+ lHj\C2Rt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t ^RI HtHt^RIHt^RIHtHtHtHtHt^RIHtHtHtHtHtHt]P>!] 4t!]PDR8gt#]t$R R lt%RR R llt&!R R]4t'R#)zKSSH remote execution environment with ControlMaster connection persistence.NPath)Iterable)BaseEnvironmentEnvironmentConnectionError) _popen_bash)FileSyncManageriter_sync_filesquoted_mkdir_commandquoted_rm_commandunique_parent_dirs) bash_argvclient_env_withload_hermes_env_vars prepend_unsetresolve_passthrough_env run_capturentcV^8dQhRR/#returnN)formats";/home/ubuntu/.hermes/hermes-agent/tools/environments/ssh.py __annotate__r sUUtUcRF;p\P!V4'dK!\VP4 R24h R#)z@Fail fast with a clear error when the SSH client is unavailable.zT is not installed or not in PATH. Install OpenSSH client: apt install openssh-clientN)sshscp)shutilwhich RuntimeErrorupper)tools r_ensure_ssh_availabler% s@||D!!$**,0T TU UrcHV^8dQhR\R\R\R\/#)rreasonsubjectwhatr)strr)rs"rrr(s/ZZZcZZPjZrc&\W RV R2R7#)u failed — verify z is healthy, then retry. retry_hint)r)r'r(r)s&&&r _sync_errorr.(s# %Y&9$?WX ZZrcjaa]tRt^-toRtRtRtR)V3RlV3RllltV3RlRltV3RlR lt V3R lR lt R*V3R lRllt V3RlRlt V3RlRlt RtV3RlRltV3RlRltV3RlRltV3RlRltV3RlRltV3RlRltV3R lR!ltR"RR#^xR$R /V3R%lR&lltR'tR(tVtV;t#)+SSHEnvironmenta'Run commands on a remote machine over SSH. Spawn-per-call: every execute() spawns a fresh ``ssh ... bash -c`` process. Session snapshot preserves exported env vars across calls (unless ``persistent=False``); CWD persists via in-band stdout markers. Uses SSH ControlMaster for connection reuse. TFcP<V^8dQhRS[RS[RS[RS[RS[RS[RS[RS[R S[/ #) rhostusercwdtimeoutportkey_path probe_only sync_files persistent)r*intbool)r __classdict__s"rrSSHEnvironment.__annotate__;sRS#*->A!7;PTrc <a\S S`W4V R7WWV3wSnSnSnSn\ \P!44R, Sn SPPRRR7V RV RV 2p V'dV RSP 2p \P!V P44P4R,p SPV R2, Sn\#4SP%4V'd R SnR #R SnSP+4SnR SnV'dnSP/4\1V3R lSP2SP4SP6SP8R 7SnSP&P;RR 7SP=4R #))r4r5 persist_envz hermes-sshT)parentsexist_ok@:z:probe::NN.sockNFc4<\SP R24#)/.hermes)r _remote_homeselfsr)SSHEnvironment.__init__..Vs_8I8I7J(5S%Tr) get_files_fn upload_fn delete_fnbulk_upload_fnbulk_download_fn)force)super__init__r2r3r6r7rtempfile gettempdir control_dirmkdir _session_idhashlibsha256encode hexdigestcontrol_socketr%_establish_connection _sync_manager_remote_home_detected_detect_remote_homerI_ensure_remote_dirsr _scp_upload _ssh_delete_ssh_bulk_upload_ssh_bulk_downloadsync init_session) rKr2r3r4r5r6r7r8r9r: socket_key _socket_id __class__s f&&&&&&&&& rrUSSHEnvironment.