+ lHja0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t H t Ht^RIHt^RIHt^RIHtHtHt^RIHtHt^R IHtHtHtHtHtH t H!t!H"t"H#t#H$t$H%t%H&t&H't'H(t(H)t)]PT!]+4t,^2t-^t.R R lt/R R lt0RRlt1RRlt2RRlt3]RRl4t4]RRl4t5]6!0Rm4t7!RR]84t9RR lt:R!]6!R"R#04R$]6!R%04/t;R&]R,R-lt?R.R/lt@R0R1ltAR2R3ltBR4R5ltCR6R7ltDR8R9ltER:R;ltFR<R=ltG] R>R?/R@RAll4tHRBRCltIRDREltJRFRGltKRHRIltLRJRKltMRLRMltNRNR?/RORPlltORQRRltPRSRTltQRRURVlltRRWRXRYRXRZRXR[R?R\R?R]R?/tSR^R_ltTRR`RalltU]V!RbP44tX]V!RcP44tY]V!RdP44tZRt[Rt\]V!ReP44t]Rt^RfRglt_RhRilt`]6!RjRk04taRlRmltbRRnRoRpRq/RRnRrRpRs//tcRtRultdRvteRwsfRx]!R4RRl4tn]>!R4RRl4to]>!R4RRl4tp]>!R4RRl4tq]>!R4RRl4tr]>!R4RRl4ts]>!R4RRl4tt]>!R4RRl4tu]>!R4RRl4tvRRltw]>!R4RRl4tx^tyRRltz]>!R$4RRl4t{]>!R4RRl4t|RRlt}]>!R!4RRl4t~RRltRRltRRlt]>!R4RRl4t]>!R4RRl4t]6!RR04tR](]nR3R]$]oR3R] ]pR3R]]qR3R]']rR3R]&]sR3R]%]tR3R]"]uR3R]]vR3R]]xR3R$]]{R3R]]|R3R!]!]~R3R])]R3R]#]R33t]F,wtttt]]9d]5M]4t]EP!]R]]]]R7K. R#)uKanban tools — structured tool-call surface for worker + orchestrator agents. Registered only under the dispatcher (``HERMES_KANBAN_TASK`` set) or when the profile enables the ``kanban`` toolset. Tools rather than ``hermes kanban`` shell-outs: they run in the agent's process (reach ``kanban.db`` from a container/SSH terminal backend, no shlex quoting of JSON metadata, structured-JSON failures). Humans use CLI/dashboard. ) annotationsN)contextmanager)AnyCallableOptional)redact_sensitive_text) judge_goal)no_cache_check_fnregistry tool_error)cfg_get load_config)KANBAN_ATTACH_SCHEMAKANBAN_ATTACH_URL_SCHEMAKANBAN_ATTACHMENTS_SCHEMAKANBAN_BLOCK_SCHEMAKANBAN_COMMENT_SCHEMAKANBAN_COMPLETE_SCHEMAKANBAN_CREATE_SCHEMAKANBAN_HEARTBEAT_SCHEMAKANBAN_LINK_SCHEMAKANBAN_LIST_SCHEMAKANBAN_REQUEST_CHANGES_SCHEMAKANBAN_REQUEST_REVIEW_SCHEMAKANBAN_SCHEDULE_SCHEMAKANBAN_SHOW_SCHEMAKANBAN_UNBLOCK_SCHEMAcV^8dQhRR/#returnbool)formats"7/home/ubuntu/.hermes/hermes-agent/tools/kanban_tools.py __annotate__r%%sTcaa^RIHpV!4pV'dR#\4oRSPR4;'g.9dR#VeR#^RIHoSPR4;'g/p\ ;QJd.VV3RlVP44F 'gK R# R#!VV3RlVP444# \dR#i;i) )kanban_toolset_requestedTkanbantoolsetsF)_get_platform_toolsplatform_toolsetsc3t<"TF-wr\V\4'gKRS!SVRR79xK/ R#5i)r*F)include_default_mcp_serversN) isinstancelist).0platformnamesr,configs& r$ ._profile_has_kanban_toolset..8s6 #4 5$8O aH+FHZ_` `#4s88) tools.kanban_toolset_contextr)r gethermes_cli.tools_configr,anyitems Exception)r) requested platformsr,r5s @@r$_profile_has_kanban_toolsetr@%sE(*I  :.44" 5   @JJ2399r s #,??#4 ss s s #,??#4    s@"CCC C+ C9#CC"C&C CCc$V^8dQhRRRRRR/#)r predicatestrdefaultr!r r")r#s"r$r%r%@s!sTdr&cV^RIHp\W 4!4# \dTu#i;i)zT``agent.delegation_context.()``; ``default`` when it cannot be evaluated.)delegation_context)agentrFgetattrr=)rBrDrFs&& r$_delegation_ctxrI@s-,)577 s  ((cV^8dQhRR/#rr")r#s"r$r%r%Is@@T@r&c\RR4#)is_delegated_child_contextFrIr"r&r$_is_delegated_child_contextrNIs 7 ??r&cV^8dQhRR/#rr")r#s"r$r%r%MsGGTGr&c\RR4#)uFalse for delegate_task children AND for cron jobs fired in-process from a worker — i.e. whenever HERMES_KANBAN_* is present but not ours."is_dispatcher_owned_worker_contextTrMr"r&r$_is_dispatcher_owned_workerrRMs ? FFr&c V^8dQhRRRR/#)r to_env_workerr!r r")r#s"r$r%r%Ss))t))r&c\4'dR#\PPR4'd\ 4'dV#\ 4#)zcheck_fn core: never for delegate children; dispatcher-spawned env workers (HERMES_KANBAN_TASK) per flag; else the profile toolset decides.FHERMES_KANBAN_TASK)rNosenvironr9rRr@rTs$r$_visiblerZSs<#$$ zz~~*++0K0M0M & ((r&cV^8dQhRR/#rr")r#s"r$r%r%^s((D(r&c\RR7#)zKLifecycle tools: dispatcher workers + profiles with the ``kanban`` toolset.TrYrZr"r&r$_check_kanban_moder^]s $ ''r&cV^8dQhRR/#rr")r#s"r$r%r%ds)))r&c\RR7#)zLBoard-routing tools (kanban_list, kanban_unblock): hidden from task workers.FrYr]r"r&r$_check_kanban_orchestrator_moderacs % ((r&kanban_complete kanban_blockkanban_schedulekanban_request_reviewkanban_request_changesc2a]tRt^ttRtRV3RlltRtV;t#)_RejectzECarries a finished ``tool_error`` payload out of a validation helper.cV^8dQhRR/#)rmessagerCr")r#s"r$r%_Reject.