+ lHjQAaR0t*0tRt^RIt^RIt^RIt^RIt^RIt^RIHtH t ^RI H t ]P!] 4t]!0R1m4t]!0R2m4tR3tRt/t]^kRRltR4RRlltR4R R lltR4R R lltR RltRRltRRltR4RRlltR4RRlltRRltRRltRRlt RRlt!RR lt"R!R"lt#R#R$lt$R4R%R/R&R'lllt%R4R(R)llt&R4R*R+llt'R4R,R-llt(R4R.R/llt)R#)5aPath resolution for the file tools: task-aware base dir, ``~`` expansion, workspace-divergence warning. Core invariant: the base directory anchoring relative paths is ALWAYS absolute and derived from the task's terminal cwd, never from the process cwd unless no other anchor exists (a relative/sentinel ``TERMINAL_CWD`` would silently anchor edits to the agent process cwd, e.g. the main repo during a worktree session). N)Path PurePosixPath) split_entryg>@c0V^8dQhR\R\/#pathreturnstr)formats";/home/ubuntu/.hermes/hermes-agent/tools/file_tools_paths.py __annotate__r s$$$$cNV'dRV9dV#^RIHpV!4pV'dNVR8XgVPR4'd0VR8XdV#\P P W R,4#\P PV4# \dRpLi;i)a_Expand ``~`` using the effective profile home (``get_subprocess_home``) so gateway/cron runs, whose process HOME may differ, agree with interactive CLI sessions. This mirrors ``hermes_constants.get_subprocess_home()`` so that ``~`` resolves consistently regardless of whether the tool runs interactively or inside a gateway-driven cron job (#48552). ~)get_subprocess_homeN~/:rNN)hermes_constantsr Exception startswithosrjoin expanduser)rrhomes& r _expand_tilder s 3d? 8"$  5 5s{tD T8(DD 77  d ## s B B$#B$c0V^8dQhR\R\/#rtask_idr r )r s"r rr4sAAASArc4a ^RIHpHpHpHpV!V4pT;_uu_4VP V4;'gVP V4pRRR4Xe~VPPP4o \V 3Rl\4R4p\VRR4pV'g\V\4'dV'd T;'gT#\V!4P R4;'g!\P !R4;'gR4P4# \ dTpEL#i;i +'giL;i \ d;\\P !R4;'gR4P4u#i;i)z@Best-effort terminal backend type for path-resolution decisions.)_active_environments _env_lock_get_env_config_resolve_container_task_idNc38<"TFqS9gK VxK R#5i)N).0hnames& r ._terminal_env_type_for_task..BsG$9q$Y$9s _hermes_backend_nameenv_type TERMINAL_ENVlocal)tools.terminal_toolr r!r"r#rget __class____name__lowernext_ENV_CLASS_NAME_HINTSgetattr isinstancer rgetenv) rr r!r"r# container_keyenvhintstampedr(s & @r _terminal_env_type_for_taskr=4s@A Z Z $6w?MY&**=9^^=Q=U=UV]=^C ?==))//1DG$9GNDc#94@G 7C00Ww&?$((4\\ .8Q\\U\]ccee $#M $ Y A299^,778>>@@Aso ED+ E+D? AV^8dQhR\R\R,/#rrr Nr )r s"r rrUs"\\\C$J\rc>\V4'd \V4#R#)zMThe task's backend name when its file paths belong to a container, else None.N)rEr=)rs&r container_backend_for_taskrIUs3H3Q3Q &w /[W[[rc\V^8dQhR\\,\,R\/#rr rr)r s"r rrZs#88d ](B8}8rcR\\P!\V444#)zNormalize path syntax without following host symlinks: container paths are meaningful inside the sandbox, and a host-side ``/workspace`` symlink must not rewrite them.)r posixpathnormpathr )rs&r _normalize_without_host_derefrOZs ++CI6 77rcLV^8dQhR\R,R\R,/#)rrawNr r )r s"r rr`s"99d 9sTz9rc\T;'gR4P4pVP4\9dR#\ V4p\ P PV4'dV#R#)zReturn *raw* expanded when it is a non-sentinel ABSOLUTE anchor, else ``None`` (a relative anchor is exactly the ambiguity that misroutes worktree edits).N)r stripr3_TERMINAL_CWD_SENTINELSrrrisabs)rQexpandeds& r _sentinel_free_abs_cwdrX`sU ciiR.   