`gjUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlmZmZddlmZej&dk(Zej*eZdedefd Zdedefd Zdedefd Zd edefd Zd edefdZd edefdZdedefdZ dZ!e"dhZ#de"fdZ$e$Z%dZ&dedefdZ'de(ddfdZ)de(ddfdZ*dHde(dzde(dzde(fdZ+e"hdZ,e"ee-d<dd d!ede(eeffd"Z.defd#Z/iZ0e(eefe-d$<iZ1e(eefe-d%<da2d&e-d'<d(Z3d)edefd*Z4dId+Z5d,edefd-Z6dJd,ed)edefd.Z7d,edefd/Z8da9d0e-d1<de:efd2Z;d3edefd4Z<e"hd5Z=defd6Z>d7Z?e@ZAeAaBd8e-d9<dedzfd:ZCd3edefd;ZDd3edefd<ZEde(ddfd=ZFd>e(dedzfd?ZGde(de(fd@ZHdeIe:eeffdAZJde:efdBZKdCedDe:edefdEZLGdFdGeZMy)KuELocal execution environment — spawn-per-call with session snapshot.N)Path)BaseEnvironment _pipe_stdin)windows_hide_flagsWindowscwdreturnctr|s|Stjd|}|s|S|jdj }|jdxsdj dd}|d|xs t dS) u[Translate a Git Bash / MSYS-style POSIX path (``/c/Users/x``) to the native Windows form (``C:\Users\x``) so ``os.path.isdir`` and ``subprocess.Popen(..., cwd=...)`` can find it. Also accepts the Cygwin (``/cygdrive/c/...``) and WSL-mount (``/mnt/c/...``) spellings of a drive root. Multi-segment POSIX paths like ``/home/x`` or ``/tmp/foo`` are left untouched. No-ops on non-Windows hosts or for paths that aren't in MSYS form. Returns the input unchanged when no translation applies. This is idempotent — calling it on an already-Windows path returns it as-is. z)^/(?:(?:cygdrive|mnt)/)?([a-zA-Z])(/.*)?$/\:\) _IS_WINDOWSrematchgroupupperreplacechrrmdrivetails K/root/.hermes/venv/lib/python3.12/site-packages/tools/environments/local.py_msys_to_windows_pathrsz c  =sCA   GGAJ   E GGAJ " % %c4 0DWAdoc"g& ''cV|rtjj|ntj}tr#t |}ddl}|j|r|Stjj|r|Stjj|}tj}tjj|sWt|j}t|j}|r+t|t|kr|t| d|k(r|S|S)aResolve the local backend's initial cwd to an absolute host path. ``TERMINAL_CWD`` can be populated from config.yaml before the terminal backend is created. If that value is relative and happens to match the directory Hermes was already launched from (for example ``hermes-agent`` while the process cwd is ``~/.hermes/hermes-agent``), passing it through unchanged makes the wrapper run ``cd hermes-agent`` *inside* the project and fail with a confusing nested-path error. Anchor relative local cwd values once, up front, so both ``subprocess.Popen(cwd=...)`` and the in-shell ``cd`` use the same absolute directory. rN) ospath expandusergetcwdrrntpathisabsabspathisdirrpartslen)rexpandedr% candidatecurrent wanted_parts current_partss r_resolve_local_initial_cwdr04s+.rww!!#&299;H(2  6<< !O ww}}X)IiikG 77== #H~++ W ++ C -]1CCc,//01\A rctr|s|Stjd|}|s|S|jdj }|jdxsdj ddj d}|rd|d|Sd|dS)a+Translate a native Windows path (``C:\Users\x``) to Git Bash / MSYS form (``/c/Users/x``) so ``builtin cd`` resolves it reliably. No-ops on non-Windows hosts or for paths that aren't drive-qualified native Windows paths. Returns the input unchanged when no translation applies. z^([a-zA-Z]):[\\/]*(.*)$r r r rr)rrrrlowerrlstriprs r_windows_to_msys_pathr4\s c  +S1A  GGAJ   E GGAJ " % %dC 0 7 7 ddl}|jt|S)zFQuote *path* for safe interpolation into a Git Bash script on Windows.rN)shlexquoter7)r"r9s r_quote_bash_pathr;s ;;t, --rctjj|xr$tj|tjS)upTrue when *path* is a directory this process can actually chdir into. ``os.path.isdir`` alone is not enough: stat() on ``/root`` succeeds for a non-root user (only ``/`` needs search permission), but ``subprocess.Popen(cwd='/root')`` then dies with ``PermissionError: [Errno 13] Permission denied: '/root'``. Seen in the wild when a root-launched CLI session leaks ``/root`` into shared state that a non-root gateway/cron process later reads (#65583) — every cron job's terminal/file tool then fails on every command, forever. Checking X_OK up front lets the caller fall back instead. )r!r"r(accessX_OKr6s r _cwd_usabler?s+ 77==  ;299T277#;;rc tr t|n|}|r t|r|S|rKtjj |r,t