+
    lHàj±/  ã                   ó  € R t ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	H
t
 ^ RIHt ]P                  ! R4      t0 RmtR tR R ltR R	 ltR
RR^RR/R R lltR R ltR R ltR R ltRR R lltRR R lltR R ltR# )uA  Host-side RPC servers for execute_code sandboxes.

Two transports share one request pipeline (token check â†’ allow-list â†’ call
budget â†’ dispatch under output silence â†’ log): ``_rpc_server_loop`` serves the
local UDS/TCP socket, ``_rpc_poll_loop`` polls a remote filesystem for request
files via ``env.execute()``.
N)Úthread_scoped_silence)Ú
tool_errorztools.code_execution_toolc                 ó    a a€ ^ RI Ho VV 3R l# )é    )Úhandle_function_callc                 ó   <€ S! WSR 7      # ))Útask_id© )Ú	tool_nameÚ	tool_argsr   r   s   &&€€Ú=/home/ubuntu/.hermes/hermes-agent/tools/code_execution_rpc.pyÚ<lambda>Ú#_default_dispatch.<locals>.<lambda>   s   ø€ Ñ(<¸YÐ[bÕ(có    )Úmodel_toolsr   )r   r   s   f@r   Ú_default_dispatchr      s   ù€ Ý0ÝcÐcr   c                ó<   € V ^8„  d   QhR\         R\         R\         /# )é   ÚrootÚsubdirsÚreturn©Ústr)Úformats   "r   Ú__annotate__r   !   s&   € ÷ Añ AœCð A¬3ð A´3ñ Ar   c                óŽ   € RP                  R T;'       g    V 3 4       4      pRP                  R V .VO 4       4      pRV RV 2# )a2  Shell command creating *root* (and optional *subdirs* under it) owner-only
on a shared host. ``umask 077`` makes intermediates and leaves private at
creation (no mkdir-then-chmod window where a co-tenant could open a dir fd);
``chmod`` then repairs any named dir that already existed with permissive
modes.Ú c              3   óN   "  € T F  p\         P                  ! V4      x € K  	  R # 5i©N©ÚshlexÚquote©Ú.0Úds   & r   Ú	<genexpr>Ú$_private_dirs_cmd.<locals>.<genexpr>'   s   é € ÐBÑ.@¨”U—[’[ —^�^Ó.@ùó   ‚#%c              3   óN   "  € T F  p\         P                  ! V4      x € K  	  R # 5ir   r   r"   s   & r   r%   r&   (   s   é € Ð>Ñ-=¨”U—[’[ —^�^Ó-=ùr'   zumask 077 && mkdir -p z && chmod 700 )Újoin)r   r   ÚmkdirÚchmods   &*  r   Ú_private_dirs_cmdr,   !   sT   € ð �H‰HÑB¨g×.@Ð.@¸$¸Ð.@ÓBÓB€EØ�H‰HÑ>¨dÐ-=°WÑ-=Ó>Ó>€EØ# E 7¨.¸¸Ð@Ð@r   c                óH   € V ^8„  d   QhR\         R\         R\        R\        /# )r   ÚcmdÚwhatÚtimeoutr   )r   ÚintÚdict)r   s   "r   r   r   ,   s(   € ÷ 	ñ 	œsð 	¬#ð 	¼3ð 	ÌTñ 	r   c               ó¢   € V P                   ! V3RRRV/VB pVP                  R^4      ^ 8w  d!   \        V RVP                  R4      : 24      hV# )zøRun *cmd* from ``/`` and raise ``RuntimeError`` on a non-zero exit.

