+ iHjTaRtv0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t H t ^RI H t HtHtHtHtHtHt^RIHtHtHt]P0!]4tRRRRRR /t]!R4t]!R4tR R/R R lltR R/R Rllt Rs!RRlt"RRlt#RRlt$RRlt%/t&]^kRRlt'RRlt(R]'R](RR/t)]^kRR lt*R!R"lt+R#R$lt,/t-]^k^t.]P^!4t0R%R&lt1R'R(lt2R)R*lt3R+R,lt4R-R.lt5R/R0lt6R1R2lt7]!R304t8]^kRR4R5llt9R6R7lt:R8R9lt;/t<]^kR:R;lt=R<R=lt>R>R?lt?R@RAlt@RBRCltA]B!^4wtCtDtEtFRDtG]H!4tI]^kRRERF/RGRHllltJRIRJltKRKRLltLRMRNltMRORPltNRQRRltORSRTltP]PPRURV4]PPRWRV43tS^@tTRRXRYlltURZR[ltVR\R]ltWR^R_ltXR`RaltYRbRcltZRdRelt[Rft\/t]]^kRgRhlt^RiRjlt_RkRllt`RmRnltaRoRpltbRqRrltcRtdRsRtlteRuRvltfRwRxltgRythRzR{lti]P!R|4tkR}R~ltlRRltm^)is_excluded_skill_path..&s=ut**uTFr)rstrpartsanyis_skill_support_path)pathrr)s&$ ris_excluded_skill_pathr-"sH SY  % %E 3=u=333=u= = g gAVW[AggrcFV^8dQhR\\,R\/#rr)rs"rrr)s  $ 4 rcjaa\V\4'dTM\\V44pVPoVeVP 4'gTM \4o\ ;QJd,VV3Rl\ SRR44F 'gK R# R#!VV3Rl\ SRR444#)zTrue if *path* is under a support dir sitting directly inside a skill root (``skills/scripts/foo`` stays discoverable: no ``SKILL.md`` above ``scripts``).Nc3<"TFIwrV^8gKV\9;'d)S\SRV!, R, P4xKK R#5i)NSKILL.md)SKILL_SUPPORT_DIRSrexists)r"idxr#baser)s& rr$(is_skill_support_path..0sS.IC 7 Y""XXtU4C[/A(AJ(N'V'V'XX.s AA1ATF) isinstancerr(r) is_absoluter* enumerate)r,rpath_objr6r)s&$ @@rr+r+)s"$--t4D ?H NNE#H,@,@,B,B4D 3"5":.3333"5":. rc$V^8dQhR\/#)rcontentr()rs"rrr:s""s"rc8\f ^RIHpVs\V4#)z8Parse YAML with the shared safe loader, imported lazily.) safe_load) _yaml_load_fn hermes_yamlrA)r>rAs& r yaml_loadrD:s)!  !!rctV^8dQhR\R\\\\3,\3,/#)rr>r)r(tupledictr)rs"rrrCs,suT#s(^S-@'ArcNVPR4pVPR4'd\P!RVR,4MRpV'g/V3#V^VP 4^,pWP 4^,Rp/p\ V4p\V\4'dTpWC3# \diTP4PR4F@pRT9gK TPR^4wrxTP4YGP4&KB YC3#i;i)zParse YAML frontmatter from markdown; returns (frontmatter_dict, body). Malformed YAML falls back to key:value line splitting. A leading UTF-8 BOM (Windows editors) is stripped first or it would defeat the ``---`` fence check.uz---z \n---\s*\n:NNN :) removeprefix startswithresearchstartendrDr9rG Exceptionstripsplit) r> end_match yaml_contentbody frontmatterparsedlinekeyvalues & rparse_frontmatterr]Cs""8,G9@9K9KE9R9R -5X\I 7{1y0145L ==?Q&( )D"$K9<( fd # # K   9 &&(..t4Dd{!ZZQ/ +0;;= IIK(5   9s #B111D$'8D$#D$c0V^8dQhR\R\/#)r platformsr)rr)rs"rrrZs  3 4 rc*V'gR#\V\4'gV.p\PpVFYp\ V4P 4P 4p\PW34pVPV4'gKXR# R#)z?Return True when *platforms* is compatible with the current OS.TF) r9listsysplatformr(lowerrS PLATFORM_MAPgetrM)r_currentrc normalizedmappeds& rskill_matches_platform_listrjZss  i & &K llG]((*002 !!