jd|ttdd|rtjj|nd}|rKt|r|Stjj|}||k(r tjS|}|rKtjS)uAReturn ``cwd`` if it exists as a directory this process can enter, else the nearest existing accessible ancestor. Falls back to ``tempfile.gettempdir()`` only if walking up the path can't find any usable directory (effectively never on a healthy filesystem, but cheap belt-and-braces). On Windows, also normalizes Git Bash / MSYS-style POSIX paths (``/c/Users/x``) to native Windows form before the isdir check so a perfectly valid ``pwd -P`` result from bash doesn't get rejected as "missing" (see ``_msys_to_windows_path``). Used by ``_run_bash`` to recover when the configured cwd is gone — most commonly because a previous tool call deleted its own working directory (issue #17558) — or inaccessible to this user, e.g. ``/root`` leaking from a root-launched CLI session into a non-root gateway's cron jobs (issue #65583). Without this guard, ``subprocess.Popen(..., cwd=...)`` raises ``FileNotFoundError``/``PermissionError`` before bash starts, wedging every subsequent terminal call until the gateway restarts. uConfigured terminal cwd %r exists but is not accessible to this user (uid=%s) — falling back to the nearest usable directory. If this is a gateway/cron process, check for root-owned paths leaking into terminal.cwd / TERMINAL_CWD (#65583).getuidcy)N?rDrrz#_resolve_safe_cwd..rr ) rrr?r!r"r(loggerwarninggetattrdirnametempfile gettempdir)rparent next_parents r_resolve_safe_cwdrOs()4  $C {3  rww}}S!  3X{35  &)RWW__S !bF  v Mggoof- &             r_HERMES_FORCE_AWS_BEARER_TOKEN_BEDROCKct} ddlm}|jD]i}|j |j |j dk(r|j t|jsO|j|jk ddl m }|jD]U\}}|jd}|dvr|j|-|dk(s3|jdsE|j|W |j hd |jd t!|S#t$rYwxYw#t$rYIwxYw) z=Derive the blocklist from provider, tool, and gateway config.r)PROVIDER_REGISTRYaws_sdk)OPTIONAL_ENV_VARScategory>tool messagingsettingpassword>AGH_TOKENHASS_URL LLM_MODEL HASS_TOKEN XAI_API_KEY GROQ_API_KEY EMAIL_ADDRESS GITHUB_APP_ID OPENAI_ORG_ID WHATSAPP_MODECOHERE_API_KEYEMAIL_PASSWORDGOOGLE_API_KEYMODAL_TOKEN_IDOPENAI_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENDAYTONA_API_KEYEMAIL_IMAP_HOSTEMAIL_SMTP_HOSTMISTRAL_API_KEYOPENAI_API_BASEOPENAI_BASE_URLSIGNAL_HTTP_URLDEEPSEEK_API_KEYGATEWAY_RELAY_IDHELICONE_API_KEYPARALLEL_API_KEYTOGETHER_API_KEYWHATSAPP_ENABLEDANTHROPIC_API_KEYFIRECRAWL_API_KEYFIRECRAWL_API_URLFIREWORKS_API_KEYANTHROPIC_BASE_URLEMAIL_HOME_ADDRESSMODAL_TOKEN_SECRETOPENROUTER_API_KEYPERPLEXITY_API_KEYSLACK_HOME_CHANNELDISCORD_AUTO_THREADOPENAI_ORGANIZATIONSIGNAL_HOME_CHANNELSLACK_ALLOWED_USERSDISCORD_HOME_CHANNELGATEWAY_RELAY_SECRETSIGNAL_ALLOWED_USERSGATEWAY_ALLOWED_USERSSIGNAL_IGNORE_STORIESTELEGRAM_HOME_CHANNELWHATSAPP_ALLOWED_USERSDISCORD_REQUIRE_MENTIONEMAIL_HOME_ADDRESS_NAMESLACK_HOME_CHANNEL_NAMEVERTEX_CREDENTIALS_PATHSIGNAL_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNEL_NAMEGATEWAY_RELAY_DELIVERY_KEYGITHUB_APP_INSTALLATION_IDSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_HOME_CHANNEL_NAMEGITHUB_APP_PRIVATE_KEY_PATHDISCORD_FREE_RESPONSE_CHANNELSGOOGLE_APPLICATION_CREDENTIALSHERMES_DASHBOARD_SESSION_TOKENCLAUDE_CODE_OAUTH_TOKEN)sethermes_cli.authrSvaluesupdateapi_key_env_vars auth_type_AWS_SDK_CREDENTIAL_ENV_VARSbase_url_env_varadd ImportErrorhermes_cli.configrUitemsgetdiscard frozenset)blockedrSpconfigrUnamemetadatarVs r_build_provider_env_blocklistrs/G  5(//1 6G NN733 4  I-;<'' G445  6  7/557 "ND(||J/H00 D!Y&8<< +C D!  " NNDD\ OO-. W {        s7A$D.1D.AD=D=+D=. D:9D:= E E ) VIRTUAL_ENV CONDA_PREFIXkeyc|j}|jdr#|jds|jdry|jdr4|jds"|jds|jdryy ) uReturn True for Hermes-internal secrets injected under *dynamic* names. ``_HERMES_PROVIDER_ENV_BLOCKLIST`` is name-based and derived from the provider/tool registries, but the gateway and CLI also inject secrets into ``os.environ`` at runtime under names no static registry knows about: - ``AUXILIARY__API_KEY`` / ``AUXILIARY__BASE_URL`` — per-task side-LLM credentials bridged from ``config.yaml[auxiliary]`` by ``gateway/run.py`` and ``cli.py`` (vision, web_extract, approval, compression, and any plugin-registered auxiliary task). These are separate, often higher-spend API keys plus base URLs that may point at private endpoints; a model-authored shell command must never see them. - ``GATEWAY_RELAY_*_SECRET`` / ``GATEWAY_RELAY_*_KEY`` / ``GATEWAY_RELAY_*_TOKEN`` — relay-auth material provisioned by the gateway (``GATEWAY_RELAY_SECRET``, ``GATEWAY_RELAY_DELIVERY_KEY``). These are Tier-1 gateway secrets, like the messaging bot tokens in ``_ALWAYS_STRIP_KEYS``. Non-secret ``GATEWAY_RELAY_*`` routing hints (``GATEWAY_RELAY_URL``, ``GATEWAY_RELAY_PLATFORMS``, …) are NOT matched and remain visible. ``code_execution_tool.py`` already catches these via substring matching on ``KEY`` / ``SECRET`` / ``TOKEN``; the terminal backend's narrower name-based blocklist did not, which is the leak this predicate closes. This is the single source of truth for "Hermes-internal dynamic secret" across every spawn path — the terminal ``_make_run_env`` / ``_sanitize_subprocess_env`` filters, the Docker passthrough filter, and the non-terminal :func:`hermes_subprocess_env` helper all call it, so the dynamic patterns are stripped **unconditionally** regardless of ``env_passthrough`` skill registration or ``inherit_credentials``. Nothing a model-driving CLI legitimately needs matches these patterns. AUXILIARY__API_KEY _BASE_URLTGATEWAY_RELAY__SECRET_KEY_TOKENF)r startswithendswith)rrs r_is_hermes_internal_secretr[soB IIKE  % z"enn[&A () y!U^^F%;u~~h?W renvcN ddlm}|}|r||d<yy#t$rYywxYw)zBBridge the context-local Hermes home override into subprocess env.r)get_hermes_home_override HERMES_HOMEN)hermes_constantsr Exception)rrvalues r_inject_context_hermes_homers6 =(* !&C      s  $$c ddlm}m}m}|}|j D]A\}}|j }||ur|dn t|||<-|s0|j|dCy#t$rYywxYw)uBridge gateway session ContextVars into a subprocess environment dict. ContextVars don't propagate to child processes, so the live session vars (HERMES_SESSION_*) are bridged onto the child env here. 🔴 Cross-session leak guard. The session vars also have a process-global os.environ mirror (written last-writer-wins as a CLI/cron fallback, never cleared). Under a concurrent multi-session host (the messaging gateway, ACP adapter, API server, TUI) that global belongs to *whichever turn wrote it last* — NOT necessarily this task. A subprocess spawned from a task whose ContextVar is _UNSET (e.g. a sibling message task that never bound, or one that inherited another session's context) would otherwise inherit the FOREIGN global and act on another session's identity. So once the session-context machinery is engaged in this process (any host has called set_session_vars), the session vars are ContextVar-authoritative: - ContextVar set (incl. explicitly-empty "") → that value wins, overriding any stale snapshot/global value. - ContextVar _UNSET → STRIP the var from the child env rather than inherit the possibly-foreign process-global. In a pure single-process CLI/one-shot that never engaged the session-context system there is no concurrency to leak across, so the inherited fallback is kept. See gateway/session_context.session_context_engaged and tests/tools/test_local_env_session_leak.py. r)_UNSET_VAR_MAPsession_context_engagedNr ) gateway.session_contextrrrrrrstrpop)rrrr_engagedvar_namevarrs r_inject_session_context_envrs4  '(H!)$ #   "'-BSZCM  GGHd #$ s A(( A43A4base_env extra_envcl ddlm}i}|xsijD]=\}}|j t rt |r(|tvs ||s9|||<?