+
    lHàj!  ã                   óÜ   € R t ^ RIt^ RIt^ RIt^ RIt^ RIHt ^ RIHt ]P                  ! 4       R8H  t
]P                  ! R4      tR tR R ltR	 R
 ltR R ltR R ltR R ltR R ltR# )u+  Hermes-owned PYTHONPATH stripping for child processes. Launchers prepend the repo
root and the Hermes venv's site-packages so the backend can ``import tools``; leaked
into a child Python of a DIFFERENT version they load the backend's C extensions and
crash. Only entries proven Hermes-owned by *path provenance* are removed â€” never by a
cross-version heuristic. Module state (``_hermes_repo_root_aliases``, ``_in_venv``,
``_hermes_site_packages``) lives in ``tools.environments.local`` (via :func:`_state`)
so tests monkeypatching it there keep working.N©ÚPath)Ú_ACTIVE_VENV_MARKER_VARSÚWindowsztools.environments.localc                 ó   € ^ RI Hp  V # )zEReturn the ``tools.environments.local`` module (owner of the caches).©Úlocal)Útools.environmentsr   r   s    ÚH/home/ubuntu/.hermes/hermes-agent/tools/environments/local_pythonpath.pyÚ_stater      s
   € å(à€Ló    c                ó<   € V ^8„  d   QhR\         R\         R\        /# )é   ÚleftÚrightÚreturn)r   Úbool)Úformats   "r
   Ú__annotate__r      s&   € ÷ cñ c”Tð c¤$ð c¬4ñ cr   c                óü   € V P                    Uu. uF"  p\        P                  P                  V4      NK$  	  upVP                    Uu. uF"  p\        P                  P                  V4      NK$  	  up8H  # u upi u upi )z;Compare path spellings with host filesystem case semantics.)ÚpartsÚosÚpathÚnormcase)r   r   Úps   && r
   Ú
_same_pathr      s]   € à)-¯ªÓ4© AŒB�G‰G×Ñ˜QÖ©Ñ4ÐV[×VaÒVaÓ8bÑVaÐQR¼¿¹×9IÑ9IÈ!Ö9LÑVaÑ8bÑbÐbùÒ4ùÒ8bs   �(A4Á(A9c          
      ób   € V ^8„  d   QhR\         R\         R\         R\        \         R3,          /# )r   Úresolved_rootÚlexical_rootÚconfigured_homer   .)r   Útuple)r   s   "r
   r   r   "   s5   € ÷ $ñ $Üð$Ü'+ð$Ü>Bð$ä
Œ4�ˆ9Õñ$r   c           
     ó  a
€ W.pV.pVP                   P                  R8X  d&   VP                  VP                   P                   4       V FÒ  p VP                  4       p\        P
                  P                  \        V4      4      p\        P
                  P                  V\        P
                  P                  \        V 4      4      .4      V8X  dK   VP                  V\        P
                  P                  \        V 4      \        V4      4      ,          4       KÒ  KÔ  	  V FP  pWPP                  ,          p VP                  RR7      V P                  RR7      8X  d   VP                  V4       KP  KR  	  . p	V FV  o
\        ;QJ d    V