*9   f % %  rcRV^8dQhR\\\3,R\/#rrXrrGr(rr)rs"rrris&EES#XE4Erc6\VPR44#)zITrue when the skill's ``platforms:`` list (absent = all) matches this OS.r_)rjrfrXs&rskill_matches_platformrpis &{{'C DDrc$V^8dQhR\/#rrr)rs"rrrusrc\P!R4'g\P!R4'd^RIHpV!4pV'dR#^RIHp\V!44# \dRpL0i;i \dR#i;i)HERMES_KANBAN_TASKHERMES_KANBAN_BOARD)"is_dispatcher_owned_worker_contextT)_profile_has_kanban_toolsetF)osgetenvagent.delegation_contextrwrRtools.kanban_toolsrxr)rwownedrxs r_detect_kanbanr~us{ yy%&&"))4I*J*J  S68E B/122  E  s# A(A;( A87A8; B  B c$V^8dQhR\/#rrrs)rs"rrrsrcB^RIHpV!4# \dR#i;i)r1 is_containerF)hermes_constantsrrRrs r_detect_dockerrs$1~ s  kanbandockers6c\PPR4;'g \PPR4#)z/run/s6z/package/admin/s6-overlay)ryr,isdirrrrs*"''-- *XXbggmm True). Cached per process EXCEPT ``kanban``: that verdict is context-dependent (delegate children / in-process cron see the worker's vars), so a process-wide cache would leak the first asker's answer to the others.rT)_ENV_DETECT_CACHE_ENV_DETECTORSrf)rdetectorresults& r_detect_environmentrsI  h3"33 %%!!#&H#XZF#c MrcRV^8dQhR\\\3,R\/#rlrm)rs"rrrs&@@4S>@d@rcHVPR4pV'gR#\V\4'dTMV.Uu.uF*p\V4P 4P 4NK, pp\ ;QJdRV4F 'gK R# R#!RV44#uupi)zvTrue when ANY declared ``environments:`` tag is active (absent = all; unknown tags fail open). Offer-time filter only. environmentsTc3J"TFq'gK \V4xK R#5ir )r)r"tags& rr$,skill_matches_environment..s?4C3'"3''4s ##F)rfr9rar(rdrSr*)rXrrtagss& rskill_matches_environmentrs??>2L AKLZ^A_A_fres1s u1sCHNN  " " $1sD u 3?4?33?3?3?4? ?? vs0BcRV^8dQhR\\\3,R\/#rlrm)rs"rrrs"DcNtrcHVPR4pV'gR#^RIHp^RIHp\ V\ 4'dTMV.F[pVP\V4P44pVeVPfR#V!V4P'dKZR# R#)atTrue when every app named in ``requires_apps:`` has a registered declaration this host satisfies. Names resolve through ``hermes_platform.declaration`` (registered by whoever owns the server, e.g. the plugin loader); the check is the same ``availability()`` the MCP check_fn uses. An unknown name hides the skill (fail closed). Offer-time filter, like ``environments:``. requires_appsT) declaration) availabilityF) rfhermes_platformr%hermes_platform.resolver.availabilityrr9ralookupr(rSapp offerable)rXnamesrrnamedecls& rskill_matches_appsrs OOO ,E +B#E400ug=!!#d)//"34 <488+D!+++ > rcV^8dQhRR/#rrNr)rs"rrrs"""rc\;_uu_4\P4RRR4R# +'giR#;i)u/Test hook — drop the shared raw config cache.N)_RAW_CONFIG_CACHE_LOCK_RAW_CONFIG_CACHEclearrrr_raw_config_cache_clearrs#  !   