__init__;s SzJ9=T9S6 49di 3 3 56E td; vQtfAdV, &\s' A AE#s(O A Arc \VP4pV'gV#\P!RP V4P 44P 4R,pVPVPR, V R24#)aOne ControlMaster per SendEnv name-set, beside the plain target socket: a mux master only relays the env names it was itself started with and silently drops the rest, so a passthrough command must ride a master that knows its names. scp/sync/probes keep the plain socket. NNrF) rr_r[r\joinr]r^ with_namestem)rKrpplaindigests&& r_control_socket_for"SSHEnvironment._control_socket_for\soT(()L 2 9 9 ;<FFHL%**R.!1&?@@rc0<V^8dQhRS[S[,/#rr)listr)rr=s"rrr>hs==$t*=rc a\VP4oSPP4'd9\ SPP SP R, R244M.pS.V3RlV4O#)zNThe plain socket plus every SendEnv-set sibling (shared 8-char target prefix).rtz*.sockc38<"TFqS8wgK VxK R#5iNr).0srys& r 2SSHEnvironment._control_sockets..ls;HqU Hs )rr_parentis_dirsortedglobrx)rKsiblingsrys& @r_control_socketsSSHEnvironment._control_socketshseT(()KP<f,EFGfh<;H;<nsHHsHtHrc VP^8wdV\VP4.M.pY P'dRVP.,#.,#)z7Port/key flags shared by ssh (``-p``) and scp (``-P``).z-i)r6r*r7)rKrflagss&& r _target_flagsSSHEnvironment._target_flagsnsB/3yyBC N+Bt}}-GGBGGrNcJ<V^8dQhRS[R,RS[S[,RS[/#)r extra_argsNrpr)rrr*)rr=s"rrr>ss,  TD[ 8TW= bf rc\\V44pR.p\'d*VPRRVP V4 2RRRR.4VP.RO4VPRV44VPVP R44TPT;'g.4VP VP RVP 24V#) r-o ControlPath=zControlMaster=autozControlPersist=300c3@"TFpRRV 23Fq"xK K R#5i)rzSendEnv=Nr)rnameargs& rr4SSHEnvironment._build_ssh_command..{s%Q84>O7P37P38sz-prC)rz BatchMode=yesrz StrictHostKeyChecking=accept-newrzConnectTimeout=10) rqr_SSH_MULTIPLEXextendr{rappendr3r2)rKrrpcmds&&& r_build_ssh_command!SSHEnvironment._build_ssh_commandss)*g > JJ T-E-Eh-O,PQ2D:NP Q op Q8QQ 4%%d+, :##$ dii[$))-. rc@<V^8dQhRS[RS[RS[P/#)r remote_cmdr5r)r*float subprocessCompletedProcess)rr=s"rrr>s-VV3VV:;V;VVrc H\VP4V.,VR7#)zORun one remote shell command over the multiplexed connection, capturing output.r5)rr)rKrr5s&&&r_run_sshSSHEnvironment._run_sshs4224 |CWUUrc 6<V^8dQhRS[RS[RS[RS[RR/#)rrr5r'r(rN)r*r)rr=s"rrr>s9MM3MMMVYM^bMrcVPWR7pVP^8wd*\V RVPP 4 2V4hR#)rz: N)r returncoder.stderrstrip)rKrr5r'r(results&&&&& r_run_ssh_checkedSSHEnvironment._run_ssh_checkedsKz;    !6==+>+>+@*ABGL L "rc VPR^R7pTP^8wduTPP4;'gTPP4p\R T 2RTP R TP R TP R 2R7hR # \PdE\RTP RTP R2RTP RTP R2R7hi;i)z!echo 'SSH connection established'rzSSH connection to rCz timed outz Check that z is up and reachable on port z& and that sshd is running, then retry.r,zSSH connection failed: z is up, sshd is running on port z, and uc can log in with the configured key, then retry — the connection is re-established automatically.N) rrTimeoutExpiredrr3r2r6rrrstdout)rKr error_msgs& rr`$SSHEnvironment._establish_connections  F]]#FPR]SF    ! ++-FF1D1D1FI,))5)$))4TUYU^U^T__e#yyk*NNP P " (( F,$TYYKq :F)$))4QRVR[R[Q\]DDF F Fs BAC5c <V^8dQhRS[/#r~r*)rr=s"rrr>sHHSHrc \P!