+ jHj ~aRWtV0tRt^RIHt^RIHt^RIHt^RIH t ^RIt^RI t ^RI t ^RI H t ^RIHt] P !]4t]!0RXm4tRYtRtR tR tR tR R /RltRtRtRZtR[tR\t]!RRR7t ]^k]!RRR7t!]^kRRRRRRRRRRRR/t"]!RR04t#]!]"4]#, t$]!0R]m4t%Rt&R]$4UUu/uFpVFpWbK K uppt'R^Rlt(R_t)]!RR7!R R!44t*R"t+R#t,R$t-R%t.R&t/R't0R(RR)RR*R R+R /R,lt1R-t2R.t3R/t4R0t5R1t6R2t7R`R3lt8R4t9RaR5lt:R6t;R7tR:t?R;RRlt@R?tAR@tBRAtCRBtDRCtERDtFREtG]H3RFRGlltIRHtJRItK]RJ4tLRKtMRLRMltNRNROltO]RPR/RQl4tPRRtQRStRRTtS]RU4tTRVtUR#uuppi)bzHFrozen, explicit local-client launch policy for the existing TurnRunner.)contextmanager) ContextVar) dataclass)cached_propertyN)PathRuntimeStoreErrorfollow_adopted desktop_local session_pinscVP\4p\V\4'd.\VPV4\4'd W1,#T#)z^Whether *field* is the session's own choice: its last committed session edit, else *launched*.)get SESSION_PINS isinstancedictbool)configfieldlaunchedpinss&&& ;/home/ubuntu/.hermes/hermes-agent/gateway/session_policy.pysession_pinnedr*s? ::l #D$T400ZQU5V5V4;d\ddsessionFcWPR/4R&VR,PRR4V'd//VP\4;'g/CRR/CV\&R#R#)zWrite an explicit session reasoning level into *config*: it wins over a per-model default (``reasoning_overrides``), at creation, on ``/reasoning`` and on a model pick that carries one. A *session* edit also records the pin.agentreasoning_effortreasoning_overridesN reasoningT) setdefaultpopr r)reffortrs&&$rpin_reasoning_effortr"0s`:@gr"#56 7O-t4V6::l#;#A#ArVKQUV|rc^RIHp\V!\VPP 4P 4PR, 44#)zPThe owning profile's current ``config.yaml`` (its present sections), read fresh._load_gateway_config config.yaml) gateway.runr%present_sectionsrdbdb_pathresolveparent) authorityr%s& rprofile_configr.:s:0 0ill6J6J1K1S1S1U1\1\_l1lm nnrc"^RIHp\VPR4\4'dVPR4M/pVP R/4pRF pV!WCV4K /VP\ 4;'g/CRR/CV\ &R#)z``/reasoning reset``: the level is *profile*'s (its current config) again, re-read every turn by a following session and on each resume by any other; a create-time ``reasoning`` included.)_followrrFN)rr)gateway.session_policy_refreshr0rr rrr)rprofiler0followedrkeys&& runpin_reasoningr5@sz7'1'++g2F'M'Mw{{7#SUH   gr *E:%;Svzz,7==2S USF<rlocal_session_policydefaultfollow_profile_readclituiguidesktopacptooloneshotcPV\9dR#V\9d\V,#T#)a``created_source`` for a policy or live label. ``local`` and ``unknown`` are not surfaces. A label stored as ``local`` maps through ``SURFACES`` (``gui`` is ``desktop``). Any other label, including ``tool`` and ``oneshot``, is kept as itself: created_source is provenance. N)_NOT_A_SURFACESTORED_AS_LOCALSURFACES)labels&rcreated_surfacerF^s% #68E?AEArc#R"TFp\V\V,04xK R#5iN) frozensetrD).0rEs& r rKms$+m]lTYIuhuo6N,O,O]ls%'c\RWR7h)aeOne named refusal: the launch field the check read, and why it failed. ``reason`` stays the bounded wire code every caller compares as a string; ``field`` and ``detail`` are what tells ~20 different create checks apart, in the client and in the gateway log, without a second run to find out which one fired (``RuntimeStoreError`` bounds and flattens both).invalid_paramsrdetailrrNs&&r_refuserPqs ,E IIrT)frozenc^a]tRt^toRtRtRtRtRtRt Rt Rt Rt Rt RtRtRtRtRRR/RlltRRR/R llt]R 4tR tR tRR ltRtRt]R4t]R4t]R4t]R4t]R4t ]R4t!]R4t"]R4t#]R4t$]R4t%V3Rlt&Rt'Vt(R#)LocalSessionPolicyNFaskcbVPfR#\P!VP4#rH)client_env_jsonjsonloadsselfs&r client_envLocalSessionPolicy.client_envs'++3tYDDXDX9YYrc^RIHpVPfRM\P!VP4pV!VP 4VP '*VR7#))client_env_scopeN)localrules)agent.session_client_envr_client_env_rules_jsonrWrXr[client_env_remote)rZr_ras& rr_#LocalSessionPolicy.client_env_scopesF=22: 4KeKe@f 1T=S=S9S[`aarsecretsTc4VPWR7^,#)rf effective)rZr-rfs&&$rrLocalSessionPolicy.configs~~i~9!<?  +  ! ! -)2GG j.y?I(0 7?9C;Efd;S;SV..sB7Y_YdF%$)tBx  1 $FGIy",MwW`bkmqOr s  4$jj177RDDUDU9VG::12Dt#ii^D5I0J(Jii|\bOiDCMQXCX)+>?^a^cF#FK9OPF V)+@AQTQV VF .G*C~& NF&&=;"&)FKJJsD) '",VZZ5H5N5NB"Ow>.t4BB  & 1 1'2 >@Q@W@WUW:E(&=*$!