__annotate__ws...r&c 8<\SV`\V44R#N)super__init__r )selfrj __class__s&&r$ro_Reject.__init__ws G,-r&r")__name__ __module__ __qualname____firstlineno____doc__ro__static_attributes__ __classcell__)rqs@r$rhrhtsO..r&rhc$V^8dQhRRRRRR/#)rcondrrjrCr Noner")r#s"r$r%r%{s!str&c,V'g \V4hR#)z3Reject (as a tool error) unless ``cond`` is truthy.N)rh)r{rjs&&r$_checkr~{s g r& kanban_create session_id project_idkanban_attach_urltitlezdict[str, frozenset[str]]_UNDECLARED_ARGScV^8dQhRR/#rr rCr")r#s"r$r%r%s 6 6S 6r&c2^RIHpV!R4;'gR#)u Profile name persisted into board records (comment author, task creator). ``hermes_cli.profiles.current_profile_name`` resolves the profile this call runs FOR — the bound home override under a multiplexed tick or turn, else the dispatcher's ``HERMES_PROFILE`` pin, else the process home; the generic ``"worker"`` only when nothing names a profile. Never taken from tool args: board records are injected into future workers' prompts, so a caller-supplied identity could forge an authoritative-looking author (see #19713). current_profile_nameworker)hermes_cli.profilesrrs r$_persisted_identityrs9  ) 5 5X5r&c V^8dQhRRRR/#)r tool_namerCr rr")r#s"r$r%r%ssxr&caV3RlpV#)zWrap a handler so every failure is a structured tool error. ``ValueError`` (invalid board slug, DB validation such as cycle/self-link, ``AttachmentTooLarge``) is reported without a traceback; anything else is logged with ``logger.exception``.cP<a\P!S4RVV3Rll4pV#)c V^8dQhRRRR/#rargsdictr rCr")r#s"r$r%3_kanban_handler..deco..__annotate__s 7 7$ 7 7r&c l<\P!S4R,R,p\V4\P S\ 44,p\ \V4V, 4p\V'*S RRPV4 RRP\ V44 R24S!V3/VB# \dpTP^,uRp?#Rp?i\dIp\T\4'g\PS R24\!S RT 24uRp?#Rp?ii;i) parameters propertiesz: unknown parameter(s): , z. Valid parameters: z. Nothing changed.Nz failed: )r get_schemasetrr9 frozensetsortedr~joinrhrr=r0 ValueErrorlogger exceptionr )rkwrallowedunknownefnrs&, r$wrapper._kanban_handler..deco..wrappers 7%00;LI,W j/,<,@,@IK,XX TW!457{#$.decos*   7 7  7 r&r")rrsf r$_kanban_handlerrs& Kr&c V^8dQhRRRR/#rrrCr r|r")r#s"r$r%r%sLLLLr&cF\RR4'd\V R24hR#)zA delegate_task child shares the parent's process, so inherited HERMES_KANBAN_* env is not proof of ownership: it may report findings but must not mutate."is_delegated_child_process_contextFz refused: delegate_task child agents are not Kanban run owners. Return findings to the parent agent; the dispatcher worker or an explicitly configured Kanban orchestrator must perform board mutations.N)rIrhrs&r$ _reject_delegated_child_mutationrs8;UCCkK KL LDr&c V^8dQhRRRR/#)rargrr Optional[str]r")r#s"r$r%r%s#-r&cVe$\V4P4pV'dV#\4'dR#\4'gR#\P P R4pV'dVP4pV'dV#R#)zGResolve ``task_id`` arg or fall back to the env var the dispatcher set.NrV)rCstriprNrRrWrXr9)rvalenv_tids& r$_default_task_idrse #hnn J"$$ & ( (jjnn12Gmmo J r&c V^8dQhRRRR/#rr")r#s"r$r%r%sUU4UCUr&c\VPR44pV'dV#\PPR4'd \ R4h\ R4h)a Resolve the target task or reject with a message the caller can act on. The env default only exists for a dispatcher-spawned worker; every other caller must name a task, so a rejection points at ``kanban_list`` instead of an env var a chat caller cannot set (#91431). task_idrVztask_id is required: this session does not own the inherited HERMES_KANBAN_TASK, so it is not a valid default. Pass an explicit task_id.ztask_id is required: this session has no dispatcher-assigned task to default to. Pass an explicit task_id; discover task ids with kanban_list.)rr9rWrXrh)rtids& r$_require_task_idrs^ 488I. /C   zz~~*++    T UUr&c$V^8dQhRRRRRR/#)rrrCvarr rr")r#s"r$r%r%s&\\3\S\]\r&c\PPR4V8Xd \PPV4#R#)zC``$var`` only when this worker is scoped to ``task_id``; else None.rVN)rWrXr9)rrs&&r$ _own_task_envrs0"$**..1E"F'"Q2::>># [W[[r&c V^8dQhRRRR/#)rrrCr Optional[int]r")r#s"r$r%r%sCMr&cj\VR4pV'd \V4#R# \dR#i;i)z=This worker's dispatcher run id when it is scoped to task_id.HERMES_KANBAN_RUN_IDN)rintr)rraws& r$_worker_run_idrs7 !7 8Cs3x(D( s## 22c$V^8dQhRRRRRR/#)rrrCmetadataOptional[dict]r r")r#s"r$r%r%s&]]C]>]n]r&cR\VR4pV'd/T;'g/CRV/C#T#)zBAdd trusted worker session id metadata for this worker's own task.HERMES_SESSION_IDworker_session_id)r)rrrs&& r$_stamp_worker_session_metadatars1w(;'y0EcUK` ab b"wr&c$V^8dQhRRRRRR/#)rrrCrrr r")r#s"r$r%r% s!  