߲jUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZddlmZddlmZddlmZdd lmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,ejZd k(Z.ej^e0Z1d Z2e jfZ4da5ejldZ7dqdZ8e2fde9de:fdZ;drdZde=de=fdZ?de=de=fdZ@de=de=fdZAde=de=fdZBde=deCfdZDde=de=fdZEdeFddfdZGdeFddfd ZHeId!d"ee=e=fd#eFd$eCd%eIddf d&ZJdeFdeFfd'ZKd%eIdeFfd(ZLdsd)eFdzd*eFdzdeFfd+ZMdd,d-eCdeFe=e=ffd.ZNdeFd-eCdeFfd/ZO dsd0d0ddd1d2d3d4eCd5eCd6d3d7eCdeFe=e=ff d8ZP dsddd9d2d3d:d;d-eCdeFe=e=ffd<ZQd:d=deCfd>ZRdsdeFd:d;deFfd?ZSd@dAdeTe=fdBZUde=fdCZVdaWdDeXdE<deTe=fdFZYdeTe=fdGZZdHe=dIeTe=de=fdJZ[dHe=de=fdKZ\eIhdLZ]de=fdMZ^dNZ_e`ZaeaabdOeXdP<de=dzfdQZcdHe=de=fdRZddeTe=fdSZedeTe=fdTZfdHe=de=fdUZgdeFddfdVZhdWeFde=dzfdXZideFdeFfdYZjeekjjdZZneeXd[<e+eneekjjdZeZpeqed\feXd]<ere d^e je jk7xs ete d_ZueCeXd`<dZveTedzeXda<deqeTe=eCffdbZwdeTe=fdcZxdde=deeTe=de=fdfZydge:dhe9deCfdiZzdjeTdge:ddfdkZ{drdlZ|drdmZ}drdnZ~GdodpeZy)tuELocal execution environment — spawn-per-call with session snapshot.N)Mapping)Pathget_process_hermes_home)BaseEnvironment) _pipe_stdin)windows_hide_flags) _ALWAYS_STRIP_KEYS_HERMES_PROVIDER_ENV_BLOCKLIST!_HERMES_PROVIDER_ENV_FORCE_PREFIX_is_hermes_internal_secret_is_provider_env_blocklisted_is_terminal_first_party_env$_matches_terminal_first_party_prefix_plugin_terminal_env_strip_keysstrip_profile_gate_env)_bash_probe_details_cache _bash_starts_git_bash_aslr_help_looks_like_msys_spawn_failure_mandatory_aslr_enabled)_build_hermes_repo_root_aliases2_strip_hermes_owned_pythonpath_and_runtime_markersWindowsFz,^(hermes_bg_[A-Za-z0-9_-]+)\.(log|pid|exit)$returncH ddlm}|dz dz S#t$rYywxYw)z;Return HERMES_HOME/cache/terminal, or None if unresolvable.rget_hermes_homecacheterminalN)hermes_constantsr Exceptionrs =/home/ubuntu/.hermes/hermes-agent/tools/environments/local.py_default_terminal_temp_dirr%4s/4 7*Z77 s  !! max_age_hoursc8ddlm}t}|ytj|dzz } t |j }i}i}|D]} |jjx||<}tj|jx} sEt|j| jdd||| jd<d} |jD]\}}tj|j} | r|| jd|k\r ?|||rI |j!rt#j$|dn|j'| dz } | S#t $rYywxYw#t $rY;wxYw#t $rYwxYw)u?Delete session temp artifacts idle for *max_age_hours* (no write anywhere in a directory's subtree; the kwarg name is the ``cleanup_*_cache`` signature the gateway housekeeping loop calls every entry with); return count. Only the managed default dir is pruned — never a user-pointed ``terminal.temp_dir``.r)subtree_touched_sinceigT) ignore_errors)hermes_constants_scratchr(r%timelistiterdirOSErrorstatst_mtime _BG_GROUP_REmatchnamemaxgetgroupitemsis_dirshutilrmtreeunlink) r&r(rootcutoffentriesmtimes group_newestfmtmremoveds r$cleanup_terminal_temp_cacherF=s ? % 'D | YY[MD0 1Ft||~&!#F%'L R VVX.. .F1I""166* *1 *'*<+;+;AGGAJ+Lb'QL $ RG 2   qvv & AGGAJ'61 "1f -  45HHJFMM!4 0AHHJ qLG  N5        s5E.E=. native ``C:\Users\x`` so ``isdir``/``Popen(cwd=)`` find it. No-op off Windows, for empty input and for multi-segment POSIX paths like ``/home/x``; idempotent on native paths.z)^/(?:(?:cygdrive|mnt)/)?([a-zA-Z])(/.*)?$/\r):\) _IS_WINDOWSrer3r7replaceupperchrrNrDtails r$_msys_to_windows_pathr]uss [[)UWZ [A  GGAJ " % %c4 0Dggaj !4?3r7"3 44cT|rtjj|ntj}tr"t |}t j|r|Stjj|r|Stjj|}tj}tjj|sWt|jt|j}}|r+t|t|kr|t| d|k(r|S|S)zResolve the initial cwd to an absolute host path. A relative ``TERMINAL_CWD`` naming the launch directory would otherwise make the wrapper ``cd`` *inside* the project; anchor it once so ``Popen(cwd=)`` and the in-shell ``cd`` agree.N) ospath expandusergetcwdrVr]ntpathisabsabspathisdirrpartslen)rNexpanded candidatecurrentwantedhaves r$_resolve_local_initial_cwdros+.rww!!#&299;H(2 << !O ww}}X)IiikG 77== #H~++T']-@-@ c&kSY.4V 3F&3PN r^ctxr|xrtjd|}|s|S|jdxsdj ddj d}d|jdj d|S)z|Native ``C:\Users\x`` -> Git Bash ``/c/Users/x`` so ``builtin cd`` resolves it. No-op off Windows / for non-drive paths.z^([a-zA-Z]):[\\/]*(.