3R lV	 4       F  '       g   K   RM	  RM! V
3R lV	 4       4      '       d   KE  V	P                  S
4       KX  	  \        V	4      #   \        \        3 d     EKª  i ; i  \         d     Kä  i ; i)a±  Exact repo-root spellings emitted by Hermes launchers. Mirrors
``gateway_windows._preserve_hermes_home_path`` (physical path under the resolved
HERMES_HOME -> configured spelling) so a junction-backed install matches without
treating arbitrary HERMES_HOME descendants as Hermes-owned. A repo-level junction
(possibly cross-drive) is accepted only when a strict resolve proves
<root>/<repo dirname> is the physical root (fail-closed).ÚprofilesT)Ústrictc              3   ó<   <"  € T F  p\        SV4      x € K  	  R # 5i©N©r   )Ú.0ÚexistingÚ	candidates   & €r
   Ú	<genexpr>Ú2_build_hermes_repo_root_aliases.<locals>.<genexpr>D   s   øé € ÐKÁ7°x”:˜i¨×2Ð2Ã7ùó   ƒF)ÚparentÚnameÚappendÚresolver   r   r   ÚstrÚ
commonpathÚrelpathÚOSErrorÚ
ValueErrorÚanyr    )r   r   r   Ú
candidatesÚhome_candidatesÚhomeÚresolved_homeÚhome_keyÚrepo_candidateÚaliasesr)   s   &&&       @r
   Ú_build_hermes_repo_root_aliasesr>   "   sª  ø€ ð  Ð.€Jð 'Ð'€OØ×Ñ×"Ñ" jÔ0Ø×Ñ˜×5Ñ5×<Ñ<Ô=Ûˆð	Ø ŸL™L›NˆMÜ—w‘w×'Ñ'¬¨MÓ(:Ó;ˆHÜ�w‰w×!Ñ! 8¬R¯W©W×-=Ñ-=¼cÀ-Ó>PÓ-QÐ"RÓSÐW_Ô_Ø×!Ñ! $¬¯©¯©¼¸]Ó9KÌSÐQ^ÓM_Ó)`Õ"`Öañ `ñ	  ó  ˆØ× 2Ñ 2Õ2ˆð	Ø×%Ñ%¨TÐ%Ó2°m×6KÑ6KÐSWÐ6KÓ6XÔXØ×!Ñ! .Ö1ñ Yñ  ð €GÛˆ	ß‹sÔKÁ7ÓK�s�sŠsÔKÁ7ÓK×KÔKØ�N‰N˜9Ö%ñ  ô �‹>Ðøô œÐ$ô 	Ûð	ûô ô 	Úð	ús%   ÁCGÄ88G8ÇG5Ç4G5Ç8HÈHc                ó>   € V ^8„  d   QhR\         R\        R,          /# ©r   Úenvr   N)Údictr   )r   s   "r
   r   r   I   s   € ÷ ñ ¤ð ¬$°­+ñ r   c                óð  a€ ^ RI HpHpHp \	        \
        4      P                  4       P                  ^,          pV! V4      P                  4       '       d	   V! V4      #  V! V4      pVe    VR,          P                  4       '       d   V# \	        V P                  R4      ;'       g    R4      oV P                  R4      '       de   \        ;QJ d1    V3R l\        4       P                   4       F  '       g   K   RM&	  RM"! V3R l\        4       P                   4       4      '       g   R#  SR,          P                  4       '       d   S# R#   \        \        3 d    Rp Lûi ; i  \         d     R# i ; i)	aa  Producer-owned runtime venv, or None: PM's committed generation, else a sealed
payload's shipped venv (its interpreter is not a venv, so ``_in_venv`` misses it),
else VIRTUAL_ENV. The variable alone is not provenance (users carry unrelated
venvs): require the legacy Windows base-Python producer's exact ``<repo>/venv``
layout AND a real ``pyvenv.cfg``.)Úpayload_venvÚruntime_facts_pathÚselected_venvNz