S   r&c\V4\V4p\V4V\9dA\P P R4'd\V4f\V R24hV#)aWorker mutation preamble, in order: delegate-child rejection, task id resolution, task-scope ownership, run-identity proof. Returns the task id. A dispatcher-spawned worker (``HERMES_KANBAN_TASK`` set) that cannot name its run id is refused on the run-lifecycle mutations: ``expected_run_id=None`` would silently skip the run-ownership CAS in ``kanban_db`` (``complete_task`` / ``block_task`` / ``request_review`` / ``request_changes`` only append ``AND current_run_id = ?`` when the value is not ``None``), so an unbound stale worker could complete a card a live successor owns. This mirrors ``agent/kanban_stop.py``, which already treats an unbound run id as unknown and fails closed. CLI / human / orchestrator paths (no ``HERMES_KANBAN_TASK``) legitimately pass ``expected_run_id=None`` and are unaffected. Non-lifecycle worker tools (heartbeat / attach / attach_url) do not terminate a run and are not gated here. rVa@ refused: this worker cannot resolve its HERMES_KANBAN_RUN_ID, so it cannot prove ownership of the card's current run. A stale or unbound worker must not terminate a run a live successor owns. Re-run through the dispatcher so the run id is pinned, or use an orchestrator/CLI path that passes an explicit expected_run_id.) rrr_RUN_LIFECYCLE_TOOLSrWrXr9rrh)rrrs&& r$ _worker_guardr si %Y/ 4 C"3')) JJNN/ 0 0 3  'k    Jr&c V^8dQhRRRR/#rr")r#s"r$r%r%-sLL#L$Lr&cl\PPR4'd\V R24hR#)zThe check_fn already hides orchestrator tools from workers; this catches a stale registration or test harness routing a worker here anyway.rVz is orchestrator-only; dispatcher-spawned workers must use kanban_complete, kanban_request_review, kanban_request_changes, kanban_block, kanban_heartbeat, or kanban_comment for their assigned task.Nrrs&r$_require_orchestrator_toolr-s= zz~~*++kK KL L,r& quiet_closeFc V^8dQhRRRR/#)rboardrrr!r")r#s"r$r%r%8s-r&c#"^RIHp^RIHpVPVR7pW$3xVP 4R# \ dT'ghR#i;i TP 4i \ d T'ghii;i;i5i)z``with _board(slug) as (kb, conn)``; lazy import so the module loads in non-kanban contexts. ``board=None`` keeps the env/symlink resolution chain; an explicit slug overrides it per call. ``quiet_close`` swallows close() errors (best-effort bridges). kanban_db)kanban_db_connect)rN) hermes_clirrconnectcloser=)rrkbkbcconns&$ r$_boardr7sx +3 ;;U; #Dh  JJL    JJL  sfBA:BA ABABBA('B(A?;A?<B>A??BBcV^8dQhRR/#)rrrCr")r#s"r$r%r%Is#r&cLVPW4p\VRJRV R24V#)Nztask z not found)get_taskr~)rrrtasks&&& r$_existing_taskrIs- ;;t !D 4t uSE45 Kr&c V^8dQhRRRR/#)rfieldsrr rCr")r#s"r$r%r%Os..#.#.r&c 6\P!RR/VC4#)okT)jsondumps)rs,r$_okrOs ::tT,V, --r&c(V^8dQhRRRRRRRR/#)rrrCdefault_statusextrarr r")r#s"r$r%r%Ss.LLcL3LLLr&c VPW4pVPW4p\RRTRV'd VPMRRV'd VPMT/VB#)zlSuccess payload reporting where the task actually landed (routing may not leave it in the requested status).rrun_idNstatusr") latest_runrridr)rrrrrrunlandeds&&&&, r$ _ok_landedrSsa -- "C [[ #F  Ls LS366d L'-fmm> LEJ LLr&c V^8dQhRRRR/#)rvaluerr rCr")r#s"r$r%r%\s993939r&c.\\V4RR7#)Tforce)rrCrs&r$_redactr \s U4 88r&c V^8dQhRRRR/#)rrrr r")r#s"r$r%r%`s..s.s.r&c,V'd \V4#T#rm)r r s&r$ _redact_optr `s"75>--r&c V^8dQhRRRR/#)rrrr rr")r#s"r$r%r%dstr&c\P!