C yy{--S!Hww}}X..88D8rc2V^8dQhR\R,/#)rr Nr )r s"r rrjs@@#*@rcB^RIHp\V!4;'gR4#)zReturn ``$TERMINAL_CWD`` only when it names a real (absolute, non-sentinel) anchor. Scope-aware: under gateway multiplexing the routed profile's cwd lives in the per-turn scope.scope_terminal_cwdN)agent.runtime_cwdr\rXr[s r _configured_terminal_cwdr^js5 !"4"6">">$ ??rc>V^8dQhR\R\R,/#rGr )r s"r rrss 8 83 8sTz 8rcx^RIHpV!V4p\TP R44# \dR#i;i)zReturn a registered cwd override keyed by the RAW task id, when available. ``terminal_tool`` collapses CWD-only overrides to the shared ``"default"`` env, but the cwd value stays keyed by the raw session id. )resolve_task_overridesNcwd)r/rarrXr0)rra overridess& r _registered_task_cwd_overriderdss> >*73  ")--"6 77 s * 99c>V^8dQhR\R\R,/#rGr )r s"r rrs" \ \3 \sTz \rc^RIHpV!V4pT;'g\V4;'g \ 4# \dRpL6i;i)a&Best-effort absolute workspace root, or ``None`` when no reliable anchor exists. Order: (1) the session's own cwd record (per-session, so one session's ``cd`` never leaks into another); (2) a registered raw-keyed cwd override (TUI/Desktop/ACP); (3) a sentinel-free absolute ``$TERMINAL_CWD``. )get_session_cwdN)r/rgrrdr^)rrgrecordeds& r _authoritative_workspace_rootrisL7"7+  [ [4W= [ [AYA[[ s7 AAc<V^8dQhR\R\R\/#rtextcontainer_pathsr r?)r s"r rrs!S4CrcDV'g^RIHpV!V4p\V4#)zExpand ``~``; on host backends also translate Git Bash ``/c/Users/...`` drive paths before Path sees them. Container/WSL Linux paths are never rewritten.)_msys_to_windows_path)tools.environments.localror)rlrmros&& r _host_textrqs B$T*  rcRV^8dQhR\R\R\\,/#rkr r@rr)r s"r rrs&#dtm7KrcV'dM\P!V4'g&\P!\V!44V4p\ V4#\ P R8XdV^RIpVPV4'g!VP\V!44V4p\VPV44#\V4pVP4'g\V!44V, pVP4#)zReturn *text* as an absolute, normalized path, joining it onto ``base()`` when relative. Container: pure-posix, no host deref. Host: resolve() (win32: ntpath normpath).win32N) rMrVrr rOsysplatformntpathrrN is_absoluteresolve)rlbasermrxps&&& r _anchorr}st$$>>#df+t4D,T22 ||w||D!!;;s46{D1DFOOD)** T A ==?? L1  99;rc0V^8dQhR\R\/#rr )r s"r rrsrc~^RIHp^RIHpHp^RIHpV!V4V!V4PR4V!43Fp\T;'gR4P4pVP4\9gKAVPR4'g\P!V4'gKvV!VR4u# R#)aWorking directory on the SSH target, read RAW: ``_authoritative_workspace_root`` expands ``~`` on the Hermes host, which names a directory the remote does not have. Same precedence (session record, registered override, ``$TERMINAL_CWD``); a value that is neither ``~``-prefixed nor POSIX-absolute (a Windows or relative host path) is skipped. ``coerce_ssh_remote_cwd`` maps the host subprocess home back to ``~``. r[)rgra)coerce_ssh_remote_cwdrbrSrssh)r]r\r/rgratools.terminal_tool_configrr0r rTr3rUrrMrV)rr\rgrarrQrls& r _ssh_remote_anchorrs5K@(*@*I*M*Me*TVhVjk399"~##% ::<6 6DOOC< $W -C  !C { >> 155c5=I ILa a (,,CC& J  '+~~'7  $ s,B'CCc>V^8dQhR\R\R,/#rGr )r s"r rrs"MMcMcDjMrc\V4pVfR#\VRR4'd\VRR4MRp\V\4'd\P !V4'dV#R#)aThe SSH user's home as detected at connect (``echo $HOME``), else None. Brings the environment up through the file tools' own creator (same cwd and cache as the call that follows) when none is live: they resolve before touching the backend, and a first call keyed ``~/x`` while later ones key ``/home/u/x`` splits read tracking and staleness checks for one file. A failed bring-up is remembered briefly so one tool call's several resolutions don't each wait out the SSH connect timeout; the tool's own backend call reports the error. N_remote_home_detectedF _remote_home)rr6r7r rMrV)rr:rs& r _ssh_remote_homers\ w 'C {18>UW\1]1]73 -cgDdC((Y__T-B-B4LLrc<V^8dQhR\R\R\/#rfilepathrr )r r)r s"r rrs&DDDcDmDrcX\T;'gR4P4pVPR4'g=\P!V4'g!\P !