*)$rPrQrSrRr))rVrWr3r7rXlstriplowerr[s r$_windows_to_msys_pathrssv II)CS IA  GGAJ " % %dC 0 7 7 IT  & . .tS 9[W[[r^c>ddl}|jt|S)zFQuote *path* for safe interpolation into a Git Bash script on Windows.rN)shlexquoterv)rarxs r$_quote_bash_pathrzs ;;t, --r^ctjj|xr$tj|tjS)zTrue when *path* is a directory this process can actually chdir into (``isdir`` alone passes ``/root`` for a non-root user; ``Popen(cwd=)`` then dies).)r`rargaccessX_OKrus r$ _cwd_usabler~s+ 77==  ;299T277#;;r^c t|}|r t|r|S|rKtjj |r,t j d|ttdd|rtjj|nd}|rSt|sHtjj|}||k(rtjS|}|r t|sH|xstjS)u=``cwd`` if enterable, else the nearest usable ancestor, else ``tempfile.gettempdir()``. MSYS paths are normalized first on Windows so a valid ``pwd -P`` result is not rejected. Lets ``_run_bash`` recover from a deleted or inaccessible cwd instead of ``Popen`` raising and wedging every later call. Used by ``_run_bash`` to recover when the configured cwd is gone — most commonly because a previous tool call deleted its own working directory (issue #17558) — or inaccessible to this user, e.g. ``/root`` leaking from a root-launched CLI session into a non-root gateway's cron jobs (issue #65583). Without this guard, ``subprocess.Popen(..., cwd=...)`` raises ``FileNotFoundError``/``PermissionError`` before bash starts, wedging every subsequent terminal call until the gateway restarts. uConfigured terminal cwd %r exists but is not accessible to this user (uid=%s) — falling back to the nearest usable directory. If this is a gateway/cron process, check for root-owned paths leaking into terminal.cwd / TERMINAL_CWD (#65583).getuidcy)N?rr^r$z#_resolve_safe_cwd..r^rQ) r]r~r`rargrJwarninggetattrdirnametempfile gettempdir)rNparent next_parents r$_resolve_safe_cwdrs  $C {3  rww}}S!  3X{35  7&)RWW__S !bF V,ggoof- & &&( ( V,  *X((**r^envc`ddlm}m} |x}r||d<||y#t$rYwxYw)zQBridge the context-local HERMES_HOME override, then the subprocess HOME contract.r)apply_subprocess_home_envget_hermes_home_override HERMES_HOMEN)r"rrr#)rrrvalues r$_apply_profile_homers@T ,. .5 .!&C c"    s ! --c ddlm}m}m}|}|j D]A\}}|j }||ur|dn t|||<-|s0|j|dCy#t$rYywxYw)uBridge gateway session ContextVars (HERMES_SESSION_*) into a child env. Cross-session leak guard: the vars' last-writer-wins ``os.environ`` mirror may belong to another turn on a concurrent multi-session host, so once the session context is engaged ContextVars are authoritative — a bound value (incl. "") wins and an _UNSET var is STRIPPED, not inherited. An unengaged CLI keeps the mirror.r)_UNSET_VAR_MAPsession_context_engagedNrQ) gateway.session_contextrrrr#r8r6strpop)rrrr_engagedvar_namevarrs r$_inject_session_context_envrs| UU'(H!)$ #   "'-BSZCM  GGHd # $ s A(( A43A4) plugin_stripr8out unwrap_forcerc ddlm}m}t d|D}|j D]\}}|j tr&|s|ttd}t|s|||<At|s|j|vr_t|} ||} t|r| s| s| r | s |||}||||<y#t$r dd}}YwxYw)aCopy *items* into *out*, dropping Hermes-managed secrets. ``_HERMES_FORCE_`` unwraps to ``NAME`` when ``unwrap_force`` (caller extras / terminal env), else is dropped. Blocklisted names survive only via env_passthrough registration or as context-entitled first-party ``BUZZ_*`` vars; the latter are used directly, never scope-resolved (UnscopedSecretError under multiplex).r)is_env_passthroughresolve_passthrough_valuecy)NFr)_s r$rz$_filter_secret_env..rr^c|SNr)_nfbs r$rz$_filter_secret_env..s[]r^c3<K|]}|jywrrY.0ks r$ z%_filter_secret_env..s#D!AGGI#DN) tools.env_passthroughrrr# frozensetr8 startswithr rir rYrr) r8rrrrrplugin_strip_foldedkeyr first_party passthroughs r$_filter_secret_envrs_W$#D|#DDkkm U >>; <c;<=>C-c2 