\\P!V4RR74# \PdR#i;i)zDRedact via a JSON round-trip; None if the result can't be re-parsed.TrN)rloadsrrJSONDecodeErrorrs&r$_redact_metadatards?zz/ 80DDQRR   s47AArc(V^8dQhRRRRRRRR/#)rrrnamerCwhatrr!r")r#s"r$r%r%ls(  C s #  r&c tVfR#\V\4'dV.p\V\\34'g'\ V RV R\ V4P 24hV'dJVUu.uF=p\V4P4'gK$\V4P4NK? ppV#uupi)z~Accept a single string (convenience) or a list/tuple; with ``strip`` the items are stringified, stripped, and empties dropped.Nz must be a list of z, got )r0rCr1tuplerhtypersr)rrrrxs&&&$ r$_coerce_str_listrls }% edE] + +1$vd5k>R>R=STUU ).AA#a&,,.QA LBs .!B5B5c V^8dQhRRRR/#)rrrr r|r")r#s"r$r%r%zsNNSNTNr&c~\VRJ;'g\V\4R\V4P 24R#)Nz%metadata must be an object/dict, got )r~r0rrrsrs&r$_require_dict_metadatarzs6 8t  9 9z(D9 24>3J3J2K LNr&c$V^8dQhRRRRRR/#)rrr artifactsz list[str]r rr")r#s"r$r%r%s!  s y T r&c\V4Vf/MTpVPR4p\V\\34'd8R.VOVO4p\\ P RV444VR&V#WR&V#)aFold ``artifacts`` into ``metadata["artifacts"]`` (merged with, never overwriting, a list the worker passed manually). Artifacts ride inside metadata so the completed-event payload needs no DB schema change; the gateway notifier uploads each as an attachment.r c3T"TFp\V4P4xK R#5irm)rCr)r2items& r$r6#_merge_artifacts..s H0G#d)//##0Gs&(c38"TFq'gK VxK R#5irmr")r2ss& r$r6r$s2Jf11fs  )rr9r0r1rrfromkeys)rr existingmergeds&& r$_merge_artifactsr*s8$%r8H||K(H(T5M**H0G(0GY0GH $T]]2Jf2J%J K O!* Or&c(V^8dQhRRRRRRRR/#) rrrrrCrjrr rr")r#s"r$r%r%s(C-3r&cVPV4p\T;'d\V4P4T;'gV R24V#)z.``args[name]``; rejects when missing or blank.z is required)r9r~rCr)rrrjrs&&& r$ _require_textr-sB HHTNE 5 ' 'SZ%%')I)ItfL4IJ Lr&trueT1yesfalse0noc$V^8dQhRRRRRR/#)rrrrrCr r!r")r#s"r$r%r%s!$cdr&cVPV4pVe\V\4'd \V4#\P\ V4P 4P 44p\VRJV R24V#)Nz$ must be a boolean or 'true'/'false')r9r0r! _BOOL_WORDSrCrlowerr~)rrrparseds&& r$_parse_bool_argr9sj HHTNE } 5$//E{ __SZ--/557 8F 6 $'KLM Mr&c$V^8dQhRRRRRR/#)rrrrDrr r")r#s"r$r%r%s!88C8-8=8r&c$Ve \V4#T#rm)r)rrDs&&r$_opt_intr<s*3u:77r&zid title body assignee status tenant priority workspace_kind workspace_path created_by created_at started_at completed_at result current_run_id model_override provider_override completion_contract last_failure_errorzid title assignee status priority tenant workspace_kind workspace_path project_id created_by created_at started_at completed_at current_run_id model_override provider_overridezDid profile status outcome summary error metadata started_at ended_atz@id filename content_type size uploaded_by stored_path created_atc$V^8dQhRRRRRR/#)robjrr4ztuple[str, ...]r dict[str, Any]r")r#s"r$r%r%s&LLL_LLr&cNVUu/uFq"Ve \W4MRbK up#uupi)zF``{name: getattr(obj, name)}``; every value None when ``obj`` is None.N)rH)r>r4ns&& r$_fieldsrBs'EJ KU#/wst ;U KK Ks"cV^8dQhRR/#)rr r?r")r#s"r$r%r%sDD.Dr&c VPWP4pVPWP4p/\V\4CRVRVR\ V4R\ V4/C#)parentschildren parent_count child_count) parent_idsr child_idsrB_TASK_SUMMARY_FIELDSlen)rrrrErFs&&& r$_task_summary_dictrMscmmD''*G||D''*H D $, - D/8':xG mS] DDr& dependency needs_inputcV^8dQhRR/#rr")r#s"r$r%r%s . .t .r&cv^RIHpV!R4wrTRJ;'d \T4# \dR#i;i)z``judge_goal`` fails open (no auxiliary model -> ``"continue"``), which is indistinguishable from "not done yet" and would wedge every goal_mode worker; so the gate is enforced only when a judge is actually reachable.)get_text_auxiliary_client goal_judgeFN)agent.auxiliary_clientrRr=r!)rRclientmodels r$_goal_judge_availablerWsCD1,?    - -$u+- s ) 88blockeduGoal completion rejected: judge ruled the goal unachievable — {reason}. The task will NOT complete silently. Either re-scope the task with kanban_edit, or record the block with kanban_block and hand the decision to a human / reviewer.continuezGoal completion rejected by judge: {reason}. To proceed, either: (1) provide explicit acceptance evidence in your summary matching the task's criteria, or (2) create continuation tasks with parents=[{tid}] and keep this task alive.uGoal review handoff rejected: judge ruled the goal unachievable — {reason}. Record the block with kanban_block instead of requesting review.zxGoal review handoff rejected by judge: {reason}. Provide acceptance evidence matching the card before requesting