+ lHj *aROtE0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI H t ^RIHtHtHtHtHtHt^RIHtHt^RIHtHt]P6!R4t/t]^k] P<!4tRRlt R R/R R llt!!R R 4t"RRlt#RRR^/RRllt$]%!0RPm4t&]%!0RQm4t']PP!R4t)RRlt*RRlt+RRRRR]+RR R!R"/t,!R#R$]-4t.R%R&lt/R'R(lt0R)R*R*R*R+R*R,R,R-R,/t1R.R/lt2R0R1lt3R2R3lt4R4t5RRR5R/R6R7lllt6RRR5R/R8R9lllt7R:R;lt8R5R/R<R=llt9R>R?lt:R@RAlt;RBt!4t?]^kRERFlt@RGRHltARIRJltB]%!43RKRLlltCRMRNltDR#)SzMCP server config loading and stdio launch environment: ${VAR}/Cursor-style interpolation, hidden-whitespace and suspicious-entry filtering, the filtered subprocess env, command resolution, the cached-npx binary shortcut and the shared stderr log.N)Path)AnyDictListOptionalSetTuple) stamp_line timestamp) _env_ref_name _prepend_pathztools.mcp_toolc$V^8dQhR\/#returnr)formats":/home/ubuntu/.hermes/hermes-agent/tools/mcp_tool_config.py __annotate__rsSc F^RIHpHpHpV!4p\;_uu_4\ P V4pVeVP'dHV!4R, pV!V4\VR, RRR^R7pVP4T\ T&VuuRRR4# \dcp\PR T4\\PR RR 7pRp?LX \d\P pRp?Lyi;iRp?ii;i +'giR#;i) a.Shared append-mode handle for MCP subprocess stderr, cached until shutdown PER PROFILE HOME (a multiplexed gateway's secondary profile must log under ITS ``logs/``, not the launch profile's). Must expose a real fd (asyncio wires the child's stderr to it); falls back to ``/dev/null``, then real stderr.)get_hermes_homehermes_home_keymkdir_under_hermes_homeNlogszmcp-stderr.logautf-8replace)encodingerrors bufferingz0Failed to open MCP stderr log, using devnull: %swr)hermes_constantsrrr_mcp_stderr_log_lock_mcp_stderr_log_fhgetclosedopenfileno Exceptionloggerdebugosdevnullsysstderr)rrrhome_keyfhlog_direxcs r_get_mcp_stderr_logr5s[Z H    # #H - : $)+f4'0'$44cGT]ijk ,. x (!   $ OQTU$bjj#@B $B$  $   sY+D =B D D *DC"D"D =D>DD DD  D D scopec>V^8dQhR\\,RR/#)rr6rN)rstr)rs"rrr3s" \ \Xc] \d \rc \;_uu_4Vf\\4MV.pVFXp\PVR4pVe)V\P JgV\P JdKGVP4KZ RRR4R# \d\PRTRR7Ki;i +'giR#;i)zMRelease cached parent handles after the selected MCP transports have stopped.Nz%Could not close MCP stderr log for %sTexc_info) r$listr%popr/r0 __stderr__closeOSErrorr+warning)r6keyskeyr2s$ r_close_mcp_stderr_logsrD3s  +0=t&'ugC#''T2BzR3::-s~~1E \    \FVZ[ \   s0A B80BB8#B5 1B84B5 5B88 C cta]tRt^BtoRtRtV3RlRltV3RlRltV3RlRltR V3R lR llt R t Vt R #) _StderrTeea.A stdio child's stderr, copied into the shared log one stamped line at a time while the last few KB stay readable (raw), so a server that dies at startup can say why on the MCP status surfaces instead of only in the log (#124264). ``sink`` is handed to the child; ``close()`` returns the captured tail.i@c <V^8dQhRS[/#)rlog_fhr)r __classdict__s"rr_StderrTee.__annotate__Issrc&\P!4wr#\P!VR^R7VnV\ 4uVnVn\P!VPV3RRR7Vn VPP4R#)wbr z mcp-stderrT)targetargsnamedaemonN) r-pipefdopensink bytearray_log_tail threadingThread_pump_readerstart)selfrHread_fdwrite_fds&& r__init___StderrTee.