eOd_eOd"eOd`eOd7eMdeMdaeOdbeMdceOd'eOdeOfddZddelmZmZdfZdgdhdidjdkdldmdndCdCdodmdpedqdrdsd"gdtduZdvdwdidjdxdldjdydldzd"dgdtduZdd{didjd|dldjd}dldjd~dlddd? sS%L ) 5cAgE3s89"99 sA AAcontent max_charsc`t||kr||r|jddzdfSddfS|jd}g}d}|D]4}t||rdndz}||z|kDrn|j|||z }6|s|j|dd|dj |t|dfS)aTrim line-numbered ``read_file`` content to the last COMPLETE line within *max_chars*. Returns ``(kept_text, lines_kept, truncated)`` so the caller can offer a ``next_offset`` instead of rejecting the read. If not even the first line fits it is clamped mid-line so the read is never empty and the cursor advances. Ported in spirit from nearai/ironclaw#5029 (dual line/byte cap on ``read_file``). Where hermes previously hard-rejected an oversized read (forcing the model to guess a smaller ``limit`` and burn a round-trip returning nothing), this trims the content to the last *complete line* that fits within ``max_chars`` and reports how many lines were kept so the caller can offer a ``next_offset`` continuation.  rFNT)lencountsplitappendjoin)r@rAlineskeptrunninglineadditions r>_truncate_to_char_budgetrO@s 7|y Gt,q0UJJUJJ MM$ EDGt9Tq1 X  )  D8   E!HZi() 99T?CIt ++ result_dictoffsetc t||\}}}||z}||d<d|d<d|d<||d<d|dd |d |d |d z d |d|d |d<t|jdd d|k\rd|d<|dxxdz cc<|S)zvTrim *content* to the char budget, annotate *result_dict* with the continuation hint, and return the trimmed text.r@T truncatedbytes truncated_by next_offsetzOutput truncated at the ,z-char read budget after z line(s) (showing lines -rD of z). Use offset=z to continue.hintrCrtruncated_lineszv Note: the first line alone exceeded the budget and was clamped mid-line; its remainder is not retrievable via offset.)rOrErG) rQr@rR total_linesrAtrimmed lines_kept_rWs r>_apply_char_budgetra^s6gyIGZ:%K$K #K ")K!,K  "9Q-/G ,.vha a7H -~k]- A 7==q !! $%2)- %&F M N NrPi> /dev/tty /dev/fd/0 /dev/fd/1 /dev/fd/2 /dev/full /dev/zero /dev/stdin /dev/random /dev/stderr /dev/stdout /dev/console /dev/urandom) z/fd/0z/fd/1z/fd/2z/environz/cmdlinez/mapsz/smapsz /smaps_rollupz /numa_mapsz/memz/auxvz/pagemapcft|dd}|y ddlm}t ||S#t$rYywxYw)zTrue when *file_ops* targets the host filesystem (only then may we stat paths or rewrite V4A headers to host-absolute paths; sandboxes have their own namespace).envNTr)LocalEnvironment)getattrtools.environments.localrp ImportErrorr8)file_opsrorps r>_file_ops_uses_host_pathsrusF (E4 (C {= c+ ,, s $ 00z/^(\*\*\*\s*(Update|Add|Delete)\s+File:\s*)(.+)$z-^(\*\*\*\s*Move\s+File:\s*)(.+?)\s*->\s*(.+)$patchpath_to_resolvedct|s|Sdtdtffd tjfd|}tjfd|S)uRewrite V4A file headers to the resolved host paths (host backends only). The shell layer must patch the SAME files ``patch_tool`` resolved for locking/staleness, not re-resolve a relative header against its own cwd (which can differ — the git-worktree cwd bug). rawr1cN|j}j|xs|SN)stripr6)ryrws r>_resz/_rewrite_v4a_patch_paths_for_host.._ress$iik##C(/C/rPcX|jd|jdS)NrDgroupmr}s r>z3_rewrite_v4a_patch_paths_for_host..s&1771:,tAGGAJ?O>P0QrPc|jd|jdd|jdS)NrDz -> rrrs r>rz3_rewrite_v4a_patch_paths_for_host..s@ |D!_rewrite_v4a_patch_paths_for_hostrsP %X . 0#0#0 " % %&QSX YE  " "#dfk llrPpathctjjt|}|tvry|j dxr|j tS)zXReturn True for concrete device/fd/proc paths that can hang reads or leak process state.Tz/proc/)osrnormpathr_BLOCKED_DEVICE_PATHS startswithendswith_BLOCKED_PROC_SUFFIXES)r normalizeds r>_is_blocked_device_pathrsI!!