|xsijD]`\}}|j t r$|tt d}t |r9|||<?t |rK|tvs ||s\|||<bt|ddl m }||t|tD]}|j|dt||S#t$rd}Y*wxYw)z.rFrNapply_subprocess_home_env)tools.env_passthroughrrrr!_HERMES_PROVIDER_ENV_FORCE_PREFIXr_HERMES_PROVIDER_ENV_BLOCKLISTr*rrrr_ACTIVE_VENV_MARKER_VARSr%_apply_windows_msys_bash_env_defaults) rr_is_passthrough sanitizedrrreal_keyr_markers r_sanitize_subprocess_envrsC*O!#I~2,,.# U >>; <  %c *  4 48L"IcN #!B--/ # U >>; <3@ABCH)(3"'Ih  ' ,  6 6/#:N"IcN # *:i( *+% gt$%*)4 M *)*sD## D32D3>r[r^ GITHUB_TOKENrbrfrhrlSLACK_APP_TOKENSLACK_BOT_TOKENrtDISCORD_BOT_TOKENrTELEGRAM_BOT_TOKENrSLACK_SIGNING_SECRETrGATEWAY_ALLOW_ALL_USERSrrrr_ALWAYS_STRIP_KEYSF)inherit_credentialsrc"tjj}tD]}|j |dt |D]H}|j tr|j |d+t|s7|j |dJ|stD]}|j |d|jddt|ddl m }||tD]}|j |dt|t!||S)uBuild a sanitized environment dict for a spawned subprocess. Centralized helper for the **non-terminal** spawn surface (browser, ACP/CLI executors, computer-use driver, dep-ensure, TUI Node host, detached gateway). Use this instead of copying ``os.environ`` directly so strip-by-default is the uniform policy across every spawn site, with a single source of truth (``_HERMES_PROVIDER_ENV_BLOCKLIST``). The terminal / execute_code path keeps using :func:`_sanitize_subprocess_env`, which is skill-aware (``env_passthrough``); this helper is for spawns that have no skill-passthrough concept. Two-tier stripping: * **Tier 1 (always):** ``_ALWAYS_STRIP_KEYS`` — gateway bot tokens, GitHub auth, and remote-compute secrets are removed regardless of ``inherit_credentials``. No child Hermes spawns legitimately needs them. * **Tier 2 (conditional):** the rest of ``_HERMES_PROVIDER_ENV_BLOCKLIST`` (LLM provider API keys, tool secrets) is removed unless the caller passes ``inherit_credentials=True``. Pass ``inherit_credentials=True`` **only** when the child legitimately needs LLM provider credentials — a user-blessed ``claude`` / ``codex`` / ``gemini`` CLI executor, or the TUI Node host that makes model calls. The flag is grep-able for audit: ``grep -rn 'inherit_credentials=True'`` lists every spawn site that still receives provider credentials. Callers that need a *specific* non-provider secret (e.g. the browser worker needs ``BROWSERBASE_API_KEY`` / ``FIRECRAWL_API_KEY``) should call with ``inherit_credentials=False`` and copy just those keys back from ``os.environ`` into the returned dict. N PYTHONUTF81rr)r!environcopyrrlistrrrr setdefaultrrrrrr)rrrrrs rhermes_subprocess_envrs@ **// C" TCy >>; < GGC  ' , GGC   1 C GGC  NN<%$:c", *#. $ Jrc tstjdxsmtjj drdndxsHtjj drdndxs#tj jdxsdSg}tj jd}|r0tjj |r|j|tj jdd }|r!tjj|d d nd }|r~tjj|d d tjj|dd d fD]8}tjj |s#||vs(|j|:tjjtj jdddd d tjjtj jdddd d |r#tjj|ddd d nd fD];}|stjj |s&||vs+|j|=tjd}|r||vr|j||D]N}t|s||k7r8|r6tjj |rtjd|||cS|rNdjfd|D}tdus t|rtt!|d||dStd)z Find bash for command execution.bashz /usr/bin/bashNz /bin/bashSHELLz/bin/shHERMES_GIT_BASH_PATH LOCALAPPDATAr hermesgitbinzbash.exeusr ProgramFileszC:\Program FilesGitzProgramFiles(x86)zC:\Program Files (x86)Programsz8HERMES_GIT_BASH_PATH=%s fails to start; using %s instead c3PK|]}tj|xrywN)_bash_probe_details_cacher).0r,details r z_find_bash..s/" 377 BBB " s#&TrzGit Bash not found. Hermes Agent requires Git for Windows on Windows. Install it from: https://git-scm.com/download/win Or set HERMES_GIT_BASH_PATH to your bash.exe location.)rshutilwhichr!r"isfilerrappendjoin _bash_startsrGrH_mandatory_aslr_enabled_looks_like_msys_spawn_failure RuntimeError_git_bash_aslr_help) candidatescustom_local_appdata_hermes_portable_gitr,found probe_detailsr s @r _find_bashrjs  LL  #%77>>/#B !ww~~k:  zz~~g&   J ZZ^^2 3F "''..(&!ZZ^^NB7NLZ277<<%H`b GGLL-uj A GGLL-ueZ H  -Iww~~i(Yj-H!!),  -  RZZ^^N4GH%QVXbc  RZZ^^$79RSUZ\acmnN\ ^ZzJbd)  2y 7R   i ( ) LL E j(%    "F"v"''..2HN   " '"  # $ ,0N 1 2:a=-PQ Q !