Used where a silent failure would ship secrets or code into a missing,
half-written, or still-permissive remote path. The error carries the
command output only, never the payload.ÚcwdÚ/r0   Ú
returncodez	 failed: Úoutput)ÚexecuteÚgetÚRuntimeError)Úenvr.   r/   r0   ÚkwargsÚresults   &&&$, r   Ú_execute_checkedr>   ,   sY   € ð �[Š[˜ÑA #ÐA¨wÐA¸&ÑA€FØ‡z�z�, Ó" aÔ'Ü˜d˜V 9¨V¯Z©Z¸Ó-AÑ,DÐEÓFÐFØ€Mr   ÚatomicFr0   Úcheckc          
      óT   € V ^8„  d   QhR\         R\         R\        R\        R\        /# )r   Úremote_pathÚcontentr?   r0   r@   )r   Úboolr1   )r   s   "r   r   r   8   s8   € ÷ Jñ J¤Cð J´#ð JÄ$ð JÜðJÜ,0ñJr   c               ó,  € \         P                  ! VP                  R4      4      P                  R4      p\        P
                  ! V4      pV'       d   RV RV RV 2MRV 2pRV 2p	V'       d   \        W	RV: 2WFR7      # V P                  V	R	WFR
7      # )a.  Write *content* owner-only to *remote_path*; returns the execute() result
(``check=True`` raises on failure via _execute_checked).

The base64 payload always travels as ``stdin_data``: pipe-mode backends
(ssh, docker, local: the real shared-host ones) deliver it on
real stdin, so it never enters argv where a co-tenant can read it via
``/proc/*/cmdline``; ``BaseEnvironment.execute`` embeds it as a heredoc
for heredoc-mode backends (modal, daytona, vercel), and managed_modal
forwards it as ``stdinData``, the same contract ``_write_to_sandbox``
relies on.zutf-8Úasciizbase64 -d > z.tmp && mv -f z.tmp zumask 077 && zremote file ship for )r0   Ú
stdin_datar5   )r4   r0   rG   )Úbase64Ú	b64encodeÚencodeÚdecoder    r!   r>   r8   )
r;   rB   rC   r?   r0   r@   ÚencodedÚtargetÚwriter.   s
   &&&$$$    r   Ú_remote_writerO   8   s¢   € ô ×Ò˜wŸ~™~¨gÓ6Ó7×>Ñ>¸wÓG€GÜ�[Š[˜Ó%€Fçð ˜F˜8 >°&°¸¸v¸hÑGØ*¨6¨(Ð3ð 
à˜%˜Ð
!€CßÜ Ð,AÀ+ÁÐ*QØ(/ôEð 	Eà�;‰;�s ¨Wˆ;ÓIÐIr   c                ó<   € V ^8„  d   QhR\         R\        R\        /# )r   ÚrequestÚ	rpc_tokenr   )r2   r   rD   )r   s   "r   r   r   O   s!   € ÷ ñ œ4ð ¬Cð ´Dñ r   c                óÒ   € \        V4      ;'       dV    \        P                  ! \        V P	                  R4      ;'       g    R4      P                  4       VP                  4       4      # )z¬Constant-time token check; an empty server token fails closed. Compared as bytes:
compare_digest raises TypeError on a non-ASCII str, and the token is script-supplied JSON.ÚtokenÚ )rD   ÚsecretsÚcompare_digestr   r9   rJ   )rQ   rR   s   &&r   Ú_rpc_token_okrX   O   sT   € ô �	‹?÷ ð œw×5Ò5ÜˆG�K‰K˜Ó ×&Ð& BÓ'×.Ñ.Ó0°)×2BÑ2BÓ2Dó ð r   c                óx   € V ^8„  d   QhR\         R\        R\        R\        R\        R\        R\