+CE#JIIc4( )EOvzzZaObdhDiDi&**W%++00@os E+5eT+B+B $).7OI &}rc\P!VP4PR4RJ;'g6\P!VP4P\ 4RJ#)follow_profile_configT)rWrXrr r{FOLLOW_ADOPTEDrYs&rfollows_profile"LocalSessionPolicy.follows_profiles[ 4,,-112IJdRLL::d../33NCtK Mrc VeVP'gR#\P4pVeV^,V8Xd V^,#\V4#)z}The owning profile's current config for a following session, else None; inside this policy's turn scope, the turn's one read.N)r _TURN_PROFILEr r.)rZr-rs&& rr|LocalSessionPolicy.read_profilesJ  D$8$8$8  "  Q47Ni((rc  JVP'dIVP\9g4VPf&R\P !VP 49d VP#\\\/WPVPVP444#)zThe next turn's toolsets from its resolved *config*: a following session without an explicit toolset pick runs the profile's current selection (main #124211), else the frozen launch set.rr) rrrDeditor_mcp_jsonrWrXrrrtuplesorted_resolve_toolsets safe_modecoding_posture)rZrs&&rcurrent_toolsets#LocalSessionPolicy.current_toolsetsst$$$ 8(CtG[G[GgD,=,=!>>== V-b&++t~~W[WjWjklmmrc l\VRR4pV'd Ve V!V4MRpVe8VPPe \VPP4#VP'g VP #^RIHp^RIH pVPV!V4RR7wrxT!Yx;'gR4#)zThe next turn's reasoning: a typed session /reasoning (the messaging handler's override), else the profile's current effort when following, else the frozen one._peek_session_stateNactive_authorityresolve_reasoning_configFrh) r conversationreasoning_overriderrreasoning_configgateway.session_authoritiesrhermes_constantsrrj) rZrunner session_keypeekstaterrrrps &&& rcurrent_reasoning_config+LocalSessionPolicy.current_reasoning_configsv4d;%0T5E[!4  !3!3!F!F!R**==> >###(( (@='7'?O ' <!B!B>SX!YYrc b\P!VP4PRR4#)z`hermes chat --yolo`: this session's dangerous-command approvals are bypassed, exactly the scope `/yolo` gives a messaging chat; never the process-wide HERMES_YOLO_MODE.yoloFrWrXrr rYs&rrLocalSessionPolicy.yolo/s&zz$++,00??rc b\P!VP4PRR4#)zD`--pass-session-id`: the session id rides the agent's system prompt.pass_session_idFrrYs&rr"LocalSessionPolicy.pass_session_id5s'zz$++,001BEJJrc VP4PR/4p\\V\4'dVPRR44#T4#)zXFrozen `checkpoints.enabled` (`--checkpoints` folds into it); legacy bool form accepted. checkpointsenabledF)rr rrr)rZsections& rcheckpoints_enabled&LocalSessionPolicy.checkpoints_enabled:sG++-##M26Z5N5NGKK 51\\T[\\rc^RIHpVP4pV!VPR/4PRVPR444#)r^resolve_turn_limitr max_turns)hermes_cli.configrrr )rZrcfgs& rrLocalSessionPolicy.max_turns@s=8kkm!#'''2"6":":;P[H\"]^^rc b\P!VP4PRR4#)z`hermes chat -v`: the session's agent runs with quiet_mode off, so its status lines reach the viewer (``agent.print``) as main's in-process verbose agent printed them.verboseFrrYs&rrLocalSessionPolicy.verboseFs&zz$++,00EBBrc x^RIHpV!VP4PR/4PR44#)zSFrozen `agent.run_budget_seconds` (`--run-budget` folds into it); None = no budget.)_normalize_run_budget_secondsrrun_budget_seconds)agent.agent_initrrr )rZrs& rr%LocalSessionPolicy.run_budget_secondsLs2 C,T[[]->->w-K-O-OPd-effrcd^RIHpT!VP4VP;'gR4#)r^rr)rrrrp)rZrs& rr#LocalSessionPolicy.reasoning_configRs$=' tzz7G7GRHHrc<V^8dQh/S[;R&S[;R&S[;R&S[R,;R&S[S[R3,;R&S[;R&S[;R &S[;R &S[R,;R &S[R,;R &S[R,;R &S[R,;R&S[;R&S[;R&S[R,;R&S[;R&S[R,;R&S[;R&S[R,;R&S[;R&#)rplatformcwdNrp.rrr{r terminal_jsoncredential_refr}r kanban_jsonrignore_user_config skills_promptrrVrdrcedit_approval_policy)strrr)format __classdict__s"r __annotate__LocalSessionPolicy.__annotate__s0 KM H  :  CHo $J%Tz(4Z&t" !"$#(:$)0 164Z&7<#=D:,EJ%KrrzrH))__name__ __module__ __qualname____firstlineno__rr}rrrrrrrVrdrcrr[r_rrjrrr|rrrrpropertyrrrrrrrrrr__annotate_func____static_attributes____classdictcell__)rs@rrSrSs"&N$("&O"KI$!%M!N#'O$)-!&Zb ==848tMM )n = S;>>>>ZZ@@ KK]] __ CC gg IIirrScVPR4p\V\4'd\VPR4;'gR4P 4p\VPR4;'gR4P 4VP 4R8XdR3#T3#\V\4'dVP 4R3#RR3#)z`(model, provider) a profile config selects; 'auto' is no provider (main's _config_model_target).rprrr8auto)r rrrstriplower)rrprs& rrrXs JJw E%uyy,22399;599Y'--2.446hnn>NRX>Xff^fff's33EKKMb @@b @@rc^RIHp\V\4'dTM/p\ VP R4;'gR4P 4P4V!VP R443#)zf``(provider, endpoint)`` identity of a ``model:`` block: what an endpoint-bound credential belongs to.normalize_route_base_urlrrr)hermes_cli.route_identityr rrrr rr)blockr s& r model_routeras^Bt,,E"E uyy$** + 1 1 3 9 9 ;=UV[V_V_`jVk=l llrc^RIHpHp\V\4'dTM/pV!W4wrgRWd!W#4^,39d\ V4\ V48H#T!V'd/VCRV/CW#4#TW#4#)aWTrue when *block* (resolved in *config*) is the route *bound* was bound to, *bound* resolved in the config it was bound in: a respelled provider on one endpoint is one route, and a named entry whose ``base_url`` moved is another. An ``auto``/unset side keeps the literal comparison: a credential never follows a route the resolver picks later.)resolved_route same_routerr)gateway.session_route_identityrrrrr)bound bound_configr rrridentityurls&&&& rbound_route_holdsrhsy Jt,,E"E"57MH (N59!