`gjW8UdZddlZddlZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZddlmZmZmZmZmZddlmZej.eZe dz Zd Zd Zd Zd Zd ZgdZ e!de"deddZ#e$e%d<dZ&ejNdZ(de)dee)fdZ*de)de)dee)fdZ+de)de fdZ,de)de)fdZ-dHdee de fd Z.de)de fd!Z/d e d"e)de fd#Z0d"e)de)fd$Z1d e d"e)de fd%Z2 dHd e de)d&ee de3fd'Z4d e ddfd(Z5e#ddfd)ee)d e de)d*e$d+eee$d&ee dee6e)e)ffd,Z7de dee fd-Z8d e de)dee)fd.Z9d e de)ddfd/Z:d e de)ddfd0Z;d e deefd1Zd5e de)dee)fd6Z?Gd7d8Z@deed9e)de)fd:ZAd;ZBd e de$d?e6d@ee dAe$dee)e$ff dBZD dJd>e$dCe$d?e6d@ee dAe$dee)eEff dDZFdHd@ee defdEZGdHd@ee dee)e$ffdFZHdHd@ee dee)e$ffdGZIy)KuV Checkpoint Manager — Transparent filesystem snapshots via a single shared shadow git store. Creates automatic snapshots of working directories before file-mutating operations (``write_file``, ``patch``, ``terminal`` with destructive flags), triggered once per conversation turn. Provides rollback to any previous checkpoint. This is NOT a tool — the LLM never sees it. It's transparent infrastructure controlled by the ``checkpoints`` config flag or ``--checkpoints`` CLI flag. Storage layout (single shared store, git objects deduplicated across projects) ----------------------------------------------------------------------------- ~/.hermes/checkpoints/ store/ — single bare-ish git repo HEAD, config, objects/ — standard git internals (shared) refs/hermes/ — per-project branch tip indexes/ — per-project git index projects/.json — {workdir, created_at, last_touch} info/exclude — default excludes (shared) .last_prune — auto-prune idempotency marker legacy-/ — archived pre-v2 per-project shadow repos (auto-migrated on first init) Why a single store? ------------------- The pre-v2 design kept a full shadow repo per working directory. Each one re-stored most of the project's files under its own ``objects/`` tree, with zero sharing across worktrees of the same project. A single user with a dozen worktrees of the same repo burned ~40 MB each (~500 MB total) storing the same blobs over and over. A single shared store lets git's content- addressable object DB deduplicate across projects and across turns, so adding a new worktree costs near-zero. The shadow store uses ``GIT_DIR`` + ``GIT_WORK_TREE`` + ``GIT_INDEX_FILE`` so no git state leaks into the user's project directory. Auto-maintenance ---------------- Shadow state accumulates over time. ``prune_checkpoints`` deletes refs whose recorded working directory no longer exists (orphan) or whose last touch is older than ``retention_days`` (stale), then runs ``git gc --prune=now`` to reclaim object storage. A size-cap pass drops the oldest checkpoints per project until total store size is under ``max_total_size_mb``. N)Path)get_hermes_home)windows_hide_flags)DictListOptionalSetTuple)env_int checkpointsstorez refs/hermesindexesprojectszlegacy-)2z node_modules/zdist/zbuild/ztarget/zout/z.next/z.nuxt/z __pycache__/z*.pycz*.pyoz.cache/z.pytest_cache/z .mypy_cache/z .ruff_cache/z coverage/z .coveragez.venv/zvenv/zenv/z.git/z.hg/z.svn/z .worktrees/z*.soz*.dylibz*.dllz*.oz*.az*.jarz*.classz*.exez*.objz*.mp4z*.movz*.mkvz*.webmz*.zipz*.tarz*.tar.gzz*.tgzz*.7zz*.rarz*.isoz.envz.env.*z .env.localz .env.