+ iHj%Va0t$Rt^RIHt^RIt^RIt^RIHt^RIH t ^RI H t R(t R)t R*tR+tRtRtRtR,t] !R RR 7tR ]R &R RltR-RRlltRR/RRlltRRltR.RRlltRRltRR/RRlltRRlt]RRRR/R l4tR!tR/R"R#llt R$R%lt!R-R&R'llt"R#)0aA local session's client environment: the allowlisted values a shell-launched client (classic CLI, Ink TUI) sends as ``session.create``'s ``client_env``. Main's ``hermes`` process read them from its own shell; the one gateway now runs every session, so they are frozen with the session's policy and bound for its turns only, never written to the gateway's ``os.environ``. Desktop sends none: its sessions keep the gateway's environment, and so does a session created before ``client_env`` existed. Plain names and string values only. Behaviour names are read through :func:`session_env`; the toolchain names (``PATH``, an activated venv, nvm/pyenv/conda) reach that session's tool subprocesses through :func:`toolchain_environ`. Values naming this host (toolchain paths, the prefill file, the project-plugins check of the client's folder) apply only when the gateway proved the client is on its host (``local``); otherwise the session keeps the gateway's and is told so. Values are never logged. ) annotationsN)contextmanager) ContextVar)is_secret_env_nameclient_env_passthroughzthis session uses the gateway's own PATH, toolchain and prefill file: the client's environment was not applied because the client is not attached to this gateway locally.session_client_env)defaultr_BOUNDcV^8dQhRR/#)return frozenset)formats"=/home/ubuntu/.hermes/hermes-agent/agent/session_client_env.py __annotate__r)sGG Gc\V\4'dVPR4MRp\V\4'dVP\4MRp\V\4'd\ RV44#\ 4#)zEThe profile's extra tool names (``terminal.client_env_passthrough``).terminalNc3"TFEp\V\4'gKVP4'gK3VP4xKG R#5iN) isinstancestrstrip).0names& r #configured_names..-s-\cdZc5J\tzz|\TZZ\\csAAA)rdictget CONFIG_KEYlistr)configrraws& rconfigured_namesr%)sp)3FD)A)Avzz*%tH&04&@&@(,,z "dC`jknpt`u`u9\c\ \G|E|GGrc V^8dQhRRRR/#)r rrr boolr)rs"rrr0s99399rcaVf \S4M9\;QJdV3RlV4F 'gK RM RM!V3RlV44pV'*;'dSPR4'*#)aOA toolchain name may travel unless it is a credential by execute_code's secret policy (even when listed: ``NODE_AUTH_TOKEN`` matches ``NODE_``; secrets reach tools through ``terminal.env_passthrough``) or a Hermes control name (a delegated child's markers, Kanban pins). ``secret``: a session's frozen copy of that policy's substrings.c3H<"TFqSP49xK R#5ir)upper)rsrs& rr_travels..5s@c\bWXdjjlAR\bs"TFHERMES_)rany startswith)rsecrethiddensf& r_travelsr20sO *0  %SS@c\b@cSSS@c\b@c=cF: 8 8dooi888rlocalTcV^8dQhRR/#)r r rr)rs"rrr9sfftfrc ^RIHpR\Uu.uFq1'gV\9gKVNK upRV'd)\ \ \ 4\V4,4M.RV'd\\4M.R\V4/#uupi)a/The normalisation rules (plain data) a session's map is filtered by, frozen with it: an exact retry is judged by these, never by the profile's allowlist or the secret policy as they are later. A client not proven ``local`` keeps only the values that name nothing on this host (prompt, provider request).)_SECRET_SUBSTRINGS behaviournamesprefixesr0) tools.code_execution_envr6 BEHAVIOUR_ENVHOST_BEHAVIOURsortedsetTOOL_ENVr%r"TOOL_ENV_PREFIXES)r#r3r6ns&$ rclient_env_rulesrB9sl< ]W]eq?V!!]W VCM,TKY^_cYkKDK? ll lsA1A1'A1cV^8dQhRR/#rIr)rs"rrrOs``.`rc\V\4'd\V4\8g\;QJd*RVP 44F 'gK RM RM!RVP 444'g*\ RVP 444\8d \R4h\V4Uu/uF"q!e\W!4'gKW V,bK$ up#uupi)zThe validated map filtered by ``rules`` (``None``: unfiltered, for a map frozen before rules were). Raises ``ValueError`` for anything but a bounded flat string-to-string map.c3"TF9wr\V\4'*;'g\V\4'*xK; R#5ir)rrrkvs& rr'normalise_client_env..Ss3^P]z!S))CCAs1C-CCP]s "AATFc3\"TF"wr\V4\V4,xK$ R#5ir)lenrSs& rrrVTs =}tq3q6CF??}s*,z;client_env must be a map of variable names to string values) rrrX _MAX_NAMESr.rMsum _MAX_BYTES ValueErrorr=rG)rNrDrs&& rnormalise_client_envr]Os ud # #s5zJ'>s^PUP[P[P]^sss^PUP[P[P]^^^=u{{}== JVWW*0- _-$=ERVL^ D+ - __ _s C- C-cV^8dQhRR/#rIr)rs"rrrYsNN~Nrc.