<==5![%777 C00 C0E RRUE RRrcaa ^RIHo\V\4'dTM/pS!VP R44o S 'gR#^RIHp\VP R4;'gR4P4pV'd V!W14.M.pVP R4p\V\4'dY\V4^8dITpVRR F,p\V\4'dVP V4MRpK. VPV4\;QJd VV 3R lV4F 'dK R # R#!VV 3R lV44#) aFalse when *block* pins a ``base_url`` that the config entry its credential comes from no longer serves in *config*: its named provider (``providers:`` / ``custom_providers:``), or the alias its ``api_key_from`` points into. That entry's key (inline, ``key_env``, ``key_cmd``) authenticates the entry's own endpoint, so a pick held on the old one ends rather than carry the new key there.r rT) _named_entryrrrwNc3<"TFqp\V\4'gK\VPR4;'gR4P 4'gKUS!VPR44S8HxKs R#5i)rrN)rrrr r)rJentryr rs& rrKentry_serves..sbXSZ%UD)F.1%))J2G2M2M2.N.T.T.VF' *(=>#ESZsA<A<A<"A<Fry) r r rrr rrrrrlenappendall) r rrrentriesraliasrr rs && @@rrrus Ct,,E"E "599Z#8 9C ;599Z(..B/557H2:|H-.G YY~ &F&$CK!O3BKD'1%'>'>EIIdODE u 3XSZX33X3X3XSZX XXrc\V4\V48wdV#/VP4UUu/uFwr#V\9gKW#bK uppC\Uu/uFq"V9gK W V,bK upC#uuppiuupi)zA pick that still holds keeps its selection; on the profile's own endpoint the rest of the ``model:`` block (a rotated key included) is the profile's. Another endpoint never gets it.)rrSELECTION_KEYS)rQrkvs&& rrrs{6k$//  E H 0Gtqt H E%3C^F{|q)|^C EEHCsA4A4A:# A:cVP4UUu/uF wrVfK WbK ppp\VPR4\4'd.VR,P 4'd RVR,/M/VR&V#uuppi)zA bare ``gateway:`` key parses as YAML null; like load_config's merge (#58277), treat it as absent so ``cfg.get('gateway', {}).get(...)`` reads the default instead of crashing a fresh install's first turn.rpr8)rrr rr)rr4rs& rr(r(sn,2<<> O>ZSUjcj>F O&**W%s++:@/:O:O:Q:Q9fWo6WYw M Ps A>A>private_secretsprofile_terminalworkspace_posture client_localc< a^RIHp^RIHpHp^RIHp SPRR4p V R8Xd^RIH p V !SWR7#\\S4\, 4p V 'g"\V \4'd V \9d/\!V 'd R V ^, 2MRV 'dR MR V : 24\#V3R l\$4R 4p V 'd \!V R4SPRR4pT;'gSPRR4pRS9dG\SR,\4'dSR,P'4'g \!RR4SPR4pRS9d9\V\4'dVP'4'g \!RR4SPR\V!444p\V\4'd?\)V4P+4'd \)V4P-4'g \!RR4SPR4pRS9dJ\V\4'd(V'd,\)V4P+4'g \!RR4SPR4RJd"RS9d\/V !44;'gTp^RIHpV!V SPR44\5S4\7\8P:!\8P<!V444p0R)m\\?S44,pSPR4RJd0V'd(\A\CV44VPER/4R&\GSV4T;'d V R8g;'dRS9;'dR S9pT;'d \IWV4p\KSWVVVR!7pV'dV!V !44MV!4pSPR4RJg\MV4'dVVR"&R ;ppR#S9dQ^R$I'H(pH)pV!WR%7p\8P<!V!SR#,V4RR&7p\8P<!VRR&7pSPW4UUu/uFwppVR*9gKVVbK p ppV PERR4^R'I,H-p!V!!V V4\]W4\]VVR+4\_T \V ,TT\a\V44\8P<!V4\8P<!V RR&7\8P<!V4YTTVR J;'dV'*VR(7# \Td!p\!R#\T44R p?EL)R p?ii;iuuppi),r^)resolve_agent_cwd)build_profile_terminal_scopedefault_terminal_scope)get_hermes_homerr:a2a)build_forward_policy)r'zparams.zunknown create fieldznot a surface: c3p<"TF+qS9gK \SV,4\JgK'VxK- R#5irHtyperrJnameparamss& rrKbuild_policy..s-k tDQWX\Q]L^fjLjtt s 66 6Nmust be a booleanrFrrxmust be a non-empty stringrprz1must be an absolute path to an existing directoryrow_cwdz!must be an absolute path when set cwd_explicit)validate_editoreditorrTrqr?rr)bypass TERMINAL_CWDr[)client_env_rulesnormalise_client_env)r`) sort_keys)private_editor_request)rrrrVrdrc>rprr>rxr[ request_idrH)1agent.runtime_cwdr,tools.terminal_scoper-r.rr/r gateway.session_a2ar1rr CREATE_FIELDSrrrDrPnext BYPASS_FIELDSrr is_absoluteis_dir_profile_workspace_cwdgateway.session_local_editorr= launch_skillsr(rWrXdumps_without_auto_pickrrr_apply_launch_overrides_in_coding_workspacerterminal_uses_host_cwdrbrArB ValueErrorrgateway.session_local_mcprD_extract_config_secretsrSr)"r7rr'r(r)r*r,r-r.r/rr1unknown bad_bypassrrrprr;r= picked_routenamedrrterminalr[rarArBexcr$r%rrDs"f&$$$$ r build_policyr_sq3Y0 ZZ% (F <#FFTTS[=01Gj--x1G'''!*&x*1& 7S Uk kmqrJ /0 ;.I"MMfjj1Eu&MFJvi/@#$F$FfU^N_NeNeNgNg 78 JJw E&*UC"8"8 56 **UC 1 34 5C c3  tCy'<'<'>'>d3iFVFVFXFXJKjj#GFJw$<$<QUV]Q^QjQjQlQl >? zz.!U*u$_%67>>3<FFJJx01& djjF);< =F4s;Mf;U7VVL zz)*d2|?C>RXCY>Z'2&':;FF+  c c&F"2 c cu c c:]cKcEHH3FCHN >ZlmGBR+O,=>XnXpHzz.!T)-CH-M-M#& JvS < ,$8 9Mu$UaefJ 5D1 & c1!;b2btq!tGc x'@7O4F4How? fhv&6UE&QX/DZ"jj0$**WPT2UW[WaWabjWk(1-;Z0:$0F0[0[|K[49  ;; , L#c( + + ,ds$&U* V#V* V5VVc@\VPR4;'gR4P4P4p\VPR4;'gR4P4P4R9pVR8H;'gVR8H;'dT#)zWhether the terminal works in the session's host cwd: the local backend, or docker mounting it at ``/workspace``. ssh, modal and the other sandboxes resolve their own cwd. TERMINAL_ENVr`&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACErdocker>1onyestrue)rr rr)r]backendmountss& rrUrUs(,,~.99':@@BHHJG FGMM2 N T T V \ \ ^b| |F g  A A'X"5"@"@&Arc^RIp^RIHpV!V4R9dR#^RIHpV!