\4;_uu_4VPR^ R7pVP^8XdzVP P 4'dZ\PRVP P 44RVn VP P 4uuRRR4#RRR4VPR8XdR#RVP 2# +'giL2;i) z(Detect the remote user's home directory.z echo $HOMErzSSH: remote home = %sTNrootz/rootz/home/) contextlibsuppress Exceptionrrrrloggerdebugrbr3)rKrs& rrc"SSHEnvironment._detect_remote_homes   + +]]<]s""T"rc  tVP R2pVP\W R2V R2V R2.4^ R7R#)z?Create base ~/.hermes directory tree on remote in one SSH call.rHz/skillsz /credentialsz/cacherN)rIrr )rKbases& rrd"SSHEnvironment._ensure_remote_dirssP##$H- *DF'2BtfLDY^b]cci[j+kl   "rc*<V^8dQhRS[RS[RR/#)r host_path remote_pathrNr)rr=s"rrr>s'ooSosotorc  VPR\P!\\ V4P 44 2^ R7R.\ 'dRRVP 2.M.,pW0PR4WP RVP RV 2.,, p\V^R7pVP^8wdB\R VPP4 2R VP RVP 24hR #) z0Upload a single file via scp over ControlMaster.z mkdir -p rrrrz-PrCrDz scp failed: z File sync to N)rshlexquoter*rrrr_rr3r2rrr.rr)rKrrscp_cmdrs&&& rreSSHEnvironment._scp_uploads %++c${2C2J2J.K"L!MNXZ ['^^dl43F3F2G$HIacd%%d+yYYKq STU`Ta:b.cccWb1    ! V]]-@-@-B,CD VZV_V_U``abfbkbkalFmn n "rcJ<V^8dQhRS[S[S[S[3,,RR/#)rfilesrN)rrqr*)rr=s"rrr>s0BOBOd5c?&;BOBOrc  V'gR#VP R2p\V4pV'd+VP\V4^RRVP 24\ P !RR7;_uu_4pVFwrV\PPWb4pTR 8XgTPR 4'd\RT: R T: 24h\PPYG4p \P!\PPT 4R R 7\P !\PP#T4T 4K VP-4R\.P0!V4 2.,p \2P4!RRRRVR .\2P6\2P8\2P8R7p \2P4!WP:\2P8\2P8R7p T P:PC4T PE^xR7wrT PG4fT PE^ R7wppM/T PH'dT PHPK4MRpT PP^8wd:\RT PP RTPSRR7PU4 24hT PP^8wdJ\WR T PP RTPSRR7PU4 2R!TP 2R"R#7hRRR4\XP[R$\]T44R# \dp\RT: RT: 24ThRp?ii;i \$d6p \'T RR4R8wdh\(P*!YY4Rp ? EKRRp ? ii;i \<d#T P?4T PA4hi;i \2PLdQY3FpTP?4K Y3FpTPA4K \ORRTP R2R7hi;i +'giEL4;i)%zUpload many files in one tar-over-SSH stream: local ``tar c`` piped through one SSH connection to remote ``tar x``, after a single batched ``mkdir -p``.NrHzremote mkdir failedzRemote directory setup on zhermes-ssh-bulk-)prefixz remote path z is not under sync base .z../z escapes sync base T)rBwinerrori"ztar xf - --no-overwrite-dir -C tarz-chf-z-C)stdinrrrrzSSH bulk upload timed outzBulk file sync to u. timed out — check the connection and retry.r,ztar create failed (rc=z): replaceerrorsz tar extract over SSH failed (rc=zFile sync over SSH to zthe connection)r)z*SSH: bulk-uploaded %d file(s) via tar pipe)/rIr rr r2rVTemporaryDirectoryospathrelpath ValueErrorr" startswithrvmakedirsdirnamesymlinkabspathOSErrorgetattrr copy2rrrrPopenDEVNULLPIPErrkillwaitclose communicatepollrreadrrrdecoderr.rrlen)rKrrrAstagingrr rel_remoteexcstagedessh_cmdtar_procssh_proc_ ssh_stderrtar_stderr_rawprocs&& rrgSSHEnvironment._ssh_bulk_uploads ##$H-$U+   ! !"6w"?EZ$>tyyk"J L  ( (0B C Cw*/& p!#!CJ$ (=(=e(D(D&k_DWX\W_'`aag: BGGOOF3dC4JJrwwy96B+0$--/5TUZU`U`aeUfTg3h2iiG!''T7C(PXbXjXj/9zXH %++G??3=??:??\ OO ! ! # o ( 4 4S 4 A ==?