}  A r_bash_starts_cacher bool | None_mandatory_aslr_enabled_cachez0/usr/bin/true; /usr/bin/cat --version >/dev/nulldetailscL|jtfddDS)zAMatch Git-for-Windows child-launch failures associated with ASLR.c3&K|]}|v ywrrD)rmarkerlowereds rr z1_looks_like_msys_spawn_failure..s  's)zdofork:z child_copy: 0xc0000142 0xc0000005)r2any)rr#s @rrrs*mmoG   rcttS tjdxsd}tj|ddddgdddt }|j d k7ry|jxsd jj}|d k(rday|d vrday y#t$r }tjd|Yd}~yd}~wwxYw)zEReturn Windows' system-wide ForceRelocateImages state when available.Nzpowershell.exez -NoProfilez-NonInteractivez-CommandzC(Get-ProcessMitigation -System).Aslr.ForceRelocateImages.ToString()T capture_outputtexttimeout creationflagsrr ON>OFFNOTSETFz0Could not query Windows Mandatory ASLR state: %s) rr r  subprocessrunr returncodestdoutstriprrrGdebug) powershellresultrexcs rrrs%0,,N\\"23G7G !U   ,.      !$"++-335 D=,0 ) % %,1 ) &  N GMM Ns$AB3BB C$B??Crcltjtj|}tj|j dk7rtj|Stj|}tj|j dk(rtj|S|S)zAResolve Git's root from either /bin or /usr/bin bash.rr)r%rJnormpathbasenamer2)rbin_dirrMs r_git_root_from_bashr>s~nnV__T23G w%%'50~~g&& ^^G $F v$$&%/~~f%% Mrclt|}|jdd}|rd|ddnd}d|d|d |d S) z:Build the targeted per-program Mandatory-ASLR remediation.'z''z Git Bash probe output: Nir z Git Bash at z cannot launch required MSYS child processes while Windows Mandatory ASLR (ForceRelocateImages) is enabled, or its output matches that Git-for-Windows failure class.zw Reinstalling Git will not change the Windows mitigation policy. Open PowerShell as Administrator and run: $gitRoot = 'a=' Get-Item "$gitRoot\bin\bash.exe", "$gitRoot\usr\bin\*.exe" -ErrorAction SilentlyContinue | ForEach-Object { Set-ProcessMitigation -Name $_.FullName -Disable ForceRelocateImages } Then restart Hermes. If the override is blocked or later re-applied, ask your Windows administrator to allow this per-program exception.)r>r)rrgit_root escaped_root detail_lines rrrsd"4(H##C.LAH-gdsm_=bK tf66A]C$n%N N rc$tj|}||S tj|dddtgdddt r t nd}|jdk(}|sd|jxsd |jxsd }|jdd t|<tjd ||jdd |t|<|S#t$r8}t|dd t|<tjd ||d}Yd}~Gd}~wwxYw)aTrue if *bash* can launch external MSYS programs. Uses ``--noprofile --norc`` so a broken login post-install (``Directory \drivers\etc``) does not falsely condemn an otherwise usable bash. The external ``true`` and ``cat`` calls are intentional: a builtin-only ``exit 0`` probe misses Git-for-Windows fork/spawn failures under system-wide Mandatory ASLR. Cached per path for the process lifetime. Nz --noprofilez--norc-cTrr)r izbash probe failed for %s: %szbash probe error for %s: %sF)rrr1r2_BASH_EXTERNAL_PROGRAM_PROBErrr3r4stderrr5rrGr6rr)rcachedr8okcombinedr9s rrrs # #D )F   =(D2N O2=,.1    ! # ---2.v}}/B.CDH.6nn.>u.E %d + LL7x~~?OPTQT?U V "t I *-c(5D/!$' 2D#> sB(C D.D  Dzlist[str] | None_git_bash_bin_dirs_cachec^ttStsgatSg} t}tj j |}tj j |}tj j|jdk(rtj j |n|}tj j|ddtj j|ddtj j|dddtj j|ddtj j|dfD]8}tj j|s#||vs(|j|:|a|S#t$r gatcYSwxYw)uGit Bash's coreutils/binary dirs, in ``/etc/profile`` precedence order. A non-login ``bash -c`` (the fallback used when ``bash -l`` is broken — the classic Windows ``Directory \drivers\etc does not exist`` failure) never sources ``/etc/profile``, so it never gets ``…\usr\bin`` on PATH. That directory holds every coreutil the file/terminal tools shell out to (``cat``, ``mktemp``, ``mv``, ``wc``, ``head``, ``stat``, ``chmod``, ``mkdir``, ``find`` …). Without it, ``write_file`` fails with an empty error (the failure text went to a missing binary's stderr) and terminal commands exit 127. We derive these dirs from the resolved ``bash.exe`` so the fallback shell can find coreutils regardless of the login shell. Returns ``[]`` off