-"56J**   * Zz/B/BCY/ZZrPfilepathbase_dirct|}|Rtjj|s3tjj tj ||}tjj |}t|ryt}|}tdD]} tj|}tjj|s=tjj tjj||}tjj |}t|ry||vrn|j||} tjj tjj|}t|S#t$rYTwxYw#ttf$rYywxYw)zTrue if the path (literal, any symlink hop, or final realpath) is a blocked device. Literal first so /dev/stdin is caught before resolving to a terminal path; every symlink hop is checked so an alias cannot bypass the guard. TF)rrrisabsrIfspathrrsetrangereadlinkOSErrordirnameaddrealpath ValueError) rrexpandedrseencurrentr`targetresolveds r>_is_blocked_devicers_ X&HBGGMM($;77<< ( 3X>!!(+Jz*UDG 2Y  [[)Fww}}V$WW\\"''//'":FCF!!&) "6 * T>   77##BGG$4$4Z$@A #8 ,,!    Z s$&F&_resolved_match_pathrs5)$899 Z . s 00defaultcddtdtffd }t|ddr2|jDcgc]}||js|c}|_t|ddr(|j Dcgc] }||s |c}|_t|ddr<|j jDcic]\}}||s||c}}|_Scc}wcc}wcc}}w) zRemove credential/cache/env paths from a SearchResult in-place; return the omitted count. Each path is resolved against the task cwd first (search backends may return cwd-relative paths; the process cwd can differ). rrr1c<tt|rdz yy)NrDFT)rr)romittedrs r>_allowedz5_filter_read_blocked_search_results.._alloweds"  4T7 C D qLGrPmatchesNfilescounts)rboolrqrrrritems)resultrrrfcrs ` @r>#_filter_read_blocked_search_resultsrs Gstvy$'%+^^Hx7G!Hvw%#)<<?a8A;? vx&*0--*=*=*?O$!Q8A;AO N I?Os#C C2 CC6C!C!exccnt|txs$t|txr|jtvS)zFReturn True for expected write denials that should not hit error logs.)r8PermissionErrorrerrno_EXPECTED_WRITE_ERRNOS)rs r>_is_expected_write_exceptionrs1 c? + J3 HSYY2H%HJrP_file_ops_cache raw_task_idcddlm}ddlm}m}m}m}m}m}m } |} | d} | |} ||} | jdxs | xs| d}|| r0||r(|| dk7rtjd|| | d| d}tjd| |dd || | || | | || d ||| || d k(rd | jd dind}| |fS#t$rd} YwxYw)zBuild the terminal environment for *task_id* via the shared ``_create_configured_env``, so a file tool that runs before any terminal command still gets the configured backend.r)_is_container_backend)_create_configured_env_get_env_config_is_unusable_container_cwd_resolve_task_host_cwd _select_imageget_session_cwdresolve_task_overridesenv_typeNcwdzaIgnoring host/relative cwd override %r for %s backend (won't exist in sandbox). Using %r instead.z*Creating new %s environment for task %s...timeoutlocal persistentlocal_persistentF)imagerrrhost_cwd local_config)tools.terminal_tool_configrtools.terminal_toolrrrrrrrr7r6loggerinfo)rrrrrrrrrrconfigr overrides recorded_cwdr terminal_envs r>!_create_terminal_env_for_file_opsrs6AXXX Fj!H&{3I&{3  --  ?, ?&-CX&+Ec+J &-  KK>Xve} .Um KK _get_file_opsr2s2--- &YK(5G . $$W-.   3..*.))+w' 3 3feT2G&{3;*;@  3##GT2 3' 3, J#..w 8HI J  S  6/33G)H  H/F9< G GG  G G GG#&G/2G; 7H >H H  HH cDt5|rtj|dntjdddt5|rt j|dnt jdddt 5|rtj|dntjddd|r$tjj|ytjjy#1swYxYw#1swYxYw#1swYjxYw)z=Clear file-operation state for a finished task, or all tasks.N) rrrclearr+r*r(r)r get_registry forget_task)rs r>clear_file_ops_cacherss $     .  ! ! # $ "    gt ,    ! " +  " & &w 5 " ( ( * + !--g6!'')+$$ "" ++s#.C>.D ?.D>D DDza FIFO (named pipe)za socketza character deviceza block devicec tjtj|jtj stj rytfdtDdS#t$rYywxYw)a4Human name for a non-regular file type that would hang a read, else None. Stat-based sibling of ``_is_blocked_device``: a FIFO/socket in a workspace hangs like ``/dev/zero`` but has no recognizable name. Host filesystems only; unstattable paths return None and flow to the normal read path. Nc3:K|]\}}|s|ywr{).0 predicatelabelmodes r> z%_special_file_kind..sV+9eiPToVsza special (non-regular) file) rstatrst_moderS_ISREGS_ISDIRnext_SPECIAL_FILE_KINDS)rrs @r>_special_file_kindrsmwwryy'// ||DT\\$/ V/BV. 00 s2A99 BBlimitc ddlm}m}m}m}m} m} | t|syt|} | jt||} | js | j|| jxsdtj| jd} | | t|}|j1}t3|}||zdz }dj5||dz |}ddlm}|t;fd|j=dD}|r| j?