__init__IsfGGIIIh: &  4: ''tzz Q]fjk  rc$<V^8dQhRS[RR/#)rr^rN)int)rrIs"rrrJPs & &S &T &rc\P!R4!RR7pRp\P!VR^R7;_uu_4pVP R4;p'dbVP V,VP )RVnW2PV4,PR4EvrcVPV4KzRRR4W2PR R R 7,;p'dVPV.4R#R# +'giLG;i) rrrrbrMiN rT)final) codecsgetincrementaldecoderr-rSreadrW _TAIL_BYTESdecodesplit _write_lines)r]r^decoderpendingsourcechunklinesrests&& rrZ_StderrTee._pumpPs..w7yI YYw 2 2f!;;u--%-"jj5043C3C2C2DE #*^^E-B#B"I"I$"O!!%( .3 ^^Ct^<< <4 <   tf % = 3 2sC<A!C<< D c4<V^8dQhRS[S[,RR/#)rrurN)r<r8)rrIs"rrrJ\s$s)rcV'gR#VPPRPRV444VPP4R# \\ 3dR#i;i)Nrfc38"TFp\V4xK R#5iN)r ).0lines& r *_StderrTee._write_lines..`s#GJt$4$4s)rVwritejoinflushr@ ValueError)r]rus&&rrp_StderrTee._write_lines\sQ   IIOOBGG#G#GG H IIOO $   sA AA.-A.c&<V^8dQhRS[RS[/#)rtimeoutr)floatr8)rrIs"rrrJes<  '"zz   ;;r)rVr[rWrTN)g@) __name__ __module__ __qualname____firstlineno____doc__rmr`rZrpr?__static_attributes____classdictcell__)rIs@rrFrFBs?jK & &<<{m9UV     s0> A  A  max_bytesi max_linescHV^8dQhR\R\R\R\/#)rrrrr)r8rc)rs"rrrxs)Ss[^rc \4p\VRR4pV'dV\P8XdR#\ VR4;_uu_4pVP ^\P 4VP4pVP \^Wa, 44VP4PRR4pRRR4XPRV R24pV^8dR#WxRP4U u.uFqP4'gKV NK p p V 'dR PW)R4#R# +'giL;iuup i \dR#i;i) uTrailing lines this server last wrote to the shared stderr log; ``''`` when none. A connect failure that only says ``Connection closed`` hides why the child died (#125300: a ``ModuleNotFoundError`` sat in the log while the agent log stayed mute). Best-effort: the segment header must still be inside the read window, and another server's output past that header is fair game — the header lines carry the name.rPNrfrgrrzstarting MCP server ''rh)r5getattrr-r.r(seekSEEK_ENDtellmaxrlrnrfind splitlinesstriprr*) rrrr2pathrawsizertcutr}rus &$$ r_tail_server_stderrrxs "r64(trzz) $   HHQ $88:D HHSD,- .HHJ%%gy9E  kk1+a@A 7"'+"8"8":K":$jjl":K05tyyz{+,=2= L sM4EE A2D:>$E$E8E E E8E: E  E E! E!z \$\{([^}]+)\}c$V^8dQhR\/#rr)rs"rrrs3rc^RIHpV!4pT;'g\P!4# \dRpL.i;i)zAbsolute workspace root for ``${workspaceFolder}``: the session's authoritative root (terminal cwd / task override / $TERMINAL_CWD), else cwd.)_authoritative_workspace_rootN)tools.file_tools_pathsrr*r-getcwd)rroots r_workspace_folderrs>H,.   299; s . >>c$V^8dQhR\/#rr)rs"rrrs88S8rc\4p\PPVP R44;'gT#)z/\)rr-rbasenamerstrip)rs r_workspace_basenamers0  D 77  DKK. / 7 747ruserHomec@\PPR4#)~)r-r expanduserrrrs**3/rworkspaceFolderc\4#r{)rrrrrrsL]L_rworkspaceFolderBasename pathSeparatorc"\P#r{r-seprrrrrsRVVr/c"\P#r{rrrrrrs bdbhbhrcFaa]tRt^toRtRV3RlV3RllltRtVtV;t#) _RenderedStraA config string after ``${...}`` rendering, carrying how it resolved, so later steps never guess from text that may itself look like ``${...}``. ``missed``: some env reference was unset (or empty) and kept its placeholder; a re-render (connect renders again under the owner's fresh scope) retries from ``template``, while a fully resolved value is final. ``unset_ref``: the template was one whole env reference that missed.cB<V^8dQhRS[RS[S[,RS[RS[/#)rtexttemplatemissed unset_ref)r8rbool)rrIs"rr_RenderedStr.