\ V4R, 4P R4p\\V\4'dTM/P R4;'gR4P4pVR 9d5VPPVPPV44MRpV'd$VPPV4'dV#R#) zA NAMED profile's configured ``terminal.cwd``, which beats a client cwd the Desktop only inherited (``cwd_explicit: false``; main's ``_completion_cwd``). Placeholders and missing dirs are unset.N)profile_name_for_home)read_user_config_rawr&r]rr>Nr8>r.rr)osrrkrrlrr rrrrrabspath expanduserisdir)homernrkrlr]raw configureds& rrNrNs6T"&776#DJ$>?CCJOH :h55x2BB5IOOR P V V XC=@H`=`!3!3C!89fjJ# j(A(A:KtKrc \VPR4\4'dXVR,P4P 4R8Xd.VP 4UUu/uFwrVR8wgKWbK upp#V#uuppi)zc`provider: auto` is the thin client's "no pick" sentinel: the profile's route stands as configured.rr)rr rrrr)r7r$r%s& rrRrRsi&**Z(#..6*3E3K3K3M3S3S3UY_3_!'C1 ?CC MDs # A?3A?c^RIHpHpV!V4pVR8Xg-\V\4'dVP 4'gR#V!RV/V4^,V8H#)aTWhether a provider pick resolves to the profile's own route, so its endpoint and key pins stay. The same resolved provider under another spelling (`vllm` for `custom`, `deep-infra` for `deepinfra`, `custom:` for a named entry) is the same route. A block with an endpoint and no provider (or `auto`) already routes to `custom` there. )profile_route_identityrrFr)rrwrrrr)pickedrrwrheld_ids&& r_keeps_profile_routerz sOV$V,G& 63 7 7v||~~ :v. 7 :g EErc^RIHpHpVPR4p\ V\ 4'gV#V!V4pVR8Xg4VP 4P4V!WQ4;'gR8wdV#/VCRV/C#)a-*params* with a provider pick of the held entry's bare config key spelled as its ``custom:``. A configured entry keyed like a canonical built-in (`providers: deepseek`) is shadowed by the built-in in raw provider resolution, so the bare spelling would route, and be frozen, as a different provider than the entry the profile runs (#140107). Only the held entry's bare key is that entry (Desktop's guard). A keyed entry's display name is not; a keyless legacy ``custom_providers:`` entry's is (``configured_entry_key``). Other picks stay as they came. )configured_entry_keyrwrrN)rr|rwr rrrr)r7rr|rwrxrs&& r_with_entry_pickr}sv\ ZZ #F fc " " %f-H6V\\^1138LX8^8f8fbfg +f +j( ++rca^RIHp^RIHp^RIHp\ \S4V4oRS9;'d\SR,V4pRS9d<V'g4TPR/4p^RI H pVFpVPVR4K RFp V S9gK SV ,p \V \4'dV P4'g \!V R 4V R8XdV!V 4p V P"R9g[V P$'dIV P&'g7V P('g%V P*'gV P,'d \!RR 4WPR/4V &K \/V3R lR4R4p V 'd \!V R 4RS9dp^RIHp \SR,\4'dV !SR,4MRpVf\!RRSR,: 24T;'gRVPR/4R&RS9dmSR,p \V \64'g$\V \8\:34'dV ^8g \!RR4\;V 4VPR/4R&SP=R 4'dUVP=R 4p\V\>4'd \?V4MV'dR\7V4/M/p/VCRR/CVR &RS9d_SR,p \V \8\34'd V!V ^R7M^pV'g\!RRV : 24VVPR/4R&RS9d[\SR,\4'dV!SR,4f\!RRSR,: 24\AVSR,4R#R# \4dRpELi;i) zOValidate the explicit model/agent launch overrides and fold them into *config*.)urlsplitr)parse_reasoning_effortrrp)ROUTE_BOUND_KEYSNrr:z=must be an http(s) URL without credentials, query or fragmentc3r<"TF,pVS9gK \SV,4\JgK(VxK. R#5irHr3)rJflagr7s& rrK*_apply_launch_overrides..Js>K'Zd+/t +=T+IT'Zs 77 7rr9ru)parse_exact_service_tierznot a known tier: normalr run_budgetz$must be a positive number of secondsrrTrr7zunreadable cap: rznot a known effort level: )rr>httphttps)rrr accept_hooksrrr<r)! urllib.parserrrrrr}rRrzrrrr rrrrPschemehostnameusernamepasswordqueryfragmentrJrrrVrintfloatr rr")r7rrrrpicks_profile_entryrprstaler4rrbad_flagrtierrlimitsf& rrSrS+sO%47 08& AF$.cc3GzHZ\b3cV$7!!'2. D%E IIeT "&' &=3KEeS))9:j uoJJ&77s|||<<<3<<<3999 J(gh27  gr *3 /(K'ZKLPRH-. = GQRXYgRhjmGnGn+F>,BCtxD < N&89O8R$S T9=9I9I'2&~6v|$ eT " "*US%L*I*IQVYZQZ L"H I?DU|'2&';< zz-  **]+#-gt#<#<$w-`g9dSZmB\mo <7 6;'2&{3f&-s337MfU`Na7b7j K#=f[>Q=T!U VVVK%891 D s0.N>> OOc $^RIHpHp^RIHp^RIHp VPR4p RV9Ed\V \4'g#\RR\V 4P 24V'dT MV!V4p \VPR4\4'dVPR4M/p V 'd V!V4M \4p V Fp\V\4'dV !V4'g\RRV: 24VP!R4'dW9d VR ,MTpW9gKgW9gKo\W,\4'dR MR p\RR V: R V 24K RV 9dVR8wd\RRV 24YP#R/4VR8XdRMR&RpV fV'd^RIHpV!V4pVe \V4MT!YR8XdRMR4pV e^RIHpV UUu0uFpV!V4FpVkK K pppVUUu0uFpV!V4FpVkK K pppVV8:g/\RRRP+\-VV, 44 24V fzVR9ds^RIHp^RIHp\T!VPR4;'g/PR444pVR8Xd \V4MR0pVVVR0, , ,pV'd^RIHpVV!4,pV#uuppiuuppi) zValidate explicit toolsets and return the session's enabled toolset set. Without a pick, a *coding_posture* session runs ``focus_toolsets`` instead of the profile default while the profile stays on ``focus``; the gateway decides it, never the client.)