s. ? c V^8dQhR\R\\\\\\\3,,/#)r config_pathr)rrrFr(int)rs"rrrs/4HU3S#s;R5S,Trcz^RIHp\V4.V!VP44O5# \dR#i;i)zT``(path, *file_signature)`` identity of config.yaml, or None when unreadable/absent.)file_signatureN)utilsrr(statOSError)rrs& r_config_cache_keyrs=(K F>+2B2B2D#EFF s (+ ::cFV^8dQhR\\\3,/#rrrGr(r)rs"rrrs$sCx.rc ^RIHpV!4pVeV#\4pVP4'g/#\ V4p\ ;_uu_4Ve\ PV4MRpRRR4XeV#\VPRR74p\T\4'g/#Tei\ ;_uu_4T\ T&\\ 4\ 8d.\ P#\%\'\ 444KERRR4T#T# +'giL;i \d#p\PRY&4/uRp?#Rp?ii;i +'giT#;i)zNRead config.yaml with an mtime+size keyed cache (no hermes_cli.config import).)worker_config_snapshotN utf-8-sigencodingz"Could not read skill config %s: %s)agent.safe_worker_policyrr r4rrrrfrD read_textrRloggerdebugr9rGlen_RAW_CONFIG_CACHE_MAXpopnextiter)rsnapshotr cache_keycachedrYes r_load_raw_configrs1?%'H!#K      !+.I  5>5J"&&y1PT   ;00+0FG fd # #  # #+1 i ('(+@@!%%d40A+B&CDA$ M6M!   9;J  $ # Ms7D:D.?AE D+ . E9EEE E/ c\V^8dQhR\\\\3,,/#rr)rrGr(r)rs"rrrs#@@Xd38n-@rch\4PR4p\V\4'dV#R#)zHThe ``skills:`` mapping from config.yaml, or None when absent/malformed.skillsN)rrfr9rG) skills_cfgs r _skills_cfgrs,!#''1J#J55:?4?rc0V^8dQhR\R\/#)rr[r)r(r)rs"rrrsCCCCrcD\4pVeVPV4#R#)zP``skills.`` from config.yaml, or None when the section is absent/malformed.N)rrf)r[rs& r_skills_cfg_getrs"J","8:>># BdBrc0V^8dQhR\R\/#)rentryr)r(r)rs"rrrs????rc\\PP\PP V444#)z3Expand ``~`` and ``${VAR}`` in a config path entry.)rryr, expanduser expandvars)rs&r _expand_pathrs+ ""277#5#5e#<= >>rc0V^8dQhR\R\/#)rprr)rs"rrr s;;d;t;rcZ^RIHpVP4'dV#V!4V, #)zJAnchor a relative config path at HERMES_HOME; absolute paths pass through.get_hermes_home)rrr:)rrs& r_home_relativer s"0 1:_%6%::rz hermes-agentcTV^8dQhR\R,R\\,/#)rrcNr)r(set)rs"rrrs" ' 'sTz 'SX 'rc\4pVf \4#^RIHpT;'g'\P !R4;'g V!R4p\ VPR44pV'd+VPR4;'g/PV4MRpVeV\ V4,pV\, #)uDisabled skill names from config.yaml: global list ∪ platform list (*platform* defaults to ``HERMES_PLATFORM`` / ``HERMES_SESSION_PLATFORM``).N)get_session_envHERMES_PLATFORMHERMES_SESSION_PLATFORMdisabledplatform_disabled) rrgateway.session_contextrryrz_normalize_string_setrfESSENTIAL_SKILLS)rcrrresolved_platformrrs& rget_disabled_skill_namesrsJu 7 nnBII.?$@nnOTmDn$Z^^J%?@H^o(;<BBGGHYZuy$)*;<< & &&rc:V^8dQhR\\,/#rrrar()rs"rrr%seetCyerc\V\4'dVP4PR4'dW\P !VP44p\V\4'dVUu.uFp\V4NK up#V.#\V\\\\34'dVUu.uFp\V4NK up#.# \ \3dRpLi;iuupiuupi)a Normalize a config value that may hold a JSON-array string into a list. ``hermes config set`` stores lists as quoted JSON/Python-literal strings; treating one as a single name would silently filter nothing. A scalar string still means one name. See #13026, #86661. [N) r9r(rSrMast literal_eval ValueError SyntaxErrorrarFr frozenset)r\rYitems& rparse_config_string_listr%s% ;;= # #C ( ( ))%++-8&$''.45fdD f55w,6utUCQZ>[,\,\% (%$CI% (dbdd  ,  6 (s$C;C1?C6C.