+ jHjj;na0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t ^RIHt^RIHtHtHtHt^RIHtHt^RIHtHt^R IHt^R IHt^R IH t ^R I!H"t"]PF!R 4t$]%!0RRRllt5R R!lt6R"R#lt7R$R%lt8R&R'lt9R(R)lt:R*R+lt;R,R-ltR2R3lt?R4R5lt@R6R7ltAR8R9ltBR:R;ltCR#)?aDashboard plugins of a secondary served profile (PLG-3, #134889). A gateway serving several profiles imports dashboard plugin code for its launch profile only. A request scoped to another served profile (its native grant, a ``?profile=`` selection) gets that profile's own plugins: discovered under its own home and the root, gated by its own ``plugins.enabled`` / ``plugins.disabled``, and run in its own plugin host (bound to its home and secret scope) whatever its ``plugins.isolation`` says, so another profile's plugin code never enters this process. Bundled plugins are Hermes code and stay in-process. The host protocol is request/response, so a secondary profile's plugin websockets are refused by name until it carries them. ) annotationsN)ThreadPoolExecutor) ExitStackcontextmanager)Path)AnyCallableIteratorOptional) parse_qsl urlencode) JSONResponseResponse)status)get_route_path) WebSocket)get_process_hermes_homezhermes_cli.web_serverzdict[str, list]_profile_pluginszdict[str, int]_profile_rescansgN@zdict[str, ThreadPoolExecutor]_hosted_executorsg$@zdict[tuple[str, str], float]_unknown_pluginscV^8dQhRR/#)returnOptional[Path])formats"J/home/ubuntu/.hermes/hermes-agent/hermes_cli/web_server_plugin_profiles.py __annotate__r=sgggcp^RIHpHpV!4pV!V4V!\448XdR#\ V4#)zVThe active scope's home when it is a profile other than the launch profile, else None.)get_hermes_homehermes_home_keyN)hermes_constantsr!r"rr)r!r"homes rsecondary_profile_homer%=s4A  D"4(O serve`` scanned them; the profile's own copy wins a same-name conflict), then the bundled ones.)get_bundled_plugins_dir)_get_default_hermes_home)_discover_dashboard_pluginspluginsF)strictusermemorybundled)hermes_cli.pluginsr)hermes_cli.profilesr*hermes_cli.web_server_dashboardr+rresolve) r$r)r*r+r0ownrdirsds & r_scan_profile_pluginsr9Ds;<K*,d4j9.DS 5 8 :Y FGMG!yyy.#++U+2KKAGM MD &"#dVd#((:I'FR[H\&]] __M $s)B(,B( B-c(V^8dQhRRRRRRRR/#)rkeystrrescansintr,r'rr)rs"rrrRs(C#rc\;_uu_4\PV^4V8Xd V\V&RRR4V# +'giT#;i)z_Cache ``plugins`` for ``key`` unless an explicit rescan began after this scan did; return them.N)_profile_plugins_lockrgetr)r;r=r,s&&&r _publishedrBRsD     Q '7 2$+ S !  N   Ns %> A c$V^8dQhRRRRRR/#)rr$r force_rescanboolrr'r)rs"rrrZs!  D   rcJ^RIHpV!V4p\;_uu_4V'dX\P V^4^,\V&\ Uu.uFqD^,V8XgKVNK upF p\ VK \ P V4\P V^4rvRRR4XeCV'g;\;QJdRV4F 'gK RM RM !RV44'd\VX\V44pV#uupi +'giLs;i)zDashboard plugins of the profile at ``home`` (:func:`_scan_profile_plugins`), cached per home like the launch profile's list. An explicit rescan also forgets the profile's cached misses.r"Nc3l"TF*p\VR,4P4'*xK, R#5i)_dirN)ris_dir).0ps& r ,profile_dashboard_plugins..es),ZSYaai1G1G1I-I-ISYs24TF) r#r"r@rrArranyrBr9)r$rDr"r;kunknowncachedr=s&& rprofile_dashboard_pluginsrSZs1 $ C   $4$8$8a$@1$D S !'7G'7!Q43;AA'7G$W-H*..s35E5I5I#q5Q  ~,ZSY,Z,ZSY,Z)Z)ZC*?