pyvenv.cfgÚVIRTUAL_ENVÚ c              3   óJ   <"  € T F  p\        SVR ,          4      x € K  	  R# 5i)ÚvenvNr&   )r'   Úrootr)   s   & €r
   r*   Ú*_validated_runtime_venv.<locals>.<genexpr>]   s$   øé € ð -aÙ=_°TŒJ�y $¨¥-×0Ð0Ó=_ùs   ƒ #TF)Úpm.environmentsrD   rE   rF   r   Ú__file__r0   ÚparentsÚis_fileÚRuntimeErrorr4   Úgetr6   r   Ú_hermes_repo_root_aliases)rA   rD   rE   rF   rK   Úshippedr)   s   &     @r
   Ú_validated_runtime_venvrU   I   s9  ø€ ÷ PÑOä”‹>×!Ñ!Ó#×+Ñ+¨AÕ.€DÙ˜$Ó×'Ñ'×)Ò)Ù˜TÓ"Ð"ðÙ˜tÓ$ˆð
 Ò ¨,Õ 6×?Ñ?×AÒAØˆÜ�S—W‘W˜]Ó+×1Ð1¨rÓ2€IØ�7‰7�=×!Ò!¯«ô -aÜ=C»X×=_Ò=_ó-a¯¯ªô -aÜ=C»X×=_Ò=_ó-a÷ *aò *aáðØ&¨Õ5×>Ñ>×@Ò@ˆyÐJÀdÐJøô œ'Ð"ô ØŠðûô ô Úðús0   ÁE Ä,E& Å	E& ÅE& ÅE#Å"E#Å&E5Å4E5c                óF   € V ^8„  d   QhR\         R\        \        ,          /# )r   rA   r   )rB   Úlistr   )r   s   "r
   r   r   f   s   € ÷ ñ ¤4ð ¬D´­Jñ r   c                óT  a€ \        4       pVP                  fú   . pVP                  '       dÖ    ^ RIpVP	                  R VP                  4        4       4       V'       g£   R\        P                  ^ ,           R\        P                  ^,           2pTP                  \        '       d(   \        \        P                  4      R,          R,          M-\        \        P                  4      R,          V,          R,          4       \        V4      Vn        \        VP                  4      p\        V 4      pVe`   ^ RIHp V! V4      o\"        ;QJ d    V3R	 lV 4       F  '       g   K   R
M	  RM! V3R	 lV 4       4      '       g   VP                  S4       V#   \         d     ELMi ; i)zÏExact site-packages dirs owned by the Hermes runtime (cached):
``site.getsitepackages()`` with a ``sys.prefix`` fallback, plus a validated
Windows base-interpreter launch's ``VIRTUAL_ENV/Lib/site-packages``.Nc              3   ó8   "  € T F  p\        V4      x € K  	  R # 5ir%   r   )r'   Úsps   & r
   r*   Ú,_get_hermes_site_packages.<locals>.<genexpr>p   s   é € ÐHÑ1G¨2œd 2Ÿh˜hÓ1Gùs   ‚ÚpythonÚ.ÚLibzsite-packagesÚlib)Úsite_packagesc              3   ó<   <"  € T F  p\        SV4      x € K  	  R # 5ir%   r&   )r'   r(   Úruntime_site_packagess   & €r
   r*   r[   ~   s   øé € ÐVÉvÀ8”:Ð3°X×>Ð>Ëvùr,   TF)r   Ú_hermes_site_packagesÚ_in_venvÚsiteÚextendÚgetsitepackagesÚ	ExceptionÚsysÚversion_infor/   Ú_IS_WINDOWSr   ÚprefixrW   rU   rM   r`   r6   )rA   r   Úresultre   ÚpyverÚruntime_venvr`   rb   s   &      @r
   Ú_get_hermes_site_packagesrp   f   s:  ø€ ô ‹H€EØ×"Ñ"Ò*ØˆØ�>�>ˆ>ðÛØ—‘ÑH°×1EÑ1EÔ1GÓHÔH÷ Ø ¤×!1Ñ!1°!Õ!4Ð 5°Q´s×7GÑ7GÈÕ7JÐ6KÐL�Ø—‘ÏKËKœd¤3§:¡:Ó.°Õ6¸ÖHÜ#'¬¯
©