-C.c:V^8dQhR\\,/#rr)rr()rs"rrr9sWWSXWrc\V4Uu0uF*qP4'gKVP4kK, up#uupir )rrS)valuesrs& rrr9s/%=f%E V%ETLDJJL%E VV Vs AAcV^8dQhRR/#rr)rs"rrrBsDrcB\P4\4R#)u(Test hook — drop the in-process cache.N)_EXTERNAL_DIRS_CACHErrrrr_external_dirs_cache_clearrBs rc:V^8dQhR\\,/#rrr)rs"rrrHsCCT#YCrc\V\4'dV.p\V\4'g.#RV4Uu.uFq'gK VNK up#uupi)zFA scalar-or-list config entry as a list of stripped non-empty strings.c3T"TFp\V4P4xK R#5ir )r(rS)r"rs& rr$#_config_str_list..Ns <uE ((**s&()r9r(ra)rawrs& r_config_str_listrHsK#se c4  << Bd5kNDTUV%'J*"3"3"5"5 oz23 *B*D E*DQ}a *D EEEeD$ GutqQYF$((1+FQFu GG C F GsC=!D DD2Dc:V^8dQhR\\,/#rrr )rs"rrrsMMT$ZMrcN\RR7UUu.uFwrVNK upp#uuppi)zSkill dirs: local ``~/.hermes/skills/`` first, then create_dir, then external. Trusted project dirs are NOT included (higher precedence; see get_project_skills_dirs).F)r%)r3)_tierr/s rget_all_skills_dirsr7s%5UK LK(%AK LL Ls !c$V^8dQhR\/#rrrs)rs"rrrs  d rc h\VUu0uF"p\PPV4kK$ up4^8XdR#\VUu0uF>p\P !\ V4P44P4kK@ up4^8H#uupiuupi \dR#i;i)aTrue only when every path is the SAME skill: one resolved file (symlink view) or byte-identical content (copy). Anything else is two different skills sharing a name, and picking one by depth would let ``/evil`` (``name: github``) shadow the real one.TF) rryr,realpathhashlibsha256r read_bytes hexdigestr) skill_mdsrs& rprovably_same_skillr@s Y7Y  #Y7 8A =iXiGNN47#5#5#78BBDiXY]^^^8X s4 B"(B B" B" AB B" B"" B10B1cFV^8dQhR\\\3,/#rr)rFrr)rs"rrrsPPE$),<Prc~\V4pVPR8g\VPV4P43#)zSame-root order of identical copies: a real SKILL.md beats a legacy flat ``.md``, then the shallower path wins (shared by skill_view and :func:`resolve_skill_catalog`).r2)rrrr"r))skill_mdrs&&rskill_candidate_rankrDs7H~H MMZ 'X-A-A$-G-M-M)N OOrcrV^8dQhR\\\,\\,3,/#rr)rFrrra)rs"rrrs( I IhsmT#Y.F(G IrcVa\RS44p\S4UUu.uFwr#V^,V8XgKVNK ppp\V4^8d\VUu0uFpSV,^,kK up4^8Xd}\VUu.uFpSV,^,NK up4'dN\ VV3RlR7pSV^,,^,SV^,,^,8wd V^,V3#\V4^8Xd V^,V3#RV3#uuppiuupiuupi)aWinner index among one identifier's ``(tier, root, rank, skill_md)`` candidates, plus the winning tier's contender indexes. The lowest tier wins; inside it a lone candidate wins, identical copies under one root resolve to the strictly best ``rank``, anything else is ambiguous (None).c32"TF q^,xK R#5i)r1Nr)r"cs& rr$'pick_skill_candidate..s 'JqddJr&c$<SV,^,#)rr)i candidatess&rr&pick_skill_candidate..s*Q-2Br)r[N)minr;rr@sorted)rLtoprKrH contendersrankedsf rpick_skill_candidaterSs  'J ' 'C )* 5E 51!! 