review.c(V^8dQhRRRRRRRR/#)rrrCrevidencer r|r")r#s"r$r%r%s.VV#V#VVVr&cV'd#VP'd\4'gR#^RIHpHpHpV!4'dRM V!RV 24p\ VP RVP;'gR 2P4VP4R7wrrVe V!V4T 'd\PR T 4R#TR 8XdR#TR 8XdR MR p \\T,T ,PYR74h Te T!T4ii;i \d$p \PRT RR 7Rp ? R#Rp ? ii;i)aGoal-mode pre-handoff judge gate: a worker must not complete / request review before acceptance criteria are met. ``blocked`` gets its own guidance; any other non-``done`` verdict gets the ``continue`` guidance. A broken judge fails open (logged) so it cannot permanently wedge work.N)get_affinity_scopereset_affinity_scopeset_affinity_scopezkanban:z )goal last_responsez7goal judge check failed, allowing lifecycle handoff: %sTexc_infoz7goal judge unreachable (%s), allowing lifecycle handoffdonerXrY)reasonr) goal_moderWagent.portal_tagsr]r^r_rrbodyrr=rwarningrh_GOAL_GATE_MESSAGESr#)rrrr[r]r^r_affinity_tokenverdictrf_transport_failed judge_exckeys&&&& r$ _goal_gaterrs: t~~~-B-D-D cb!3!5!5;MPWX[W\o;^ 56@ |4 R'89??AQYQ_Q_Qa7c 3GQ)$^4  PRXY&)+)C %i05< default claimer (local workers).rVFrwNTryclaimerHERMES_KANBAN_CLAIM_LOCKnoteexpected_run_ida`kanban auto-heartbeat for task %s refused (%s): this process carries HERMES_DELEGATED_CHILD_CONTEXT together with HERMES_KANBAN_TASK, so the board treats it as a delegate_task descendant and its claim will not be extended by activity. Only the dispatcher's own spawn grants worker scope; do not copy a worker's environment into a hand-launched process.zauto-heartbeat: %s failedrczauto-heartbeat: bridge failed)rWrXr9time monotonicrt$_AUTO_HEARTBEAT_MIN_INTERVAL_SECONDSrNrrxrheartbeat_claimheartbeat_workerrrsr!PermissionError_auto_heartbeat_fence_warnedrrjr=r|) rnowr}rrops succeededrkwargsopexcs r$!heartbeat_current_worker_from_envr2s **..- .C .. C 3559]]"$$#& 8 Dd + +z&&BJJNNC]4^(_`((649JN[^L_*`acCI! [[& $R%.}s&:TttTrDc38"TFqPxK R#5irmrrs& r$r6rs!51$$rr`z- operatorrzNew noter&z< on your kanban task from the operator (delivered mid-run). z:Take it into account for the work you're doing right now:  zcomment-inject: steer failed)rRrWrXr9rrhasattrr"_COMMENT_POLL_MIN_INTERVAL_SECONDSrrlist_comments_afterr=rr|maxrauthorrrirLrr!r) rGrrseenrrrowsownrfreshlinesrs & r$inject_new_comments_from_envris 3N2O2O"**..- .UYC .. C 5=w(?(?004VV!$  ! !# &D Dd + +z))$diia)HD,  |"%&:T&:A"F3 |4!!5!55s  C [1R 6 6 8C ?QQVV\\rDXDXDZQQE [ FK Ler!((((j)AFFLLN+; ) for full state.rrrEunsatisfied_parentsrrrFcommentseventsrunsworker_contexti)rr9rrrrrB _TASK_FIELDSrIrrJ list_comments_COMMENT_FIELDS list_events _EVENT_FIELDS list_runs _RUN_FIELDSbuild_worker_context) rrrrrrpidrrrrs &, r$ _handle_showrs 488I. /C zz D L    ! " "jrb,zz GD,/ r}}T/ "ACAWAWX\Ab$dAb+#sHf-Ab$d  T/ b>N>Nt>YZ>YO4>YZ "..:STWTX:YZ:YQwq-0:YZ bll46MN6MWQ ,6MN b55d@ B C # "$d[ZN # " "sCAF4F (F-FFF"8FF&'F F F0 kanban_listc V^8dQhRRRR/#rr")r#s"r$r%r%s##t#c#r&c \\R4\VR4pVPR4pVf\M \ V4p\T^8R4\T\8*R\ 24\TPR44;_uu_4wrETPT4pTPYPPR 4TPR 4TPR 4Y#^,R 7p\T4T8pTRTp \P!R T U u.uFp \!YET 4NK up R\T 4RTRTRT'd#T\8d\#T^,\4MRRT/4uuRRR4# \ \ 3d\R4u#i;iuup i +'giR#;i)z5Task summaries with the same core filters as the CLI.rinclude_archivedlimitNzlimit must be an integerzlimit must be >= 1zlimit must be <= rassigneertenant)rrrrrtaskscount truncated next_limitpromoted)rr9r9KANBAN_LIST_DEFAULT_LIMITr TypeErrorrr r~KANBAN_LIST_MAX_LIMITrrecompute_ready list_tasksrLrrrMmin) rrrrrrrrrrts &, r$ _handle_listrs}-&t-?@ HHW E6-2])E  5A:+, 5) )->?T>U+VW ! " "jr%%d+}} 88J/8J88H%8HXYPY[I% Ve zz uEu!(15uE SZ%i 'E4I,Iuqy*?