*.localz .DS_Storez Thumbs.dbz*.log <HERMES_CHECKPOINT_TIMEOUT _GIT_TIMEOUTiPz^[0-9a-fA-F]{4,64}$ commit_hashreturnc|r|jsy|jdrd|Stj|sd|Sy)zValidate a commit hash to prevent git argument injection. Returns an error string if invalid, None if valid. Values starting with '-' would be interpreted as git flags (e.g., '--patch', '-p') instead of revision specifiers. zEmpty commit hash-z/Invalid commit hash (must not start with '-'): z4Invalid commit hash (expected 4-64 hex characters): N)strip startswith_COMMIT_HASH_REmatch)rs K/root/.hermes/venv/lib/python3.12/site-packages/tools/checkpoint_manager.py_validate_commit_hashrsN k//1"c"@PP   -Ek_UU  file_path working_dirc|r|jsytjj|rd|St |}||z j } |j |y#t$rd|cYSwxYw)zValidate a file path to prevent path traversal outside the working directory. Returns an error string if invalid, None if valid. zEmpty file pathz/File path must be relative, got absolute path: z7File path escapes the working directory via traversal: N)rospathisabs_normalize_pathresolve relative_to ValueError)r r! abs_workdirresolveds r_validate_file_pathr,s IOO-  ww}}Y@ NN!+.Ki'002HW[)  WH VVWsA))A:9A: path_valuecPt|jjS)z;Return a canonical absolute path for checkpoint operations.)r expanduserr')r-s rr&r&s   & & ( 0 0 22rctt|}tj|j j ddS)z6Deterministic per-project hash: sha256(abs_path)[:16].N)strr&hashlibsha256encode hexdigest)r!abs_paths r _project_hashr8s7?;/0H >>(//+ , 6 6 8" ==rbasec$|xsttz S)z+Return the single shared shadow store path.)CHECKPOINT_BASE_STORE_DIRNAME)r9s r _store_pathr=s  #O~ 55rctS)uReturn the shared store path. Retained for backward-compatibility with callers / tests that imported this helper. Under v2 the shadow git storage is shared across all projects — per-project isolation lives in refs and indexes, not in separate repo directories. )r=)r!s r_shadow_repo_pathr?s  =rdir_hashc|tz |z SN)_INDEXES_DIRNAMEr r@s r _index_pathrEs # #h ..rctd|S)N/) _REFS_PREFIX)r@s r _ref_namerIs^1XJ ''rc |tz |dz S)Nz.json)_PROJECTS_DIRNAMErDs r_project_meta_pathrLs $ $(5'9 99r index_filectt|}tjj}t ||d<t ||d<|j dd|j dd|t ||d<n|j ddtj |d<tj |d<d |d <|S) uJBuild env dict that redirects git to the shared store. The shared store is internal Hermes infrastructure — it must NOT inherit the user's global or system git config. User-level settings like ``commit.gpgsign = true``, signing hooks, or credential helpers would either break background snapshots or, worse, spawn interactive prompts (pinentry GUI windows) mid-session every time a file is written. Isolation strategy: * ``GIT_CONFIG_GLOBAL=`` — ignore ``~/.gitconfig`` (git 2.32+). * ``GIT_CONFIG_SYSTEM=`` — ignore ``/etc/gitconfig`` (git 2.32+). * ``GIT_CONFIG_NOSYSTEM=1`` — legacy belt-and-suspenders for older git. ``index_file``, if given, forces git to use a per-project index under ``store/indexes/`` so projects don't race on a shared index. GIT_DIR GIT_WORK_TREE GIT_NAMESPACEN GIT_ALTERNATE_OBJECT_DIRECTORIESGIT_INDEX_FILEGIT_CONFIG_GLOBALGIT_CONFIG_SYSTEM1GIT_CONFIG_NOSYSTEM)r&r#environcopyr2popdevnull)r r!rMnormalized_working_direnvs r_git_envr^s*-[9 **// CZC N56CGGOT"GG .5 #J   $'!zzC!zzC!$C JrcdD]B}||z }|jr |jddtjd|Dy#t$r!}tj d||Yd}~kd}~wwxYw)aRecreate refs/ and branches/ dirs that ``git gc`` may have removed. ``git gc --prune=now`` on a bare repo with only packed refs can remove the empty ``refs/heads/`` directory. Git 2.34+ requires ``refs/`` (and some versions require ``branches/``) to exist even when all refs are packed in ``packed-refs``. Without them, ``git add -A`` returns ``fatal: not a git repository`` and all checkpoint operations fail silently. )z refs/headsbranchesTparentsexist_okz'Repaired missing %s in checkpoint storez(Cannot create %s in checkpoint store: %sN)existsmkdirloggerdebugOSErrorwarning)r subdirr$excs r_repair_bare_repo_dirsrlss- v~{{}  4$ 7 FO   > s)A  A3A..A3argstimeoutallowed_returncodesc ht|}|js=d|}tjddj dgt |z|dd|fS|j s=d|}tjddj dgt |z|dd|fSt|t||}dgt |z} |xs t} tj| d d ||t|tjt } | jd k(} | jj!