+ jHj*Rt^RIHt^RIt^RIt.R%OtRRltRRltRRltR R lt R R lt R Rlt RRlt RRlt RRltRRltRRltRRltRRltRRltRR /R!R"lltR&R#R$lltR#)'umPre-import startup fast paths — THE canonical lightweight helpers. This module is imported by ``hermes_cli/main.py`` BEFORE its heavy import wall (config, argparse tree, logging, providers). Everything here must stay **stdlib-only and cheap** (os/sys file probes; no yaml, no hermes_cli.config, no argparse). A guard test (``test_startup_fast_import_weight``) subprocess- imports this module and fails if any heavy module sneaks into sys.modules. Why this module exists (the bug class it kills): version-printing kept being reimplemented as ``*_fast()`` copies at the top of main.py, each duplicating canonical logic — project-root resolution, container detection, profile detection. The copies drifted: eb4040242 changed the canonical output and referenced ``PROJECT_ROOT`` inside the fast function, which doesn't exist yet on the fast path → the fast path NameError'd on --version and nobody noticed. One implementation, imported by both the fast path and the module constants, makes that drift structurally impossible; the parity guard test would have caught eb4040242 the day it landed. ``hermes_cli/config.py``'s ``get_container_exec_info()`` reads the same ``.container-mode`` file; keep the file-format assumptions here and there in sync (this module deliberately only PROBES existence/typos cheaply and errs toward the slow path, which then does the authoritative parse). ) annotationsNc V^8dQhRRRR/#)pathstrreturn str | None)formats"=/home/ubuntu/.hermes/hermes-agent/hermes_cli/_startup_fast.py __annotate__r .sSZc\VRR7;_uu_4pVP4uuRRR4# +'giR#;i \\3dR#i;i)z>Read a small text file, or None when it is missing/unreadable. utf-8-sigencodingN)openreadOSErrorUnicodeDecodeError)rhandles& r _read_textr.sE $ - -;;=. - - - ' (s*A2 A A AAAAcV^8dQhRR/#rrrr )r s"r r r 7sPP#Pr c\PP\PP\PP \ 4\P 44#)uDRepo root as a str — the single source for main.py's PROJECT_ROOT.)osrrealpathjoindirname__file__pardirr r r project_root_strr!7s7 77  BGGLL)BBIIN OOr cV^8dQhRR/#rrNoner )r s"r r r <s--4-r c@\PPRR4pVP4'gR#\PP \PP VP444pW8wdV\PR&R#R#)aExpand ``~``/``$VAR`` in ``HERMES_HOME`` once, at process entry, and write it back. fish does not expand ``~`` inside ``VAR=~/...`` and every shell passes a quoted value through verbatim, so a literal tilde reaches the process. ``Path("~/.hermes")`` is *relative*: the many raw ``os.environ["HERMES_HOME"]`` readers (this fast path, the active_profile probe, profile re-home, the dotenv loader) would each resolve it against cwd and scaffold a full home under ``/~/.hermes``. One expansion here gives every reader the same absolute spelling; ``hermes_constants`` expands as well for non-CLI entry points. A relative value that is not tilde/variable-shaped is left alone. HERMES_HOMEN)renvirongetstripr expanduser expandvars)rawexpandeds r normalize_hermes_home_envr/<sg **.. +C 99;;ww!!"''"4"4SYY["ABH$, =!r c V^8dQhRRRR/#)rrrrr )r s"r r r Os  C C r ch\PPV4# \dTu#i;i)aJ``os.path.realpath`` that survives a deleted cwd. A relative ``sys.path`` entry is resolved through ``os.getcwd()``, which raises ``FileNotFoundError`` once the directory the process started in has been removed (a cron delivery child spawned from a reaped scratch workspace, #102941); the CLI then dies before it can parse argv. )rrrr)rs&r _realpath_or_selfr2Os0ww%%  s ! 11cV^8dQhRR/#r#r )r s"r r r ]s%%T%r c\4p\PP\ V44p\ PUu.uF<pV'd0\PP\ V44V8wgK:VNK> up\ PR&\ PP ^V4R#uupi)zCPut the project root at sys.path[0], deduping realpath-equivalents.:NNNN)r!rrnormcaser2sysinsert) project_rootnormalized_rootentrys r ensure_project_root_on_pathr;]s#%Lgg&&'8'FGO&)hhbhU277#3#34Ee4L#MQ`#`5hbCHHQKHHOOA|$bs B=*B=B=c V^8dQhRRRR/#rargvz list[str]rboolr )r s"r r r fs++i+D+r cVR.R.39#)z --versionz-Vr r>s&r is_global_fast_version_argvrBfs [MD6* **r c V^8dQhRRRR/#r=r )r s"r r r js..i.D.r c RV9#)aIs ``argv`` the Desktop client's SSH backend spawn (``serve --ssh-session-token-file``)? That child has a fixed identity: Desktop names the remote profile explicitly (or none for the root home) and hands its session token through a 0600 FILE, never the ``HERMES_DASHBOARD_SESSION_TOKEN`` env var the local pool spawn uses. Every