+ jHj%Rt^RIt^RIt^RIt^RIt^RIt^RIHt^RIH t ^RI H t ^RI H t HtHt^RIHtHtHtHtHt]P,!R4t]tRR ltR R ltR R ltRRltRRltRRltRRltRRlt ]!!4t"RR/RRllt#RR/RRllt$RRlt%RR/R R!llt&R"R#lt'R$R%lt(]!R&R'7!R(R)44t)R*R3/t*]PVR4R+R,ll4t,R-R.lt-R/R0lt.R5R1R2llt/R#)6a9Declarative env-credential bridge a platform plugin attaches to its ``PlatformEntry``. A platform declares ``env_overrides`` (ordered ``step(config)`` callables, usually :class:`EnvCred`, :func:`home_step`, :func:`reply_mode_step`) and ``env_enable_credentials`` (the env names its explicit-disable WARNING cites). ``gateway.config_env._apply_env_overrides`` runs the steps of every platform with activation evidence, so the data lives with the adapter instead of in a core table. Import-light on purpose (only ``gateway.config``): adapters import it at module load. N) dataclass)partial)Path)AnyCallableOptional) GatewayConfig HomeChannelPlatformPlatformConfig _getenv_strzgateway.configc0V^8dQhR\R\/#valuereturn)strlist)formats"9/home/ubuntu/.hermes/hermes-agent/gateway/platform_env.py __annotate__rsGGCGDGcVPR4Uu.uF*qP4'gKVP4NK, up#uupi),)splitstrip)rparts& rcsv_listrs3%*[[%5 F%5TLDJJL%5 FF Fs AAcTV^8dQhR\R\\.\3,/#)rdefaultr)intrr)rs"rrr#s%CHcUCZ0rcaRV3RllpV#)zA``int(raw.strip(), 10)`` with *default* on malformed/blank input.c0V^8dQhR\R\/#)rrawr)rr )rs"rrint_or..__annotate__%s33rc~<\\V4P4^ 4# \\3dSu#i;i) )r rr TypeError ValueError)r#rs&rparseint_or..parse%s9 s3x~~', ,:& N s "&<<)rr)sf rint_orr,#s Lrc0V^8dQhR\R\/#rr)rs"rrr-sssrc$VPR4#)/)rstriprs&r strip_slashr3-s << rc0V^8dQhR\R\/#rr.)rs"rrr1s!!s!s!rc>VP4P4#N)rlowerr2s&r strip_lowerr81s ;;=    rc0V^8dQhR\R\/#r)rbool)rs"rrr5s7777rc(VP4R9#)true>1onyesr<)r7r2s&r truthy_tokenr@5s ;;=6 66rc0V^8dQhR\R\/#rrr)rs"rrr9s22C2C2rc\P!V4# \d\TP RR44u#i;i)z(JSON list, else comma/newline separated. r)jsonloadsr(rreplacer2s&rmention_patternsrH9s;2zz%  2 dC0112s&AAcJV^8dQhR\\\3,RR/#)rextrarN)dictrr)rs"rrrAs"d38ntrcNVFwr#\V4pV'gKW@V&K R#)zO``extra[key] = csv_list(raw)`` for each ``(key, raw)`` whose list is non-empty.N)r)rJspeckeyr#itemss&& r csv_extrasrPAs#  5#Jrc$V^8dQhR\/#)rrr.)rs"rrrIs99s9rc\V\4'd \V4#\R\ \V44R4#)zKFirst truthy value among *envs* (a single name or a tuple of alternatives).c38"TFq'gK VxK R#5ir6r+).0vs& r env_first..Ms3-q-s  ) isinstancergetenvnextmap)envss&r env_firstr^Is3$d| 3C-3R 88rrFcVV^8dQhR\\\3,R\RR/#)rrJrrN)rKrrr:)rs"rrrUs)77d38n7d7t7rczVFvr4p\V4pV'dVP4pV'gK2V'dLV^,\Jd;\P!\ 4;_uu_4\ V4W&RRR4KV'dV^,!V4MTW&K R# +'giK;i)z``extra[key] = fn(value)`` for each ``(key, env[, fn])`` whose env value is truthy. ``strip=True`` strips BEFORE the truthiness check. ``fn=INT`` parses an int and silently ignores a non-integer value. N)rZrINT contextlibsuppressr(r )rJrMrrNenvfnrs&&$ r env_extrasrfUs  2s  KKME  "Q%3,$$Z00 Z 10*,AuEJ100s 0B)) B: c LV^8dQhR\R\R\R\RR/#)rconfigplatformenv_baserrN)rr rr:)rs"rrrhs1   ]  h  #  Y]  jn  rc \V4pV'dVP4pV'd\WP9dJ\Y\V R2R4\V R24;'gRR7VPV,nR#R#R#)zeSet ``home_channel`` from ```` (+``_NAME``/``_THREAD_ID``) when the platform is configured._NAMEHome _THREAD_IDN)richat_idname thread_id)rZr platformsr home_channel)rhrirjrros&&&$ renv_home_channelrthssXG --/8///2=8*E*F3v R\F]?^?f?fbf3 "/0wrc@V^8dQhR\R\R\RR/#)rrhrirdrN)rr r)rs"rrrts.UU=UHU3U4Urc\V4P4pVR9d+W0PPV\ 44nR#R#)offN>allrwfirst)rZr7rr setdefaultr reply_to_mode)rhrirdmodes&&& renv_reply_moder}ts> #;   D &&PT##Hn.