+ jHjr/a0t$Rt^RIHt^RIt^RIt^RIt^RIHtH t H t H t ^RI H t HtHt]P !R4tRtRt] !RR 7!R R 44t]P*!4tRsR ]R &]P2!4tRsRs]P*!4tRsR]R&R0tRRlt ]3RRllt!RRlt"RRlt#RRlt$RRlt%RRlt&RR lt'R!R/R"R#llt(R$R%lt)R&R'lt*R!R/R(R)llt+R*R+lt,R,R-lt-R.R/lt.R#)1aRecord of who carries inference, for ``setup.status`` and ``setup.ready``. It runs once per process on a daemon thread: at ``hermes serve`` boot, and on the gateway when the local Desktop first connects (``tui_gateway.methods_onboarding.begin_local_desktop_boot``). It never creates an identity: the desktop's welcome-trial claim (``hermes_cli.welcome_trial``) and the first hosted connector action are the only creators. For the desktop's local backend it first records a fresh install's onboarding decision (``onboarding_run.latch_first_install``) and settles a claim cut off before its marker write (``welcome_trial.settle_interrupted_claim``). Then it inventories credentials cheap-first, resolves which provider carries inference, records the answer in process memory, and tells every connected client with one ``setup.ready`` event. ``free_tier.status`` and ``setup.status`` read the record; provider resolution never reaches the portal. ) annotationsN)asdict dataclassfieldreplace)AnyDictOptionalzhermes_cli.authg @z setup.readyT)frozenc]tRt^t$RtR]R&R]R&R]R&R]R&R]R&R tR]R &]!]R 7t R ]R &]!] PR 7t R]R&] RRl4t RRltRRltRtR#) SetupRecordzlWhat the bootstrap found. One shape for every reader; no version field (renderer and backend ship together).boolprovider_configuredstrinference_providerfree_tier_account has_identityother_providerserror)default_factorydict[str, Any]failurefloat finished_atcV^8dQhRR/#returnr )formats"C/home/ubuntu/.hermes/hermes-agent/hermes_cli/free_tier_bootstrap.py __annotate__SetupRecord.__annotate__/sLLLc HVP;'dVPR8H#)nous)rrselfs&r!free_tier_routeSetupRecord.free_tier_route.s!%%KK$*A*AV*KKr$cV^8dQhRR/#rrrr)r s"r!r"r#2sNr$c z\V4pVPVPR44VPVR&V#)rr))rupdatepopr))r(payloads& r! as_payloadSetupRecord.as_payload2s8,w{{9-.%)%9%9!"r$cV^8dQhRR/#r,r)r s"r!r"r#:s"""r$c ,\VP4#)N)dictrr's&r!failure_fieldsSetupRecord.failure_fields:sDLL!!r$rN)__name__ __module__ __qualname____firstlineno____doc____annotations__rrr5rtimerpropertyr)r1r6__static_attributes__rr$r!r r swE3O$D9G^9tyy9K9 LL""r$r Optional[SetupRecord]_recordFzOptional[tuple]_inventory_stampcV^8dQhRR/#rrrAr)r s"r!r"r"Js-r$c\#)z7The record, or None until the first bootstrap finishes.)rBrr$r!current_recordrGJs Nr$c V^8dQhRRRR/#)rtimeoutrrrAr)r s"r!r"r"Os  U BW r$c\\'gR#\PV4\4#)aBlock up to ``timeout`` seconds for a bootstrap that is IN FLIGHT, then return whatever it produced, reconciled with any provider configured since (:func:`reconcile_record`). Returns None at once when no bootstrap ever started in this process (a bare ``tui_gateway`` under test, an old serve without the boot hook): the caller falls back to its live probe instead of paying the wait for nothing.N)_started_donewaitreconcile_record)rIs&r!wait_for_recordrOOs! 