5JE :sj#IjJqM!$4$4j#IJaOTg'1 2z!Z]1  z 2U4U4 (BC fQi  #z&)'.s!*O13s1vf~+>+>s&)c3h<"TF'p\SR,SV,R,.4xK) R#5irb)r@)r"rcrrds& rr$res.\U[PQ.& 3q6&>/JKKU[s/2TFzgSkill '%s' at %s is shadowed by a higher-precedence copy (project > local > create_dir > external_dirs)unique ambiguous)rGr;rparentr"r#r(r setdefaultritemsrSrDupdaterO_SHADOW_CHECKEDr.r*rwarning)rZrownersrK skill_diraliaswinneridxsrcwon_rrelhigherr[rds&` @rresolve_skill_catalogrxs $ $Gq47G $C#%F#16O** &221V9=FFH/!F)ninna6HIE   eR ( / / 2J (*F||~ %'VF^SQ02Fs1vf~WZ[\W]^dWe2fhklmhnouhv w'!$  & #1& NAo$6c#\H\SVF^ai-G!!\H V\$2 HHJ$H 7qy>PF*O*O$OPC#_4##C(s\U[\sss\U[\\\NN$TUY[\]c[df]5v \Q  HHHH 5 HHK&+:J3PTH U J; %' IsL(A(L #L L z.hermesrz.agentsc\V^8dQhR\\,R\\,/#)rrPrr)rs"rrrs"Xd^x~rcVf^RIHpV!4p\V4P4p\P !4P4p\ \4FNpTR, P4'dY#8XdRu#Tu#TPT8XdR#TPpKP R# \dR#i;i \dR#i;i)uNearest ancestor containing ``.git`` (dir or worktree file), or None. Without *start*, the surface's effective working directory wins over the process cwd — the same ladder every other cwd consumer reads (``resolve_agent_cwd``: session-bound cwd, then the scope's ``TERMINAL_CWD``, then the process cwd). The session cwd comes first because a multi-session host (TUI/desktop gateway) pins each session's workspace there while its terminal scope resolves a placeholder ``terminal.cwd`` to ``$HOME``; reading only the scope made every project skill invisible on those surfaces (#114359). ``TERMINAL_CWD`` is the per-surface workdir the terminal tool and cron jobs use (a cron job sets it from its per-job ``workdir`` without chdir'ing the scheduler process), which lets non-interactive surfaces inherit a prior interactive trust decision by project identity — and a surface with no workdir in a trusted repo simply resolves no project and loads nothing (#48975). N)resolve_agent_cwd.git) agent.runtime_cwdr{rr rr!range_PROJECT_ROOT_MAX_DEPTHr4ri)rPr{curr!rus& rfind_project_rootrs = ;%'E5k!!# 99;   D  ./Af $$&& #{t33zzS **C0      s5*B38C C C!C3 CC CCc:V^8dQhR\\,/#rr)rr)rs"rrr(s3t9rc\4p\\R44F,pVP\ V4P 44K. V# \ dK@i;i)zKResolved set of trusted project roots from ``skills.trusted_project_dirs``.trusted_project_dirs)rrrr.rr r)rrs r!_project_trusted_dirs_from_configr(sYF!/2H"IJ  JJ|E*224 5K M   s(A A A c0V^8dQhR\R\/#r)rr)rs"rrr3s$4rcp\V4P4\49# \dR#i;i)z>True when *root* is listed in ``skills.trusted_project_dirs``.F)rr rrr's&ris_project_root_trustedr3s5Dz!!