        R\
        /# )	r   rQ   Úallowed_toolsÚtool_call_counterÚmax_tool_callsÚtool_call_logÚ
call_startÚwherer   )r2   Ú	frozensetÚlistr1   Úfloatr   )r   s   "r   r   r   W   sJ   € ÷ ñ ¤ð ¼ð ÔW[ð Ü(+ðÜFJðÜX]ðä"ðä'*ñr   c          
     óF  € V P                  RR4      pV P                  R/ 4      p	W�9  d*   \        RV RRP                  \        V4      4       24      # V^ ,          V8¼  d   \        RV R24      # VR	8X  d6   \	        V	\
        4      '       d    \         F  p
V	P                  V
R
4       K  	   \        4       ;_uu_ 4        V! W‰4      pR
R
R
4       T^ ;;,          ^,          uu&   RTR\        T	4      R,          R\        \        P                  ! 4       T,
          ^4      /p\!        X4      pT'       d   YíR&   TP#                  T4       T#   + '       g   i     L‹; i  \         d7   p\        P                  RY|RR7       \        \        T4      4      p R
p?LÊR
p?ii ; i)zŽEnforce allow-list + budget, then dispatch one authenticated request. Only a dispatched
call consumes budget and is logged; refusals are free.ÚtoolrU   ÚargszTool 'z/' is not available in execute_code. Available: z, zTool call limit reached (z0). No more tool calls allowed in this execution.ÚterminalNzTool call failed in %s: %sT©Úexc_infoÚargs_preview:NéP   NÚdurationÚerror)r9   r   r)   ÚsortedÚ
isinstancer2   Ú_TERMINAL_BLOCKED_PARAMSÚpopr   Ú	ExceptionÚloggerrl   r   ÚroundÚtimeÚ	monotonicÚ_result_errorÚappend)rQ   rZ   r[   r\   Údispatchr]   r^   r_   r
   r   Úparamr=   ÚexcÚentryrl   s   &$$$$$$$       r   Ú_handle_rpc_requestr|   W   s|  € ð
 —‘˜F BÓ'€IØ—‘˜F BÓ'€IØÔ%Ü˜F 9 +ð .(Ø(,¯	©	´&¸Ó2GÓ(HÐ'IðKó Lð 	Là˜Õ˜~Ô-ÜÐ5°nÐ5Eð FJð Jó Kð 	Kà�JÔ¤:¨i¼×#>Ò#>ß-ˆEØ�M‰M˜% Ö&ñ .ð&Ü"×$Õ$Ù˜iÓ3ˆF÷ %ð
 �a×˜AÕÓØ�Y ´°I³¸sÕ0CØœœtŸ~š~Ó/°*Õ<¸aÓ@ðB€Eä˜&Ó!€EßØˆg‰Ø×Ñ˜ÔØ€M÷ %×$ûäô &Ü�‰Ð1°5ÈˆÔMÜœC ›HÓ%�ûð&ús6   Â.E Ã 	EÃ	E ÅE	ÅE ÅE ÅF Å*,FÆF c                ó$   € V ^8„  d   QhR\         /# )r   r   r   )r   s   "r   r   r   x   s   € ÷ 	-ñ 	-œSñ 	-r   c                óJ  € \        V \        4      '       d   V P                  R4      '       d   RV 9  d   R#  \        P                  ! V 4      p\        T\        4      '       d   TP                  R4      MRpT'       d   \        T4      R,          # R#   \
         d     R# i ; i)z=The ``error`` text of a JSON-object tool result, else ``""``.Ú{z"error"rU   rl   N:Ni,  N)rn   r   Ú
startswithÚjsonÚloadsÚ