C  %c *ciik=P.P 237 (- ' ,k[  {-c59E  CH# _9HL]5_sCCCcvt|t|t|t|ddlm}||S)zGuards shared by every spawn surface: profile-home propagation, session-context bridging, Hermes-owned PYTHONPATH + venv-marker strip, MSYS defaults, delegate_task Kanban scrub. Returns the (possibly new) dict.rdelegated_child_subprocess_env)rrr%_apply_windows_msys_bash_env_defaultsagent.delegation_contextr)rrs r$_finalize_child_envrs2$6s;)#.G )# ..r^ci}|D]\}}t|||ddlm}|jfd||j Dt |}|$t ||j|d||<t|S)zFilter each ``(items, unwrap_force)`` in *parts* into one env, rewrite PATH via *fix_path* (always prepending the hermes install dir so bare ``hermes`` resolves for children of a systemd/cron-launched gateway), then apply the shared guards.)rrr)scoped_passthrough_additionsc36K|]\}}|vs ||fywrr)rrvrs r$rz _scrubbed_env..,s!e$!QqXdOd1ves  rQ) rrrupdater8 _path_env_key_prepend_hermes_bin_dirr6r)rhrfix_pathrr8rrpath_keys ` r$ _scrubbed_envr sC$]|5#L|\] CJJe">s"C"I"I"KeeS!H/29N0OPH s ##r^base_env extra_envcJt|xsidf|xsidfgtdS)zFilter Hermes-managed secrets from a subprocess environment (background/PTY spawn path, search workers, computer-use driver, user-script runners).FTc|Srrps r$rz*_sanitize_subprocess_env..:sar^)rr)rrs r$_sanitize_subprocess_envr6s4 8>r51IOT3JK8:K IIr^inherit_credentialsrcttjj|}|j ddt |S)uSanitized env for the **non-terminal** spawn surface (browser, ACP/CLI executors, computer-use driver, TUI Node host). Tier 1 (``_ALWAYS_STRIP_KEYS``, plugin keys, force-prefixed hints, dynamic internal secrets) is always removed; Tier 2 (the provider/tool blocklist) unless ``inherit_credentials`` — pass that **only** for children that legitimately need LLM credentials (user-blessed claude/codex/gemini CLI, TUI Node host). Terminal/execute_code use ``_sanitize_subprocess_env``.r PYTHONUTF81)_scrub_credentialsr`environcopy setdefaultr)rrs r$hermes_subprocess_envr=s5 RZZ__.DW XCNN<% s ##r^ctdttzD}t|D]E}|j |vs.|s t |s!|j ts t|sC||=G|S)z`Tier 1 (always) and, unless ``inherit_credentials``, Tier 2 provider/tool credentials, in place.c3<K|]}|jywrrrs r$rz%_scrub_credentials..Msi1QWWYir) rr rr-rYrrr r )rr strip_foldedrs r$rrIsmi1CFeFg1giiLCy IIK< '+0LS0Q>>"CD-c2C  Jr^T)inherit_profile_home scrub_secretsextrastrip_launch_profilebasezMapping[str, str] | Nonerrrrc | t|ntjj}|r t ||rt ||rt|SdS|r t ||r|j|ddlm }||S)aSingle factory for child-process envs. ``base=None`` snapshots ``os.environ``. ``scrub_secrets=True`` -> :func:`_sanitize_subprocess_env` (profile home inherent, ``inherit_profile_home`` ignored). ``scrub_secrets=False`` keeps the base byte-for-byte (git credential flows, ``bws``/``op``); ``inherit_profile_home`` bridges HERMES_HOME + HOME and ``extra`` is applied last so caller overrides win. ``strip_launch_profile`` drops the LAUNCH profile's ``.env`` residue from the base first (:func:`strip_launch_profile_env`; a no-op unless a routed home is active) so a child that acts for a routed profile sees only that profile's declared names, never the launch profile's.Nrr) dictr`rrstrip_launch_profile_envrrrrr)rrrrrrrs r$build_subprocess_envrWsp)-(8$t*bjjoo>OC %'ET%[LLtLLC   5G )# ..r^) target_homerrzstr | Path | Nonecddlm}m}m}m}ddlm}m}| t|n t|} t|xs |xsd} | r1| | d<|| t| rt| | t| d|rW| r|t| } n|} | |r |dd| jd | xsij!D| S) uChild env for a process that acts FOR the active (possibly served) profile: ``hermes -p X`` workers, ``key_cmd`` helpers, browser drivers. The process env is the LAUNCH profile's. When the target is a ROUTED home (not the launch profile's — under multiplex or a Desktop/dashboard backend serving ``?profile=`` with the flag off) the launch ``.env`` residue and bridged ``TERMINAL_*`` are