__annotate__s.3x}TfjrcX<\SV`W4pVfTMTVnW5nWEnV#r{)super__new__rrr)clsrrrrrendered __class__s&&&&& rr_RenderedStr.__new__s07?3-$,$4D( &rr)rfNFF) rrrrrrrr __classcell__)rrIs@@rrrs9 rrcFV^8dQhR\\,R\/#)ruser_envr)rdict)rs"rrrs//htn//rcD^RIHp^RIHp\P P 4UUu/uFDwr4V\9g3VP4\9gVPR4'gKBW4bKF pppV!4FpV!V4pVfKWEV&K RF3pV\P 9gK\P V,WS&K5 V'd3VP 4Fwr4\VRR4'dKWEV&K ^RI H pV!V4#uuppi)aFiltered env for stdio subprocesses so API keys/tokens don't leak: the safe baseline keys, ``XDG_*``, vars injected by an external secret source (users configured that backend precisely so subprocesses can consume them), plus the server config's own ``env``. get_secret)secret_source_namesXDG_rF)delegated_child_subprocess_env)HERMES_KANBAN_DBHERMES_KANBAN_BOARD)agent.secret_scoperhermes_cli.env_loaderrr-environitems_SAFE_ENV_KEYSupper_SAFE_ENV_KEYS_CASE_INSENSITIVE startswithragent.delegation_contextr)rrrrCvalueenvrs& r_build_safe_envrs.9%'ZZ%5%5%7 n%7zs . CIIK3R$RVYVdVdekVl  %7 n #$3  H%; "** zz#CH; #..*JC5+u55 C+H )# ..- ns ?D2Dc0V^8dQhR\R\/#)rcommandrr8r)rs"rrrsDrca\RVP44R4pV'd%V\PP R48XdR#VP R4Uu.uFqD'gK VNK ppVUu.uF pSV,NK ppV'dA\ ;QJdV3RlV4F 'gK RM RM!V3RlV44'dS.p\T;'gR4P \P4p\PR 8Xd6\PV9d!VP^\P4VFpT;'g\Pp \PPV 4'gKDVFp \PPW4p \PP!V 4'gKI\P"!V \P$\P&,4'gKV uu# K R#uupiuupi) aResolve *command* under the config env's PATHEXT (Windows only; ``shutil.which`` uses the PARENT's). The extension walk mirrors ``which`` itself (existing-suffix short-circuit, configured extensions in order) but reads nothing from and writes nothing to ``os.environ``: swapping the parent's PATHEXT around a ``which`` call would publish this server's per-profile value to every other thread for the duration, and a ``finally``-restore cannot undo that window.c3"TFPwrVP4R8XgK\V\4'gK4VP4'gKLVxKR R#5iPATHEXTNr isinstancer8rr|kvs& rr~-_which_with_config_pathext..s=qkdaQWWY)5KPZ[\^aPbghgngngpkAAA ANr;c3~<"TF2pSP4PVP44xK4 R#5ir{lowerendswithr|extrs& rr~rs+SdsW]]_55ciikBBds:=TFrfwin32)nextrr-rr&roanyr8pathsepr/platformcurdirinsertrisdirrisfileaccessF_OKX_OK) rpath_argr cfg_pathextrexts candidates directoriesr directory candidateresolveds f&& r_which_with_config_pathextrszqciikqswxK + )BB&,,S1 91CSCC1D 9+/04C'C--4J0 SdSSdSSSY hnn"%++BJJ7K ||w299K#?1bii($$299 ww}}Y'' #Iww||I9Hww~~h''BIIh"''@Q,R,R$   :0s$ H:2H:>H?npxnpmnodeuvuvxc~V^8dQhR\R\\\\\,3,,/#)rrr)r8rtupler<)rs"rrrs,sxc49n0E'Frcf^RIp\V,pVPV4PVP 44eR#VP V4VR8Xd/VP V4pVe\VP4.M.pML^RI H pV!RR/4R,P\P4Uu.uFqf'gK VNK ppV'd6\P!V\PP!V4R7MRpVf\#RV RV R 24hWt3#uupi) amPM's executable for a bare launcher name and the toolchain dirs its children need first on PATH (npx's ``env node``, uvx's sibling uv). Never the user's copy: a missing managed tool is provisioned through PM, which raises naming the remedy when it may not. None only when PM ships no