} | j"j!} | s?| j|vr1tjd dj | | j| | | | fS#tj$$r6d |ddj | }tj|d dd|fcYSt&$rz}t)|dd}|dk(r,tjddj | d Yd}~yd|}tjddj | |d dd|fcYd}~Sd}~wt*$r@}tjddj | |d ddt|fcYd}~Sd}~wwxYw)a5Run a git command against the shared store. Returns (ok, stdout, stderr). ``allowed_returncodes`` suppresses error logging for known/expected non-zero exits while preserving the normal ``ok = (returncode == 0)`` contract. Example: ``git diff --cached --quiet`` returns 1 when changes exist. zworking directory not found: zGit command skipped: %s (%s) gitFz&working directory is not a directory: rMT)capture_outputtextrnr]cwdstdin creationflagsrz(Git command failed: %s (rc=%d) stderr=%szgit timed out after zs: )exc_infofilenameNzGit executable not found: %s)Frsz git not foundz,Git command failed before execution: %s (%s)z#Unexpected git error running %s: %s)r&rdrferrorjoinlistis_dirr^r2set subprocessrunDEVNULLr returncodestdoutrstderrTimeoutExpiredFileNotFoundErrorgetattr Exception)rmr r!rnrorMr\msgr]cmdresultokrrrkmissing_targets r_run_gitr*s-[9 ! ( ( *-.D-EF 3SXXugT >R5SUXYb#~ ! ( ( *67M6NO 3SXXugT >R5SUXYb#~ 5#45* MC 'DJ C-6%# *+$$-.    ! #$$&$$&f''/BB LL: v00& 66!!  $ $$WIS#@ S4 (b#~  j$7 U " LL7#QUL V--.D-EF CSXXc]TWbf gb#~ # :CHHSM3Y] ^b#c(""#s>CF AJ1(J109I%.1I%J1% J115J,&J1,J1c|jsyt|}d}tth}t |j D]}|j }||vs|jtr)|6tjd}|t|z } |jdd||z } tj t#|t#||} |tj%d||S#t$r!}tjd|Yd}~yd}~wwxYw#t$r!}tjd||Yd}~d}~wwxYw)a<Move pre-v2 per-project shadow repos into a ``legacy-/`` dir. The pre-v2 layout had one shadow git repo per working directory directly under ``CHECKPOINT_BASE``. The v2 layout wants a single ``store/`` dir. Rather than delete the old data (users might want to recover), rename everything except our own v2 entries into ``legacy-/``. The legacy dir is subject to the same retention sweep and can be manually cleared with ``hermes checkpoints clear-legacy``. Returns the legacy-archive path, or None if nothing to migrate. Nz %Y%m%d-%H%M%STraz'Could not create legacy archive dir: %sz*Could not archive legacy checkpoint %s: %sz_Migrated pre-v2 checkpoint repos to %s. Clear with `hermes checkpoints clear-legacy` when safe.)rdr=r<_PRUNE_MARKER_NAMEr~iterdirnamer_LEGACY_PREFIXtimestrftimererhrfrishutilmover2info) r9r legacy_rootreservedchildrstamprkdest_s r_migrate_legacy_storerrsE ;;=  E"&K 23Hdlln%Uzz 8 t~>   MM/2EN#3E7!;;K !!$!>T! U KKE CI .!U( A  F  ! H#N   U NNGPS T T Us0C1+(D1 D:DD E'EEc |j}|js |jddt ||dz jry|jdd|t z jd|t z jdtjj}tj|d<tj|d<d |d <d D]}|j|d tjd d dt|gdd|ttj t#}|j$dk7rd|j&j)S t|}t/gd||t/gd||t/gd||t/gd||t/gd|||dz }|jd|dz j1dj3t4dzdt6j9d|y#t$r}d|cYd}~Sd}~wwxYw#tj*t,f$r}d|cYd}~Sd}~wwxYw)zInitialise the shared shadow store if needed. Returns error or None. Also performs one-time migration of pre-v2 per-directory shadow repos into ``legacy-/``. Traz"Could not create checkpoint base: NHEAD)rcrTrUrVrW)rOrPrSrQrRrrinitz--bare)rurvr]rnrxryrzShadow store init failed: )configz user.emailz hermes@local)rz user.namezHermes Checkpoint)rzcommit.gpgsignfalse)rz tag.gpgSignr)rzgc.auto0rexclude utf-8encodingz"Initialised checkpoint store at %s)parentrdrerhrrCrKr#rXrYr[rZrrr2rrrrrrrrr write_textr}DEFAULT_EXCLUDESrfrg) r r!r9rkinit_envkrcfg_wdinfo_dirs r _init_storers: < > JJtdJ 3 d#   KKtK, $$d$3 %%t%4 zz H$&JJH !