+ jHj?C Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t ^RI H t HtHt^RIHtHt^RIHtHtHtRtR,t]P2!R 4tR R lt] !R R 44tRRltRRltRRltRRlt RRlt!RR/RRllt"RRlt#RRlt$RR lt%R!RR"RR#R$R%]PLPNR&RR'R/R(R)llt(R*R+lt)R#)-uPlugin update checks — the standard, read-only 'is it outdated?' verb. Address resolution per plugin, in order, no derivation ever (settled 2026-09-03, plugin-auto-update plan): 1. saved sidecar tag + matching manifest update_url → fetch the feed yml 2. manifest update_url differs from the saved tag (or appeared where none was saved) → NEEDS-FIXING: fetch refused, tag untouched 3. no update_url anywhere + git row → git ls-remote vs revision 4. neither → manual/unupdatable Plus the pip world, stateless: entry-point discovery → installed version vs PyPI latest. NEVER mutates anything — no pulls, no row writes, no saved-tag changes. ) annotationsN) dataclass)Path)AnyCallableOptional)InvalidVersionVersion) ProvenanceProvenanceClassplugins_provenanceg$@z[0-9a-fA-F]{40}c$V^8dQhRRRRRR/#)lateststrcurrentreturnOptional[bool])formats"?/home/ubuntu/.hermes/hermes-agent/hermes_cli/plugins_updates.py __annotate__r&s!cCNcV\V4\V48# \dR#i;i)z8Invalid versions are unknown, not evidence of an update.N)r r)rrs&&r_version_is_newerr&s-v!111 s  ((c]tRt^.t$R]R&R]R&RtR]R&RtR]R&RtR]R &RtR]R &Rt R]R &R t R]R &RRlt Rt R#) CheckResultrnameklassN Optional[str]rrrupdate_available needs_fixing min_hermesreasoncV^8dQhRR/#)rrdictr)rs"rrCheckResult.__annotate__9s     rc RVPRVPRVPRVPRVPRVP RVP RVP/#)rclassrrr r!r"r$)rrrrr r!r"r$)selfs&rto_jsonCheckResult.to_json9sX DII TZZ t|| dkk  5 5 D-- $// dkk  rr) __name__ __module__ __qualname____firstlineno____annotations__rrr r!r"r$r+__static_attributes__rrrrr.sS I J!G]! FM '+n+"&L-& $J $FC   rrc$V^8dQhRRRRRR/#)r plugin_dirrkeyrrrr)rs"rrrFs&OOTOO Orc^RIpVR, pVP4'gR#VPRR7;_uu_4pVPV4;'g/pRRR4\ X\ 4'gR#TPT4p\ T\4'd'TP4'dTP4#R# +'giLw;i \dR#i;i)zBOne field from the installed plugin.yaml (claims, not provenance).Nz plugin.yamlz utf-8-sig)encoding) hermes_yamlis_fileopen safe_load Exception isinstancer&getrstrip)r4r5yamlmanifestfdatavalues&& r_read_manifest_fieldrEFsM)H      ]]K] 0 0A>>!$**D1 dD ! ! HHSME&uc22u{{}}5;;=N$N1 0 s/CC C C CC C.-C.c V^8dQhRRRR/#)rprovr rrr)rs"rrrXs*** *rcN\VPVPPR7pVP\P Jd RVnV#VP\PJd(RVPPR4: R2VnV#VP\PJd RVnV#VP;'g/pVPR4;'gRVn VPR 4R Jd9R Vn R VP;'gR R,;'gR 2VnV#VPR4;'gRp\VPR4pVfVeRV: R2VnV#VeWC8wdRV: RV: R2VnV#V#)z SELF_CLONEDrr rEpathr!)rGresultrQsavedclaimeds& rcheck_local_provenancerWXs diitzz/?/? @F zz_+++;   zz_***3DHHLL4J3MNJ J    zz_000G  ((..bCWWZ(00DFN wwxD "'#V^^%9%9r3$?$H$H5#IJ   GGL ! ) )TE"499l;G },,G;7M M   W-)%2FkM O  Mrc(V^8dQhRRRRRRRR/#)rrGr fetchCallable[[str], str] ls_remoterrr)rs"rrrs8ee e e$ e  ercVP;'g/pVPR4p\V\4'dTM/pVPR4;'gVPR4pV'Ed^RIHpHp\VPRVPR4R7p VPR4RJdR MiV!\V44;'gRT!\VPR 4;'gVPR R 44PR ^4^,4p V 'dRV P 2V n V #V!