build for this platform (Termux), where the platform's own copy IS the toolchain.Nr)with_hermes_node_pathPATHrfrzHermes-managed z* is not installed; run `hermes pm install `)pm_MANAGED_LAUNCHERS get_packagemissing_reasoncurrent_targetensure uv_launcherr8parentr#rror-rshutilwhichr RuntimeError)rr!packagelauncherdirsrd executables& r_managed_launcherr1s  )G ~~g--b.?.?.ABNIIg$>>'*)1)=HOO$%2:0&">vFLLRZZX^Xa\]X^FJgBJJOOD,ABPTJ_WI5_`g_hhijkk   _s D.D.c V^8dQhR\R\R\\,R\\\\,3,/#)rr-managedr.r)r8r<r)rs"rrrsB Q Qs QS QS QeCQUVYQZNF[ Qrc^RIHpV!V4pWB8XdW3#\P!V\P P V4R7;'gTV3#)zHermes's npm/node *launcher* and toolchain *dirs*, swapped for PM's copies outside a sealed Windows payload (``pm.user_facing.copies``). npm starts each package bin through cmd.exe, and cmd.exe cannot start the packaged ``node.exe``.)copiesr)pm.user_facingr5r)r*r-rr)r-r3r.r5moveds&&& r_outside_packager8sJ& 4LE }} <<rzzu'= > I I'5 PPrc0V^8dQhR\R\/#)rrr)r8r)rs"rrr-s@@#@$@rcz\V4P4pT\\P4P4P 8XdR#^RIHp\T!44P4pYR, 8H;'gY1P9# \dR#i;i \dR#i;i)zTrue for the bin dirs Hermes' bootstrap prepends to this process's PATH: anything under the active hermes home (the sealed payload's venv, ``/bin``, PM store runtimes) plus the running interpreter's own bin dir (a repo checkout's venv).FTrbin) rresolver@r/r0r(r#rr*parents)rrrhomes& r_is_hermes_managed_bin_dirr@-s ?**,4'//18880O%&..0 e| # ? ?t/?/?'??  s#BB+ B('B(+ B:9B:z5.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCwindowschV^8dQhR\\,R\\,R\/#)rrrAr)rrrr<)rs"rrrBs/GG8D>GhtnGX\GrcVf\PR8HMTpV'gR.#T;'g/\P3Fcp\RVP 44R4pV'gK.VP R4Uu.uFqU'gK VNK ppV'gKaVu# \ P R4Uu.uFqU'gK VNK up#uupiuupi)uExecutable suffixes a bare name resolves through, in order. The child env's PATHEXT comes first (``shutil.which`` reads the PARENT's, so a per-profile config value never reaches a plain ``which`` — same source as ``_which_with_config_pathext``), then the parent's, then the OS default. POSIX appends nothing. ``windows`` injectable for the same testability reason as ``_npx_bin_candidates``.Nntrfc3"TFPwrVP4R8XgK\V\4'gK4VP4'gKLVxKR R#5irrrs& rr~$_pathext_suffixes..LsEVNDAi/4>q#4FKL779aNrr)r-rPrrrro_WINDOWS_DEFAULT_PATHEXT)rrA is_windowsrsrrrs&$ r_pathext_suffixesrIBs %,ODJ t 99"bjj)VFLLNVW[] 5#(;;s#3;#3CsCC#3D;t *499#> F>C#CC> FF< Gs CC? C Cc V^8dQhR\R\\,R\\,R\\,R\\,/#)rrr rrAr)r8rrr)rs"rrrUsD3(3-'~BJ4.\deh\irca\W#R7p\;QJdV3RlV4F 'gK RM RM!V3RlV44'dS.pMVUu.uF pSV,NK pp\T;'gR4P\P 4FpV'd\ V4'dKVFp\PPWx4p \PPV 4'gKI\P!V \P\P,4'gKV uu# K R#uupi)u-First PATH hit for *command* OUTSIDE Hermes-managed bin dirs, or ``None``. ``shutil.which`` stops at the first hit, and bootstrap prepends the managed runtime's bin dir, so a bare ``python3`` resolves to the bundled interpreter — which lacks the user's packages and kills the server on import (#125300). Candidates run through ``_pathext_suffixes`` rather than the npx cache layout's ``.cmd``/``.exe`` pair: a user install may only ship a ``.bat``/``.py`` wrapper, and missing it here would silently fall back to the managed hit this exists to step past.)rAc3<"TF;q;'d.SP4PVP44xK= R#5ir{rrs& rr~(_first_user_which_hit..