ValueErrorr2   r9   )r=   Úbodyrl   s   &  r   rv   rv   x   s…   € ä�fœc×"Ò"¨&×*;Ñ*;¸C×*@Ò*@ÀIÐU[ÔD[ÙðÜ�zŠz˜&Ó!ˆô ",¨D´$×!7Ò!7ˆD�H‰H�WÔ¸T€Eß$Œ3ˆu‹:�dÕÐ,¨"Ð,øô ô Úðús   ¸B ÂB"Â!B"c                ó<   € V ^8„  d   QhR\         R\        R\         /# )r   r]   Ústartr   )ra   r1   )r   s   "r   r   r   „   s&   € ÷ kñ k¤Tð k´#ð k¼dñ kr   c                ó–   € WR  Uu. uF/  q"P                  R4      '       g   K  RVR,          RVR,          /NK1  	  upR,          # u upi )zÚFailed in-script tool calls since *start*, for the execute_code result: a script that
ignores a helper's ``{"error": ...}`` return would otherwise report plain success while
the write/patch it relied on never happened.Nrl   rd   :Né   N)r9   )r]   r†   Úes   && r   Útool_errors_sincerŠ   „   sJ   € ð ?LÈFÑ>SÓfÑ>S¸×W\ÑW\Ð]d×WeÔ4ˆV�Q�v•Y ¨¨7­Ó4Ñ>SÑfÐgiÕjÐjùÒfs
   ‡A¤Ac                ó    € V ^8„  d   QhR\         P                   R\        R\        R\        R\        R\        R\
        P                  R\        /# )	r   Úserver_sockr   r]   r[   r\   rZ   Ú
stop_eventrR   )Úsocketr   ra   r1   r`   Ú	threadingÚEvent)r   s   "r   r   r   ‹   sQ   € ÷ 9<ñ 9<¤&§-¡-ð 9<¼#ð 9<Ìdð 9<Ü(,ð9<Ü>Að9<ÜR[ð9<ä!*§¡ð9<ä=@ñ9<r   c	                óÄ  € Vf   \        V4      pRp	 V P                  R4       VP                  4       '       g    V P                  4       w  rš V	f    V	'       d    V	P                  4        R# R# V	P                  R4       Rp  V	P                  R4      pT'       g   MÏYÍ,          pRT9   g   K-  TP                  R^4      w  rìTP                  4       pT'       g   K7  \        P                  ! 4       p \        P                  ! TP!                  4       4      p\#        TT4      '       d   \%        TYSYHTTR	R
7      M
\'        R4      pT	P-                  TR,           P/                  4       4       KÇ  T	'       d    T	P                  4        R# R#   \         d     EKv  i ; i  \         d"   p\        P                  RT4        Rp?R# Rp?ii ; i  \         d     Km  i ; i  \        P(                  \*        3 d   p\'        RT 24      p Rp?LÇRp?ii ; i  \         d    \        P                  R4        LÉ\         d#   p\        P                  RTRR7        Rp?LðRp?ii ; i  \         d"   p\        P                  RT4        Rp?R# Rp?ii ; i  T	'       dA    T	P                  4        i   \         d!   p\        P                  RT4        Rp?i Rp?ii ; ii ; i)as  Accept one client and serve newline-delimited JSON requests until it disconnects, idles
300s, or the call limit is reached. ``tool_call_counter`` is a mutable ``[int]``. ``dispatch``
overrides how an allowed, budgeted call runs: per-call sandboxes use the default (the thread
carries the cell's context); session kernels rebind each call to the CURRENT cell's authority.