#'H'JJJ s #& 55cFV^8dQhR\R\\,/#r)rra)rs"rrr;s   $t* rc,a\4P4p.pV3Rl\4FRpVP4'd9VP4V8wd"VP VP44KPKRKT V# \ dKfi;i)z}Existing skill dirs under *root*, excluding the profile's own skills dir (HERMES_HOME itself may live inside a git checkout).c36<"TFpSV, xK R#5ir r)r"subrs& rr$1_candidate_project_skills_dirs..@s>'='=s)r r PROJECT_SKILLS_SUBDIRSrrr)rrdirscandsf r_candidate_project_skills_dirsr;s}"#++-LD>'=> {{}}.]sJ$Iq$Isr2r)rrsumiter_skill_index_filesr)rcountr/s r!get_untrusted_project_skills_rootrWss  /D E595E +D 12 M  SJ$:1j$IJJ JEN "D=+t+   s#A A'&A'z project-localc$V^8dQhR\/#rrrs)rs"rrrwsdrc\V4Pp\VP44pV\ 9d\ V,#^RIHp^RIH pV!4R, R, pV!V\VR7wrgVPR8HpV'd!\PRWP4T\ T&T# \d\T4pLi;i \d\PRTR R 7R pLNi;i) uTrue when a project skill's scan verdict is ``dangerous``. Fail-closed: a scanner crash or missing scanner quarantines the skill. Scans unconditionally — non-project callers should not call this.)scan_skill_cachedrcacheproject_skill_scans)source cache_dir dangerousu8Project skill quarantined (verdict=dangerous): %s — %su<Project skill scan failed — quarantining (fail closed): %sT)exc_info)rrir(r r_PROJECT_QUARANTINE_CACHEtools.skills_guardrrr_PROJECT_SCAN_SOURCEverdictrrnsummaryrR) rCrpr[rrrr_prov quarantineds & ris_quarantined_project_skillrwsX%%I)##%& ''(-- 84#%/2GG )).srJaRnopRqJs$ $r2N)r)rs&riter_project_skill_filesrss1+zJrrrs " "c0V^8dQhR\R\/#)r identifierrr?)rs"rrrs$$C$C$rcT;'gRP4pV'gV#\V4P4pVP4'gVP R4#^RIHpVP4pV.p\\3FpVPV!44K VF6pVPV4'gK\VPV44u# \VP!4PVP!444# \d\4pLi;i \dKi;i \d\"P%RT4Tu#i;i)z}Translate a trusted absolute skill path (slash commands / cron may store them) to the relative form ``skill_view()`` accepts.rr) skills_toolu~Skill identifier %r is an absolute path outside trusted skills roots — passing through unchanged (skill_view will reject it))rSrrr:lstriptoolsr _skills_dirrRr r)rextendr r(r"r rr)rraw_identifieridentifier_path _skills_tool primary_root trusted_rootsgetterrs& rnormalize_skill_lookup_namersS!&&B--/N >*557O  & & ( ($$S)) (5#//1 "NM*,DE    *F  ) )$ / /22489 9?**,889M9M9OPQQ (%' (      WXf hs6&DD7&5E D43D47 EE #E/.E/c$V^8dQhR\/#rrr)rs"rrrs00$0rc\V\4'dTM\\V44pVP4P 4# \ \ 3d"TP4P4u#i;ir )r9rr(rr r RuntimeErrorabsolute)r,r<s& r_resolve_for_skill_ownershiprsf!