`s1 IDS 8 87==?++CIIK8 8Ds A6ATFrfN) rIrr8ror-rr@rrrr r r ) rr rrArnamesrrrPrs f&&$ r_first_user_which_hitrOUs S 2D s ID Isss ID III *./$33$/R(..rzz: 6yAA D Y5Iww~~i((RYYy"''BGGBS-T-T  ; 0sEc^V^8dQhR\R\R\\\3,/#)rrrr)r8rr)rs"rrrns*)*)*C)*d)*uS$Y7G)*rc\PP\V4P 44p\ T;'g/4p\ P!RRV\ PR7pV\9d \V4MRpVeVwr&\V,R8Xd\WBV4wr&VUu0uF"p\PPV4kK$ ppVPRR4P\P4U u.uF4q'gK \PPV 4V9gK2V NK6 p p \PP!.VOV O4VR&W#3#\P"V9dVPR4p V e\$P&!W+R7MRp V f*\(P*R8XdV'd \-W+V4p V 'dVR 9d\/W+V4;'gT p V 'dT p\PP1V4p V 'd \3W=4pW#3#uupiuup i) aResolve a stdio command against the exact subprocess env (bare launchers under a filtered PATH). Bare ``npx``/``npm``/``node``/``uv``/``uvx`` resolve to Hermes's PM-managed copies with their toolchain dirs first on the child PATH, never the user's (an absolute ``command:`` stays the user's choice). Anything else resolves on the child env's PATH only: ``shutil.which`` with ``path=None`` silently falls back to the PARENT's ``os.environ["PATH"]``, letting a command "resolve" against an env the child will never be spawned with. An absent child PATH is a miss; an explicitly empty one keeps its cwd-only meaning (same distinction the child's ``execvp`` will see); a miss stays as-written for an honest spawn failure.z \.(cmd|exe)$rf)flagsNrrrr>rrrrr)r-rrr8rrresub IGNORECASEr"r1r8normcaser&rorrrr)r*r/rrrOdirnamer )rrresolved_command resolved_envr-r3r.r/rBprvr  which_hit command_dirs&& r_resolve_stdio_commandr]nsww))#g,*<*<*>? r?Lvvor+;2==QH-59K-K)QUG!( h '5 0%5hRV%W " -12T  #T2'++FB7==bjjIsIaQSUSZSZScScdeSfnrSrIs!zz~~~> V-- vv%%##F+EMEYFLL!1A_c  !8\23C|\I )1TT-.>,Wdd[dI ( ''//"23K$\?  ))-3ss8(I  I!!IIc^V^8dQhR\R\R\\,R\/#)rbin_dirrPrAr)r8rrr<)rs"rrrs- ) ) )C )Xd^ )W[ )rcVf\PR8HMTpV'd7RUu.uF)p\PPWV,4NK+ up#\PPW4.#uupi)aLauncher paths to try for *name* inside an npx cache's ``.bin``, in order. On Windows that directory holds the extensionless sh script plus ``.cmd``/``.ps1``; the sh one cannot be spawned there and ``os.access(X_OK)`` is only an existence check, so select by extension (same precedence as ``hermes_constants._candidate_node_command_names``). ``windows`` is injectable so the branch is testable without patching ``os.name`` process-wide.rD)z.cmdz.exe)r-rPrr)r_rPrArHrs&&$ r_npx_bin_candidatesras^ %,ODJ=MN=Mc WSj1=MNN GGLL ' ((Os/A8cFV^8dQhR\R\\,/#)rrOr)r<rr)rs"rrrs>>$>8E?