dropped (``strip_launch_profile_env``) AND every provider/tool credential is scrubbed from the base regardless of provenance: a key systemd / Compose / the shell injected into the launch process was never recorded in ``.env`` or a source snapshot, so a name-based strip cannot see it and the target overlay cannot remove it. ``inherit_credentials=True`` is for children that legitimately run with the profile's credentials (they run the agent or mint its token): the target profile's own secrets (its ``.env`` + hydrated sources, what a standalone ``hermes -p X`` loads itself) are overlaid — never a sibling profile's. Under multiplex with neither a target nor a bound scope the call raises (``get_secret``'s fail-closed contract): minting with the launch environ would sign in as the wrong profile. ``False`` keeps the provider scrub; the caller re-adds the few keys the child needs via ``get_secret``. ``target_home`` defaults to the active override; ``base`` replaces the ``hermes_subprocess_env`` snapshot.r)UnscopedSecretErrorbuild_profile_secret_scopecurrent_secret_scopeis_multiplex_active)apply_scratch_tmp_envrrrQrFaserved_profile_child_env(inherit_credentials=True) called with no target home and no profile secret scope bound while multiplexing is on; the child would inherit the launch profile's credentials. Bind the profile scope (or pass target_home) at the spawn site.c30K|]\}}| ||fywrr)rrrs r$rz+served_profile_child_env..sOdaAq6Os  )agent.secret_scoperrrrr"rrrrr_is_routed_homerrrrr8) rrrrrrrrrrtargetsecretss r$served_profile_child_envrps&ddP($t*.CXk.lC @ 8 :@b AF #Mc" 6 " $S& 1 s > 0f>G*,G#6#8)tuu Ow}"&;&;&=OO Jr^z str | Pathcddlm} t|j|jk7S#t$rYywxYw)zATrue when ``target_home`` is not the process's own (launch) home.rrT)r"rrresolver/)rrs r$rrsB8K ((*.E.G.O.O.QQQ s.7 AAcddlm}m}ddlm}m}|xs|}|r t |s|S|}ddlm}t||dz t|jzD chc]G} || jr| jjdr| jI} } |D cgc]} | j| vs| c} D]} || =t|Scc} wcc} w)a"Drop the LAUNCH profile's residue from a child env built for another served profile. ``os.environ`` holds the default profile's ``.env`` and its bridged ``TERMINAL_*`` settings; the secret scrub removes credentials but not settings (``HERMES_MODEL``, ``TERMINAL_ENV``, ``HERMES_LANGUAGE``...), so a standalone ``hermes -p X`` worker and a served one saw different envs. The child re-loads X's own ``.env`` and bridges X's config itself. ``target_home`` defaults to the active home override; no-op when there is no target or the target IS the launch profile. The authority test is "does this task serve a routed home", not "is the gateway-wide multiplex flag on": the Desktop/dashboard backend serves ``?profile=B`` by installing a HERMES_HOME override without that flag.r)_is_global_env load_env_file)rr)TERMINAL_CONFIG_ENV_MAPz.env TERMINAL_)rrrr"rrrhermes_cli.configrsetvaluesrYrr) rrrrrrr launch_homerr residue_namesrs r$rrsAR  646F 0 )+K9 M+. /037N7U7U7W3XXSciik*ciik.D.D[.Q SMS=a!'')}"<= H "# &&S>s(A C,:C1C1customz str | Nonec (tjj}|dd}|xr"tjj |ddd|xr#tjj |ddddtjj |ddd dtjj |d d d d|xr"tjj |d d dg}|xsdgd |D}t t jd|D}tjd}|rb||vr^tjj|j}d|vsd|vrtjd||S|j||S)u&Ordered bash.exe candidates on Windows: HERMES_GIT_BASH_PATH, our portable Git under %LOCALAPPDATA%\hermes\git (PortableGit ``bin`` and MinGit ``usr\bin``), known Git-for-Windows dirs, then PATH last — ``shutil.which`` may return WSL's bash, which fails silently on Windows paths. LOCALAPPDATArQhermesgitbinusr ProgramFileszC:\Program FilesGitzProgramFiles(x86)zC:\Program Files (x86)Programsc3bK|]'}|stjj|d)yw)zbash.exeN)r`rajoin)rrs r$rz+_windows_bash_candidates..s!K1277<<:6Ks/%/c3fK|])}|stjj|s&|+ywrr`raisfile)rcs r$rz+_windows_bash_candidates..s!