_get_platform_toolsenabled_mcp_server_names)saved_toolset_resolver)validate_toolsetrrz%must be a list of toolset names, got mcp_serversz!unknown or invalid toolset name: zmcp-:NNzis disabled in configzhas no usable config entryz MCP server  desktop_uir<z4desktop_ui is only available on the Desktop, not on rsr>r:N)focus_toolsets)resolve_toolsetznot available on this surface: , )parse_config_string_list)CLIENT_SURFACE_TOOLSETSrrtproject)_get_plugin_toolset_keys>r<r;)hermes_cli.tools_configrrhermes_cli.toolset_validationrrrrr rrrPr4rrrr startswithragent.coding_contextrrjoinragent.skill_utilsrrr)r7rrrrr?rrrrexplicitknownrtenabled_serversr6serverwhyposturerrrt requestedrjrrdisabledsurfacers&&&&&& rrrssVD)zz*%HV(D)) J"GXH_H_G` a b%+ 0Fv0N2H26:ceDdC((d  &Gx$PQ!%!8!8T=ST"XY]F#(E1;Jenvheaders docker_env extra_headersdocker_extra_argsterminal_docker_envterminal_docker_extra_argsrz)z{}z[]) rragent.credential_persistencerrrrr enumeraterrrrX) rprivaterrr containersrr4child child_path sensitives &&& rrXrXs6CGJ't44EKKMjY^`dNeNe)E:JkmE F] sC(QQciik=P.P/P/Pyy{j0/P/P4J34O  5 #<'(HII"'J EJ #EJ ?rcaSPR.4pRS9de\V\4'dCV'd;\;QJdRV4F 'gK RM RM !RV44'd \ RR4V'dU\;QJd#V3Rl\ 4F 'gK RM RM!V3Rl\ 44'd \ RR4VUu.uFq"P 4NK up#uupi)zThe validated `-s/--skills` identifiers of a create request (empty when absent). Skills live in the profile, which a bypass launch must never read: refused there, not dropped.skillsc3"TF7p\V\4'*;'gVP4'*xK9 R#5irH)rrr)rJss& rrK launch_skills..s0%^W]RS*Q*<&<&M&MAGGI &MW]s AATFz'must be a non-empty list of skill namesc3J<"TFpSPV4RJxK R#5iTN)r r5s& rrKrsI=4fjj&$.=s #zFa bypass launch never reads the profile, so skills cannot be preloaded)r rranyrPrKr)r7rrsf rrPrPsZZ" %F6:fd#;#;6"%#%^W]%^###%^W]%^"^"^CD ##I=I###I=IIIbc% &v!GGIv && &sC:c$\V4pV'gR#^RIHpHpV!W!R7wrVpV'g \ R4hV'dB^RIpVP !\4PRV!V4VRPV44T;'gR#)a`-s/--skills` preload blocks for a new session, rendered ONCE at creation and frozen in its policy (the CLI's startup preload). Blocking skill-tree reads: callers run it off the owner loop. A typo among good names is logged and skipped, like the CLI; none resolving refuses.N)build_preloaded_skills_promptformat_missing_skills)task_id unknown_skillz/Skipping %s for session %s; continuing with: %sr) rPagent.skill_commandsrrrlogging getLoggerrwarningr) r7 session_idrrrpromptloadedmissingrs && rrender_launch_skillsrs|6 "F Y;FWFG 00(#++,],A',JJX\XaXabhXi k >>Trc\P!VP4PR4'd0VP'g^RIHp^RIHpV!V!44R#R#R#)ar`--accept-hooks` / `HERMES_ACCEPT_HOOKS=1` on a launch: consent to the profile's configured shell hooks in the per-user allowlist (no prompt; kept in memory if that write fails), which the open's ``refresh_profile_hooks`` then registers. A bypass launch has no profile hooks to consent to, so the flag is a no-op there rather than a refusal. Allowlist I/O: off the loop.r)accept_for_launchr$N) rWrXrr ragent.shell_hooksrr'r%)policyrr%s& raccept_launch_hooksrsK  zz&%%&**>::6C\C\C\74.01D]:rcVeVP'dR#^RIHp^RIHpV!V4R# \ d\ PRRR7R#i;i)aBring this owner's shell hooks in step with the profile on every local session open (create and resume): hooks added to ``config.yaml`` or approved since the gateway started register, removed or revoked ones stop firing, as each new CLI process did on main. Reads the owner home's LIVE config (as session creation does), never the session's frozen copy: the registry is shared by every session and surface of this profile. Consent comes from the allowlist (the launching client's TTY prompt, or ``accept_launch_hooks``) or an opt-in in force on the gateway itself; this never prompts. A bypass launch registers nothing (main's safe mode registered none). Config read + allowlist I/O: run off the loop.N)sync_from_configr$z7shell-hook