Windows or when bash can't be located. Dirs are returned in the order Git Bash's own ``/etc/profile`` prepends them (mingw first, then usr/bin, then bin) and only if they exist on disk. rmingw64rmingw32local) rMrrrr!r"rJr<r2rr(r)dirsrr=rMrootr,s r_git_bash_bin_dirsrT?sP$ +'' #% ''D(| ggood#G WW__W %F&(gg&6&6v&>&D&D&F%&O277??6 "U[D  T9e,  T9e,  T5'51  T5%(  T5! #  77== # (= KK "# $ K- (#% ''(s FF,+F, existing_pathct}|s|Stj}|r"|j|Dcgc]}|s| c}ng}|Dcgc] }||vs| }}|s|S|j g||Scc}wcc}w)aPrepend Git Bash's binary dirs to ``existing_path`` if missing. No-op off Windows or when the dirs can't be resolved. First-occurrence wins, so a PATH that already lists a dir keeps its position. This is what lets the non-login ``bash -c`` fallback find coreutils; in the healthy case the session snapshot re-exports the full login PATH inside the shell, so this only matters when that snapshot is absent. )rTr!pathsepsplitr)rUgit_dirssepeentriesdmissings r_prepend_git_bash_dirsr_ts"#H  **Cshkshzshrdashmkshc$tstjjd}|r`tjj |rAtj |tjrt|jtvr|StS)u Find the user's login shell for background process spawning. Unlike ``_find_bash`` (which always returns a bash binary for callers that explicitly need bash), this function prefers the user's configured ``$SHELL`` on POSIX so that ``spawn_local`` uses the shell the user actually logs in with. On macOS Catalina+ the default login shell is zsh, but ``shutil.which("bash")`` still finds the system ``/bin/bash`` (GNU bash 3.2). When bash 3.2 is invoked with ``-l`` (login) and stdin is ``/dev/null``, it sources ``~/.bash_profile`` which on many macOS setups contains ``exec /bin/zsh -l``. That ``exec`` replaces bash with zsh but drops the ``-c`` argument, so the background command never runs — the subprocess exits 0 with no output and no side effects. Preferring ``$SHELL`` (when it is a POSIX-``sh``-family shell) avoids this because zsh/bash/sh/dash/ksh handle ``-lic`` correctly even with redirected stdin. Only POSIX-sh-family shells are honoured: ``spawn_local`` invokes the shell as ``[shell, "-lic", "set +m; "]``, and that ``-lic`` bundle + ``set +m`` job-control syntax is NOT understood by fish, csh/tcsh, nushell, elvish, xonsh, etc. Returning such a ``$SHELL`` would trade the bash-3.2 swallow for a parse error on every background command, so for any non-allowlisted shell we fall back to ``_find_bash`` (the prior behaviour). On Windows, ``$SHELL`` is typically bash (Git Bash), so behaviour is unchanged — we fall through to ``_find_bash``. r) rr!rrr"r r=r>rr_SPAWN_COMPATIBLE_SHELLSr) user_shells r _find_shellrhs`< ZZ^^G, z* *bgg.Z %%)AA  <rza/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binzstr | None | object_HERMES_BIN_DIRctturtSd}tjd}|rtj j |}|tjrtjdnd}tj j|j}tj j|rT|dk(s|jdr>tj j|rtj j |}|tjr-tj j tjnd}|rItrdnd}tj jtj j!||r|}|r!tj j#|sd}|a|S)uReturn the directory holding the ``hermes`` console-script, or None. The terminal tool runs in a freshly-spawned subshell whose PATH is the agent process's PATH plus a static set of system dirs (``_SANE_PATH``). When the gateway is launched by something that does NOT source the user's shell rc — systemd, a service manager, a desktop launcher, cron — the hermes install dir (``~/.local/bin``, the venv ``bin``/``Scripts``, pipx, nix) is absent from that PATH, so plugins shelling out to bare ``hermes`` via the terminal tool hit ``command not found`` (exit 127) even though ``hermes`` works fine in the user's own interactive terminal. We resolve the install dir once (it never changes within a process) and prepend-if-missing it to the subshell PATH so bare ``hermes`` resolves regardless of how the gateway was started. Resolution order (cheap, no heavy imports): 1. ``shutil.which("hermes")`` — normal PATH-installed shim. 2. The directory of ``sys.argv[0]`` when it's an absolute path to a real ``hermes`` executable (covers nix-store / venv wrappers). 