#N!aBGGNN1.s XqbggnnUVFWX$..)z /usr/bin/bashz /bin/bashNSHELLz/bin/shHERMES_GIT_BASH_PATHz8HERMES_GIT_BASH_PATH=%s fails to start; using %s instead c3RK|]}tj|xs ywr)rr6)rrdetails r$rz_find_bash..s/"X5N5R5RST5U+U6+UF"Xs''TrzGit Bash not found. Hermes Agent requires Git for Windows on Windows. Install it from: https://git-scm.com/download/win Or set HERMES_GIT_BASH_PATH to your bash.exe location.)rVr:rnextr`rr6r rrarrJrr rr RuntimeErrorr)rrrk probe_detailsr)s @r$ _find_bashr-s&  V$8X$BXZ^_8::>>'*8.7 9ZZ^^2 3F)&1J   "F"v"''..2HNPVXac    "X&"XX " $ ,0N}0]2:a=-PQ Q!}  A BBr^zlist[str] | None_git_bash_bin_dirs_cachec>ttr tngatS)a4Git Bash's coreutils dirs in ``/etc/profile`` order (mingw first so coreutils beat System32 lookalikes); ``[]`` off Windows. A non-login ``bash -c`` (fallback when ``bash -l`` is broken) never sources ``/etc/profile``, so without these ``cat``/``mktemp``/``mv`` are missing and commands exit 127.)r.rV_compute_git_bash_bin_dirsrr^r$_git_bash_bin_dirsr1s  'CN#=#?TV ##r^c t}tjj tjj |}tjj |j dk(rtjj |n|d}fd|D}ttjd|DS#t$rgcYSwxYw)Nr)z mingw64/binz mingw32/binz usr/local/binzusr/binrc3|K|]3}tjjg|jd5yw)rRN)r`rar split)rsubr=s r$rz-_compute_git_bash_bin_dirs..s+ @CBGGLL / # / @s9<c3`K|]&}tjj|s#|(ywr)r`rarg)rds r$rz-_compute_git_bash_bin_dirs..sBAq1AaBr$) r-r#r`rarbasenamerrr-rr)rrsubsdirsr=s @r$r0r0s|WW__RWW__T2 3F&(gg&6&6v&>&D&D&F%&O277??6 "U[D LD @4 @D  BBB CC  s C CC existing_pathr:c|jtjDcgc]}|s| }}|Dcgc] }||vs| }}|r#tjjg||S|Scc}wcc}w)zPrepend *dirs* missing from *existing_path* (``os.pathsep``); an already-listed dir keeps its position; unchanged input when nothing is missing.)r4r`pathsepr )r;r:er?r7missings r$_prepend_missing_path_entriesr@sp(--bjj9?QQq?G?3Q!7"2q3G34;2::??/W/w/ 0NN@3sA+A+ A0A0c*t|tS)z|Prepend Git Bash's binary dirs if missing (no-op off Windows), so the non-login ``bash -c`` fallback can find coreutils.)r@r1)r;s r$_prepend_git_bash_dirsrB#s )8J8L MMr^>shkshzshrdashmkshc(trdntjjd}|r`tjj |rAtj |tjrt|jtvr|StS)u<User's login shell for background spawning: ``$SHELL`` on POSIX when it is an executable sh-family shell, else ``_find_bash``. macOS's system bash 3.2 under ``-l`` with stdin ``/dev/null`` sources ``~/.bash_profile``, which often ``exec /bin/zsh -l`` and drops ``-c`` — the command silently never runs.rQr%) rVr`rr6rarr|r}rr4_SPAWN_COMPATIBLE_SHELLSr-) user_shells r$ _find_shellrK0s_ # w(?Jrww~~j1bii BGG6TZ %%)AA <r^za/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binzstr | None | object_HERMES_BIN_DIRctturtStjd}tj rtj dnd}t jj|j}tjr-t jjtjnd}trdnd}|r t jj|}nt jj|rU|dk(s|jdr?t jj|r t jj|}nC|r?t jjt jj!||r|nd}|r't jj#|r|atSdatS)a<Directory holding the ``hermes`` console-script, or None (cached). A gateway launched by systemd/cron/a desktop launcher lacks the install dir on PATH and bare ``hermes`` exits 127. Order: ``which``; absolute ``sys.argv[0]`` naming a real hermes executable; ``sys.executable``'s dir if it holds the shim.rrrQz hermes.exezhermes.N)rL _SENTINELr:rsysargvr`rar8rr executablerrVrerrr rg)rargv0rexe_dirshimrks r$_resolve_hermes_bin_dirrUHs& i' LL "E88CHHQKE 77  E " ( ( *D14bggoocnn-RG&>"'',,wPT:U+VG\` #,y1IiO PTO r^c@t}t||r|gSgS)z?Prepend the hermes install dir to ``existing_path`` if missing.)rUr@)r;bin_dirs r$rr`s$%'G (W UURT UUr^c ddlm}m}g||dz Dcgc]}|jst | c}Scc}w#t $rgcYSwxYw)zExisting Hermes-managed runtime dirs: ``$HERMES_HOME/node`` (+``/bin``) and ``$HERMES_HOME/bin`` (managed ``uv``). Per call, not cached: home is profile-scoped and a managed tree can appear mid-process.r)riter_hermes_node_dirsr)r"rrYr9rr#)rrYr7s r$_managed_runtime_path_entriesrZfsXK U"7"9 U?;Lu;T Ud1YZYaYaYcAddd  s'A A