@OS  "# # " z "64556F # " "s1E3 BFF$AF3FFF F+ c V^8dQhRRRR/#rr")r#s"r$r%r%s"RARA4RA#RAr&c \RV4p\VPR44p\VPR44pVPR4p\V\4'd\ V4;'gTp\ VPR4RRRR7p\ VPR 4R R RR7pV'd \WW4p\T;'gTR 4\V4\W%4p\VPR 44;_uu_4wrVPW4p \RYT;'g T;'gR P44VPWWCVV\!V4R7p TPY4p T 'grTP1Y4pT'd+RP+RT44p\3RT RT R24h\RT 'd T P4MR;'gRT R24TP7Y4p\9TT'd TP:MRTP=Y4Uu.uFp\?T\@4NK upR 7uuRRR4# TP"d$p \%RT R24uRp ? uuRRR4#Rp ? iTP&d'p \%RT RT R24uRp ? uuRRR4#Rp ? iTP(d=p\%RRP+TP,4 R24uRp?uuRRR4#Rp?iTP.d$p\%RT R24uRp?uuRRR4#Rp?ii;iuupi +'giR#;i)!z5Mark the current task done with a structured handoff.rbsummaryresultr created_cardstask idsTrr  file pathsz4provide at least one of: summary (preferred), resultrr`)rrrrrz;kanban_complete could not preserve the declared artifacts: z. Your task is still in-flight and its scratch workspace was kept. Fix the artifact path or storage error, then retry kanban_complete with the same handoff.Nzkanban_complete refused: zi. Nothing changed. Wait for the worker to finish, or an operator can run `hermes kanban complete --force z`.zfkanban_complete blocked: the following created_cards do not exist or were not created by this worker: rz. Your task is still in-flight (no state change). Retry kanban_complete with the same summary/metadata and either drop these ids from created_cards, or pass created_cards=[] to skip the card-claim check entirely.zkanban_complete blocked: z. Your task is still in-flight (no state change). Retry kanban_complete with a non-empty summary or result describing what was done.c36"TFwrV RV R2xK R#5i)z ()Nr")r2rrs& r$r6#_handle_complete..s"S(;3cU"VHA#6(szcould not complete z#: unsatisfied parent dependencies: z/; complete the parents first (done or archived)Fz- (unknown id, stale run, or already terminal))rr attachments)!rr r9r0rrrr*r~rrrrrrr complete_taskrArtifactPreservationErrorr LiveClaimErrorHallucinatedCardsErrorrphantomEmptyCompletionErrorrrhlast_failure_errorrrrlist_attachmentsrB_ATTACHMENT_FIELDS)rrrrrrrr rrrr artifact_err claim_errhall_err empty_errblockersdetailras&, r$_handle_completerse )4 0C$((9-.G (+ ,Fxx #H(D!!#H-99$ !?JdLM +!6 \Y]^I#H8 7  fTU8$-c @ >1q"45 > @A} # "++  Ml^\ ! # "*   ^+I;7UUXTYY[]^ ^1 # "6(( L++/99X5E5E+F*GHJKL L? # "J&& #+I;7!"# #Q # "J #4 @ # " "s-MMI1=A>MWX,6:;K;K;M;MWZ%%' (SWF ! " "jr{{4%D++T^^,:;<=VV W   fnS6IKr(-_`a"CVD # " " "s BD// E c V^8dQhRRRR/#rr")r#s"r$r%r%js*3*3*3*3r&c \RV4p\\VRR44pVPR4p\ V4Ve\ V4p\ VRJR4\VPR4RRR R 7pV'd \WE4p\W$4p\VPR 4;'gR4pV'd6^R I H pH p\ V!V4R V: RRPV!44 24\VPR44;_uu_4wr\!RV P#W4W#4V P%WW4V\'V4R R7wr\ T RT RT ;'gR 24\-YTR4uuRRR4# T P(d$p \+RT R24uRp ? uuRRR4#Rp ? ii;i +'giR#;i)z6Move implementation into the first-class review phase.reruisummary is required — describe what was implemented and how it was verified so the reviewer has contextrNz'metadata could not be safely serializedr rTrreviewer)list_profile_namesprofile_existszreviewer profile z' is not installed. Installed profiles: rr)rrrr with_reasonzAkanban_request_review could not preserve the declared artifacts: z. Your task is still in-flight (no state change) and its scratch workspace was kept. Fix the artifact path or storage error, then retry kanban_request_review with the same handoff.zcould not request review for rz"unknown id or not in running/readyreview)rr r-r9rrr~rr*rr rr r rrrrrrequest_reviewrrr r)rrrrrr rr r rrr fail_reasonrs&, r$_handle_request_reviewris / 6Cm i345Gxx #H8$#H-xt#%NO +!6 \Y]^I#H8-c.G/G>GG G c V^8dQhRRRR/#rr")r#s"r$r%r%s F F$ F Fr&c `\RV4p\\VRR44p\VP R44;_uu_4wrEVP WRV\ V4R7wrg\TRT RT;'gR 24\WEVR VR 7uuR R R 4# +'giR #;i) z8Return a reviewer-owned running task to its implementer.rfrfu2reason is required — describe the changes neededrrzcould not request changes for rzinvalid review stateready) implementerN) rr r-rr9request_changesrr~r)rrrrfrrrrs&, r$_handle_request_changesrs 0$ 7C dH&Z[]F ! " "jr'' fnS6I(K r3C56;[;[E[:\]^"CfE # " " "s A B B- kanban_heartbeatc V^8dQhRRRR/#rr")r#s"r$r%r%s   D  3  r&c \RV4p^RIHp\VP R44;_uu_4wrEVP WR\ PP R4R7VPWRVP R4\V4R7p\VRV R 24\VR 7uuR R R 4# +'giR #;i) zSignal liveness: extend the claim TTL AND record a heartbeat event. Without the claim half, a worker blocked in one long tool call would still be reclaimed by ``release_stale_claims``.rrwrr)rr)rrzcould not heartbeat z (unknown id or not