\V44p V f RV n V #V PV n V PV P8gV nV #\!V4p V P'gV P"'dV #VP;'g/pVPR4;'gR p V EeV!V 4p \'T 4pTPR4T n TPR4T nTPR4;'g/PR4pT'd\,P/T4'dT P'd/\,P/\T P44'gR T nRT n T #TP14T n TP14T PP148gT nT #\3TP4R4pTf R T nRT P: R2T n T #TT n\7T PT4T nT PfRT P: RT: 2T n T #VPR 4;'gR pV'g RV n V #V!V4pTT n \9T4;'dTT P8gT nT # \$dpRT 2T n T uR p?#R p?ii;i \(dpRT 2T n T uR p?#R p?ii;i \$dpRT 2T n T uR p?#R p?ii;i)zDCheck local provenance before contacting its approved update source.catalogr catalog_name) find_removedget_live_catalog_entryrJ)rrr allow_removedTNreporIr##zremoved from catalog: z4catalog entry is unavailable; installed pin retainedrNzfeed fetch failed: zfeed unparseable: versionr" artifactsgitzOfeed declares a git sha but the install records no full revision sha to comparezfeed declares version z< but the installed plugin.yaml records no version to comparezcannot compare feed version z with installed version zno recorded sourcezls-remote failed: )rQr>r=r&hermes_cli.plugin_catalogr_r`rrrsplitr$rMrrr rWr!r<parse_feed_yml ValueErrorr"_FULL_GIT_SHA_RE fullmatchlowerrErSrbool)rGrYr[rQ catalog_valuer]r^r_r`rTremovedentryrU feed_textexcfeedfeed_gitinstalled_versionrIheads&$$ rcheck_provenancedrxs ((..bCGGI&M%/ t%D%DM"G;;v&AA#''.*AL|R$))9cggjFYZ''/2d:$ \* + ` `C F 3 L Lswwx7LMSSTWYZ[\]^_  4W^^4DEFMM&s<'89 =RFMM  "(..EII"= #D )F }}}+++ ((..bC GGL ! ) )TE  e I !),D+  HH\2 HH[)//R44U; (228<<>>>)9)C)CFNN#**+/'3  $NN,FM&.nn&6&..:N:N:P&PF #M0IF  $&*F #((9:<< MM+"3FMMCT"U  " " *.v}}.?@%%6$9; M WWX  $ $"F ,   FM"4jCCTV^^-CF M} 1#7FMM   06FMM h ,SE2  sZ:P P+Q P( P#P(#P(+ Q 6 QQ Q  Q0 Q+%Q0+Q0c V^8dQhRRRR/#)rtextrrr&r)rs"rrrsrct^RIpVPV4p\ T\ 4'g \R4hTP R4p\ T\4'dTP4'g \R4hRTP4/pR FVpTP T4p\ T\4'gK,TP4'gKDTP4YV&KX TP R4p\ T\ 4'dvTP R4p T e"\ T \4'g \R4hTP4U U u/uFwr\ T \4'gKYbK! up p TR&T# TPdp\RT 24ThRp?ii;iuup p i) zwThe electron-updater-derived feed shape: version, released, min_hermes, artifacts{git,bundle,bundle_sha256}, notes_url.Nzinvalid feed YAML: zfeed must be a YAML mappingrdzfeed missing 'version'rerfz#feed artifacts.git must be a string)r" notes_url) r8r; YAMLErrorrjr=r&r>rr?items) rzr@rCrsrdoutr5rDrerfkvs & rririsd?~~d# dD ! !677hhy!G gs # #7==??122$gmmo6C*  eS ! !ekkmm{{}CH+%I)T""mmE" ?:c3#7#7BC C&__. .TQ*Q2DDAD. K J) >>?.se453>?" s#F F4=F4 F1F,,F1cV^8dQhRR/#)rrrr)rs"rrr s   rc\VRR4pVfR#VPPR4;'gR# \dR#i;i)uThe name of the distribution the entry point belongs to — metadata, never a guess derived from the import module (audit C17).distNName)getattrmetadatar>r<)eprs& r_owning_distributionr sN 2vt $D |}}  (00D0 s!:: A A  entry_pointsc(V^8dQhRRRRRRRR/#) rrvrZ pypi_latestzCallable[[str], Optional[str]]rOptional[list]rlist[CheckResult]r)rs"rrrs8BB+B0B! B  BrcVf8\\PP4P RR74p.pVFp\ VRR4;'g \ V4pV'g*VP\VPRRR74KTV!V4pT!T4pTf-TP\TPRTRRR R 74K\Yv4pTP\TPRTTTTf R T: R T: 2MRR 74K V# \PPd2TP\TPRRT: R 2R74EK-i;i)zXThe pip world, stateless: entry-point dists vs PyPI. Nothing recorded, nothing to drift.Nzhermes_agent.plugins)group dist_namepipzOentry point has no owning distribution metadata; cannot determine what to check)rrr$z distribution z not importablezunknown (not on