+ iHj"(a0t$Rt^RIHt^RIt^RIt^RIHt^RIH t H t H t H t H t Ht]P!R4t/tR]R&Rt^@tR R ltR R ltR RltRRltRRltRRRR/RRlltRR/RRlltRRltRRltRRlt.R OtR#)!uWorkspace and project-root resolution for LSP. 1. **Workspace gate** — LSP only runs when the cwd (or the edited file) sits inside a git worktree, so gateway users on user-home cwd's never spawn daemons. 2. **Workspace trust** — whether a server may load code the project itself ships. 3. **nearest_root** — the per-server project-root walk: up from a start path looking for marker files (``pyproject.toml``, ``Cargo.toml``, ...), optionally bailing if an exclude marker shows up first. ) annotationsN)Path) AbstractSetIterableIteratorOptionalSetTuplezagent.lsp.workspacedict_workspace_cacheic V^8dQhRRRR/#)pathstrreturn)formats"8/home/ubuntu/.hermes/hermes-agent/agent/lsp/workspace.py __annotate__rs5555cz\PP\PPV44#)uExpand ``~``, make absolute, collapse ``.``/``..``. Symlinks are deliberately NOT resolved — some servers (rust-analyzer's Cargo workspace identity) care, and we want the path the user typed.)osrabspath expanduser)rs&rnormalize_pathrs& 77??277--d3 44rc V^8dQhRRRR/#)r startrrzOptional[Path]r)rs"rrr#s  c n rc\\V44pVP4'd VPpV# \\ \ 3dR#i;i)zPNormalized start directory (a file's parent), or ``None`` on pathological input.N)rris_fileparentOSError RuntimeError ValueError)r start_paths& r _start_dirr$#sS./0     #**J  \: .s6:AAc V^8dQhRRRR/#)r rrrzIterator[Path]r)rs"rrr/sD^rc#t"Tp\\4FpVxVPpW18XdR#TpK R#5i)zVYield ``start`` and its ancestors up to the filesystem root, bounded by ``_MAX_WALK``.N)range _MAX_WALKr)rcur_rs& r_walk_upr+/s4 C 9   =  s68c V^8dQhRRRR/#)r rrr Optional[str]r)rs"rrr:sS]rc\V4pVfR#\P\V44pVe V^,#Rp\ V4F.pVR, P 4'd\V4pMK0 W3RJ3\\V4&\\4\8d\P4V# \ dKRi;i)ueReturn the nearest ancestor dir containing ``.git`` (file or dir — worktrees count), else ``None``.Nz.git) r$r getrr+existsr len_WORKSPACE_CACHE_CAPclear)rr#cachedresolvedr)s& rfind_git_worktreer6:sE"J  ! !#j/ 2F ayH # f $$&&s8'$*243G(HS_% 33 O    s(B?? CCc$V^8dQhRRRRRR/#)r rrworkspace_rootrboolr)rs"rrrPs!  c 3 4 rc\V4p\V4pW#8XdR#\PPW#.4V8H# \dR#i;i)zTrue iff ``path`` is inside (or equal to) ``workspace_root``. Symlinks are not resolved: a symlink pointing outside still counts as outside, matching servers that reject didOpen for unrelated files.TF)rrr commonpathr")rr8proots&& ris_inside_workspacer>PsS tA . )Dyww!!1),44 s"A AAexcludesceilingc ,V^8dQhRRRRRRRRR R/#) r rrmarkers Iterable[str]r?zOptional[Iterable[str]]r@r-rr)rs"rrr_s:'' ' '& '  '  'rcj\V4pVfR#V'd\\V44MRp\V4pV'd \V4M.pRRlp\ V4FNp V!W4'dR#V!V R.4'gV!W4'd\ V 4u#VfKEW8XgKMR# R#)ubWalk up from ``start`` for the directory containing the first matched marker. Returns ``None`` past ``ceiling`` (or the filesystem root), or when an exclude marker is found first — the server is gated off for that file (e.g. typescript skips deno projects when ``deno.json`` precedes ``package.json``). Marker names are exact filenames — no globs. Nc$V^8dQhRRRRRR/#)r r)rnameslistrr9r)rs"rr"nearest_root..