8 JJw  r$cV^8dQhRR/#rEr)r s"r!r"r"[s/r$c\pVeVP'dV#^RIHpHpV!4V!V!448wg\ \ 48XdV#\4'g\#\VRR\4\P!4R7p\;_uu_4\VJd\uuRRR4#VsRRR4\4\V4V# +'giL';i)aLLet a provider configured AFTER boot count: a record that says ``provider_configured: false`` is re-inventoried once ``config.yaml`` / ``.env`` / ``auth.json`` moved since the inventory that built it, and replaced (+ ``setup.ready``) when something now carries inference. The identity and failure block are kept as is. A record that already says ``True`` is never re-probed, so the answer only moves false -> true here. Every write path that assigns the main model (the Models page, a picker key save) calls this for the immediate broadcast; ``setup.status`` calls it for writes this process never saw (``hermes setup`` / ``hermes model`` from a shell, a hand edit). The record is the LAUNCH profile's: a call scoped to another profile's home (a dashboard write with ``?profile=B``) leaves it alone, or B's providers would open the launch gate.N)get_process_hermes_homehermes_home_keyT)rrrr)rBrhermes_constantsrRrSrC _config_stamp_inventory_other_providersr_resolve_inferencer>_lock _due_changed _broadcast)recordrRrS refresheds r!rNrN[sF ~333 IO,C,EFFJZ^k^mJm % ' 'D$+=+?TYY[ZI  &   Ny  s"C=C C. cV^8dQhRR/#rrNoner)r s"r!r"r"ysr$c\;_uu_4RsRsRsRs\ P 4RRR4R# +'giR#;i)NF)rXrBrK_settledrCrLclearrr$r!reset_for_testsrcys1  s 6 A cV^8dQhRR/#)rrtupler)r s"r!r"r"s  u r$c^RIHpV!4p.p\FApW, P4pVP VP VP 34KC \V4# \dTP R4Koi;i))get_hermes_homeN) hermes_cli.configrh_INVENTORY_FILESstatappend st_mtime_nsst_sizeOSErrorre)rhhomestampnamests r!rUrUss1  D E  +##%B LL".."**5 6! <  LL  s=A&&BBcV^8dQhRR/#rr)r s"r!r"r"sDr$c^RIHp\4sV!RRR7R8g# \d"p\ P RT4Rp?R#Rp?ii;i) aVIs anything usable configured BESIDES the free tier? Asks the resolver ladder itself (the thing that picks the provider for a turn) with the free-tier rung hidden: an explicit key, a config pin, a sign-in or a host credential answers; nothing else falls through to ``no_provider_configured``. Not ``_has_any_provider_configured``: that first-run guard also counts host credentials (gh auth, Claude Code) and a config pin, and it does not hide the free-tier rung. Stamps the config files BEFORE reading them, so a write that lands during the inventory is seen by the next :func:`reconcile_record`. resolve_providerautoT)skip_free_tierr&z8free tier bootstrap: nothing else carries inference (%s)NF)hermes_cli.authrwrUrC Exceptionloggerdebug)rwexcs r!rVrVsI1$t<FF  OQTUs  A AA cV^8dQhRR/#)rrrr)r s"r!r"r"sCr$cj^RIHp\V!R4;'gR4# \dR#i;i)rgrvrxr)rzrwrr{rvs r!rWrWs50#F+11r22 s## 22c V^8dQhRRRR/#)rotherr rr r)r s"r!r"r"sD[r$c ^RIHpVP4pV'd/MVP4;'g/pV'dVP V4MRp\ T;'g4T;'g*\ V4;'dVPV4'*\4T\ V4T\VPR4;'gR4VR7#)zJOne inventory pass into a record. Reads only: no identity is created here. anon_authFrr)rrrrrrr) hermes_clircurrent_nous_statelast_mint_failurefree_inference_activer