||nd|| j@||kDdd}|drd|dzd|dtC||d|d |d<tE}t3|d|kDrtG||d||||dr1|d}tI|dtKt||d<|d|k7}nd}|dk(rc|ds^|s\|sZ|jMd sItOt||tQt||tSjT|t|tWjX|d!S#|ttjj f$r}t"j%d|d |j&j)}||vxs ||vxr|d k7}|r@t+||r4t|j-d st/d |d |d|dcYd}~SYd}~yd}~wwxYw)"a$Render an extractable document (.docx/.xlsx/.pdf/...) as paginated text. Returns the JSON result, a tool_error for an actionable extraction failure (size cap, encrypted, malformed), or ``None`` to fall through to the normal read path. Runs BEFORE the binary-extension guard. r)ANYDOC_EXTENSIONSEXTRACTABLE_EXTENSIONSMAX_DOCUMENT_BYTESExtractionErrorextract_document_bytesis_extractable_documentN) max_byteszDocument bytes unavailableT)validatez!document extraction failed for %sexc_infoz.ipynbzUnsupported document type Cannot read '' (u"): document extraction failed — z8. Use terminal utilities to inspect or convert the file.rDrC)get_max_line_lengthc3:K|]}t|kDywr{)rE)rrMmax_line_lengths r>rz+_read_extracted_document..sX$#d)o5Xs)r@r] file_sizerTextracted_documentrTz Use offset=z to continue reading (showing rYrZz lines)r[r@ file_read secret_fileFr\ ensure_ascii)-tools.read_extractr r r r r rrrread_file_byteserrorbase64_contentbase64 b64decoderbinasciiErrorrdebugsuffixlowerr8r tool_error splitlinesrErItools.tool_output_limitsranyrG_add_line_numbersrminr?rarrr6r%r0r record_readjsondumps)r _resolvedrRrrr r r r r rrtbinarydocument_bytesextracted_textr_doc_ext _binary_docrJr]end_line page_textrr\rQrArenderedredactedrs @r>_read_extracted_documentr>s99 #3y> 2W%H))#i.DV)W <<6008!&,,"N2NO O))&*?*?$O/IO  % % 'Ee*K~!H % 845I<)+OX)//RVBWXXODM8--i@SU"%% 8+" $K ;(Q,(xqX{!;  U^_9y)!6 +C N;"= Iy)X5! K 4X#KOO)> ?  8$ N##))+"33I . . G8x3G  JsO<C++,GHvS 3)),.223 3 sA=I$K;,A?K6+K;6K; task_data dedup_keyct5|dj|ddz}||d|<t|ddddk\rtd|dzdf||dzdtd iSt j d t|d d d d S#1swYNxYw)zReturn the "unchanged" stub for a repeated identical read, escalating to a hard BLOCK after 2 stubs so weak tool-followers don't loop forever. dedup_hitsrrDNrz8BLOCKED: You have called read_file on this exact region u times and the file has NOT changed. STOP calling read_file for this path — the content from your earlier read_file result in this conversation is still current. Proceed with your task using the information you already have.r already_readT unchangedF)statusmessagerdedupcontent_returnedr)r+r6r r+rr2r3r)r?r@rhitss r>_dedup_stub_or_blockrKs *&**9a81<-1 , *y)*  qy 1H:&0 0 - -%d+ - - ::-!    +**s ,BB F)r=r:r]version_beforesnapshot resolved_strpartialr=r:c  | | xs t|nd} | duxr| dd| cxk(xrt|k(nc}d}t5|dj|d|dj ||dj |||ft |d|||f} t jj|}||jdi|<|d }|rN| L|d krG| |d |<|j|| k(}|s"| }|r| t||| || | |\}}|xr| }|r| ||<|s|j|d|r|d k\r)|d j|d|dj|t|ddd tj ||| |r ddlm}|t-|SS#t$rYwxYw#1swYPxYw#t"$rt$j'd dY[wxYw#t"$rt$j'ddYSwxYw)uBookkeeping after a real (non-stub) read; returns the consecutive-read count. Per-task tracker under the lock (stub counter, history, consecutive count, mtime for dedup + staleness, page coverage, and the write_file baseline once the task has seen every line UNREDACTED — in one page or by paging contiguously through a file too big for one; a redacted page returned a non-round-trippable ``«redacted:…»`` sentinel, so it must not bless an overwrite that would persist the sentinel into a credential file). Then OUTSIDE our lock (no nested locking): the cross-agent registry, and the background-review read-mark (a FULL read of a skill file counts like skill_view so a follow-up skill_manage(patch) is accepted). NFrBdedup_generation_reads read_historyreadread_timestampsfull_write_baselinesrH)rOzfile_state.record_read failedTrr)!mark_background_review_skill_readz"background-review read-mark failed)r$r#r+rrrrrgetmtimerrr6r'discardr rr1r7rr(tools.skill_manager_guardsrXr)r?rrrNrRrr@rOr=r:r]rLrMversionstablecompleterF _mtime_now baselinesrXs r>_record_successful_readras` Ew (lK N U -d<.