+ jHj'5a0t$Rt^RIHt^RIt^RIt^RIt^RIHtHtH t ^RI H t ^RI H t ^RIHt^RIHt]P$!]4tRR ltR R ltR R ltRRltRRltRRltRRltR+RRlltRRltR]3R]3R]3R]3R]3R]33tR ]R!&] ;QJd.R"]4FNK 5M !R"]44t!R ]R#&R$]33t"R ]R%&R&R'lt#R+R(R)llt$]R*8Xd]%!]$!44hR#),ahHome maintenance shared by explicit updates and bounded boot maintenance. Config migration owns backup/rollback; skills sync owns content merging; the SQLite guard detects damage without repairing it. Boot bounds these home steps per revision. The explicit scope CLI also provisions runtimes through PM. Launcher publication belongs to hermes_cli._launchers. ) annotationsN)datetimetimezoneUTC)Path)Iterable) expose_cli) install_rootc$V^8dQhRRRRRR/#)pathrstampstrreturn)formats";/home/ubuntu/.hermes/hermes-agent/hermes_cli/post_update.py __annotate__rs&EEtECEDEc.VPVP RV 24pVP4'gV#\^R4F@pVPVP RV RV 24pVP4'dK>Vu# \ RV 24h)z.bak-i.z#could not choose a backup path for ) with_namenameexistsrange RuntimeError)r r baseindex candidates&& r _backup_pathrs >>TYYKuUG4 5D ;;== q$NNdii[eWAeW#EF !!   &step_migrate_config..ds2AQsnonemigratedz->)hermes_cli.configr9r:r;r<hermes_cli.config_migrationsr=r>loggerwarningr+ Exceptionr5rjoin) r9r:r;r<r=r> current_ver latest_verr)post_ver_r2s rstep_migrate_configrT=s,  34K dI|44* 57L7NOdI'<== 1<>BCG55'(KH#G,::,GZ} .6>tyy222 L  EK L  $ {m2j\$B CC ! s ) CC3cV^8dQhRR/#r7r)rs"rrrms  $ rc ^RIHpV!RR7;'g/pRRR\VPR4;'g.4R\VPR4;'g.4/#)z~Sync bundled skills into the active home. Content-diffed, respects user modifications and deletions; converges on repeat runs.) sync_skillsT)rBr?copiedupdated)tools.skills_syncrWlenget)rWresults rstep_sync_skillsr^ms^. t $ * *F d#fjj*00b13vzz),223 rcV^8dQhRR/#r7r)rs"rrr~s++T+rc^RIHp^RIHpV!4R, pVP 4'gRRRR/#V!VRRR7pVP R 4'dRR/#VP R R 4p\ PR V4RR RV/#)aVerify the active home's state.db is intact. Boot bootstrap has no pre-update snapshot to restore from (that pairing lives in ``hermes update``), so this is detection: a corrupt db is surfaced loudly in the log instead of the user silently losing session search. Read-only, idempotent. get_hermes_home)verify_sqlite_integrityzstate.dbr?Tr@z no-state-db) check_header run_pragmavalidmessagez unknown erroru|state.db failed integrity check after a code update: %s — restore a backup with `hermes backup` tooling or contact supportFerror)hermes_constantsrbhermes_cli.backuprcrr\rLrh)rbrc state_pathr]rgs rstep_state_db_guardrl~s19 "Z/J     dI}55 $Zdt TF zz'd|jjO4G LL K %' **rcV^8dQhRR/#r7r)rs"rrrs  t rc<^RIHp^RIHpV!V!44RR/#)a Drop the active home's cached live plugin catalog after a code change. Bundled/sealed app updates never run ``hermes update``'s maintenance tail, so without this a pre-update snapshot out-votes the newer in-tree catalog for the rest of its TTL (#119340). Per home, like the boot record. ra)invalidate_live_cache_for_homer?T)rirbhermes_cli.plugin_catalogro)rbros rstep_drop_live_plugin_catalogrqs1H"?#45 $<rc V^8dQhRRRR/#)r project_rootz Path | Nonerr"r)rs"rrrsX.X.kX.TX.rc ^RIp^RIp^RIHpVf \ 4M \ V4pV!4R, \ R43pVR, P 4'gRRRR /#^R IHpV!V4pVP 4'dRRRR /#RpVP4pR p TFp YP48XdRp MK T 'gRRRR/#^RI H p T !TRR7p T fR^RRRRR\P !