>rc\V\4'd V'gR#\V4pV'd"V^,R9dVP^4K)V'gR#\;QJd#RVR,4F 'gK RM RM!RVR,44'dR#\ V^,4pRVP R49dR#V'dVP R4'dR#\PPR4;'g>\PP\PPR 4R 4p\PPVR 4p\PPV4'gR#\P!V4pTEF p\PPYFR 4p\!TR RR7;_uu_4p\"P$!T4;'g/PR4;'g/p RRR4TX 9dK\PPYFRTR 4p \!T R RR7;_uu_4p\"P$!T4;'g/PR4p RRR4\X \4'd"\PP+T4.p MC\T \,4'd+\/T 4^8Xd\T P144p MEKq\PPYFRR4p \3Y^,4Fcp\PP5T4'gK*\P6!T\P84'gKWYR,3uu# EK R# \dR#i;i +'giEL;i \\&\(3dEKRi;i +'giELp;i \\&\(3dEKi;i)umResolve ``npx -y `` to the already-installed binary, or None. ``npx`` resolves the package and then FORKS, staying resident as the real server's parent for nothing (~48 MB private memory per MCP server, measured); Hermes already supervises the child (shared death supervisor). When the package is in npx's cache we spawn its binary directly. Deliberately conservative — None (caller keeps plain ``npx``, so a cold machine still installs) for a cache miss, a version pin (``pkg@1.2.3``), extra npx flags, a manifest without one obvious bin, or any unreadable cache entry. Returns ``(binary_path, remaining_args)``.Nc3>"TFp\V4R9xK R#5i-yNrfz--yesrr|rs& rr~"_npx_cached_bin..s 7h3q6_ $hNNTF@-npm_config_cacherz.npm_npx package.jsonr utf-8-sigr" dependencies node_modulesr<z.binrg)rr<r=rr8 removeprefixrr-rr&rrrrlistdirr@r(jsonloadr TypeErrorrrlenrBraexistsr r )rOrvspec cache_rootnpx_rootentriesentrymanifestr2depspkg_json bin_fieldrNr_rs& r_npx_cached_binrs dD ! ! :D 47o-   s 7d2h 7sss 7d2h 777 tAwP@!VR R RR \>PBR!RR"7pVPJ^8wgVP=4'g_\LPOR#T VPP;'g VPRPU4R(R4VP=4'gR#\VPX!VP[R$R%74;'g/PR4p\T\^4'dNTPT4;'g5\aT4^8Xd#\c\eTPg444MRp\T\4'gR#T\TPhT, 4.T R ,O3#uupi \>PD\F3d.p\>PH!T^R\T44pRp?ELRp?ii;i \F\\3dR#i;i))a``(node.exe, [bin script, *args])`` for ``npx [-y] ...`` when *command* is a sealed Windows payload's own npx, else None. That npx starts the package bin through cmd.exe, and cmd.exe cannot start the packaged ``node.exe`` (``pm.user_facing``). Hermes gets here only without a host Node and without a copy that PM may make. The payload's Python CAN start the packaged ``node.exe``, so the package is installed with npm's own script and the bin's script runs on that node. Install scripts stay off, because npm runs them through cmd.exe too. None keeps plain npx (an honest failure) for any other argv shape, a non-registry spec (git, URL, path: npm installs those under a name the spec does not show), a failed install, or an unclear bin. Like npx, only an exact version is reused as installed. Any other spec re-resolves on each start and keeps the previous install when npm cannot run (offline). ) _sealed_dirsappliesNrrrrfrur<z npm-cli.jsrnc3>"TFp\V4R9xK R#5irerrhs& rr~&_packaged_npx_entry..s.[RZQs1v/HRZrjrkTF:rrmr;cachezmcp-npx:NNrqz%\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?installz--prefixz --no-savez--ignore-scriptsz --no-auditz --no-fundz--loglevel=errorrriX)capture_outputrrrstdinrcheckz3npm install of %s with the packaged node failed: %srsr"rg).r\ri )5r6rrrr<r-rrVr&rWr8r)r*rrrr=rr rpartition partitionr#rrhashlibsha256encode hexdigestrS fullmatchis_file subprocessrunDEVNULLSubprocessErrorr@CompletedProcess returncoder+rAr0stdoutrrxloads read_textrrr{ritervaluesr()rrOrrr/npm_dirsnpm_dirrnpm_clirvr}r6_barebaseversionrPrprefixrexactrresultr4rs&& r_packaged_npx_entryrs 5 99JtT220H LLA7 KSW WE h&&(()ZVkSe.