$--t4D ?H0""$,,.. \ "0""$--//0sA /A>=A>c$V^8dQhR\/#rrrs)rs"rrrs _ _D _rc a\V4o\\44pVP\ 44\ ;QJdV3RlV4F 'gK R# R#!V3RlV44# \ dLGi;i)zTrue when ``path`` lives under an external or trusted project skills dir. Those are externally owned: autonomous lifecycle maintenance treats them as read-only (user-directed tool calls may still edit them).c3X<"TFpSP\V44xK! R#5ir )r r)r"r candidates& rr$)is_external_skill_path..s(^X]PTy''(DT(JKKX]s'*TF)rrarrr)rRr*)r,r0rs& @ris_external_skill_pathrss-T2I578E  ,./ 3^X]^33^3^3^X]^ ^^    sA44 BBctV^8dQhR\\\3,R\\\3,/#rlr)rs"rrrs*66$sCx.6T#s(^6rcVPR4p\V\4'dVPR4MRp\V\4'dV#/#)zG``metadata.hermes`` mapping from frontmatter, or ``{}`` when malformed.metadatahermesN)rfr9rG)rXrrs& r_hermes_metadatarsCz*H'1(D'A'AX\\( #tF--6525rctV^8dQhR\\\3,R\\\3,/#rlrGr(rra)rs"rrrs.AA$sCx.AT#t)_Arcn\V4p\Uu/uFq"VPV.4bK up#uupi)zPExtract conditional activation fields from parsed frontmatter (absent = ``[]``).)r_CONDITION_KEYSrf)rXrr[s& rextract_skill_conditionsrs2 k *F0? @C$ $ @@ @s2cV^8dQhR\\\3,R\\\\3,,/#rlr)rs"rrrs/!!4S>!d4S>>R!rc\V4PR4p\V\4'dV.pV'd\V\4'g.#/pVEFp\V\4'gK\ VPRR44P 4p\ VPRR44P 4pV'dWB9g V'gKRVRV/pVPR4e VR,VR&VPR4p\V\ 4'd'VP 4'dVP 4MTVR&WbV&EK \ VP44#)zExtract ``metadata.hermes.config`` declarations (key/description/default/prompt). Entries missing ``key`` or ``description`` are skipped; ``prompt`` defaults to the description.configr[r descriptiondefaultprompt)rrfr9rGrar(rSr)rXrrrr[descr prompt_texts& rextract_skill_config_varsrs+ ; ' + +H 5C#te jd++ (*F$%% $((5"%&,,.488M2./557cm4 !&]D A 88I  *#IE) hhx( 1;K1M1MR]RcRcReRe+++-kohs     rc\V^8dQhR\\\\3,,/#rrr[)rs"rrrs ##T#s(^(<#rc(/p\4p\4FpVP4'gK\VR4Fp\ VP RR74wrE\TPR4;'gTPP4pYa9g\T4'gKr\T4F"pTR,T9gKYgR&YpTR,&K$ K K \VP44# \ dKi;i)zConfig var declarations across all enabled, platform-compatible skills, deduplicated by key; each dict carries a ``skill`` attribution key.r2rrrr[skill)rr7rrr]rrRr(rfrirrprrar)all_varsr skills_dir skill_filerXru skill_namevars rdiscover_all_skill_config_varsrs+-H')H)+   "" 0ZHJ !2:3G3GQ\3G3]!^ [__V4NN 8I8I8N8NOJ%-CK-P-P0=u:X-#-L+.SZ(>I, ! ""  sD DDz skills.configcRV^8dQhR\\\3,R\/#)rr dotted_keyr)rs"rrrs"T#s(^rcTpVPR4F*p\V\4'dW29dR#W#,pK, V#)zGWalk a nested dict following a dotted key; None if any part is missing..N)rTr9rG)rrrgr#s&& r_resolve_dotpathrs?G  %'4((D,?-& Nrz\$(?:\{HOME\}|HOME)(?=$|[/\\])c0V^8dQhR\R\/#)rr\rr?)rs"rrr's99S9S9rc0a\4oS'dIVR8XgVPR4'dSVR,,p\PV3RlV4p\P P \P PV44#)a\Expand ``~`` / ``$HOME`` against the HOME Hermes injects into tool subprocesses. Skill config defaults describe paths the agent hands to tools, so in a container where the control process HOME (``/opt/data``) differs from the tool HOME (``{HERMES_HOME}/home``) a plain ``expanduser`` pointed the prompt at a path no tool would ever read (#12260). ~:rNNc<S#r r)_msubprocess_homes&rr+_expand_skill_config_path..4sOr)rz~\)r rM _HOME_VAR_RErryr,rr)r\rs&@r_expand_skill_config_pathr'sn*+O C<5++M::#eBi/E  !;UC 77  bgg007 88rcV^8dQhR\\\\3,,R\\\3,/#)r config_varsrr[)rs"rrr8s0  T$sCx.