@ A L5LQ   **B E 4t DE N LL=L M L NsUAF74F(B$F71G G)( F41F73F44F77G G&%G&) H  H rDc t||\}}t|d}|r t|St|j j rdn t |}t||rtd|dSt||}tt|r,t|}|tjdd|d |d d Stt|}|r t|St!|||||} | | St#t|r*td |d |j$j'dSt|} t)d| |} | | S| ||f} t*5t-|} | dj/| }| | dv}dddt|}t|r t1| nd}t3s||k(rr t5 | |S|j7t|r| n|||}|j9}|j/dxsd}t;|tr4|j=dr#t?d| |tj|d|s|j/drtj|dS|j/dd}tA}tC|jDxsd|kDr2tG||jDxsd||j/dd||_"d}|jDrF|jD}tI|dtK| |_"|jD|k7}|jD|d<|jDr$tM|jD}|r ||d<|d|d <|r6|tNkDr-|d!kDr(|j/d"r|jQd d#|d$d%|j/d}|j/d&d'k(rtS|j/d(|d)z }n)||zd)z }t;|tRr|dkDr tU||}tW ||| ||| |d)kDxstY|j/d"|xstY|j/d*|||t[|d+d, }|d-k\rtd.|d/f||d0t\diS|d1k\r d2|d3|d4<tj|dS#1swY4xYw#t^$r}tt|cYd}~Sd}~wwxYw)5u`Read a file with pagination and line numbers. Guard order: NT/device-namespace prefix (raw string, no resolution) → device-path blocklist (no I/O) → stat-based special-file guard (host only) → Hermes internal denylist → document extraction → binary-extension guard → negative-result cache → dedup stub → real read. ReadverbN)rrzE': this is a device file that would block or produce infinite output.F'z' is u, not a regular file — reading it would block indefinitely, so no read was attempted. Use terminal utilities if you need to interact with it.)successnotezCannot read binary file 'rzF). Use vision_analyze for images, or terminal to inspect binary files.rTrHrRr"rzFile not found:r is_binaryrrr]unknownTrr@conflict_blocksz unresolved git merge-conflict block(s) (<<<<<<< / ======= / >>>>>>>) in this range. Resolve them (keep one side or combine, delete the markers) before editing around them._hintrTzThis file is large (rXzj bytes). Consider reading only the section you need with offset and limit to keep context usage efficient.rVrUrWrDr\ _snapshot)rOr=r:r]rLrMrWz.BLOCKED: You have read this exact file region z| times in a row. The content has NOT changed. You already have this information. STOP re-reading and proceed with your task.rCrz%You have read this exact file region z times consecutively. The content has not changed since your last read. Use the information you already have. If you are stuck in a loop, stop reading and proceed with writing or responding._warning)0r rr+r expanduser is_absoluterrrrurrr2r3rrr>rr)r*r"r+r/r6r#r rK read_fileto_dictr8rr,r?rEr@rarrr_LARGE_FILE_HINT_BYTESrr9r0rarrqrr7)rrRrrnt_err device_baser4kind block_error extractedrNcached_not_foundr@r?cached_versioncontent_served_in_generationrtrLrrQ_errrrAr= unredacted conflictsr]r:rFes r>read_file_toolrVsNN"1&%@  (6: f% %"4j335AACdIZ[bIc d[ 9v&445 5+49  %]7%; <%i0Dzz$D6tf-,,#.//+3y>: k* *,T9feWU    I /+D6Y5E5E5K5K5M4NOVVW W9~ 1&,P  '# #"651  \"7+I&w/33I>N,5 BZ8[+[ (  \!)9RS[9\ 5bf  &/C/E"n49U' 9dC C##4Mh4WL]acikpqnn& w'-2 dC T__5F%G flGTZZ bg=h i ;??;/::k> >  OOK3 ') v~~# $y 0/V^^1r6 y99FFN >>J2d8KL8Y[FN~~3H%+^^K " >>-fnn=I1: -. k"uuG$ )&<<CKKOOK$@  " "7&ym433 5 "oom4 ??> *g 5;??=&ABQFH~)H+s+ ax5' 7D,PVX](1FQJ;m4P[P_P_`kPlKm191eT+//RcBd=e19{7E18d1S U A:@H>>1" 1 )$/ 1 1 A:7w?cc  #zz+E::e \ \f "#a&!!"su(SAS;A S S(S;=S9S S 'R9A SB2SHS$S9S>S S-S("S-(S-cL tt||S#t$rYywxYw)zHTask-resolved path string, or None when resolution fails for any reason.N)rrr7)rrs r>_resolve_or_noners,)(G<== s  ##paths content_paths cross_profilec|D]&}t||xs|rdn t||}|s$|cS|D]}t||}|s|cSt||xs t ||S)aRun the shared write/patch guards in order; return the first error string. Order matters: hard denies (sensitive path, mirror) and the corruption guard run before anything that could prompt the user, and ONE approval prompt covers every path of a multi-file