>?M'rc<V^8dQhR\R\R\/#)rrirjr)r rr:)rs"rrr|s&XXXCX4Xrc&\\WVR7#)rirjr)rrtrs&&$r home_stepr|s #hQV WWrc0V^8dQhR\R\/#)rrird)r r)rs"rrrs??h?S?rc$\\WR7#)rird)rr}rs&&rreply_mode_steprs >H >>rc<V^8dQhR\R\R\/#)rrhrir)rr r )rs"rrrs!..M.X...rc^RIHpV!W4#)zEnable *platform* on env credentials unless config.yaml explicitly disabled it (warns once). Delegates to the core gate, which owns the explicit-disable marker and the one-time WARNING.)_enable_from_env)gateway.config_envr)rhrirs&& renable_from_envrs4 F --rT)frozencba]tRt^toRtRtRtRtRtRt Rt Rt Rt V3RlRlt V3RltRtVtR#)EnvCreda&Credential-gated platform enable, applied as ``step(config)``. ``creds``: env names that must ALL be truthy (inner tuple = ANY of). ``token``: env stored as ``PlatformConfig.token`` even when yaml disables the adapter (sending skills use it). ``fixed``: ``(extra_key, env[, default[, fn]])`` always written once enabled. ``optional*``: ``env_extras`` specs. ``warn_missing``: ``(env, msg)`` logged BEFORE enabling when blank. ``then``: tail ``fn(config, platform_config)``. ``home``: ``env_home_channel`` env base applied only when the gate passed. NFc$<V^8dQhRS[RR/#)rrhrN)r)r __classdict__s"rrEnvCred.__annotate__sVV}VVrc\;QJd&RVP4F 'dK RM RM!RVP44'gR#VP'dI\VP^,4'g'\P VP^,4\ WP4pVP'd$\VP4;p'dW2nVPpVPFqvrVpV'd V^,MRp\V\4'd\V4;'gTM \Wh4p \V4^8dV^,!V 4MT WE&Ks \W@P 4\W@P"RR7VP$eVP%W4VP&'d/\)WPVP&VP*R7R#R#)c38"TFp\V4xK R#5ir6)r^)rTgroups& rrV#EnvCred.__call__..s<9U##sFTNrX)r)rxcreds warn_missingrZloggerwarningrritokenrJfixedrYtupler^lenrfoptionaloptional_strippedthenhomert home_strip) selfrhplatform_configrrJrNrdrestrrs && r__call__EnvCred.__call__s[s</.py`` (a light declaration module importing only core) executed from its file under a private name: the plugin package (``__init__``, adapter, ``register()``) is never imported. None when absent or *directory* is not a bundled plugin.)r Npluginsrrz.py_hermes_bundled__)gateway.configr _scan_bundled_plugin_platformsr__file__resolveparentis_file importlibutilspec_from_file_locationmodule_from_specloader exec_module)rrr pathrMmodules&& rbundled_siblingrs (??A!DD > ! ! # * * 1 1I = Ki W]a\bbeZf fD <<>> >> 1 14DTF!I;2WY] ^D ^^ , ,T 2FKKF# MrcFV^8dQhR\R\\,/#rrpr)rrr)rs"rrrs" Q Q3 Q8E? Qrc\PWR34wr\V4pVfR#\\ W2 R2R4;'gR4\\ W2 R2R4;'gR43#)ao``(env_overrides, env_enable_credentials)`` a BUNDLED platform plugin declares, read without the plugin. For when its registry entry is absent: discovery suppressed (a parked profile's config read, ``HERMES_SAFE_MODE``) or the plugin disabled. These rows were core's own table, and the duplicate-credential guard and the explicit-disable warning still need them then.rXN ENV_OVERRIDESENV_ENABLE_CREDENTIALSr+)_BUNDLED_ENV_SIBLINGSgetrrgetattrrprprefixrs& rbundled_env_rowsrsv .11$r CI Y 'F ~ '&HM":B?EE2 F '&H,B"CRHNNB O QQrc0V^8dQhR\R\/#r)rrK)rs"rrrs]]]]rc\PWR34wr\V4pVe#\\ W2 R2R4;'g/4#/#)z``AUTHZ`` (allowlist / allow-all / allow-bots / own-policy env names) a bundled platform plugin declares in its ``gateway_env.py``, read without the plugin; {} for other names.rXNAUTHZ)rrrrKrrs& r bundled_authzrsQ.11$r CI Y 'FBHBT4(% 0$7==2 >\Z\\rcHV^8dQhR\R\R\R\/#)rrpfieldentryrrB)rs"rrrs.NNcN#NcNSNrcVe \W!R4MRpT;'gJ\\T;'gR4P4P 44P V4#)z*entry*'s authorization env field, else the bundled plugin's declaration. A user plugin overriding a bundled platform, safe mode or a disabled plugin then still gate on the names core always enforced for it; never looser than the bundled adapter.NrX)rrrrr7r)rprrrs&&& r authz_fieldrsQ,1+rs !**\\   + ,  G!729 h7U7&  `e  UX%X?. $&V&V&VX*+AB    Q]NNr