AA A AActjdz dz } |jr t|gSgS#t$rgcYSwxYw)u>``~/.local/bin`` when it exists — the pip --user / pipx / uv-tool install target. A backend launched by a non-interactive SSH session, systemd or a GUI launcher inherits a PATH without it (only the login shell adds it), so CLIs installed there were ``command not found`` from the terminal tool (#111778).z.localr)rhomer9rr/) local_bins r$_user_local_bin_entriesr^qsQ  h&.I#,#3#3#5I=2=  s:: AAc$tr|Stjd|jdD}|j tjgt jdt tdj|S)aKNormalised POSIX PATH with missing sane entries appended: empty entries dropped (shells read them as cwd), duplicates collapsed (first wins), then missing ``_SANE_PATH`` / managed-runtime / ``~/.local/bin`` dirs appended so user entries keep precedence. Windows is a no-op passthrough (native ``;`` PATH untouched).c3&K|] }|s| ywrr)rentrys r$rz4_append_missing_sane_path_entries..sQe5EQsrT) rVrrr4r _SANE_PATHrZr^r )r;ordereds r$!_append_missing_sane_path_entriesrds mmQ}/B/B3/GQQG NN4==">:#3#3C#8">;X;Z">#:#<">?@ 88G r^cZtr%|jdd|jddyy)uDisable MSYS argument path conversion (``/FO`` -> ``C:/.../git/FO`` breaks tasklist/schtasks/wmic/``cmd /c``). Git for Windows honors ``MSYS_NO_PATHCONV``; MSYS2/Cygwin bash honor ``MSYS2_ARG_CONV_EXCL`` — set both; users can override. Git Bash rewrites arguments that look like Unix paths (``/FO``, ``/TN``, ``/Create``) into ``C:/.../git/FO``-style paths, which breaks native Windows commands such as ``tasklist``, ``schtasks``, and ``wmic``. Hermes runs terminal commands through bash on Windows, so set the standard MSYS opt-out by default. Refs #56700. MSYS2-proper and Cygwin bash (which ``_find_bash`` can still return via the final ``shutil.which`` fallback) ignore it and honor ``MSYS2_ARG_CONV_EXCL`` instead, so set both. ``*`` disables all argv conversion — the semantic equivalent of ``MSYS_NO_PATHCONV=1``. Also fixes ``cmd /c`` mangling (#56147). MSYS_NO_PATHCONVrMSYS2_ARG_CONV_EXCL*N)rVrrs r$rrs* )3/ ,c2r^run_envc8trtd|DdSdS)zPATH env key to update without altering Windows casing (``Path`` vs ``PATH``); None when a Windows env has no PATH key at all.c3HK|]}|jdk(s|yw)PATHNrrs r$rz _path_env_key..s;qqwwyF':;s""Nrm)rVr*)rjs r$rrs!GR4;G;T B]W]]r^cttttjj |zdfgt dS)aeBuild a run environment with a sane PATH and provider-var stripping. The process env is the LAUNCH profile's; under a routed home override its ``.env`` residue is dropped first (``strip_launch_profile_env``, a no-op for the launch profile) so the backend's own ``env`` and the served profile's declared passthrough names are what the child sees.Tc*tt|Sr)rBrdrs r$rz_make_run_env..s#9:[\]:^#_r^)rrrr`rrrris r$ _make_run_envrpsB 4 89J Kc QRTXYZ\e\g_ aar^rP_hermes_repo_root._hermes_repo_root_aliases base_prefix real_prefix_in_venv_hermes_site_packagesc8 ddlm}|xsijdxsi}|jdxsg}t|tsg}|Dcgc]}|st |c}t |jddfScc}w#t$rgdfcYSwxYw)zx(shell_init_files, auto_source_bashrc) from config.yaml; defaults on any failure so terminal execution never breaks.r) load_configr!shell_init_filesauto_source_bashrcT)rrxr6 isinstancer-rboolr#)rx terminal_cfgfilesrBs r$ _read_terminal_shell_init_configrs1# +00<B   !34:%&E %+1A+T,2B2BCWY]2^-___+ 4xs*AB B B&B B BBcRt\}}|xs|r tsgdng}g}|D]q} tjj tjj |}|r0tjj |r|j|s|S#t$rYwxYw)anFiles to source before the login-shell snapshot (``~``/``${VAR}`` expanded, missing dropped). ``auto_source_bashrc`` applies only without an explicit list: ~/.profile and ~/.bash_profile first (no interactivity guard; where n/nvm/asdf/pyenv add PATH), ~/.bashrc last (Debian's returns early when non-interactive, but guard-less bashrcs keep working).)z ~/.profilez~/.bash_profilez ~/.bashrc) rrVr`ra expandvarsrbrrr#)explicit auto_bashrcrresolvedrras r$_resolve_shell_init_filesrs =>HkJ!,[MFHH 77%%bgg&8&8&=>Dt,%  O   sA.B B&%B& cmd_stringr~c|s|S|Dcgc]}|jdd}}dgd|D}dj|dz|zScc}w)zPrepend guarded, silent ``source `` lines: ``set +e`` keeps going on errors, ``2>/dev/null`` hides noisy prompts, ``|| true`` neutralises the status.'z'\''zset +ec3.K|] }d|d|dyw)z[ -r 'z ' ] && . 