patch. N)rrrrr)rrrrperrs r>_write_precheck_errorrs#Aw/N!D'@G'L J  *1g6 J /ug > >-eW=?rPcg}|D]i}|j|}|rtj||ndxs t||}|s|rt |t ||}|sY|j |k|S)uOne pre-edit warning per path, in priority order: cross-agent registry (names the sibling subagent) > per-task staleness > workspace divergence (relative path resolving outside the terminal's cwd — the worktree-cwd bug).N)r6r check_staler!rrrH)rrwrwarningsrrws r>_edit_warningsrszH    #34Z # #GQ /$ dCXYZ\cCdQ(DGW=A OOA   OrP session_idc t||Dcgc]}|j|xs|c}||D]9}t|||j|s!tj|||;ycc}w)zPost-success bookkeeping: verification-stale marker, then per path refresh the read stamp (no false staleness on the next edit) and record the write.)rN)r&r6r0r note_write)rrrwrrs r> _note_editedrsuWU&S'7';';A'>'C!'C&S`jk @q'*    "  ! !'+;A+> ?@'TsA/ i Ng?ir new_contentc |rtt|cxkr tksyy t|j |}t |dd}t |ddst |tsy tt|cxkr tksyy|j|j}}|syddl m }t||||zj}|tt|t|z } | tkrytt|t||z } |ddt|dd| d d | dd t|dd S#t$rYywxYw) aReturn a hint when ``new_content`` mostly re-sends what is already at ``resolved``. Reads the OLD content through the task's own file ops (``read_file_raw``, the sandbox/remote backend the write targets), never the host path: on a remote backend the host file is a different file, and a host FIFO at that path would block the write lock forever. Bounded size and a line multiset comparison (linear) instead of a sequence diff (quadratic on repeated lines).Nr@r"r)CounterrXrZz lines were already on disk (z.0%z unchanged); ~z( line(s) actually changed. Re-sending a z-char file costs output tokens for every unchanged line; for edits like this use patch (old_string/new_string), which sends only the changed region.)_REWRITE_HINT_MIN_CHARSrE_REWRITE_HINT_MAX_CHARSr read_file_rawrqr8rr7r, collectionsrsumvaluesmax_REWRITE_HINT_MIN_UNCHANGED) rrrrold old_lines new_linesrrEratiochangeds r>_whole_file_rewrite_hintr3sq 3s;7GbKbbcw'55h?fi. 67D )C1E2F $s3x J3J J K>>+[-C-C-EyI #WY'')*<<DDFGI C NC N; ;E **#i.#i.1I=G Q-tC N1--J5QT+Ucdklmcno225k2B11EFv v sAE EEc t||xs<t||xs.t|g|xst|g|xs|rdn t ||}|s t |rd}|r t |S t||}||i}t5}|r$|jtj|t|||} | r+tjt|| |dcdddSt!|g||} t#|||} t%|j'|xs||} | j)} | r| d| d<| r| j+ds| | d<|r|| d <| j+dr t-||n/|r|g| d <t/||t1| d dt3||g||dddtj dS#1swY xYw#t4$r}t7|r+t8j;d t=|j>|n,t8jAd t=|j>|dt tC|cYd}~Sd}~wwxYw)uWrite content to a file. ``cross_profile`` bypasses the sandbox-mirror lost-write guards only (unadvertised in the schema; the mirror rejection error teaches it — the cross-PROFILE guard it was named for no longer exists). NzRefusing to write internal read_file display text as file content. Strip read_file line-number prefixes or reconstruct the intended file contents before writing.Frrror"r[ resolved_pathfiles_modified_content_sha256z"write_file expected denial: %s: %szwrite_file error: %s: %sTr)"rrrrrrr+rr enter_contextr lock_pathrr2r3rrrr write_filersr6r0r%rqrr7rrr(type__name__r"r)rr@rrrrr4rw_lockblockerr rewrite_hintrrQrs r>write_file_toolrUsb !w / T*49 T0$A T-dVW= T%t*CD'*R  1':/ #+"%T73  ), [ LE##J$8$8$CD/tYHGzz"6tWi"P_de L L&tf.>HH3GYPL"7+66y7HD'RF ..*K*21+ J'KOOG$<&2 F#09 O,w'&tW55>KK 01.i'&RceiBjkWtf.> K? L@zz+E::A L LB " ' * LL=tAw?O?OQR S LL3T!W5E5EqSWL X#a&!! "sE(GAG G#CG#GG G IA5I IIc ddlm}tj|Dcgc]&}|j d|j ddvf(}}|t j|Dcgc]-}|j d|j dfD]}|df/c}}z }g}g}|D]S\}}|j } || rtd| dcS|j| |sC|j| U||fScc}wcc}}w) a{Extract every path named in V4A headers, rejecting ``..`` traversal. Returns ``(all_paths, content_write_paths)`` or a tool_error string. Header paths come from patch CONTENT (more attacker-influenceable than ``path=``, which keeps its legitimate ``..