3. The directory of ``sys.executable`` — the running interpreter's venv ``bin``/``Scripts`` is where its console-scripts live. Nrrr zhermes.z hermes.exe)ri _SENTINELr r r!r"rJsysargvr<r2r&rr  executablerrr()r,r argv0baseexe_dirshims r_resolve_hermes_bin_dirrss-0i' I LL "E GGOOE* "xx Rww&,,. GGMM% !T__Y%?u%.I58^^"''//#..1 #..mrFrNr r)rrrdictr!rrrrr*rrrr|rr_rurrrrrrr) rrmergedrkvrpath_keynew_pathrrs r _make_run_envrhs:*O"**s" #FG  1 <<9 :>?@AH)(3 !GH  ' *  4 48JGAJ W%H4W[[25NO*(34H=(:g&  (+# GT"#*'2 N[ *)*sD(( D87D8c@ ddlm}|xsi}|jdxsi}|jdxsg}t|tsg}t |jdd}|Dcgc]}|st |c}|fScc}w#t$rgdfcYSwxYw)uReturn (shell_init_files, auto_source_bashrc) from config.yaml. Best-effort — returns sensible defaults on any failure so terminal execution never breaks because the config file is unreadable. r) load_configterminalshell_init_filesauto_source_bashrcT)rrr isinstancerboolrr)rcfg terminal_cfgfiles auto_bashrcfs r _read_terminal_shell_init_configrs 1m!rwwz*0b   !34:%&E<++,@$GH %+1A+[88+ 4xs*A,B .B6 BB B BBct\}}g}|r|j|n|rts|jgdg}|D]s} tjj tjj |}|sCtjj|sc|j|u|S#t$rYwxYw)uhResolve the list of files to source before the login-shell snapshot. Expands ``~`` and ``${VAR}`` references and drops anything that doesn't exist on disk, so a missing ``~/.bashrc`` never breaks the snapshot. The ``auto_source_bashrc`` path runs only when the user hasn't supplied an explicit list — once they have, Hermes trusts them. )z ~/.profilez~/.bash_profilez ~/.bashrc) rextendrr!r" expandvarsr#rr r)explicitrrresolvedrawr"s r_resolve_shell_init_filesrs=>HkJ(# [ HIH" 77%%bgg&8&8&=>D BGGNN4( OOD ! " O    s`` lines (guarded + silent) to a bash script. Each file is wrapped so a failing rc file doesn't abort the whole bootstrap: ``set +e`` keeps going on errors, ``2>/dev/null`` hides noisy prompts, and ``|| true`` neutralises the exit status. zset +er@z'\''z[ -r 'z ' ] && . 'z' 2>/dev/null || truer)rrr)rr prelude_partsr"safepreludes r_prepend_shell_initrsu JMS||C)vdV:dV;PQR S ii &-G Z rc eZdZdZddededeffd ZdefdZe dedefd Z d edefd Z d d dddede dededzde jf dZdZdefdZdeffd ZdZxZS)LocalEnvironmentzRun commands directly on the host machine. Spawn-per-call: every execute() spawns a fresh bash process. Session snapshot preserves env vars across calls. CWD persists via file-based read after each command. Nrr,rc`t|}t| ||||jy)N)rr,r)r0super__init__ init_session)selfrr,r __class__s rrzLocalEnvironment.__init__s-(- S's; rr ctrB ddlm}|dz dz }|jddt|jdd Sd D]i}|jj|xstjj|}|sB|jd sT|jd xsd cStj j#d r6tj$d tj&tj(zry t j }|jd r|jd xsd Sy #t$r$t t j dz }YXwxYw) uReturn a shell-safe writable temp dir for local execution. Termux does not provide /tmp by default, but exposes a POSIX TMPDIR. Prefer POSIX-style env vars when available, keep using /tmp on regular Unix systems, and only fall back to tempfile.gettempdir() when it also resolves to a POSIX path. Check the environment configured for this backend first so callers can override the temp root explicitly (for example via terminal.env or a custom TMPDIR), then fall back to the host process environment. **Windows:** hardcoded ``/tmp`` is wrong in two ways — native Python can't open the path, and the Windows default temp (``%TEMP%``) often contains spaces (``C:\Users\Some Name\AppData\Local\Temp``) that break unquoted bash interpolations. Use a dedicated cache dir under ``HERMES_HOME`` instead — single-word path, guaranteed to exist, same string resolves in both Git Bash and native Python. r)get_hermes_homecacherhermes_terminalT)parentsexist_okrr)TMPDIRTMPTEMPz/tmp)rrrrrrKrLmkdirrrrrr!rrrstripr"r(r=W_OKr>)rr