__annotate__ss!T$4rc|VF#pW, P4'dR#K% R# \dK7i;i)TF)r0r )r)rFnames&& rpresentnearest_root..presentssCD J&&(()   s , ;;z __init__.py)r$rrrGr+r) rrBr?r@r# ceiling_path markers_list excludes_listrKr)s &&$$ r nearest_rootrP_sE"J4;4w/0L=L&.DNBM # 3 & &s]O,,1K1Ks8O  #(;$ rcwdc$V^8dQhRRRRRR/#)r file_pathrrQr-rztuple[Optional[str], bool]r)rs"rrrs"#}PjrcT;'g\P!4pV'd \V4MRpVe\ W4'dVR3#\V4pVeVR3#R# \dRpLRi;i)zReturn ``(workspace_root, gated_in)`` for a file. The cwd's worktree wins when the file is inside it; otherwise the file's own worktree is the fallback anchor (monorepos / unrelated checkouts). ``(None, False)`` when neither is in a git worktree.NT)NF)rgetcwdr r6r>)rSrQ cwd_anchorcwd_root file_roots&$ rresolve_workspace_for_filerYs~''BIIK 1; ,H 3I H H~!),I$   sA$A$$ A43A4cV^8dQhRR/#)r rzset[str]r)rs"rrrs(rc^RIHp^RIHp^RIHp^RIHp\PPR4'd \4#\P.pV!V!RR44'gVPV4\R4p\4pVFGp\\!V!444pTfK#\%YX4'dK6TP'T4KI V# \"T3dK]i;i) apGit worktrees the operator pointed Hermes at: the launch dir and the surface-set workspace (``resolve_agent_cwd``: the Desktop/TUI session cwd, ``hermes -w``'s worktree, a gateway's ``terminal.cwd``). The agent's ``cd`` moves neither (it only moves the terminal's cwd). A repo at or above ``$HOME`` never counts: a dotfiles repo would trust every directory below it.)resolve_agent_cwd)get_session_env)TerminalPolicyUnavailable)is_truthy_valueHERMES_KANBAN_TASKHERMES_CRON_SESSION~)agent.runtime_cwdr\gateway.session_contextr]tools.terminal_scoper^utilsr_renvironr/setrUappendrr6rr r>add) r\r]r^r_anchorshomerootsanchorr=s roperator_workspace_rootsrps 47>% zz~~*++u yykG ?+@"E F F() # DeE $S]3D  $7$C$C IIdO  L 23   sC## C43C4c(V^8dQhRRRRRRRR/#) r r=r trusted_rootsrCoperator_rootszAbstractSet[str]rr9r)rs"rrrs*55s5=5Rb5gk5rca\;QJdV3RlV4F 'gK RM RM!V3RlV44'dR#\S4V9#)arTrue iff a language server may load code the project at ``root`` ships (its own interpreter, TypeScript SDK, config files, build scripts): ``root`` is inside an ``lsp.trusted_workspaces`` entry, or belongs to one of the ``operator_workspace_roots`` worktrees. A nested clone inside such a worktree has its own ``.git`` and is not trusted: the agent may have fetched it.c3<<"TFp\SV4xK R#5i)N)r>).0tr=s& r 'is_trusted_workspace..s ?A tQ ' 'sTF)anyr6)r=rrrssf&&ris_trusted_workspacer{s9  s ? ?sss ? ??? T "n 44rcV^8dQhRR/#)r rNoner)rs"rrrsTrc.\P4R#)zaClear the workspace-resolution cache (on service shutdown, so re-init doesn't see stale results).N)r r3rrr clear_cachersr)rr6r>r{rPrrprY) __conditional_annotations____doc__ __future__rloggingrpathlibrtypingrrrrrr getLoggerloggerr __annotations__r2r(rr$r+r6r>rPrYrpr{r__all__)rs@rrs# HH   0 1$  5 , ')- ' " 'Tt(:5 r