'z' 2>/dev/null || trueNrr#s r$rz&_prepend_shell_init..s XaVA3j3HIXsr')rXr )rr~rsafepreludes r$_prepend_shell_initrs] -2 3AIIc7 # 3D 3YXSWXYG 99W  $z 11 4sApgidtimeoutc.tj|z} |j t j |dtj|k\rytjdV#t$rYPwxYw#t $rYyt$rYRwxYw)zWait until the process group is gone, reaping the wrapper as we go (a dead but unreaped group leader still makes ``killpg(pgid, 0)`` succeed). POSIX-only; callers are behind the _IS_WINDOWS gate.TrFg?) r, monotonicpollr#r`killpgProcessLookupErrorPermissionErrorsleep)procrrdeadlines r$_wait_for_group_exitrs~~')H   IIK  IIdA  >> x ' 4    "    s(A/A>/ A;:A;> B BB descendantsc|D]I} |js tj|j|k(r9 |j Ky#t$rYwxYw#t $rYgwxYw)uSIGKILL snapshotted survivors that escaped the process group via ``setsid`` — after TERM→KILL so in-group members keep their grace; psutil's identity-aware Process skips recycled PIDs. POSIX-only (see _IS_WINDOWS gate in caller).N) is_runningr`getpgidpidr/killr#)rrchilds r$_sweep_escaped_descendantsrs{  ##% ::eii(D01 JJL      s3A"AA AAAA A+*A+c tj|j} ddl}|j |jjd}|tjk(r t||n tj|tjt||dsttj|tjt||dt!j"t$j&t(5|j+d dddt/||y#t$rt |ddx}Y#wxYw#t$rg}YwxYw#1swYHxYw#t$rYVt,$rt||YlwxYw) u6TERM the group, wait, KILL, then sweep setsid escapees. Descendants are snapshotted BEFORE the first signal — once the wrapper dies they reparent to init — and we wait on the group, not the wrapper, which can exit before grandchildren under load. POSIX-only (_IS_WINDOWS handled by the caller). _hermes_pgidNrT) recursiveg?@g?r)r`rrrrpsutilProcesschildrenr#getpgrp_kill_known_pidsrsignalSIGTERMrSIGKILL contextlibsuppress subprocessTimeoutExpiredr/waitrr)rrrrs r$_kill_process_group_posixrsK zz$((#nnTXX.77$7G  rzz| {+ 0 IIdFNN +'dC8 $/$T45(()B)BGL+IIcI*+{D1; D.$7 7D @  A  ++!   0 T; /  0sSD(/E6B E&EE&(EE EEE#E&& F1FFc|g|D]4}tjt5|jddd6y#1swYAxYw)zPKILL the wrapper and its snapshotted descendants by PID (idempotent on zombies).N)rrr#r)rrrs r$rr:sJ&+&   +  KKM    s ?A c< ddlm}m}||jd||jt jtjt5|jddddy#t$r|j Y_wxYw#1swYyxYw)zLIdentity-checked terminate (start time guards against PID reuse), else kill.r)get_process_start_time terminate_pidT)forceexpected_start_timerrN) gateway.statusrrrr#rrrrrr/r)rrrs r$_kill_process_windowsrAsHdhhd@VW[W_W_@`a   Z66 @ #   s-A3B3BBBc eZdZdZdZdZdZdeedffdZ ddede d e ffd Z defd Z ededefd Zd edefdZddZdddddedede dedzdej(f dZdZde ffd ZdZxZS)LocalEnvironmentzRun commands directly on the host: every execute() spawns a fresh bash; the session snapshot preserves env vars across calls; CWD persists via the stdout marker.Tr.cttj|jz}t t d|DS)aFirst-party ``BUZZ_*`` names present in the env, excluded from the shared session snapshot. env_passthrough can never list them (it refuses blocklisted names), so under a multiplexed gateway profile A's BUZZ_PRIVATE_KEY would land in the snapshot and be sourced by profile B. Prefix-only and monotonic on purpose: conservative even when the context-gated carve-out is inactive.c3VK|]!}t|trt|r|#ywr)r{rr)rr4s r$rzPLocalEnvironment._additional_profile_scoped_passthrough_names..^s,U$$)Md)S Us'))rr`rrtuplesorted)selfmergeds r$,_additional_profile_scoped_passthrough_namesz=LocalEnvironment._additional_profile_scoped_passthrough_namesWsA bjj488+,VU#UUV Vr^NrNrrc\t|t||||jy)N)rNrr)super__init__ro init_session)rrNrr __class__s r$rzLocalEnvironment.