`` use). Move headers check BOTH endpoints; only Update/Add write text and feed the binary-document guard. r)has_traversal_componentrr)UpdateAddFz*V4A patch header contains '..' traversal: z. Use the agent's cwd-relative path (no '..') or an absolute path in '*** Update File:' / '*** Add File:' / '*** Delete File:' / '*** Move File:' headers.) tools.path_securityrrfinditerrrr|r+rH) rvrrheadersgrrry writes_textv4a_paths r>_collect_v4a_header_pathsrs patch_toolrs!%tf"O0 w5-e4 i % 9Q<' ! ,(:NPWYfgL,''>"Zi,iSUR1A"g1N-N,i,i [" `F+<+C+C+ELRbLM ?$$Z%9%9"%=> ?+O=NPWXN$W-Hy %o6" `" `%);%&JK" `" `#4"7"7"="E!//ZYde%&>?#" `" `$"++,MeUfhp,qr!N4&"9:)" `" `,!..*K*/**^*D J'??7+Q`%`"&7&;&;B&?&E2&E%`"%`0B ,-)*a/3Ea3HK0Wo7H*U%g=N=U=U=W/^r[]/^_E" `L ??7 #(8C G@TWWCG$zz+E::q-jL6&a 0_E" `" `p "#a&!!"s#K;'K; K;K/K 'K +AK/ K;K/ K;&;K/! K;+*K/ K;;K/K%6AK/9K* K* K/ BK;K; K//K84K;; L"LL"L".2 discoverypatternr file_glob output_modecontextorderc . t||\}}d||t||xsd|||f} t5tj| ddt d} t | | } ddd dk\rtd| df|| d td iSt|d } | r t| S tt|| }t|}|r t|St!d|| }||St#| j%||||||||| }t'|| }t)|ddxsdD]J}t)|ddst+|j,d t/t1|j2| |_L|j5d }|r|d|d<|j7dxsd}t|tr4|j9dr#t;d|| t=j>|d| dk\r d| d|d<|j7dr d||zd|d <t=j>|dS#1swYxYw#tttf$r)}|}t|tr t|sYd}~d}~wwxYw#t@$r}tt|cYd}~Sd}~wwxYw)!zSearch for content or files.searchrNr)last_key consecutiverSrWz(BLOCKED: You have run this exact search z times in a row. The results have NOT changed. You already have this information. STOP re-searching and proceed with your task.)ralready_searchedTSearchrd) rrrrrrRrrrrrr@r)densifyze result(s) omitted because they target credential, token, cache, or secret-bearing environment files._omittedr"zPath not found:FrrzYou have run this exact search zY times consecutively. The results have not changed. Use the information you already have.rorTzResults truncated. Use offset=zB to see more, or narrow with a more specific pattern or file_glob.rl)!r rr+r*rrrr+rrrrrrr8rr"rrrrqrr@rrrrsr6rr,r2r3r7)rrrrrrRrrrr search_keyr?rFruresolved_search_pathrrxcached_search_nfrrrrQ _search_errrs r> search_toolr s O"3FEB TIOUTZ\ab  =%00 CE;KLI%i_check_file_reqsrgs- " $$rPrru[Read a text file with line numbers and pagination. Use this instead of cat/head/tail in terminal. Output format: 'LINE_NUM|CONTENT'. Suggests similar filenames if not found. Use offset and limit for large files. Reads exceeding ~100K characters are truncated on a line boundary and return a next_offset; continue with offset to read the rest. Documents auto-extract to readable text: .ipynb, Office (.docx/.xlsx/.pptx and legacy .doc/.ppt/.xls), PDF (text layer), OpenDocument, RTF, EPUB, SQLite (.db/.sqlite: schema, row counts, first rows). Cannot read images/binary — use vision_analyze for images.objectstringz8Path to the file to read (absolute, relative, or ~/path))r descriptionintegerz9Line number to start reading from (1-indexed, default: 1))rrrminimumzMaximum number of lines to read (default: 2000, max: 2000). Reads are additionally capped at a ~100K-character budget with a next_offset continuation.i)rrrmaximum)rrRrr propertiesrequired)namer parametersruWrite content to a file, completely replacing existing content. Use this instead of echo/cat heredoc in terminal. Creates parent directories automatically. OVERWRITES the entire file — use 'patch' for targeted edits. For an EXISTING file, call read_file first: write_file refuses (file untouched) when this task has no current full read/write of the file or the file changed on disk since; on refusal, read_file, merge, then retry. Auto-runs syntax checks on .py/.json/.yaml/.toml and other linted languages; only NEW