r is_guest_staterWrget)rrstaterrs$ r! _build_recordrs$&/&B&B&DE$)b 0K0K0M0S0SQSGBG 77>U !oo%6oo4;;n;nyOgOghmOnKn-/+%['++g&,,"- r$announcec V^8dQhRRRR/#)rrr rr r)r s"r!r"r"st{r$c\;_uu_4\e\uuRRR4#\'d2\P \ 4\e\uuRRR4#RsRRR4\ 4p\\4R7p\;_uu_4W!uss \P4RRR4V'd \V4V# +'giLr;i +'giL8;i)zSettle an interrupted claim -> inventory -> resolve inference -> record -> broadcast. Idempotent per process: a second call returns the existing record. Never raises. ``announce=False`` skips the ``setup.ready`` event.NTr) rXrBrKrLrMSETUP_READY_WAIT_SECONDS_settle_installrrVrasetrZ)rsettledr[s$ r! run_bootstraprs     8 JJ/ 0"  G !;!= >F "  6 M!  s'C C&C%CC$ C! $ C4 cV^8dQhRR/#rr)r s"r!r"r"sr$c$Rp^RIHp^RIHpVP 4'dV!4^RIH pT!4T# \ dRp\ PRRR7L6i;i \ dRp\ PRRR7T#i;i) zRecord a fresh install and settle the guest's claim; True when neither step failed. A failure is logged: onboarding.state still answers live, and the record still says who carries inference.Tr)latch_first_installFz7onboarding: could not record the first-install decision)exc_info)settle_interrupted_claimz0free tier: could not settle an interrupted claim) rrhermes_cli.onboarding_runron_local_desktop_backendr{r|warninghermes_cli.welcome_trialr)rrrrs r!rrsGa(A  - - / /  !ZE " N aP[_`a ZITXY NZs$!== A'$A$#A$'$BBcV^8dQhRR/#r^r)r s"r!r"r"s!!D!r$c\;_uu_4\RJ;'d \'*pRRR4X'd\P RR7'gR#\ 4'd$\;_uu_4RsRRR4\ 4\P4R# +'giL;i +'giLC;i \P4i;i)zThe local Desktop connected again to a process whose bootstrap could not settle the install: try those steps again and rebuild the record when they pass. Nothing before the bootstrap finished or once it settled.NF)blockingT)rXrBra_resettle_lockacquirerrefresh_recordrelease) unsettleds r!resettle_after_failed_bootrs 4'88L   N22E2BB!          s/B#C 8B6;C # B3 6 C C Cc V^8dQhRRRR/#)rrr rrAr)r s"r!r"r"s   0E r$c\fR#\\4R7p\;_uu_4VsRRR4\ 4V'd \ V4V# +'giL/;i)zRebuild the launch profile's record after the identity changed (a trial claim), so ``setup.status`` and the ``setup.ready`` listeners move with it. None before the first bootstrap.Nr)rBrrVrXrYrZ)rr[s$ r!rrsF !;!= >F  N6 M s A A' cV^8dQhRR/#r^r)r s"r!r"r" s  d r$c2^RIHpVP4R#)rgonboarding_dueN)rr invalidaters r!rYrY s)r$c V^8dQhRRRR/#)rr[r rr_r)r s"r!r"r"s;;{;t;r$c^RIHpV!\VP44R# \d"p\ P RT4Rp?R#Rp?ii;i)rg)_broadcast_global_eventzsetup.ready not broadcast: %sN)tui_gateway.serverrSETUP_READY_EVENTr1r{r|r})r[rr~s& r!rZrZs@;> 163D3D3FG ; 4c::;s!% AA  AcV^8dQhRR/#)rrzthreading.Threadr)r s"r!r"r"s$4r$cN^RIHpV!\RR7pVP4V#)z@Run on a daemon thread so the inventory never delays the socket.)spawn_context_threadzfree-tier-bootstrap)rr)agent.memory_providerrrstart)rthreads r!start_background_bootstraprs : !-6K LF LLN Mr$)z config.yamlz.envz auth.json)/__conditional_annotations__r< __future__rlogging threadingr> dataclassesrrrrtypingrrr getLoggerr|rrr LockrXrBr=EventrLrKrarrCrjrGrOrNrcrUrVrWrrrrrrYrZr)rs@r!rs # 99&&   , -! $"""@ !% %  !%)/(7 &> < *$d0*!$ t  ;r$