reader of "is this process Desktop's backend" needs both shapes; this is the argv half. z--ssh-session-token-filer rAs&r is_desktop_ssh_backend_argvrEjs & --r cV^8dQhRR/#rrr?r )r s"r r r usII$Ir c\PPR4'g&\PPR4'dR#\R4;'gRpRV9;'gRV9;'gRV9#) zDTrue when we're already INSIDE a container (fast path is then safe).z /.dockerenvz/run/.containerenvTz/proc/1/cgroupr'dockerpodmanz/lxc/)rrexistsr)cgroups r is_container_startup_environmentrMusc ww~~m$$7K(L(L ( ) / /RF v  H HV!3 H Hw&7HHr c V^8dQhRRRR/#)r hermes_rootrrr?r )r s"r r r }s00#0$0r c\\PPVR44;'gRP 4p\ T;'dVR8g4#)zECheap probe: does an active non-default profile redirect HERMES_HOME?active_profiler'default)rrrrr*r?)rOactives& r active_profile_may_override_homerT}sEk3CDEKK R R TF ..6Y. //r cV^8dQhRR/#rr )r s"r r r s<>- , 2 2 4 G G Gr cV^8dQhRR/#rGr )r s"r r r s77d7r c\PPR4R8Xg\4'dR#\PPRR4P 4pV'd\P P \P PVR44'dR#\P P\P P\P PV444pVR8g;'d \V4#\4p\V4;'g>\P P \P PVR44#) uConservative probe for NixOS container-mode routing. False positives are fine (the slow path does the authoritative check). False negatives are NOT — they'd print the host's version instead of the container's — so any profile ambiguity means "may be active". HERMES_DEV1Fr&r'z.container-modeTprofiles) rr(r)rMr*rrKrbasenamernormpathrTrX) hermes_home parent_name default_homes r container_mode_may_be_activerfs zz~~l#s*.N.P.P**..399;K 77>>"'',,{4EF G Ggg&&rwwrww7G7G 7T'UV j(ZZ-Mk-ZZ ?L +L 9 7 7RWW^^  \#45>77r cV^8dQhRR/#rrrr )r s"r r r sZr cf\PFp\PPT;'g\P!4RR4p\ VRR7;_uu_4pVFpVP 4pVPR4'gK,VPR4wrVpVPR^4^,P 4P R4pT;'gR uuuR R R 4u# R R R 4K R # +'giEK ;i \dEKi;i) zARead OpenAI SDK version without importing ``importlib.metadata``.openaiz _version.pyrr __version__=#z"'N) r6rrrgetcwdrr* startswith partitionsplitr)base version_filerlinestripped_key_sepvalues r read_openai_versionrysww||D$7$7BIIK=Q  l[99V"D#zz|H#..}== (0(:(:3(?%D!KKQ/288:@@GE ==D(:9":9 :99   sCD (BD *D . D ;D =D  D D D  D0/D0cV^8dQhRR/#rhr )r s"r r r s22Z2r c\\PP\ 4R44pT;'gRP 4P 4;'gR#)uThe installer's ``.install_method`` stamp, if present. Only the stamp (step 1 of ``config.detect_install_method``'s resolution order) — the managed/git/pip fallbacks need heavier imports and stay on the slow path. z.install_methodr'N)rrrrr[r*lower)methods r read_install_methodr~sG  ^%57HI JF LLb   ! ' ' ) 1 1T1r check_updatesTc V^8dQhRRRR/#)rrr?rr$r )r s"r r r s6 6 d6 d6 r c ^RIHp\V!44\R\4 24^RI H p^R I H pV!V!\444pV'd\R V 24\R \P P#4^, 24\%4p\V'dR V 2MR 4V'gR#^RIHpHp ^RI Hp V !RR7p V P/R4p V P/R4'd)\RV P/R4 RV !4 R24R#W8Xd\RV !4 R24R#V 'd/V ^8d(V ^8XdRMRp \RV RV RV !4 R24R#V ^8Xd\R 4R#R# \d2^RIHp^RIHp\RT!4P RT R24ELi;i \d\4pELi;i \dR#i;i)!uTHE canonical ``hermes --version`` output (also used by /version). Every lazy block degrades gracefully — a broken/heavy import can never take the basic version output down. )format_banner_version_label)__release_date__)get_version_infozHermes Agent vz ()zInstall directory: )Path)detect_install_methodzInstall method: zPython: z OpenAI SDK: zOpenAI SDK: Not installedN)UPDATE_AVAILABLE_NO_COUNTcheck_for_updates)recommended_update_commandT)passivebehindrollbackzNewer than stable release v sourceVersionu — 'z' moves back to ituUpdate available — run ''commitcommitszUpdate available:  u behind — run 'z Up to date)hermes_cli.bannerrprint Exception hermes_clirhermes_cli.version_inforderived_versionr!pathlibrhermes_cli.configrr~r6versionrqryhermes_cli.source_checkrrrr))rrrrrrinstall_methodopenai_versionrrrstatusr commits_words$ r print_fast_version_inforsZA )+,   0 23 45/ ;.t4D4F/GH   012 HS[[&&(+, -.(*N ^L( )A\]  X@"40H% ::j ! ! / ?0K/LM0233EG H  0 ./I/K.LAN O  '-{8 L &vha ~=NOiOkNllmn o q[ , O Z/< /1AAB"EUDVVWXY Z /,./6    sRF"G>G/&G/,G/G/,G/>G/8GGG,+G,/ G>=G>c V^8dQhRRRR/#)rr>zlist[str] | Nonerr?r )r s"r r r s+tr cVf\PR,p\V4'gR#\4'dR#\ 4R#)uHandle ``hermes --version`` before the heavy import wall. Only ``--version``/``-V`` (the ``version`` subcommand was removed — ``--version`` now carries the full output incl. update status), and never when container mode may need to route the command into the container. :NNFT)r6r>rBrfrrAs&r try_fast_versionrs9 |xx| &t , ,#%% r ) rTrfr;rMrErBr/rr!r~ryr)N)__doc__ __future__rrr6__all__rr!r/r2r;rBrErMrTrXr[rfryr~rrr r r rs|0#   P -& %+.I0 <H7($26 T6 rr