Ngš™™™™™©?zRPC conn close error: %si,  r   Ti   ó   
Úsandbox©rZ   r[   r\   rx   r]   r^   r_   zUnauthorized RPC requestzInvalid RPC request: Ú
zRPC listener socket timeoutzRPC listener socket error: %srg   )r   Ú
settimeoutÚis_setÚacceptÚTimeoutErrorÚcloseÚOSErrorrr   ÚdebugÚrecvÚsplitÚstriprt   ru   r�   r‚   rK   rX   r|   r   ÚJSONDecodeErrorÚUnicodeDecodeErrorÚsendallrJ   )rŒ   r   r]   r[   r\   rZ   r�   rR   rx   ÚconnÚ_r‰   ÚbufÚchunkÚliner^   rQ   Úresprz   s   &&&&&&&&&          r   Ú_rpc_server_loopr©   ‹   s†  € ð ÒÜ$ WÓ-ˆØ€Dð.<Ø×Ñ˜tÔ$Ø×#Ñ#×%Ò%ðØ%×,Ñ,Ó.‘�Øð Š<Ø÷B ð<Ø—
‘
–ñ ðA 	�‰˜ÔØˆØðØŸ	™	 %Ó(�÷ ØØ�LˆCØ˜3–,ØŸI™I e¨QÓ/‘	�Ø—z‘z“|�ßÙÜ!Ÿ^š^Ó-�
ð	gÜ"Ÿjšj¨¯©«Ó7�Gô ' w°	×:Ò:ô	 /Ø¨}Ø'5ÐXeØ#-°Yõô AKÐKeÓ@fð	 ð
 —‘˜d T�k×1Ñ1Ó3Ö4÷ ð<Ø—
‘
–ñ øôI  ô ÛðûôN ô <Ü—‘Ð7¸×;Ò;ûð<ûô=  ô Úðûô ×,Ñ,Ô.@ÐAô EÜ%Ð(=¸c¸UÐ&CÓD•DûðEûô ô 4Ü�‰Ð2Ö3Üô HÜ�‰Ð4°aÀ$ˆ×GÑGûðHûô ô <Ü—‘Ð7¸×;Ò;ûð<û÷ ð<Ø—
‘
•øÜô <Ü—‘Ð7¸×;Ñ;ûð<úð ús&  “&H »F ÁH ÁF Á0H ÂG ÂH ÂJ ÂH Â0AH Ã4$G ÄAH Å7I& ÆFÆH ÆFÆH ÆG
Æ)GÇG
ÇGÇH ÇJ ÇGÇH ÇHÇ:HÈH ÈHÈH È I#È5J È7I#É I#ÉIÉJ ÉI#É#J É&JÉ1JÊJÊ	KÊJ0Ê/KÊ0KÊ;KËKËKËKc                óŒ   € V ^8„  d   QhR\         R\         R\        R\        R\        R\        R\        P
                  R\         /# )	r   Úrpc_dirr   r]   r[   r\   rZ   r�   rR   )r   ra   r1   r`   r�   r�   )r   s   "r   r   r   Ç   sM   € ÷ 8+ñ 8+¤ð 8+¬sð 8+Ä4ð 8+Ô\`ð 8+Ü#&ð8+Ü7@ð8+ÜNWÏoÉoð8+ä!ñ8+r   c	                óÀ  € \        V4      p	Rp
\        P                  ! V4      pVP                  4       '       Eg    V P	                  RV R2R^
R7      pVP                  RR4      P                  4       pV'       g   VP                  V
4       Kk  \        R R	 VP                  R
4       4        4       4      pV EF\  pVP                  4       '       d    EME\        P                  ! 4       p\        P                  ! V4      pV P	                  RV 2R^
R7      p \        P                  ! VP                  RR4      4      p\%        TT4      '       g0   \         P#                  RT4       T P	                  RT 2R^R7       KÇ  TP                  R^ 4      p\'        T\(        4      '       g1   \         P#                  RT4       T P	                  RT 2R^R7       EK  \+        TYdYYTTRR7      p\-        Y RTR 2TR^<R7       T P	                  RT 2R^R7       EK_  	   VP                  4       '       d   EK  VP                  V