__init__bs* 7._posixss88C='C 'r^)TERMINAL_TEMP_DIRTMPDIRTMPTEMPr)rVr%rrrmkdirrMrrXrr6r`rrrargr|W_OKr}r#rf)r cache_dirrenv_varrkrfallbacks r$ get_temp_dirzLocalEnvironment.get_temp_dirfs 35L !4!4!67:KK  OOD4O 8 % 'y>))$4 4 (c (c (E )G W-H1HIY11#622bggmmI6Ni((  )  24I OOD4O 89~H""3'BIIh"''@Q,R)+h''&&(("5"5c":hZZPX@YZZ    sA?G GGc>tjt|S)z@Use native paths for Python, but Git Bash-friendly paths for cd.)r_quote_cwd_for_cdrs)rNs r$rz"LocalEnvironment._quote_cwd_for_cds001Fs1KLLr^ract|S)z?Rewrite native/mixed Windows paths before quoting for Git Bash.)rz)rras r$_quote_shell_pathz"LocalEnvironment._quote_shell_paths %%r^ct|j}||jk(ry|t|jk7r!tj d|j|||_y)uSwap ``self.cwd`` for a usable directory if it vanished or is inaccessible (e.g. a command ``rm -rf``'d its own cwd) — otherwise Popen raises before bash starts and every subsequent call fails. A benign MSYS→Windows normalization is not warned about.NzaLocalEnvironment cwd %r is missing on disk; falling back to %r so terminal commands keep working.)rrNr]rJr)rsafe_cwds r$ _recover_cwdzLocalEnvironment._recover_cwdsW%TXX. txx   ,TXX6 6 NNH( $r^Fx)loginr stdin_datarrrc dt}|rt|t}|g|rdgngd|}|jt j |fdt |jddtjtj|tjntjd|jd tr dtini}tsFtjt 5t#j$|j&|_ddd| t+|||S#1swYxYw)Nz-lz-cTzutf-8rX) textrencodingerrorsstdoutstderrstdinstart_new_sessionrN creationflags)r-rrrrPopenrprPIPESTDOUTDEVNULLrNrVr rrrr`rrrr)rrrrrrargsrs r$ _run_bashzLocalEnvironment._run_bashs | ,Z9R9TUJC%RC$C C  Ptxx!87S\??:+<+<%/%;*//ASAS" P ;F!3!562 P $$%78 9$&JJtxx$8! 9  ! j )  9 9s )%D&&D/c trtnt|y#t$rBt j t 5|jdddYy#1swYYyxYwwxYw)z-Kill the entire process group (all children).N)rVrrr/rrr#r)rrs r$ _kill_processzLocalEnvironment._kill_processsQ &1 "7PRV W $$Y/      s&"A%A A%A! A%!A%resultc8|j}t| ||j|k7rot|j}|r,tj j |r ||_||d<y||_|jdd|jddyy)u/Base semantics plus: Git Bash ``pwd -P`` emits MSYS form on Windows — normalize to native and require the dir to exist, else ``_run_bash`` would warn every command. A stale path rolls back to the previous cwd, which this command did not observe, so ``cwd_observed`` is dropped.rN cwd_observedN)rNr_extract_cwd_from_outputr]r`rargr)rrprev_cwd normalizedrs r$rz)LocalEnvironment._extract_cwd_from_outputs 88 (0 88x .txx8JbggmmJ7% *u # >40 5$' r^c2ddl} |j|jd}|j|jg|D]9}t j t 5tj|ddd;y#t$rg}YewxYw#1swYWxYw)zClean up temp files, including orphaned atomic-write snapshots (``snap.tmp.``) a failed/interrupted mv could leave behind.rNz.tmp.*) glob_snapshot_pathr# _cwd_filerrr/r`r<)rrstalerBs r$cleanupzLocalEnvironment.cleanups  II!4!4 5V<=E%%t~~>> A$$W-  !     E   sA<B < B  B  B )rQ<NrN)__name__ __module__ __qualname____doc___sudo_nopasswd_probe_supported_profile_scoped_passthroughis_localrrrintrrr staticmethodrrrr|rrrrrr __classcell__)rs@r$rrLs&*""&H VeCHo VCsd[c[BMsMsMM&c&c&(;@PS+/C4#!Dj4>4D4D,(t(" r^r)rz Path | Nonerr)rrloggingrdr`platformrWr:rrrOr threadingr,collections.abcrpathlibrr"rtools.environments.basertools.environments.base_outputrhermes_cli._subprocess_compatr #tools.environments.local_env_policyr r r r rrrrr&tools.environments.local_gitbash_proberrrrr#tools.environments.local_pythonpathrrsystemrV getLoggerrrJTERMINAL_TEMP_MAX_IDLE_HOURSLockrHrIcompiler2r%floatr rFrMrr]rorsrvrzr|r~rrrrrrrrrrrrrrrr-r r-r.__annotations__r1r0r@rBrIrKrbobjectrNrLrUrrZr^rdrrrp__file__rrrqabsoluterrrrprefixhasattrrurvrrrrrrrrrrr^r$r%sK    #436<ccc==Yhoo9,   8 $ "*INN,"rzzIJ 8T'u'X['T <5s5s5CC.+s+s+\#\#\.3.3. .2B /T /d /$y$t$,Itd{Itd{IVZI:? $$ $4S> $ D $ 4 (,/MQD!&/ $/FJ//'A//,0S>/4(,)SW %) $)=P)) #s(^)X$'$'5H'TX'D\d3i8BCB<04,3$DI$ DDI DOODIO#ON#N#N%%QR S M H )2&2t0V3V3V tCy c  S S 3t33$^4^C$J^ ataax.002::1=4=.MtH~..088;=T=V/X5s+X#}cjj9SZZG1S-0 $2+/tDzD(/ %S 4*@ 49(2C2S 2c2S5T*D$$2NRRr^