*EF M H  s#5DD &D ,;D D D" c$V^8dQhRRRRRR/#)rr,r'namer<rOptional[dict]r)rs"rrrjs&EEDEEErc0a\V3RlV4R4#)c3V<"TFqPR4S8XgKVxK R#5i)rUN)rA)rKrLrUs& rrM_named..ks =GquuV}'<Gs) )N)next)r,rUs&fr_namedr[js =G=t DDrc$V^8dQhRRRRRR/#)rr$rrUr<rrVr)rs"rrrns!4s~rc ^RIHpV!V4\P!4rCW13p\;_uu_4\ P WT4V8d RRR4R#\P V^4pRRR4\\VX\V44V4p\;_uu_4\ P4UU u.uFwrW8:gK VNK up pF p \ V K Ve\ PVR4M/\P V^4V8XdV\,\ V&RRR4V# +'giL;iuup pi +'giT#;i)zThe profile at ``home``'s entry for ``name`` after a rescan, or None; a name found missing within the last :data:`_UNKNOWN_PLUGIN_RESCAN_SECS` is answered without one. Blocking: the request gate runs it on a worker thread.rGN)r#r"time monotonicr@rrArr[rBr9itemspop_UNKNOWN_PLUGIN_RESCAN_SECS) r$rUr"home_keynowr;r=pluginrPuntilexpireds && rrescanned_pluginrhns1#D)4>>+;c  C      )C /  #&&x3  Jx2G2MNPT UF  *:*@*@*BS*Bhael*BSG )T    d +  ! !(A .' 9$'*E$E S !  M  T   Ms6D9D9&E> E E AE9 E E E# c V^8dQhRRRR/#)rrerVrrr)rs"rrrsBBNB~BrcV'dVPR4'gR#\VR,4VR,, P4#)z@The resolved backend file of a discovered plugin entry, or None. _api_fileNrI)rArr4res&rplugin_api_pathrms8 K00  6+#6 6 ? ? AArc V^8dQhRRRR/#)rrUr<rrr)rs"rrrs G Gs G~ Grcn^RIp^RIHpHp^RIHpHpV!W04'dM\VPPRV 24RR4pV'd\V4P4#R#V!4;_uu_4\\V!4V44uuRRR4# +'giR#;i)zThe file this process's ``/api/plugins//`` router runs: the imported module's when one is mounted (a hosted forward route has none here), else the copy the first request would mount, the launch profile's discovery entry.N)_get_dashboard_pluginsapp)_launch_profile_scope_plugin_api_mountedhermes_dashboard_plugin___file__)syshermes_cli.web_serverrprqr3rrrsgetattrmodulesrArr4rmr[)rUrvrprqrrrsfiles& r_in_process_api_filer{sAZ3%%s{{)A$'HI:W[\'+tDz!!#55  v&<&>EF ! s >B## B4 c V^8dQhRRRR/#)rrerVrrEr)rs"rrrsQQ^QQrcVRJ;'d;VPR4R8H;'d\VR,4\V48H#)zWhether a secondary profile's entry may use this process's router: only its bundled copy, and only when that router runs that very file (a launch-profile user plugin can shadow the bundled name, or a disabled one hide it).Nsourcer0rU)rAr{rmrls&r_runs_in_processrsP $  P P6::h#79#D P P$VF^48OOQrc V^8dQhRRRR/#rrUr<rrVr)rs"rrrsSS3S>SrcL\4pVfR#\\V4V4#)zZThe active secondary profile's own entry for ``name``, or None (also in the launch scope).N)r%r[rS)rUr$s& rsecondary_pluginrs& ! #D<4RV,Ed,KT%RRrc V^8dQhRRRR/#rr)rs"rrrsJJ3J>JrcJ\V4pVe\V4'dR#T#)zThe active secondary profile's own entry for ``name`` when its plugin host serves it, or None: the launch profile's scope, an unknown name, or the bundled copy this process runs.N)rr)rUres& r_secondary_hosted_pluginrs(d #F>%5f%=%=4I6Irc V^8dQhRRRR/#rrUr<rrEr)rs"rrrsaaCaDarc\\4RJ;'d\\V44'*#)zWhether this process's ``/api/plugins//`` router (the launch profile's copy) must not serve the active scope: a secondary profile runs only