-A d3PS8n rc`\4p/pVFp\V\ RVR, 24pVe-\V\4'd)VP 4'gVP RR4p\V\4'dRV9gRV9d \V4pWBVR,&K V#)zMap logical skill config keys to current values (or declared defaults); path-like string values are ``~``/``$HOME``/``${VAR}`` expanded against the tool HOME.rr[rrr$)rrSKILL_CONFIG_PREFIXr9r(rSrfr)rrrrr\s& rresolve_skill_config_valuesr8s F!H ,?+@#e*)NO =Zs33EKKMMGGIr*E eS ! !se|se|-e4E$U  OrcRV^8dQhR\\\3,R\/#rlr)rs"rrrJs&BBd38nBBrcVPRR4pV'd)\V4P4PR4#R#)z@Normalize a skill's description field for comparison/truncation.rrz'")rfr(rS)rXraw_descs& r_normalize_skill_descriptionrJs7}b1H193x=   & &u -ArArcRV^8dQhR\\\3,R\/#rlr)rs"rrrPs&gg4S>gcgrcr\V4p\V4\8dVR\^, R,#T#)zCExtract a system-prompt-length description from parsed frontmatter.Nz...)rrSKILL_PROMPT_DESC_LIMIT)rXrs& rextract_skill_descriptionr Ps7 ' 4D9TdTrc8\\V44\8#)zMTrue when the description will be truncated in the system prompt skill index.)rrr ros&r)is_skill_description_truncated_for_promptrVs +K8 9 C z^[a-zA-Z0-9_-]+$chV^8dQhR\R\\\,\3,/#)rrr)r(rFr)rs"rrrks(66s6uXc]C-?'@6rcHVPR4wrpV'dW3#RV3#)zcSplit ``'namespace:skill-name'`` into ``(namespace, bare_name)``; ``(None, name)`` without ``':'``.rKN) partition)r namespacesepbares& rparse_qualified_namerks)>>#.ID #I 5$5rcFV^8dQhR\\,R\/#)rrr)rr(r)rs"rrrqs"DD(3-DDDrcd\V4;'d\\PV44#)zDCheck whether *candidate* is a valid namespace (``[a-zA-Z0-9_-]+``).)r _NAMESPACE_REmatch)rs&ris_valid_namespacer$qs$  ? C CtM$7$7 $BCCrcV^8dQh/^\9d\\\3,;R&^\9d(\\\.\3,3,;R&^\9dL\\ \\ \ \ \ 3,\\\3,3,;R&^\9d \;R&^\9dF\\ \\ \ \ \ 3,\\,3,;R&^\9d"\\ \R3,,;R&^\9d\\\3,;R&#) rrrrrr.rmr) __conditional_annotations__rGr(rrrFrrrrarr)rs"rrrsQQb('4T ?'cQ^S(2t8,,-_QDML4c3S#56S#XFGLEQd:9)9eQ| LKd5c3S!894:EFK} Qj .-U38_%-k Qf0/4T ?/gQr)r|z.githubz.hubz.archivez.curator_backupsz.locksz.venvvenv node_modulesz site-packages __pycache__z.toxz.noxz .pytest_cachez .mypy_cachez .ruff_cache) references templatesassetsscriptsr )fallback_for_toolsetsrequires_toolsetsfallback_for_toolsrequires_toolssession_platforms)wr&__doc__rr;loggingryrNrb threadingpathlibrrtypingrrrrrr r rr r r getLogger__name__rrerr!r3r-r+rBrDr]rjrprr~rrrrrrrLockrrrrrrrrrrrrrrrrrr$r~r*r+r,r-AMBIGUOUS_SKILL_PREFIXrrmr3r7r@rDrSrXrxr,rrrrrrrrr)rrrrrrrrrrrrrrrcompilerrrr rr rrr"rr$r)r&s@rr=sQ  "BBB   8 $7GYH !OPh4h $  ". E&('& nh X1 @,KML#)" <@ C ? ;((899 'e(W JLK C:( '