re-sync failed; keeping the registered hooksTr)rrrr'r%rrr)rrr%s& rrefresh_profile_hooksrsO~22220a-. aP[_`as0"AAcVP'dR#\P!VP;'gR4;'g/p\P!VP4P R4RJ;'gVP R4RJp^RIHp^RIHpVP4pV!WRR7V!V4R#)aWorker side of the same contract: tools run in the managed child, so its own plugin manager needs the session's shell hooks and outbound webhooks, registered from the frozen config with the launch's consent (a Kanban attempt always consents), as the classic one-shot CLI registered both at startup. Bypass sessions register nothing (the safe policy also refuses inside both registrars).NnullrT)register_from_config)r) rrWrXrrr agent.outbound_webhooksrrr)rkanbanacceptregister_outbound_webhooksrrs& rregister_worker_hooksrs     ZZ**44f 5 ; ;F ZZ++ , 0 0 @D H n nFJJWeLfjnLnFZ6 ]]_F5v&rconfig_secrets owner_keyclient_requestc "^RIHp^RIp^RIHp Hp \ T;'g/4pV !WW$PV R44pVfV'g V!VRRR7#\VRR4p V f /;qn VP RVP RV 2p V PV 4p \VRR4pVf /;qn V'dCVe?V e;W9d5^RIHpT!W,VP T;'g/4'dT MTpVe'V e#VP#W4'g \%R 4h\VR R4pVf /;pVnT pV'd\VR R4e^R IHpV!WW$4pVV9dVV,V8wd \%R 4hV'd\ V4VV&Ve,V f(V'd RUu/uFpV\VV4bK upW&VeW;V &^R IHpT!Y#eV RV!V4 2MRV'dVR7#RR7#uupi)a+CLI keys live only in this authority lifetime, never its durable receipt. Restart deliberately revokes them. History remains readable; inference must report launch_credentials_unavailable, never select a profile fallback key. An ``owner_key`` (an alias's, expanded by the owner) of the same create request as the attempt holding the slot (``same_create_retry``, its ``client_env`` in ``client_request``) takes the held key: a ``.env`` rotation between overlapping attempts is not a changed request, and the policy then fingerprints the key it runs with. replaceN) PRIVATE_KEYbind_editor_mcp)rr}_local_launch_keys:_local_owner_key_requests)same_create_retryadmission_conflict_local_config_secretsr))config_referencefingerprint_secret_value#)rrVrc) dataclassesrhmacrWrrrr rr instance_idepochr rhermes_state_localrrcompare_digestrrr~rrr)r-rrrxrrrrr rrkeysrefoldownersrconfigs config_refrr$rs&&&&$$$ rbind_launch_keyrs $F...B/N YF2 s{y6rs6rq'&!,,6rs S F 6ZmSE3KG3T2U*Vsw3AZ MMGK MMts9H c4VPR^4^,#)z^The in-memory slot of a durable credential ref (``::[#]``).r )split)rs&r _key_slotrRs   Q ' **rc<^RIp^RIHp^RIHp\ V\ 4'dVP4'g \RR4VPVP,PpVeVPVP8wd \R4h^RIHp\#V!VP$VP4R,4P&pVf \R4h\)VR R4p V f /;qnV P-\/V44p V e%VP1W4'g \R4hR#VP3R 4wrV 'd(TP1Y!V4;'gR 4'g \R4hW)\/V4&R#) al``session.resume`` re-supplying a launch-only key after an owner restart revoked it (call after authorizing *session*, a SessionRef). Only a session launched with a key can take one, and only that same key (its durable fingerprint); anything else is an override of the frozen route and is refused. Like the original, the key lives in this authority's memory only.NrPlatformrxr:r) local_receiptrrr r)r rrgateway.configrrrrrPsessionsrrrLOCALrrrrestore_policyr)rrrr rr partition) r-rrxr rrrrrrr_ fingerprints &&& rrebind_launch_keyr%WsLE' gs # #7==?? 78    2 2 3 : :F ~HNN: 4550 y||W5G5GHR S b bC { 455 92D 9D |.00+ 88IcN #D ""411#$89 9 c*Aq d11+?WX_?`?f?fdfgg 455"3rc^RIHpVUu.uF)p\VPP V4RR4NK+ ppVUu.uF1qUfKVP VP 8XgK%VPNK3 ppV'g \4#^RI H p\V!V4P VP 4RR4;'g/p\4p \R\VPV44FNp T PRV P;'d\V P4V P 344KP V #uupiuupi)z`The launch-key slots and config-secret references the live LOCAL policies of *session_ids* name.rrN)local_adapter_mappoliciesc3:"TFpV'gK VxK R#5irHrz)rJrs& rrK_secret_refs..s!F$>CADC$>s  )rrrrr rr chat_idrgateway.session_local_recoveryr'filtermapupdaterrr}) r- session_idsrsidsourcesrchatsr'r(refsrs && r _secret_refsr5xs'OZ[{wy))--c2HdC{G[*1 n'^FOO_g_m_mLm^V^^'E n u @(377GUYZ``^`H 5Ds8<<78 FF$9$9$^$^iH]H]>^$*$<$<$>F F9 K\ ns/EE  E 'E c :^RIp^RIHpVUu0uFp\V4kK ppV'gR#\ V\ VP 4V, 4pVP RVP R2p\VRR4;'g/p\VRR4;'g/p VU u.uF,qPR^4R ,V9gK"W9gK*V NK. up Fp WV PV R4K \VRR4;'g/p \V 4Fp V PV4'd3\P!V \!V4R4P#R4p M'V PV4'dV \!V4RMRp W9gK{W9gKWK \VRR4;'g/p VFVpV PR VP%VP& RV 2P)44P+4,R4KX R#uupiuup i) aDrop retired sessions' launch keys, frozen config secrets and editor MCP servers. They live only in this authority's memory for the session's lifetime; a deleted session can never