\"4P%4/pTP'\)T4RRR7wpp\*P,!TRRR7;_uu_4pTP/TP1T^R7R ,4RRR4\*P2!TT4\P5R!T4RRR"\)T4/# \d RRRR /u#i;i \dEKIi;i \d*p \PRT 4RRRRT 2/uRp ? #Rp ? ii;i +'giL;i \d*p \PRT 4RRRRT 2/uRp ? #Rp ? ii;i)#uOne-time adoption of shipped stampless installs (birth certificate). Main-era curl|sh / Setup installs created a ``.git`` checkout at a blessed managed root but never wrote a stamp — under the stamp-pure ladder they would all classify as "somebody's working tree" and `hermes update` would refuse them. This step writes the missing fact exactly once: blessed root + ``.git`` + no stamp → a minimal stamp with ``updateMechanism: self``. The blessed-root table lives HERE and only here — it is a one-time birth certificate for shipped installs, not a classification rung (hermes_cli.steward never path-matches). Once pre-stamp installs are extinct this step and the table can be deleted. * ``.git`` anywhere else → never adopted. * An existing stamp (any content) → untouched. * nix/docker/sealed populations are excluded by construction: their update mechanisms replace the tree wholesale with a build-time-stamped one, and sealed payloads always ship stamps. * Read-only tree (nix-like) → soft skip with a debug log, no crash. Nraz hermes-agentz/usr/local/lib/hermes-agentz.gitr?Tr@znot-a-checkout)install_stamp_pathzalready-stampedzunresolvable-rootFznot-a-blessed-root)write_source_stamp)adoptedz2blessed-checkout adoption skipped (unwritable): %sz unwritable: schemaVersionupdateMechanismselfsourceadoption adoptedAtz.install-stamp.z.tmp)dirprefixsuffixwzutf-8)encoding)indent z6adopted blessed checkout at %s (updateMechanism: self)rw)jsontempfilerirbr rrpm.pathsruresolveOSErrorhermes_cli.source_stamprvrLdebugrr$r isoformatmkstemprosfdopenwritedumpsreplaceinfo)rsrrrbrootblessedru stamp_path resolved_root is_blessedrrv identifiedexcr fdtmp_namehandles& rstep_adopt_blessed_checkoutrs|,0)1<>tL7ID N* *+G 6M ! ! # #dI'788+#D)JdI'899M<  J   1 1 33! 4 dI';<<:=(d;  Q v j c*446   A#++I&7,LB2sW55 TZZaZ84?@6 JJx , KKH$O $ 3t9 --W <dI':;;<    =  I3OdIcU';<< ="65 A LLMs S$ \#+?@ @ AsyG)G G2AH<*H)H<GG G/.G/2 H&=H!H&!H&) H9 4H<< I0I+%I0+I0cV^8dQhRR/#r7r)rs"rrrs!0!0!0rc^RIp^RIHpHpVP 4pV'gRRRR/#V!4'dRRRR/#V!4'gRRRR/#.p.pVFCpVR 8XdVP RRR 7MVP VRR 7VPV4KE V'dRRRRPV4RV/#RRRV/# \d8p\PR Yg4TPT R T 24Rp?KRp?ii;i)zExplicit refresh of PM's drifted packages; never selected by boot. PM supplies package identities, not diagnostic text to parse. Its own ensure/sync operations own freshness checks and publication under lock. N)lazy_installs_allowedsealedr?Tr@currentrzlazy-installs-disabledvenv)explicitevict_incompatible_plugins)rz!provision_runtimes: %s failed: %s: Frhz; refreshed) pm pm.installrrdrift sync_venvensurer1rNrLrMrO)rrrproblemsrerrorsrrs rstep_provision_runtimesrs 8xxzH dIy11 xxdIx00 " "dI'?@@IF ,v~ dt L $ .   T " eWdii&7iPP $ Y //  , NN> J MMTF"SE* + + ,s?C D,DDadopt_blessed_checkoutr<rWstate_db_guarddrop_live_plugin_catalogrtuple HOME_STEPSc#D"TFq^,R8wgKVxK R#5i)rWNr)rDsteps& rrFrF4sT7m#;DDZs  BOOT_HOME_STEPSprovision_runtimes MACHINE_STEPSc V^8dQhRRRR/#)r stepsrrr"r)rs"rrr=sX$rc/pVFwr#V!4W&K V# \d3p\PRY$4RRR\T4/Y&Rp?KMRp?ii;i)uRun steps in order; one failure never stops the rest. Returns ``{name: result_dict}``. A raising step records ``{"ok": False, "error": str}`` — the caller still writes its record so a broken step cannot retrigger the slow path on every boot. zpost-update step %s failed: %sr?FrhN)rNrLrMr)rresultsrfuncrs& r run_stepsr=s_G  = FGM N = NN;T G!5'3s8Run the selected maintenance registry and report its failures.Nzhermes_cli.post_update)progz--scopeall)choicesdefaultz %(message)s)levelrr?zFAILED (rh)r@z post-update rz skipped ()homemachiner)rr)rr)argparseArgumentParser add_argument parse_argslogging basicConfigINFOscopeextendrrrr0r\print) rrparserargsselectedrrresfailedstater@s & rmainrNs9  $ $*B $ CF  +EuU   T "D gll=AH zz_$ # zz'' &!G$+MMO IOyt3774=ddOF I]]_  Xcggg6F5Gq+I'')$ tfB7)1'=e&TUV%1A Js E:.E:__main__r/)&__conditional_annotations____doc__ __future__rrrr'rrrpathlibrtypingrhermes_cli._launchersrrr getLogger__name__rLrr+r5rTr^rlrqrrr__annotations__rrrrr SystemExit)rs@rrs%# ,,,!   8 $E )D` "+4 X.v!0R:;*+$%*+!>?:  E 23 u"0 z TV r