its own bundled copy here.N)r%rr)rUs&rin_process_router_refusedrs* " #4 / ` `8HIYZ^I_8`4``rcV^8dQhRR/#)rrzIterator[None]r)rs"rrrs  > rc#"^RIHp^RIHpHp\ \ VPRR4PR444PR4p\4;_uu_4pV!V4'gVPV!V44RxRRR4R# Td+p\PRYFP4Rp?L:Rp?ii;i +'giR#;i5i) zBind a plugin request's ``?profile=`` selection for its routing decision (the route dependency binds it again for the handler). An unknown profile binds nothing: the route dependency answers it as for any other route.) HTTPException)_config_profile_scope_is_current_profile query_stringrzlatin-1profilez/Plugin request for profile %r left unscoped: %sN)fastapirhermes_cli.web_server_profilesrrdictr rAdecoder enter_context_logdebugdetail)scoperrrrstackexcs& rplugin_request_scopers &Y9UYY~s;BB9MNOSST]^G "7++ c##$9'$BC  ! c LgWaWabb c sHA#C"%C5B C C"C ! CCC  C C  C"c V^8dQhRRRR/#)rresultdict[str, Any]rrr)rs"rrrsNxrc\VR,\VR,4R7pVR,F7wr#VP4R9gKVPP W#4K9 V#)z7A plugin host's buffered ``asgi`` answer as a response.bodyr)content status_codeheaders> connectioncontent-lengthtransfer-encoding)rr>lowerrappend)rresponser;values& rhosted_responsersZvCx@PSTXY]T^TcTcSd$run_hosted_request..sT#hIY>Y[_:`5arNz4Plugin %s: its plugin host did not answer within %gsrplugin z did not answer within gsir)HOSTED_REQUEST_TIMEOUT_SECSr^r_ contextvars copy_contextasyncioget_running_looprun_in_executorrrunrwait_for TimeoutErrorrwarningr )r$rUrtimeoutcontextjobrs&&f @rrun_hosted_requestrs*G(72K4L4L4NHg  " " $ 4 4 -a cCpW%5%5c%CCDDC p KT[X8OPWXY{Z['\]knoops<A7C$<B%B#B%"C$#B%%9C!C$ C!!C$c V^8dQhRRRR/#)rrUr<rzOptional[Response]r)rs"rrrs--#-BT-rc aaa a a a a a"\S4\4uo pS eVfR#S PR4'g\RR/RR7#\ SP 4P R^4pR\V4^8d V^,MR,o \\SPPR R 7UUu.uFwrEV\9gKWE3NK upp4oSPP4UUu.uF#wrEVP4\ 9gK WE3NK% uppo SP#4GRjxL o ^R IHpV!S4o R V V V VV V VV3R llp\)VSV4GRjxL #uuppiuuppiLDL \*d7p\,P/RSS T4\RRS: R2/RR7uRp?#Rp?ii;i5i)zServe ``/api/plugins//`` for a secondary profile through its own plugin host, or None when the in-process router answers (the launch profile, or a bundled plugin). Consent has been checked in the request's scope already.Nrkrz Not Foundir/T)keep_blank_values)admitted_for_sensitive_routec V^8dQhRRRR/#)rrfloatrrr)rs"rr6forward_secondary_plugin_request..__annotate__seeeeerc <^RIHpV!4P4pVPS\ SR,4\ SR,4S P SS SSVSR7 #)r)get_plugin_managerrIrk)r authenticated)r1r _plugin_host asgi_requestr<method) rrhostrrrrUpathrequeryrequests & rr.forward_secondary_plugin_request..callsb9!#002  s6&>':C{@Srcookie authorizationx-hermes-session-tokenx-hermes-gateway-ticket>tokenattachticketrinternaldisplay_ticket)F)D__conditional_annotations____doc__ __future__rrrlogging threadingr^concurrent.futuresr contextlibrrpathlibrtypingrrr r urllib.parser r fastapi.responsesr r starletterstarlette._utilsrstarlette.websocketsrhermes_cli.configr getLoggerr frozensetrrr__annotations__rLockr@rrrrbrr%r9rBrSr[rhrmr{rrrrrrrrrr)rs@rrs: # 1044-4+*501()\] fg$&/&#%.%!( #3505#13.3g _  E0B GQS Ja     p-@r