\ V4V4pVR8XgVPR4'd%\V4pV'dW2R,,MTpVPR4'g \V4#VPR4wrEpV'd\P!V4MRp\VR8XdV4#V RV 24#)azResolve *filepath* in the SSH target's namespace, never via the Hermes host (``Path.resolve()`` and ``get_subprocess_home()`` both name host directories). ``~`` becomes the remote home once the live environment has detected it, so the result is absolute and the write guards see the real target. Before that it stays ``~``-prefixed for the remote shell; ``~user`` always does. rSrr:NN/.) r rTrrMrVrrrrO partitionrNr)rrrlrhead_tails&& r _resolve_ssh_pathrs x~~2  $ $ &D ??3   (=(=~~094@ s{dood++("&t2hD ??3  ,T22NN3'MDT'+9  d #D  CCTF!D62B CCrc0V^8dQhR\R\/#)rresolvedr r?)r s"r rrs22S2T2rcVPR4'dVPR4^,MRpVR8H;'gVPR4#)zTrue for a still-``~``-relative SSH path that climbs above ``~``: its absolute target is unknown until the remote home is, so no path guard can classify it.rrrS..z../)rr)rrs& r _ssh_path_escapes_homersF*2)<)V^8dQhR\R\R,/#rGr )r s"r rrsCd rcH^RIHpV!4PR4pVR8Xd ^RIHp\ V4pVe V!V4MRp\ V\4'd\P!V4'dV#R# \d\PRTRR7R#i;i) aA container backend's configured working directory (already sanitized to the backend default) when the session recorded none: the cwd its terminal commands start in (``_resolve_command_cwd``'s default). The process cwd is a host directory (``/opt/data`` in the Docker image) the sandbox does not have. The live env's cwd is NOT used: a shared env's cwd is wherever ANOTHER session last ``cd``'d.)r"rbr)plugin_sandbox_homeNz-container default cwd unavailable for task %sT)exc_info) r/r"r0rrrr7r rMrVrloggerdebug)rr"rbrr:s& r rrs ^7##E* #: G&w/C.1o%c*4C c3  IOOC$8$8J  ^ DgX\ ] ^sA3A:6A::#B! B!cRV^8dQhR\R\R\\,/#rrK)r s"r rr3s+iiSi3itmG[ircaa\S4R8Xd \VS4#\S4o\\ VS4VV3RlS4#)zuResolve *filepath* against the task's absolute base directory (absolute inputs are returned resolved-but-unanchored).rc<\SSR7#))rm)r)rmrsr (_resolve_path_for_task..:s ,WoVr)r=rrEr}rq)rrrms&f@r _resolve_path_for_taskr3sG#7+u4 733+G4O :h8VXg iircRV^8dQhR\R\R\\,/#rrK)r s"r rr=s+AAcACA}H\Arc\V4wr#VR9g V'g#VPR4'd \W4#\T;'gRV4V, #)z``_resolve_path_for_task`` for an operation on the directory entry itself (delete, rename): the parent is resolved, but a symlink in the last component is kept, since resolving it aims the operation at the file the link points to.rr)rSrr)rrr)rrparentr(s&& r _resolve_entry_for_taskr=sKx(LF v$//#2F2F%h88 !&--C 9D @@rc lV^8dQhR\R\\,R\R\R,/#)rrrrr NrK)r s"r rrHs5sd]6JUXilosisrc`\V4R8XdCVPR4'g\P!V4'dR#\ RV4pM\ \ V44P4'dR#\V4pV'gR#\V4'd\\ \ V444pM"\ \ V44P4pVPV4'dR#RV: R\V4: R\V4: R2# \dR#i;i) a*Warn when a RELATIVE path resolved OUTSIDE the task's workspace root (the edit is about to land in a different checkout than the terminal's cwd). ``None`` for absolute paths, an unknown root, or a path under the root. SSH compares in the remote namespace, as ``_resolve_path_for_task`` resolved it.rrNrzRelative path z resolved to z), which is OUTSIDE the active workspace (z). The edit will land in a different directory than the terminal's cwd. If this is not intended (e.g. a git-worktree session writing into the main checkout), pass an absolute path under the workspace instead.)r=rrMrVrrrryrirErOrzis_relative_tor r)rrrrworkspace_roots&&& r _path_resolution_warningrHs  &w /5 8""3''9??8+D+D$S'2DM(+,88:::7CN!$W--4T-:W5XYM.9:BBD  " "4 ( (XL c(m5FG--0YM:L M N s/&DD5D>DA'D= D D-,D-cbV^8dQh/^\9d\\\3,;R&#)rr)__conditional_annotations__dictr r)r s"r rrs'8+*T#u*%*9r>rSrrbauto./>modaldockerdaytonavercel_sandbox)r.rrrr)default)+r__doc__loggingrrMrvrpathlibrragent.runtime_self_protectionr getLoggerr2r frozensetrUrDr5rrrr=rErIrOrXr^rdrirqr}rrrrrrrrrrr)rs@r rs  '5   8 $$$BC$-.^$_!F(**$(A.=\ 8 9@ 8 \ &&,M&D*2a@Daa"4iAr