@$H K^^GDtV]fo*4*<*T"X> >>YE8**G4 K00!RSJF K Z s5)S9%,S>,U U >U"UU UUc\aa^RIHo\V\4'd\V\4'dVP 'gV#\ VRV4p.oVV3Rlp\PV4'gV#\PW!4p\ W1\S4SV.8HR7#\V\4'd/VP4UUu/uFwrEV\V4bK upp#\V\4'dVUu.uFp\V4NK up#V#uuppiuupi)aiRecursively resolve ``${VAR}`` / Cursor ``${env:VAR}`` placeholders and context vars. Env refs resolve from the active profile's secret scope when multiplexing (the routed profile's value, not another profile's in ``os.environ``). Unset (or empty) vars keep the literal placeholder; a templated string comes back as a ``_RenderedStr`` recording how it resolved.rrcF<\PVP^4P44pVeV!4#S!\ VP^44R4pV'g!SP VP^44T;'gVP^4#)rlN)_CONTEXT_VAR_RESOLVERSr&grouprr append)mresolverr _get_secretrs& r_replace'_interpolate_env_vars.._replace6sx-11!''!*2B2B2DEH#z!"=#.Rs=*33se2*sz MCP server 'z': zB in url/headers is not set in this profile's .env or secret sourcemissing_credentials) r&rsortedrfinditerr8rrr failure_class)rrrrr unresolvedrefsunsets&& r_require_rendered_remoterIs F jj%%2 OI)>)D)D"(L(L(N OFgAQAZAZ[^_d[eAfAAfghJyy=*==\+c$@3343 Mhs>C cRV^8dQhR\R\R\\,/#r)r8rr<)rs"rrr^s%dtCyrcaa.oRVV3RlloS!VR4SF=pW3\9gK\PW34\PRW4K? S#)zWarn once per (server, key path) about string values with leading/trailing whitespace (a pasted newline causes opaque auth failures). Advisory only: values are never mutated (could be intentional) nor logged (often secrets). Returns flagged paths.c4V^8dQhR\R\RR/#)rrrrN)rr8)rs"rr-_warn_hidden_whitespace..__annotate__ds!))S)))rc<\V\4'd(WP48wdSPV4R#\V\4'd<VP 4F%wr#S!Y1'dV RV 2M \V44K' R#\V\ 4'd%\V4FwrCS!W1 RV R24K R#R#)r[]N)rr8rrrrr< enumerate)rrrri_walkflaggeds&& rr&_warn_hidden_whitespace.._walkds eS ! !e{{}&< NN4 t $ $ a$D61#CF;& t $ $!%(a61#Q()%rrfuMCP server '%s': config value '%s' has hidden leading or trailing whitespace — this often causes authentication or connection failures. Check for stray spaces/newlines in config.yaml (or the referenced env var).)_whitespace_warnedaddr+rA)rrkey_pathrrs&& @@r_warn_hidden_whitespacer^scG)) &"  "*< <  " "K#: ; NN/0; G NrcRV^8dQhR\R\R\\,/#)rrPcfgr)r8rr)rs"rrrxs%#(3-rc^RIHpT!T\V\4'dTMR4R# \dp\ T4uRp?#Rp?ii;i)zWhy a server's ``tool_costs``/``spend_limit``/``cost_unit`` is unusable, else None. A budget the user declared must never be silently dropped while its server keeps spending, so the server is skipped.)config_cost_policyN)tools.mcp_tool_costsrrrrr8)rPrrr4s&& r_malformed_cost_tablerxsD84 3(=(=4H  3xs!