run again, so keeping them would hold its credentials until the process exits. A branch's policy names its parent's slots, so a slot named after a retired session stays while a live policy references it, and then until restart, which revokes every launch secret anyway. Only slots named after *session_ids* are released, so the set never exceeds release by name: no later sweep, and a binding not yet published always sits under its own live session's name. Call before the retired sessions leave ``authority.sessions``.N)PREFIXrrrrr_local_editor_mcpzeditor-session:ry)hashlibr~r7rr5rrr r rrr rrrWrXrr sha256 profile_idencode hexdigest)r-r0r9r7r1retiredkeptprefixrrrrownereditorss&& rrelease_launch_secretsrCs9#./;Cs3x;G/   3y'9'9#:W#D ED%%&a '8 :F 92D 9 ? ?RD Y ;T B H HbF#\tyya'8'<'GCOt\ I 3]i!8$?EE2GG} >>& ! !JJs3v;<0155i@E),)?)?CF %TE   i!4d;AArG %):N:N9OqQTPU7V7]7]7_(`(j(j(llnrs)0]sH#HHHcVPfR#\VR/4P\VP44pVf \ R4hV#)Nrr)rrr rr)r-rrs&& r launch_keyrEsL $ I3R 8 < .sM_T:dC000_s"$TFNrTr>zinvalid policyrzinvalid policy objectr@zterminal policy mismatchrrstorage_unavailablerz)+rSrHrIrDrrrrrrrLrprrrrrrr4rrrrr_valid_client_envrVrdrcrEDIT_APPROVAL_POLICIESrVr rr{rrrWrXrrUr KeyError TypeErrorr)datarrIsurfacesrrr]r^s& rr!r!s@#+d+9XhX%ZX"6**mm8+v(==BY/Y!&**c22$vzz:J:V:V:X:X!&,,44FLLW>W9X`d9d!&"6"6d4j8IJJ--.d:()?)?@@DIaIaDbjnDn()E)EtLL..6LL//58V]]e=S$$$V-F-F-F-. .'((&*=*=v?S?STEdjj/66 !899U::f223 !( + + ^0LPVPZPZ0Z78 8vfoo(>?? i ,@ 56C?@sEC/N21N$N%N(D#N NANBNN. N))N.c$V^8dQhR\/#)rkind)r4)rs"rrrsZZ4ZrcHaVfR#\V\4'd\P!V4MRp\V\4;'dW\ ;QJd-V3RlVP 44F 'dK R# R#!V3RlVP 444#)z`A stored client map (names to strings) or its rules (``kind=list``: rule names to string lists).NTc3<"TFwwr\V\4;'dY\VS4;'dES\J;'g5\;QJdRV4F 'dK RM RM !RV44xKy R#5i)c3B"TFp\V\4xK R#5irHrM)rJitems& rrK._valid_client_env...s?QT:dC00QsFTN)rrr)rJr$r%rXs& rrK$_valid_client_env..ss)ZMXTQ*4As);*A*A 1d@S*A*A  ??ss?Q?sss?Q??*AMXs!BBB BB%BF)rrrWrXrrr)rrXrs&f rrQrQs })%55$**U 4C c4  Z ZSS)ZMPYY[)ZSSZSZS)ZMPYY[)Z&ZZrch^RIHpV!\VPV44\ VRR4V4#)zA local turn's toolsets: the policy's current set, plus ``onboarding`` for an onboarding chat (``agent.onboarding_session.onboarding_chat_toolsets``).)onboarding_chat_toolsetsr)N)agent.onboarding_sessionr`rrr)r-rrrr`s&&&& rpolicy_turn_toolsetsrbs4B #D)@)@)H$I7S\^bdhKiku vvrc^RIHpRp\VRR4VP8Xd6\VP V4R/4P VP 4pVexVPR8wgg\;QJd2RVPVP34F 'gK RM' RM#!RVPVP344'gV#\V4#) aE*scope* (the profile scope a turn enters), also marked as work for the local Desktop when the turn belongs to a Desktop chat its creator's connection declared local (``stage_local_session``); any other turn gets *scope* untouched. Read from the live policy without raising: a cold policy is restored, or refused, by the turn.rNrr(r<c3x"TF0p\P!V4P\4RJxK2 R#5ir)rWrXr LOCAL_DESKTOP_CHAT)rJrss& rrK%local_desktop_turn..s.;rGpDJJsO   2 3t ;Gps8:TF) rrrr _adapter_for_sourcer r+rrr{r_serving_local_desktop_within)rrscoperrs&&& rlocal_desktop_turnrjs ( Fvz4(HNN:33F;ZLPPQWQ_Q_` ~%/ss;rHNHZHZ\b\o\oGp;rsss;rHNHZHZ\b\o\oGp;r8r8r ( //rc #"^RIHpT;_uu_4V!R4;_uu_4RxRRR4RRR4R# +'giL;i +'giR#;i5i)r^)serving_local_desktopTN)hermes_cli.process_identityrl)rirls& rrhrhs1A %d++ ,++s/A"A; A A" A A A  A"c6^RIHp^RIHpVPVP 8wdR#VP V4p\WB4'dNVPV4'd7VPPVP4pVf \R4hV#R#)r^)LocalSessionAdapterrNrP) gateway.session_localrorrrr rgrauthorize_sourcer(r r+r)rrroradapterrs&& rpolicy_for_sourcerss{9' (..(((0G'//G4L4LV4T4T!!%%fnn5 >$$9: : rc$V^8dQhR\/#rreturn)r)rs"rrrs%%t%rcH\VP4P4#)z{Readiness, not structure: a removed workspace keeps the chat readable and movable, but no turn runs in a missing directory.)rrrM)rs&rworkspace_readyrxs   " " $$rc$V^8dQhR\/#ru)r)rs"rrrs 9 9D 9rcr^RIHp^RIHpV!RVPR7pV!RVR.R^R.R R R R R V/RR 4#)zA failed, never-run turn for a session whose frozen working directory is gone. Nothing ran and an unchanged resend fails the same way, so the reply names the folder and the way out instead of the generic "something went wrong" apology.)r) stamp_failurez$gateway.errors.workspace_unavailable)rfinal_responsemessages api_callstoolsfailedT