running))rN) rrrxrr9rrWrXrrr~r)rrrr}rrrs&, r$_handle_heartbeatrs *D 1C4 ! " "jr 4bjjnn=W.XY  ! ! DHHV,nS>Q"Sr)#.JKL3 # " " "s A:B:: C kanban_commentc V^8dQhRRRR/#rr")r#s"r$r%r%s00$00r&c v\R4VPR4pV'g \R4h\\ VR44p\ 4p\ VPR44;_uu_4wrVVPWbV\V4R7p\W'R7uuRRR4# +'giR#;i) z$Append a comment to a task's thread.rrztask_id is required: comments are per-task and this session has no dispatcher-assigned task to default to. Discover task ids with kanban_list, or pass the task id you mean.rir)rri)r comment_idN) rr9rhr r-rr add_commentrCr)rrrrirrrcids&, r$_handle_commentr s%%56 ((9 C  9: : =v. /D! "F ! " "jrnnTvCInF3/ # " " "s 1+B'' B8 cV^8dQhRR/#rr")r#s"r$r%r%sFF3Fr&c \V4;_uu_4wrVVPWa\V4VVRVR7p\W\ V4R7uuRRR4# +'giR#;i)zStore via ``kanban_db.store_attachment_bytes`` (shared size cap, per-task dir, metadata row) so agent, dashboard, and CLI surfaces stay in lockstep.rG) content_type uploaded_byr)r attachment_idsizeN)rstore_attachment_bytesrCrrL)rrfilenamedatar#rratt_ids&&&&& r$_store_attachmentr+sU *2** s8}d%7%+I33t9E s 8A A( kanban_attachc V^8dQhRRRR/#rr")r#s"r$r%r%s _ _ _ _r&c D\RV4p\VR4p\VR4p^RIp^RIpVP \ V4RR7p\TPR4Y#YpPR 44# TP \3dp\RT 24hRp?ii;i) z)Attach an inline (base64) file to a task.r,r(content_base64NT)validatez$content_base64 is not valid base64: rr#) rr-base64binascii b64decoderCErrorrrhr+r9) rrrr( content_b64r1r2r)rs &, r$_handle_attachr6s  .CT:.H&67KBK 04@ TXXg.tXXnE] ^^ NNJ 'B ``(data, content_type)``. Every hop is SSRF-checked (redirects followed manually) so a model-controlled URL, or a public host 302ing, cannot reach loopback/private/cloud-metadata ranges. ``ValueError`` for bad scheme, blocked target, too many redirects, or a body over the cap (checked while streaming, so nothing oversize is buffered).)urljoinurlparseN) is_safe_urlr`zunsupported URL scheme z; only http/https are allowedz;URL blocked by SSRF protection (private/internal address): GETz User-Agentzhermes-kanban/attachF)headerstimeoutfollow_redirectslocationz&redirect without Location header from z content-type;zattachment exceeds z MB limitr&ztoo many redirects fetching )httphttpsi) urllib.parser;r<httpxtools.url_safetyr=range_MAX_ATTACH_URL_REDIRECTSschemer7rstream is_redirectr?r9raise_for_statussplitr iter_bytesrLappendr)r8r9r;r<rGr= current_urlrnrKchunkstotalresprBr#chunks&& r$_download_url_with_caprWs /,K ,q0 1;'..44";;= * *6vj@]^_ _;''Mk][] ]  \\%|E[6\"$u>>AE<<++J7$'Mk]%[\\%k< >>  ! ! # LL,,^<BBII#NqQWWYaa]aL5U#$$':9;U:VV_%`aa e$ 6>xx--122 3C59 ::!>>s%05G.&G.1G.9-G.'AG.. G> c V^8dQhRRRR/#rr")r#s"r$r%r%sXXTXCXr&c ^RIHp\RV4p\\ VR44P 4pVP R4;'gVP R4pV'd \V4P 4'gP^RIHpH pV!V!V4PPR^4R,4P 4;'gRp\WBP4wr\'TP R4Y5YP R4;'gT 4# \dp \R T 24uR p ? #R p ? i\ d1p \"P%R 4\R T R T 24uR p ? #R p ? ii;i)zHAttach a file fetched server-side from an http(s) URL (shared size cap).rrr8r(r)unquoter</downloadzkanban_attach_url: Nz!kanban_attach_url download failedz#kanban_attach_url: failed to fetch rrr#)rrrrCr-rr9rFrZr<pathrsplitrWKANBAN_ATTACHMENT_MAX_BYTESrr r=rrr+) rrrrr8r(rZr<r) fetched_ctrs &, r$_handle_attach_urlrbs?+ +T 2C mD%( ) / / 1Cxx #88txx'8H 3x=..0028C=--44S!BB B& c V^8dQhRRRR/#)rrrr r")r#s"r$r%r%4sm r&c2V'gR#^RIHp^RIHpV!V!4R, RR7pTPT4'dTMRTP4# \d\ P RRR7R#i;i TP4i;i) zGReturn a session id only when it is present in this profile's state.db.N) SessionDB)get_hermes_homestate.dbT)db_path read_onlyz3Could not open state.db to verify Kanban provenancerc) hermes_staterihermes_constantsrjr=rr| get_sessionr)rrirjstates& r$_persisted_session_idrr4s *4/"3j"@DQ"..z::zD  JUY Z  s""ABB"BBBc V^8dQhRRRR/#rr")r#s"r$r%r%Gs;D;D;D;Dr&c D\R4\VR4pVPR4p\VR4VPR4VPR4rTRV9d VR,MVPR4pR p\ VR 4\ VPR 4R R 4\ VR 4rpVPR4VPR4r\T ;'gV '*R4\ VPR4;'g.RR4p \ VPR44;_uu_4wr^RIHp^RI H p\4'd \PPR4MR pV'dVPVV4MR p\VPR44;'gIV'd VP MR ;'g+\V!44;'g\V!RR44pVf6Vf2Vf.Ve*VP"'dVP"VP$rvTP'T\)V4P+4VPR4\)V4\-V 4VPR4;'g \PPR4\/VPR4^4YETVPR4YxTVPR4\/VPR44T YT \/VPR 