Ó#3°eÕ#;¸eÕ#CÀoÕ#UôWä&*¨6£lˆÔ#Ü�%×-Ñ-Ó.€Fä*¨3Ó/€LØÒÝ1Ù -¨lÓ ;Ðß‹sÔVÉvÓV�s�sŠsÔVÉvÓV×VÒVØ�M‰MÐ/Ô0Ø€Møô ô Úðús   ¯*F ÆF'Æ&F'c                ó(   € V ^8„  d   QhR\         RR/# r@   ©rB   )r   s   "r
   r   r   ƒ   s   € ÷ ñ ¼Dð ÀTñ r   c                óZ   € \        V 4       \         F  pV P                  VR4       K  	  R# )zòStrip Hermes-owned PYTHONPATH entries, then the runtime marker vars. Order is
load-bearing: PYTHONPATH filtering runs BEFORE the markers go so a validated Windows
base-interpreter launch (VIRTUAL_ENV -> <repo>/venv) can still prove ownership.N)Ú_strip_hermes_owned_pythonpathr   Úpop)rA   Ú_markers   & r
   Ú2_strip_hermes_owned_pythonpath_and_runtime_markersrw   ƒ   s$   € ô # 3Ô'ß+ˆØ�‰�˜Öó ,r   c                ó(   € V ^8„  d   QhR\         RR/# r@   rr   )r   s   "r
   r   r   Œ   s   € ÷ Tñ T¬ð T°ñ Tr   c                óz  a€ V P                  R4      pV'       g   R# . \        V 4      O\        4       P                  OpVP	                  \
        P                  4      pV Uau. uFQ  oS'       g   K  \        ;QJ d    V3R lV 4       F  '       g   K   RM	  RM! V3R lV 4       4      '       g   KO  SNKS  	  ppV Uu. uF  qDV9  g   K  VNK  	  ppV'       d$   \
        P                  P                  V4      V R&   MV P                  RR4       V'       d   \        P                  RV4       R# R# u upi u upi )uÛ  Remove Hermes-owned PYTHONPATH entries: only exact matches of the repo root
(any launcher spelling) and runtime site-packages â€” never descendants, which are
user paths. Empty components (= cwd) and everything else are preserved.

Everything else -- user libs, Nix plugin paths, a pythonX.Y/site-packages entry meant for a DIFFERENT
child version -- is preserved byte-for-byte: ownership is decided by path provenance, never by a
cross-version heuristic (#74817 follow-up).
Ú
PYTHONPATHNc              3   óN   <"  € T F  p\        \        S4      V4      x € K  	  R # 5ir%   )r   r   )r'   r   Úes   & €r
   r*   Ú1_strip_hermes_owned_pythonpath.<locals>.<genexpr>š   s!   øé € Ð/\ÑP[È1´
¼4À»7ÀA×0FÐ0FÓP[ùs   ƒ"%TFz1Stripped Hermes-owned entries from PYTHONPATH: %s)rR   rp   r   rS   Úsplitr   Úpathsepr6   Újoinru   ÚloggerÚdebug)rA   ÚppÚowned_pathsÚentriesr|   ÚstrippedÚkepts   &   `  r
   rt   rt   Œ   sä   ø€ ð 
�‰�Ó	€BßÙØXÔ-¨cÓ2ÐX´V³X×5WÑ5WÐX€KØ�h‰h”r—z‘zÓ"€GÙ"Ô]™7�a¤a”¯C«CÔ/\ÑP[Ó/\¯C¯CªCÔ/\ÑP[Ó/\×,\—�™7€HÐ]ÙÓ4‘w�!¨8Ñ"3�AˆA‘w€DÐ4ßÜŸJ™JŸO™O¨DÓ1ˆˆLÒà�‰�˜dÔ#ßÜ�‰ÐHÈ(ÖSñ ùò ^ùÚ4s*   Á"
D3Á1
D3Á<D3ÂD3Â3D3Â?D8ÃD8)Ú__doc__Úloggingr   Úplatformri   Úpathlibr   Ú#tools.environments.local_env_policyr   Úsystemrk   Ú	getLoggerr�   r   r   r>   rU   rp   rw   rt   © r   r
   Ú<module>r�      sf   ðñ2ó Û 	Û Û 
Ý å Hà�oŠoÓ 9Ñ,€à	×	Ò	Ð5Ó	6€òõcõ
$õNõ:õ:÷Tr   