completedFerrorworkspace_unavailable) agent.i18nragent.turn_failure_copyr{r)rrr{texts& rworkspace_unavailable_resultrsS5 3&** ED *D*b+qRY[]"D+ugtM0% 99rr-c #"VfRxR#\V4'g\RRVPR7h^RIHp^RIHpHp\P!VP4pVPe>^RI H pV!W4P4FwrxV^,eKWV^,&K \P!WP#V434p Tp VP$'d0^RIHp V !WP+VP-VRR 74R 7p T!VP4p V!V4p \.P!V 4p^R IHp^R IHp^R IHpVe!VP-V4P=R4MRpVe V!V4M\>P@!4pV!V4;_uu_4V!W4;_uu_4T;_uu_4VPC4;_uu_4RxRRR4RRR4RRR4RRR4\.PEV4V!V 4V PFPEV 4\PEV 4R# +'giLw;i +'giL;i +'giL;i +'giL;i \.PET4T!T 4T PFPET 4\PET 4i;i5i)NrrrN)set_session_cwd)set_terminal_scopereset_terminal_scope)rnrFrhrO) editor_scope)session_auxiliary_scope)editor_mcp_scope auxiliary)$rxrrrFrrGrrrWrXrr}r~rnrrrr|rr rrr_ACTIVE_POLICYrOragent.auxiliary_task_configrrWrr contextlib nullcontextr_resetvar)rr-rrrr]rnrr profile_tokenactiver cwd_tokenterminal_token policy_tokenrrrr aux_scopes&$ r policy_scoper)s" ~  6 " " 7uVZZXX1Mzz&../H +M1)DJJLKDAw$)a!M"%%v/B/B9/M&NOM F '*A*A&--PYch-Bi*jk +I'1N!%%f-L9 +G>AJAVFMM),00=\` :C:O+I6U_UkUkUm 6""$4Y$G$G%%'' (JS$G" \*^, I&M* ('JS$G$G"" \*^, I&M*sBK7 B,K7 A#J%0J I? I, %I*I, 2I? :JJ% AK7 I)$I, , I<7I? ? J J J" J%%AK44K7c Ve V'gR#\P!VP4p\VP R4;'gR4P 4P 4R8wg\V4'g\V4R#^RI H pH pH pV!V4pVP R4VP8XdVP R4R8XdR#V!V/VCRVPRRR V!VP4/C4R#) aMake the session's frozen workspace its terminal cwd override for this turn's tools (#140665). The client's cwd (or ``--in DIR``) is frozen into the policy at admission, but the terminal tool mounts ``resolve_task_overrides(task_id)['cwd']`` into a per-session Docker container. Before the one-gateway runtime each ``hermes chat`` was its own process with its own ``TERMINAL_CWD``; now the turn runs here, so register it under the turn's own task id (inside the turn's routed scope, which qualifies the key). Docker mounting the host cwd only: the local backend already runs in the policy's ``TERMINAL_CWD``, and ssh and the other sandboxes keep their own cwd. Re-registered only when the workspace changed, so an agent's ``cd`` inside the session survives later turns. Nrarrc)register_task_env_overridesresolve_task_overridesworkspace_key_forr cwd_sourcer workspace_key)rWrXrrr rrrUunbind_turn_workspacetools.terminal_toolrrrr)rrr]rrrcurrents&& rbind_turn_workspacerRs~Wzz&../H 8<< ' - -2.446<<>(JRhiqRrRr g&jj$W-G{{5VZZ'GKK ,E,R*ZG*ZUFJJ V_*9;LVZZ;X*Z[rcV'gR#^RIHpHpHpHpV!V4pVP V4;'g/pRV9dR#VP VR4V!V4VP R48Xd V!V4R#R#)zDrop the workspace override :func:`bind_turn_workspace` registered for *task_id*, and the cwd record it seeded. Only its own entry (tagged ``workspace_key``): an ACP/TUI workspace or an RL image override registered by someone else under the same id stays.N)_qualify_task_key_task_env_overridesclear_session_cwdget_session_cwdrr)rrrrrr r )rrrrrr4rs& rrrmsp nn G $C!%%c*00bGg%C&w7;;u#55'"6rc^RIHpV!V4;_uu_4VFp\V4K RRR4R# +'giR#;i)zSession teardown: drop each session's workspace binding under its owning profile's scope (the key the turn bound it under), so the override table does not grow with every closed session.) owner_scopeN)rrr)r-r0rr1s&& rrelease_session_workspacesr}s38 Y  C !# &   s 6 A c#"\PWPV434pRx\PV4R# \PT4i;i5i)zHold ONE read of a following session's profile for every resolution inside, as a turn's ``policy_scope`` does, without that scope's workspace and terminal setup (a session control reads the route, it runs nothing).N)rrr|r)rr-tokens&& rprofile_read_scopersI   v':':9'EF GE# E" E"s&AAAAAc*\P4#)zThe frozen launch policy of the turn executing in this context, or ``None`` (standalone serve / messaging turns). Consumers read it instead of re-deriving from live config.)rr rzrr active_policyrs    rchV^8dQh/^\9d \;R&^\9d \;R&#)rrr)__conditional_annotations__r)rs"rrrs4NN^NM M_O`LKzKaOr>rrrpr>rrrxr;rrrrrrrrr[rErrrr<rrurrr)rp providerscustom_providersfallback_providersfallback_model model_aliasesrs)rrrurtcoding_context)r8rrapi_moderqrwkey_env api_key_env)rr>Nrr`rYrH)rTworkspace_sessionr)FF)rz)Wr__doc__rr contextvarsrr r functoolsrrWrpathlibrhermes_state_runtimerrrrrIrIrrrerrr"r.r5rr#rKrrrD_KEEP_STORED_LABELrCrBrFSURFACE_GROUPSrPrRrSrrrrrr(r_rUrNrRrzr}rSrrTrXrPrrrrrrr%r5rCrErGr!rrQrbrjrhrsrxrrrrrrrr)groupr6rs00@rrsN%"!% 2   8 $mn (" %  e WEWo Tw!3 '(>MM&'