44VPR!4\)VPR"4;'gR#4\14VR$7p\3VPVV4\44pVP7VV4Uu.uFpVP8R%8XgKVNK ppV'dR&R'R(VR-,P:R),/MR&R*/p\=R.R+V/VBVBR,\?VV4/BuuR R R 4#uupi +'giR #;i)/z@Create a (child) task; orchestrator workers use this to fan out.rrruassignee is required — name the profile that should execute this task (the dispatcher will only spawn tasks with an assignee)workspace_kindworkspace_pathprojectrNtriageskillsz skill namesrgrVproviderz-'provider' requires 'model' to be set as wellrErrget_session_env)_current_origin_session_idrVrrr`rir HERMES_TENANTpriorityidempotency_keymax_runtime_secondsgoal_max_turnscompletion_contractinitial_statusrunning)rrirrErrrurvrrproject_source_task_idrxcreator_task_idrrrymodel_overrideprovider_overridergrrr created_byrdependency_waitgatedTgated_byparentFr subscribedr]r") rr-r9r~r9rrgateway.session_contextr|tools.async_delegationr}rRrWrXrrrrrr create_taskrCrrr<rrB_CREATED_FIELDSrrpayloadr_maybe_auto_subscribe)rrrrrurvrrrxryrgrrrErrr|r}self_tid self_taskrnew_tidrrwaitgates&, r$_handle_createrFs%_5 $ (Exx #H 8TU &*XX.>%?JZA[N$-$5i488L;QJ!h')9$((8:LhXe)fk*F)-(9488J;O% > 2 2!224cdtxx 288b)ZPG ! " "jr;E244JJNN#78:> 3;BKKh/ ,DHH\,BCYY2;)..YY./I/KLYY/?RTV/WX   ."8^=S$)=)=)=5>5I5I9<<2.. E ((*&1ACPXM'N488H+=+`+`P_A`dhhz2A6)U_((7##9$ HH%67 (2G)H IRX)BR9S0T $)> ?txx(89FFYG*,!!E"T73_E>>$8X8aAFFFW ``platform="tui"`` for the TUI poller. ``HERMES_SESSION_ID`` is deliberately NOT a fallback: it is set for every CLI/ACP invocation and would auto-subscribe every CLI run.r{HERMES_SESSION_PLATFORMr`HERMES_SESSION_CHAT_IDHERMES_SESSION_KEYNtuiHERMES_SESSION_CHAT_TYPEHERMES_SESSION_THREAD_IDHERMES_SESSION_MESSAGE_IDHERMES_SESSION_PROFILErrD thread_id chat_typescope_idHERMES_SESSION_SCOPE_IDparent_chat_idHERMES_SESSION_PARENT_CHAT_IDtelegramT telegram_dm_topic_reply_fallbackdirect_messages_topic_idtelegram_reply_to_message_idHERMES_SESSION_USER_IDHERMES_SESSION_USER_ID_ALTz notify+wake) r3chat_idrruser_id user_id_altnotifier_profile delivery_modedelivery_metadata>dmdirectprivate>r`r/) rr|rWrXr9rrrr7rCr) envr3rrrr message_idrrkvrs r$_resolve_notify_targetrs ?5r:C@XZ\<]g 7.3__rzz~~FZ\^7_ !;'.3;;tI.3;;tI0"5;;J3R8 </ :5(B) ${I&> 6; < s#BBG H )   ) J&9b'')-HH@D<= y> *.sx@>3:&"44KKY6R[K\9\KK $**{0C0I0IrJK>sA-A-A-A- A-rz9_maybe_auto_subscribe failed: %r (platform=%r key_set=%r)r3r`r) r r r=rrrr;list_notify_subsadd_notify_subrrjr!)rr_kbn_excrs&& @r$rrs  {}h0JTXYYZF') >7 3@//>@333@//>@ @ @ D<'> C kanban_linkc V^8dQhRRRR/#rr")r#s"r$r%r%s A At Ac Ar&c \R4VPR4pVPR4p\T;'dTR4\VPR44;_uu_4wrEVP WRV\ \ V44R7p\R RVRVRV/V'dRV/M/BuuR R R 4# +'giR #;i) uAdd a parent→child dependency edge after the fact (cycles/self-links/running children → ValueError). A worker linking its OWN running card proves ownership with its run id so the dependency-block handoff still works.r parent_idchild_idz(both parent_id and child_id are requiredr)rrexpected_child_run_idrrNr")rr9r~r link_tasksrrCr)rrrrrrrs&, r$ _handle_linkrs %]3%Ixx #H 9 ! !#MN ! " "jr "0X"?AAYAAA16z9-BA # " " "s &AB66 C u📋u✔u⏸u⏰u👀u↩u💓u💬u📎u➕u▶u🔗r*)rtoolsetschemahandleremojicheck_fn>rcrbrdrerfrm)rri created_at)rrrr)rrurvr)__conditional_annotations__rw __future__rrrloggingrWr contextlibrtypingrrr agent.redactrhermes_cli.goalsrtools.registryr r r hermes_cli.configr r tools.kanban_tools_schemasrrrrrrrrrrrrrrr getLoggerrsrrrr@rIrNrRrZr^rarrr=rhr~r__annotations__rrrrrrrrrrrrrrrr r rrrr*r-r6r9r<rrOrrKrrrrrrBrMrrWrkrrrrtrrrrrrrrrrrrrrrr r+r6rJrWrbrfrrrrrrrr_ORCHESTRATOR_TOOLS_TOOLS_name_sch_handler_emoji_gateregister)rs@r$rs#  %**.'BB2GGGGG   8 $ 6@G )(( ))!" .i.Y l;<G9-/+ 64L(U,\] b FL" .L9.  N tS$tWeS%QUW\] 8??DuwH YY^Y^Y`bZ``bc 2; FLLNPNL D"+L-+H!I . W  W Y O : <=&Vj(,$&)e)$$,d&)"$'E'%'N'(ZC C@# #:"#RA$RAj %=!%=P"#E$E(()*3**3Z)* F+ F#$  %  !"0#04F! _" _#;L$%X&X*%&Z'Z$!;D";D|4+5\>!" P# P A  A& 0@ AB& f=& f=.0@%H(-?.0@%H:UW\]02CVL,ovF*NFC24FO46I6R*NEB,ouE& f= ?"&,!E46/48K/K +QcE 5(4Y_$&&,r&