*(0(<(lmoo  oKD C Cs6Q+?M)Q+PB%Q+) N 4N N Q+ O )O Q+ O Q+-PQ+A%Q((Q++ Q< c$<V^8dQhRS[RR/#)rdestrNr)rr=s"rrr>sAAtAArc  fVP R2PR4pVP4R\P!V4 2.,p\ VR4;_uu_4p\ P!V\ PV\ P^xRR7pRRR4XP^8wdVPPRR 7P4pVP4Uu.uFqwP4'gKVNK ppVP^8H;'dH\V4;'d5\ ;QJdR V4F 'dK RM R M !R V44p V 'g\#R V 2R VP$ 24hR#R# +'giEL;iuupi)z*Download remote .hermes/ as a tar archive.rH/z!tar cf - --exclude='*.sock' -C / wbF)rrrr5checkNrrc3B"TFqPR4xK R#5i)z: socket ignoredN)endswith)rlines& rr4SSHEnvironment._ssh_bulk_download.. s!RP>Nd 011>NsTzSSH bulk download failed: zFile sync from )rIlstriprrropenrrunrrrrrr splitlinesr<allr.r2) rKrrel_baserfrrrdiagnostic_lines tolerateds && rrh!SSHEnvironment._ssh_bulk_downloads''(188=))+/ H0E/F G/II $  ^^G:3E3EaXbXgXgqt}BCF    !]])));AACF281B1B1DU1D 1D U))Q.PP48H3IPPccRP>NRPcccRP>NRPOPI!$>vh"G$3DII;"?AA "   Vs"9F0F. F. F+ c4<V^8dQhRS[S[,RR/#)r remote_pathsrN)rr*)rr=s"rrr>s#EES EdErcZVP\V4^ RRVP 24R#) zremote rm failedzRemote file cleanup on N)rr r2)rKrs&&rrfSSHEnvironment._ssh_deletes, / =rCU 7 {C Erc<V^8dQhRR/#rr)rr=s"rrr>s&&&rcZVPeVPP4R#R#r)rarirJs&r_before_executeSSHEnvironment._before_executes%    )    # # % *rloginr5 stdin_datac Z<V^8dQhRS[RS[RS[RS[R,RS[P/#)r cmd_stringrr5rNr)r*r<r;rr)rr=s"rrr>sC x xC x4 x# x!Dj x4>4D4D xrc  \\R7wrVVPVR7\\P !\ W44V4,p\V4pVe\WtVR7#\Wt4#)aForward the passthrough allowlist (skill ``required_environment_variables`` + ``terminal.env_passthrough``) the way docker does: ``SendEnv`` carries the names, the ssh client's env carries the values, so secrets never enter the remote ``bash -c`` argv. The remote sshd must ``AcceptEnv`` them (#14091). Profile-scoped names missing from the active scope are unset remotely so a shared host cannot serve another profile's value.)hermes_env_loader)rp)env) r_load_hermes_env_varsrr rrrrr) rKr rr5rvalues unset_namesr client_envs &&$$$ r _run_bashSSHEnvironment._run_bashsi6H]^%%v%65;;}]gOuCvx}9~~$V, ?I?U{3 ;w[fgj[wwrc VP'd0\PR4VPP4VP 4FpVP 4'gK\ P!\\P4;_uu_4RRRV 2RRVP RVP 2.p\P!VR^\PRR 7R R R 4\ P!\4;_uu_4VP4R R R 4K R # +'giLQ;i +'giEK;i) z"SSH: syncing files from sandbox...rrrz-OexitrCTF)capture_outputr5rrN)rarinfo sync_backrexistsrrrrSubprocessErrorr3r2r runlink)rKsocketrs& rcleanupSSHEnvironment.cleanup#s     KK< =    ( ( *++-F==??$$Wj.H.HIIdl6($;T6dii[XYZ^ZcZcYdKefs4*J\J\dijJ$$W-- .- .JI.--sAD5E5 E  E ) rIrbrarXr_r2r7r6r3)~<FTT)Nr)__name__ __module__ __qualname____firstlineno____doc___profile_scoped_passthrough"_passwordless_sudo_probe_supportedrUr{rrrrrr`rcrdrergrhrfrr(r3__static_attributes____classdictcell__ __classcell__)rmr=s@@rr0r0-s#')-&B A A== HH  VVMM P HH"" ooBOBOHAA0EE&& x% xPS x+/ x x   rr0)zthe SSH connection)(r=rr[loggingrrr rrVpathlibrtypingrtools.environments.baserrtools.environments.base_outputrtools.environments.file_syncrr r r r tools.environments.remote_commonr rrrrr getLoggerr9rrrr$r%r.r0rrrrKsQ O6cckk   8 $ D-UZ A _A r