+ A  AA A ctV^8dQhR\\\3,R\\\3,/#)rserversrrr8)rs"rrrs*DdOS$Yrcv^RIHp/pVP4Fwr4V'd\ V\ 4'd V!W44MRpV'd)\ PRVRPV44K]\W44;pe\ PRW64KWBV&K V# \dRpLi;i)zkDrop exfiltration-shaped MCP configs, and servers with a malformed cost table, before any stdio spawn path.)validate_mcp_server_entryNz'Skipping suspicious MCP server '%s': %sz; zRSkipping MCP server '%s': %s (fix tool_costs/spend_limit/cost_unit in config.yaml)) hermes_cli.mcp_securityrr*rrrr+rArrerror)rr safe_serversrPrissues bad_costss& r_filter_suspicious_mcp_serversrs)EL]]_ 9RWabegkWlWl*45rv  NNDdDIIV\L] ^0;;i H LLm *"% %  )$(!)sB(( B87B8clV^8dQhR\\\3,R\\,RR/#)rrrejectedrN)rr8 frozenset)rs"rrrs3KKS$YK9S>KdhKrc^^RIHp^RIHpHpV!4V!4P 4p\ V4P4FwrgWa9d\PRV4K#W`9dW,pVU u/uFqV9gK W9gKWV ,bK p p V 'd1/VCV CW&\PRVRPV 44K\PRV4K\V4W&K R #uup i \d\PRRR 7R #i;i) aLMerge plugin-provided (portable) MCP servers into *safe_servers*; native config wins on a clash. Never raises. The package's declared costs are facts about its server, so a same-name native entry (the way a user widens a package server's trust) keeps them unless it sets the cost key itself; ``spend_limit: 0`` turns the limit off.) CONFIG_KEYS)discover_pluginsget_plugin_managerzLPortable MCP server '%s' skipped: the native entry of that name was rejectedzlPortable MCP server '%s' conflicts with native config; using the native entry with the package's declared %srz?Portable MCP server '%s' conflicts with native config; skippingz#Failed to load portable MCP serversTr:N)rrhermes_cli.pluginsrrget_portable_mcp_serversrrr+rArrr*r,) rrrrrportablerPrnativercarrieds && r_portable_mcp_serversrs  1KK%'@@B7AGGIIDmost%%+.9Zk#X9!/91!f9kZ)>F)>g)>L&NN$DEI499U\K]_NN#dfjk%)#Y "J [ K :T JKs1A2D:DD DA#DD"D,+D,cFV^8dQhR\\\3,/#rr)rs"rrrs$sDy/rc^a a ^RIHpV!4'd/#^RIHp^RIHpV!R4'd/#T!4P R4o ^RIHpV!4/p\S \4'dS M/o \S 4o S P4F7wrV\V4p\V\4'gK(\WW4WtV&K9 \!V V 3RlS 44p\#WH4V# \dLi;i \d#p \$P'RT 4/uR p ? #R p ? ii;i) zm``mcp_servers`` from config.yaml as ``{name: config}`` (empty on error / safe mode), ``${VAR}`` interpolated.)safe_worker_enabled) load_config)env_var_enabledHERMES_SAFE_MODE mcp_servers)load_hermes_dotenvc3f<"TF&qS9gK \VSV,4fK"VxK( R#5ir{)r)r|nkeptrs& rr~#_load_mcp_config..s+v1D=QEZ[\^efg^hEiQQs 11 1zFailed to load MCP config: %sN)agent.safe_worker_policyrhermes_cli.configrutilsrr&rr r*rrrrrrrrr+r,) rr _env_enabledr rrPr interpolatedrr4r rs @@r_load_mcp_configrs< 19 * + +I-##M2  @  )+ '66'B-g6ID05L,--';%1T" &vvvl5     4c: sRC?C?C? C.AC?85C?. C<9C?;C<<C?? D, D'!D,'D,cV^8dQh/^\9d\\\3,;R&^\9d&\\ \\3,,;R&#)rr%r)__conditional_annotations__rr8rsetr)rs"rrrsKaa*('DcN'+at10Cc3h(0uar>HOMELANGrTERMUSERSHELLLC_ALLTMPDIR>OSTMPTEMPPUBLICWINDIRAPPDATACOMSPECrHOMEPATHUSERNAME HOMEDRIVE SYSTEMROOT USERDOMAIN PROGRAMDATA SYSTEMDRIVE USERPROFILE COMPUTERNAME LOCALAPPDATA PROGRAMFILES PROGRAMW6432ALLUSERSPROFILECOMMONPROGRAMFILESCOMMONPROGRAMW6432NUMBER_OF_PROCESSORSPROCESSOR_ARCHITECTUREPROGRAMFILES(X86)COMMONPROGRAMFILES(X86)r{)Frrrjrrxloggingr-rSr)rr/rXpathlibrtypingrrrrrrhermes_cli.stderr_timestampr r tools.mcp_tool_commonr r getLoggerr+r%Lockr$r5rDrFrrrrrcompilerrrrr8rrrr"r1r8r@rGrIrOr]rarrrrrrrrrrrr)rs@rr@sa   88=>   + ,%'' ~~'2 \T \(<(<UE5&%tUTXY0 Q@$SGtGG&SW2)*X )d )>B@?F>$,/504&U^T_K8r