errors introduced by this write are surfaced (pre-existing errors are filtered out). The result's verified:true means the on-disk content hash was confirmed — do NOT re-read the file to check the write landed.zWPath to the file to write (will be created if it doesn't exist, overwritten if it does)z%Complete content to write to the file)rr@aTargeted find-and-replace edits in files. Use this instead of sed/awk in terminal. Uses fuzzy matching (9 strategies) so minor whitespace/indentation differences won't break it. Returns a unified diff. Auto-runs syntax checks after editing. Finds a unique string and replaces it.zFile path to edit.zExact text to find and replace. Must be unique in the file unless replace_all=true. Include surrounding context lines to ensure uniqueness.zjChanged replacement text; it must differ from old_string. Pass empty string '' to delete the matched text.booleanzLReplace all occurrences instead of requiring a unique match (default: false))rrr)rrrr)rrraTargeted find-and-replace edits in files. Use this instead of sed/awk in terminal. Uses fuzzy matching (9 strategies) so minor whitespace/indentation differences won't break it. Returns a unified diff. Auto-runs syntax checks after editing. REPLACE MODE (mode='replace', default): find a unique string and replace it. REQUIRED PARAMETERS: mode, path, old_string, new_string. PATCH MODE (mode='patch'): apply V4A multi-file patches for bulk changes. REQUIRED PARAMETERS: mode, patch.znEdit mode. 'replace' (default): requires path + old_string + new_string. 'patch': requires patch content only.)renumrrzREQUIRED when mode='patch'. V4A format patch content. Format: *** Begin Patch *** Update File: path/to/file @@ context hint @@ context line -removed line +added line *** End Patch)rrvc. ddlm}m}|xsdjj }|xsdjj }|dvry|j ddd }|jd ryd |vS#t $rYywxYw) uWhether the active main provider/model is the OpenAI/codex family — the population trained on the V4A apply_patch dialect. Provider-family-coarse on purpose (no per-model training-diet table to go stale): direct OpenAI providers always qualify; on aggregators (openrouter/nous/azure...) the MODEL slug decides (gpt-*/o-series/ codex). Fail-closed to the universal replace-only schema. r)_read_main_model_read_main_providerrF> openai-chat azure-openai openai-codexcodexopenaiT/rDrQ)zgpt-zgpt.chatgptro1o3o4o5zopenai/)agent.auxiliary_clientrrr|r*r7rGr)rrprovidermodelslugs r>_is_openai_family_mainrsP')/R668>>@!#)r00288:UU ;;sA r "D ST   sAB BB search_filesaSearch file contents or find files by name. Use this instead of grep/rg/find/ls in terminal. Ripgrep-backed, faster than shell equivalents. On macOS, broad searches above the user home automatically skip TCC-protected folders (Desktop, Documents, Downloads, Library, Movies, Music, Pictures); target one directly when access is intentional. Content search (target='content'): Regex search inside files. Output modes: full matches with line numbers, file paths only, or match counts. File search (target='files'): Find files by glob pattern (e.g., '*.py', '*config*'). Also use this instead of ls. Discovery order is the fast bounded default; exact global newest-first order is an explicit opt-in and may scan the full tree.zPRegex pattern for content search, or glob pattern (e.g., '*.py') for file searchrzK'content' searches inside file contents, 'files' searches for files by namezCDirectory or file to search in (default: current working directory)zOFilter files by pattern in grep mode (e.g., '*.py' to only search Python files)z1Maximum number of results to return (default: 