4       EK$  R#   \        P                  \        3 d3    \         P#                  RT4       T P	                  RT 2R^R7        EKÝ  i ; i  \.         d9   pTP                  4       '       g   \         P#                  RTRR7        Rp?L½Rp?ii ; i)züPoll the remote filesystem for request files and answer them. Background thread; each
``env.execute()`` is an independent process, so this is safe alongside the script-execution
thread. Malformed or unauthorized requests are removed without a response.gš™™™™™¹?zls -1 z/req_* 2>/dev/null || truer5   )r4   r0   r7   rU   c              3   ó~   "  € T F3  pV'       g   K  VP                  R 4      '       d   K&  RV9   g   K/  Vx € K5  	  R# 5i)z.tmpz/req_N)Úendswith)r#   Úfs   & r   r%   Ú!_rpc_poll_loop.<locals>.<genexpr>×   s:   é € ð QÑ*W QÜ"#ô  !Ø,-¯J©J°v×,>ô  !ØCJÈaÁ<÷  !šqÓ*Wùs   ‚
=‘=ª=³
=c              3   ó@   "  € T F  qP                  4       x € K  	  R # 5ir   )rŸ   )r#   r§   s   & r   r%   r°   ×   s   é € Ð*WÑDV¸D¯:©:¯<¨<ÓDVùs   ‚r•   zcat zMalformed RPC request in %szrm -f zUnauthorized RPC request in %sÚseqz$RPC request with malformed seq in %szremote sandboxr”   z/res_Ú06dT)r?   r0   zRPC poll error: %srg   N)r   r    r!   r—   r8   r9   rŸ   Úwaitrm   rž   rt   ru   r�   r‚   r    rƒ   rr   rœ   rX   rn   r1   r|   rO   rq   )r;   r«   r   r]   r[   r\   rZ   r�   rR   rx   Úpoll_intervalÚquoted_rpc_dirÚ	ls_resultr7   Ú	req_filesÚreq_filer^   Úquoted_req_fileÚread_resultrQ   r²   Útool_resultr‰   s   &&&&&&&&&              r   Ú_rpc_poll_loopr½   Ç   sš  € ô ! Ó)€HØ€MÜ—[’[ Ó)€NØ×Ñ×!Ó!ð,	EØŸ™ f¨^Ð,<Ð<VÐ$WÐ]`Ðjl˜ÓmˆIØ—]‘] 8¨RÓ0×6Ñ6Ó8ˆFßØ—‘ Ô.ÙÜñ QÑ*WÀFÇLÁLÐQUÔDVÔ*Wó Qó QˆIä%�Ø×$Ñ$×&Ò&ÚÜ!Ÿ^š^Ó-�
Ü"'§+¢+¨hÓ"7�Ø!Ÿk™k¨D°Ð0AÐ*BÈÐUW˜kÓX�ðÜ"Ÿjšj¨¯©¸À2Ó)FÓG�Gô
 % W¨i×8Ò8Ü—L‘LÐ!AÀ8ÔLØ—K‘K &¨Ð(9Ð :ÀÈQ�KÔOÙØ—k‘k %¨Ó+�Ü! #¤s×+Ò+ô —L‘LÐ!GÈÔRØ—K‘K &¨Ð(9Ð :ÀÈQ�KÔOÚÜ1Ø¨=Ø#1ÐTaØ)Ð1Aô�ô ˜c Y¨e°C¸°9Ð#=¸{Ø%)°2õ7à—‘˜f _Ð$5Ð6¸CÈ�×KòC &ðJ × Ñ ×"Õ"Ø�O‰O˜M×*ñ_ "øô" ×,Ñ,¬jÐ9ô Ü—L‘LÐ!>ÀÔIØ—K‘K &¨Ð(9Ð :ÀÈQ�KÔOÛðûô4 ô 	EØ×$Ñ$×&Ò&Ü—‘Ð1°1¸t�ÔDÿøð	EúsQ   ¼?J Á<J ÂAJ ÃAJ Ä&I
Ä?CJ É
AJÊJ ÊJÊJ ÊKÊ%.KËK>   ÚptyÚnotifyÚ	heartbeatÚ
backgroundÚwatch_patternsÚnotify_on_completeÚpersist_on_release)r   r   )Ú__doc__rH   r�   ÚloggingrV   r    rŽ   r�   rt   Úagent.thread_scoped_outputr   Útools.registryr   Ú	getLoggerrr   ro   r   r,   r>   rO   rX   r|   rv   rŠ   r©   r½   r	   r   r   Ú<module>rÊ      s˜   ðñó Û Û Û Û Û Û Û å <Ý %ð 
×	Ò	Ð6Ó	7€ò FÐ òdõ
Aõ	ðJÈð JØ!#ðJØ38÷Jõ.õõB	-÷k÷9<÷x8+r   