cache_direnv_varr,s r get_temp_dirzLocalEnvironment.get_temp_dirs4&   L<+-7*D  OOD4O 8y>))$4 40 4G W-H1HIY11#6 '',33 4 77== RYYvrww7H%I'')    $##C(/C /% L !4!4!67:KK  LsE)E43E4c>tjt|S)z@Use native paths for Python, but Git Bash-friendly paths for cd.)r_quote_cwd_for_cdr4)rs rrz"LocalEnvironment._quote_cwd_for_cd,s001Fs1KLLrr"ct|S)z?Rewrite native/mixed Windows paths before quoting for Git Bash.)r;)rr"s r_quote_shell_pathz"LocalEnvironment._quote_shell_path1s %%rFx)loginr, stdin_datarrrc  t}|rt}|r t||}|r|dd|gn|d|g}t|j}t |j } | |j k7rTtrt|j n |j } | | k7r!tjd|j | | |_|j } tr dtini} tj|fd|ddtjtj|tjntj d| d | } ts% t#j$| j&| _| t-| || S#t*$rYwxYw) Nz-lrEzaLocalEnvironment cwd %r is missing on disk; falling back to %r so terminal commands keep working.r-Tzutf-8r) r+rencodingerrorsr4rIstdinstart_new_sessionr)rrrrrrOrrrrGrHrr1PopenPIPESTDOUTDEVNULLr!getpgidpid _hermes_pgidProcessLookupErrorr)rrrr,rr init_filesargsrsafe_cwd normalized _popen_cwd _popen_kwargsprocs r _run_bashzLocalEnvironment._run_bash5so| 24J0ZH 16dD*-T4?TV    ??$$%/%;*//ASAS"     $&JJtxx$8!  ! j ) &  s$E66 FFcdtdtfddtdtdtffd } tr/ ddlm}|j d  jd y tjj } tj"|t$j&||dry tj"|t$j(||d  jd y #t$rjYwxYw#tjtf$rYy wxYw#t$rt!d d }|YwxYw#t$rYy wxYw#t$rYy wxYw#tjtf$rYy wxYw#tt*tf$r$ jYy #t$rYYy wxYwwxYw)z-Kill the entire process group (all children).pgidr cd tj|dy#t$rYyt$rYywxYw)NrTF)r!killpgrPermissionError)rs r _group_alivez4LocalEnvironment._kill_process.._group_alive~s5  $"% "  s ///r,c^tj|z}tj|krG j|sytjdtj|krG j| S#t$rY[wxYw#t$rY#wxYw)NTg?)time monotonicpollrsleep)rr,deadlinerrs r_wait_for_group_exitz._wait_for_group_exits~~''1H.."X-IIK$D) 4 .."X-  $D)) )!  s#B8B  BB B,+B,r) terminate_pidT)forceg@)r,rNg?g?)intrfloatrgateway.statusrrrkillwaitr1TimeoutExpiredOSErrorr!rrrIrsignalSIGTERMSIGKILLr)rrrrrrs ` @r _kill_processzLocalEnvironment._kill_process{s s t  *s *U *t *$-  <!$(($7IIcI*::dhh/D IIdFNN3(c2IIdFNN3%T3/IIcI*A! IIK #117; *"4>D|$** #117;"OW=      sF C3D#D1$E' F 2$E F E.3D F DF D.+F -D..F 1E  F E  F  EF EF  E+(F *E++F .F F F  F G"F44 G=GGGr8c&|j|y)aUpdate cwd from the stdout marker emitted by the wrapped command. The base command wrapper already appends ``pwd -P`` to stdout inside a session-specific marker, so the local backend can share the same parser as remote backends instead of re-reading the temp file it just wrote. ``_extract_cwd_from_output`` keeps the local Windows normalization and stale-path rollback semantics intact. N)_extract_cwd_from_output)rr8s r _update_cwdzLocalEnvironment._update_cwds %%f-rc |j}t| ||j|k7rXtrt |jn |j}|r't j j|r||_y||_yy)uSame semantics as the base class, but on Windows the value emitted by ``pwd -P`` inside Git Bash is in MSYS form (``/c/Users/x``). Normalize to native Windows form and validate the directory exists before assigning to ``self.cwd`` — otherwise ``_run_bash``'s safe-cwd recovery would warn on every subsequent command. Always defers to the base class for stripping the marker text from ``result["output"]`` so output formatting is identical. N)rrrrrr!r"r()rr8prev_cwdrrs rrz)LocalEnvironment._extract_cwd_from_outputse88 (0 88x A? B B BB BB)r <N)__name__ __module__ __qualname____doc__rrrrr staticmethodrrrr1rrrrrr __classcell__)rs@rrrsCsd .c.`MsMsMM&c&c&;@!$+/DCD4DD!DjD4>4D4DDLM^ .$ .$t$0rrr)r r)r )Nrloggingr%r!platformrr rr1rlrKrpathlibrtools.environments.baserrhermes_cli._subprocess_compatrsystemr getLoggerrrGrrr0r4r7r;rr?rOrrrrrrrrrrrr__annotations__rrrrrrHrrr>rrrMrrTr_rfrhrwobjectrkrirsrur|rrrtuplerrrrrDrrrsK    @<hoo9,   8 $(s(s(8%C%C%P8s8s8$##,.3.3. L^UCUp')DdO(,.4S>./3}3Q C D  FcccC( s t F04,32DI2j*#*#*0%%QR'S'XC  H )2&26t6r)3)3)"-%S-%S-%`/t//.4C$J$1t11h%S 4*@('49'T C S  c *OOr