\V\WR74#)zJGateway side: the map filtered by the session profile's own current rules.)r3)r]rB)rNr#r3s&&$raccept_client_envr`Ys '7'L MMrc$V^8dQhRRRRRR/#)r committedrrequestr r'r)rs"rrr^s!&&T&D&T&rc0VPR4pVeRV9dVRJ;'dRV9#VPR4p\VR,VfRM\P!V44pT\P!T48H# \dR#i;i)a,Whether a retried ``session.create`` (``request``: its params) carries the client environment the committed session (``committed``: its stored policy) froze. The complete retried map, normalised by the rules frozen with the session, must equal the stored one: an added name those rules keep, a missing stored name or a changed value is a different request; one they drop never counts. Staging and the transactional commit both judge by this. A session committed without a map (Desktop, one from before the field) still matches only a retry that sends none.client_env_jsonN client_envclient_env_rules_jsonF)r r]jsonloadsr\)rbrcstoredrDsents&& r retry_matchesrl^s]], -F ~W4~==,g"== MM1 2E#GL$95=4VZV`V`afVgh 4::f% %% s-B BBrDc#"\PVfRM V\V4V34pRx\PV4R# \PT4i;i5i)a Bind one session's client environment (``None``: the gateway's own) for this context; ``local`` is the gateway's own proof, frozen in the session's policy, that the client runs on this host; ``rules`` the normalisation rules frozen with it (``client_env_rules``; ``None``: the built-ins).N)r r>r'reset)envr3rDtokens&$$ rclient_env_scoperqpsF JJs{td5k50I JE  U Us(A AA AA cH\P4pVfR#V^,#r)r r )bounds rbound_client_envrt|s JJLE=4.eAh.rc$V^8dQhRRRRRR/#)r rrr r r)rs"rrrs!''c'C''rc\P4pVeV\9d&V^,'g\P!W4#V^,PW4#)zA behaviour value for the session executing here: its client's (an unexported name is unset, as it was for main's process), else the gateway's own environment, which a client not attached locally also keeps for the values that name this host.)r r r<rKgetenv)rr rss&& r session_envrxsE JJLE }/ayy'' 8<< &&rcV^8dQhRR/#rIr)rs"rrrsmm.mrc\P4pVeV^,'g/#V^,P4UUu/uF'wrV\9gK\ V4'gK%WbK) upp#uuppi)z`The toolchain values this session's tool subprocesses start with (empty when unbound or remote).)r r rMr;r2)rsrrNs rtool_envr{s\ JJLE }E!HH +08>>+; l+;KDt=?XK]efj]kKDK+; ll lsA5A5+A5cV^8dQhRR/#rIr)rs"rrrsNrc\Vf\PMT4p\P 4pVfV#\ F1pV^,'gV\ 9gKVPVR4K3 V^,'gV#V^,;'gR\R\RR/pVR,Uu0uFp\W4R,4'gKVkK! pp\VR,4pVP4UUu/uF/wrxVR8Xg"Wu9dKVPV4'dK-WxbK1 p ppV \4,#uupiuuppi)aFThe environment this session's tool subprocesses start from (``base``: the gateway's). Unbound (messaging, cron, Desktop): unchanged. Every client's session drops the gateway's own behaviour values it reads from its client (:func:`session_env`), so tools never see the daemon's ephemeral prompt or provider request in place of the session's. A client not attached locally keeps the host values (``HOST_BEHAVIOUR``) and the rest of the gateway's environment. A local shell client's session: its toolchain replaces the gateway's, and every toolchain name it did not export (built-in, or configured for its profile when the session was created) is unset, as in main's process: one client's venv or GEM_HOME never reaches another's session through the daemon it started. PATH is the exception: a client that sent none runs with the gateway's.Nr8r9r0PATH)rrKrLr r r;r<popr?r@r2rFrMr/r{) baserorsrrDr8r9rTrUkepts & rtoolchain_environrs T\rzzt 4C JJLE }  88t>1 GGD$  88 !H Z Z(J8I8UYZE#Gn PndX0OTTnE PU:&'H YY[ f[TQAK Dall[cNdDAD[D f (*  Q fs2EE>E E -E )HERMES_EPHEMERAL_SYSTEM_PROMPTHERMES_PREFILL_MESSAGES_FILEHERMES_INFERENCE_PROVIDERHERMES_ENABLE_PROJECT_PLUGINS)rr)r~ VIRTUAL_ENVGOPATHGOROOT CARGO_HOME RUSTUP_HOME JAVA_HOME)CONDA_NODE_NVM_PYENV_ir)NN))#__conditional_annotations____doc__ __future__rrhrK contextlibr contextvarsrr:rr;r<r?r@r!NOT_LOCAL_WARNINGrYr[r __annotations__r%r2rBrGrOr]r`rlrqrtrxr{r)rs@rrs # %"72 S `9 % c    4dC CG9fdfN m`NdN &$4t/ 'mr