50)z0Skip first N results for pagination (default: 0)modifiedzFile-search order: 'discovery' is fast bounded traversal order; 'modified' is exact global newest-first and may scan the full tree; ignored for content)r@ files_onlyrFzOutput format for grep mode: 'content' shows matching lines with line numbers, 'files_only' lists file paths, 'count' shows match counts per filezDNumber of context lines before and after each match (grep mode only)) rrrrrrRrrrc |jdxsd}t|jdd|jdd|jdt|S) NrrrrrRrDr)rrRrr)r6rr argskwtids r>_handle_read_filer sW &&  (yC txx3DHHXq_handle_write_filers &&  (yC 88F :dhhv.>#D -      d9os +:DO$--.a 1    &\4 ?C488OU;<66,' rPc \|jdxsd}t|jdd|jd|jd|jd|jdd |jd |t|jd d |jd  S)NrrrrrrrrFrvrr) rrrrrrvrrr)r6rrrs r> _handle_patchr*s &&  (yC  XXfi (txx/?88L)dhh|6LHH]E2$((7:KUX488OU;<66,'  rPc |jdxsd}ddd}|jdd}|j||}|jdd}| t|tr|jsd}t |jd d |||jd |jd d |jdd|jdd|jdd|jdd| S)Nrrr@r)grepfindrrrrrrrrrRrrrrr) rrrrrrRrrrr)r6r8rr|r)rrr target_map raw_targetrrs r>_handle_search_filesr!5s &&  (yC#W5J(I.J ^^J 3F 88FC D | 4-djjl B'T((;'txx/DTXXV^`aMbHH]I6TU@Vhhw ,c  ;;rPcz ddlm}|rdtdjddiS iS#t$rYiSwxYw)u-One-word capability upgrade: "PDF (text layer)" → "PDF (scanned or text)" when hosted OCR has a trusted route (see read_extract.hosted_ocr_available). Config/env probe only — no network at schema-build time. Compaction's tool refresh (#97073) picks up a key added mid-session. rhosted_ocr_availablerzPDF (text layer)zPDF (scanned or text))r r$READ_FILE_SCHEMArr7r#s r>_read_file_schema_overridesr&Fs[  ;  !/ >FF&(?   " I   I s '- ::fileu📖)rtoolsetschemahandlercheck_fnemojimax_result_size_charsdynamic_schema_overridesu✍️)rr(r)r*r+r,r-c tsiSddtditdddtdidgd}t|dS#t$ricYSwxYw)uLayer the V4A patch mode onto the base replace-only schema for OpenAI-family mains (see PATCH_SCHEMA comment). Config/context probe only — no I/O at schema-build time; compaction's tool refresh (#97073) re-evaluates on model switches.rrrrrvr)rr)r_PATCH_V4A_PARAMS PATCH_SCHEMA_PATCH_V4A_DESCRIPTIONr7)paramss r>_patch_schema_overridesr4]sx %'I)&1|,\:*73    6VLL  s >/> A  A u🔧u🔎) PurePosixPath)tools.binary_extensionshas_opaque_document_extension)r6 is_pdf_path)tools.file_tools_read_trackingnotify_other_tool_call)r9reset_file_dedup)r7r8r:r;ctj|}|tdtd|ddl}ddlm}|t|g|t|j|d|dS)Nzmodule z has no attribute r) warn_oncerD) _PLUGIN_COMPAT_LAZYr6AttributeErrorr importlibhermes_cli.plugin_compatr=rq import_module)rrr@r=s r> __getattr__rCse $ $T *F ~wxl2DTHMNN2 h&v& 9**6!95vay AArPr{)r)rFN) rNNNFNrFN) r@rNrrr@rrr)__doc__r$rr2loggingrrerrr contextlibrpathlibragent.file_safetyrr agent.tool_result_classificationrtools.binary_extensionsrtools.skill_provenancer tools.file_operationsr r r tools.file_operations_commonr rrr agent.redactrrtools.file_tools_pathsrrrrtools.file_tools_write_guardsrrrrrrrrrtools.file_tools_read_trackingrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0 getLoggerrrEACCESEPERMEROFSrr;r9r?rtuplerrOdictrart frozensetrrrucompile MULTILINErrrrrrrr7rrrr__annotations__rrrS_ISFIFOS_ISSOCKS_ISCHRS_ISBLKrrr>rKrarrrrrrrrrrrrrrtools.registryrr+rr%WRITE_FILE_SCHEMAr1r2r0rSEARCH_FILES_SCHEMArrrr!r&registerr4r5 posixpathsysr>rCrrPr>rgs    JB87QQRCXXTTTVVVVV   8 $ ,, U[[A" :S :,c,c,eCdN>S,<D3]`eh,!"#! -4 - # #UWYWcWcd bjj!QSUS_S_`mSmDmWZm$[#[$["-"-d T0A"-T"-J s S S S0JiJDJ !'"3'"'"T>3>/B>B*#*6 ]])* ]]J \\'( \\#$ &0d 0"G73G73G7sG7UXG7]`cg]gG7TDU##F.34(,TDCtCcCCTWC$'C03C@ECSWC&*C>ADjCVYCL-.(( U"U"cU"SU"U".1U"@CU" U"7:U"U" U".1 U"v0% q %6pq(9tBCPQR'9Q^p}AB H. q %7PQ (9`a Y' &  1 !3 ! m ! L "m  .93!+ b(G$H  U 4 o  (:LM')W1EWdqz{%6{ILM"*Q[o{KSYqxy" &b=ZN BrP