PyPI))rrrrr r$zcannot compare PyPI version z with installed r#) list importlibrrselectrrappendrrPackageNotFoundErrorr) rvrrresultsrrrrr s $$$ rcheck_pip_pluginsrs    + + - 4 4;Q 4 R "$GB T2NN6J26N  NN9    ' 2GY' > NN#%)2   ,V= WW!1(/36*   !D ::< " ": . .CD8LMM Krc V^8dQhRRRR/#)rrrrr)rs"rrrjs22s2s2rc`^RIp!RRVPP4pVPPV!44pVP \ V4\ R7;_uu_4pVP\4pRRR4XPRRR7# +'giL#;i)uThe real feed fetcher: url -> text (raises on failure). ONE implementation shared by the manual ``hermes plugins check-updates`` and the cadence tick — callers never re-derive it. Nc(a]tRtRtV3RltRtV;t#)/default_fetch..HTTPSFeedRedirectHandlerirc <\SV`WW4WV4pVeKVPP4P R4'gVP 4\ R4hV#)Nrz%update_url redirect must use https://)superredirect_requestfull_urlrmrcloserj) r*reqfpcodemsgheadersnewurl redirected __class__s &&&&&&& rr@default_fetch..HTTPSFeedRedirectHandler.redirect_requestssW1#4gVJ%j.A.A.G.G.I.T.TU_.`.`  !HII rr)r-r.r/r0rr2 __classcell__)rs@rHTTPSFeedRedirectHandlerrrs   rrtimeoututf-8replace)errors) urllib.requestrequestHTTPRedirectHandler build_openerr:r_FETCH_TIMEOUTread_MAX_FEED_BYTESdecode)rurllibropenerresprCs& r default_fetchrjs 6>>#E#E^^ ( ()A)C DF %c*N C Ctyy) D ;;wy; 11 D Cs ,B B- c V^8dQhRRRR/#)rrIrrr)rs"rrrs--c-c-rc ^RIHp\P!V!4;'gRRVR.RRRR^RR 7pVP^8wd5\ VP ;'gR P4R ,4hVP;'gR P4pV'dVPR 4^,#R #)uThe real git probe: source -> HEAD sha (raises on failure). Uses the same resolved git executable the CLI path resolves. Lazily imports plugins_cmd (which lazily imports this module) — no import cycle at module load. )_resolve_git_executablerfz ls-remoteHEADTrrF)capture_outputrzr7rrcheckzls-remote failed:NNr# ) hermes_cli.plugins_cmdr subprocessrun returncode RuntimeErrorstderrr?stdoutrh)rIrprocrs& rdefault_ls_remoters? >> " + +e[&&I GI  D !DKK==+=DDFtLMM ;;  " # # %C!$399T?1 ,",rrYr[ include_pipTpip_installed_versionpip_pypi_latestpip_entry_pointsc8V^8dQhRRRRRRRRRR R R R R RR/#)r plugins_dirrrYzOptional[Callable[[str], str]]r[rrnrrZrz(Optional[Callable[[str], Optional[str]]]rrrrr)rs"rrrsZ""" *". "  " 0 ">"%""rc Vf\pVf\p\V4Uu.uFp\WqVR7NK ppV'd(Vf\pVP \ VVVR74V#uupi)uAll checks for one plugins dir. NEVER mutates anything. ``fetch``/``ls_remote`` default to :func:`default_fetch` / :func:`default_ls_remote` — the single shared network implementation the manual command and the cadence tick both ride. )rYr[)rvrr)rrr rx_default_pypi_latestextendr) rrYr[rrrrprs &$$$$$$ r run_checksrs  }% $K00A !I>0   "2O "7+-   NsA+c V^8dQhRRRR/#)rrrrrr)rs"rrrs  s } rcl^RIpRV R2pVPPV\R7;_uu_4p\P !VP \44pRRR4XPR4;'g/PR4# +'giL:;i \dR#i;i)u9PyPI JSON API — the real fetcher (injectable in tests).Nzhttps://pypi.org/pypi/z/jsonrinford) rrurlopenrjsonloadsrrr>r<)rrrrrCs& rrrs "4& .C ^^ # #C # @ @D::dii89DA &&B++I66A @ s.)B$*BB$?B$ B! B$$ B32B3i)*__doc__ __future__rimportlib.metadatarrrer dataclassesrpathlibrtypingrrrpackaging.versionrr hermes_cli.plugins_provenancer r r rrcompilerkrrrErWrxrirrrrrrrdrrrrrrs # !**5 !::01     .O$*ZeP< B$( BJ 2,-."-1"15 "  " 3<2D2D2L2L "AE"(,"J r