$&JJH !&)H "#2 Q 2 FHc%j 1d,$$,.      !/ 0C0C0E/FG G "YF 5ufE 95&I 2E6B /? '7v~H NNDN! %% "#d*W& LL5u= m >7u= = >D  % %'8 92+C5112s<H8A.H3 H0!H+%H0+H03I IIIcLt|}t||}tj}tt |||d}|j rK t j|jd}t|tr|jd||d< |jjdd|j!t j"|dy#ttf$rYVwxYw#t$r!}t$j'd||Yd}~yd}~wwxYw) zDCreate or update ``projects/.json`` with workdir + timestamps.)workdir created_at last_touchrrrTraz'Could not write project metadata %s: %sN)r8rLrr2r&rdjsonloads read_text isinstancedictgetrhr)rrerdumpsrfrg)r r!r@ meta_pathnowmetaexistingrks r_register_projectrs[)H"5(3I ))+C !=> #38D zz)"5"5w"5"GHH(D)%-\\,%D\"Ptd;TZZ-@ $    P > 3OOPs,A C$ AC9$C65C69 D#DD#c8t|}t||}|js t||y t j |j d}t|tsi}tt||d<tj|d<|jd|d |jt j |dy#ttf$ri}YwxYw#t$r!}t"j%d||Yd}~yd}~wwxYw)z7Update last_touch for a project, preserving created_at.Nrrrrrz(Could not update project metadata %s: %s)r8rLrdrrrrrhr)rrr2r&r setdefaultrrrfrg)r r!r@rrrks r_touch_projectrs[)H"5(3I    %-zz)--w-?@ dD !/+67DODOOL$|"45QTZZ-@ Z  Q ?CPPQs)%C1&C/C,+C,/ D8DDcH|tz }|jsgSg}|jdD][}|j} t j |j d}t|tsF||d<|j|]|S#ttf$rYqwxYw)z/Return all registered projects under the store.z*.jsonrr_hash) rKrdglobstemrrrrhr)rrappend)r projects_diroutrr@rs r_list_projectsrs,,L     C!&&x0  >> ::i1171CDD$%  W  4  J $   s%BB! B!r$cd} t|jdD]}|dz }|tkDs|cS |S#ttf$rY|SwxYw)z;Quick file count estimate (stops early if over _MAX_FILES).r*)rrglob _MAX_FILESPermissionErrorrh)r$countrs r_dir_file_countr$se E d!!#& A QJEz!   L W %  L s+888A  A cd} |jdD]0} |jr||jjz }2 |S#t$rYAwxYw#t$rY|SwxYw)z9Best-effort recursive size in bytes. Returns 0 on error.rr)ris_filestatst_sizerh)r$totalps r_dir_size_bytesr1sy E C A 99;QVVX---E  L      L s4A-A A AAAA A'&A' shadow_repoct||}|r|St|| |dz jtt |dzdy#t $rYywxYw)aBackwards-compatible initialiser. In v1 ``shadow_repo`` was a per-project dir; in v2 it's the shared ``store/`` path (or a test path that we respect). We initialise the store at ``shadow_repo``, create per-project markers, and return None on success. HERMES_WORKDIRrrrN)rrrr2r&rh)rr!errs r_init_shadow_reporEsp k; /C  k;/ ' '33  , - 4w 4     s+A AAc eZdZdZ ddedededefdZdd Zdd ed edefd Z d ede e fd Z e dede ddfdZd edede fdZd d ededede fdZdedefdZd ed edefdZded ededdfdZded ededdfdZdeddfdZy)!CheckpointManageraBManages automatic filesystem checkpoints. Designed to be owned by AIAgent. Call ``new_turn()`` at the start of each conversation turn and ``ensure_checkpoint(dir, reason)`` before any file-mutating tool call. The manager deduplicates so at most one snapshot is taken per directory per turn. Parameters ---------- enabled : bool Master switch (from config / CLI flag). max_snapshots : int Keep at most this many checkpoints per directory. max_total_size_mb : int Hard ceiling on total store size. Oldest checkpoints per project are dropped when the store exceeds this after a commit. max_file_size_mb : int Skip adding any single file larger than this to a checkpoint. (Implemented via ``.gitignore`` excludes + a post-stage size check.) enabled max_snapshotsmax_total_size_mbmax_file_size_mbc||_tdt||_tdt||_tdt||_t |_d|_y)Nrr) rmaxintrrrr_checkpointed_dirs_git_available)selfrrrrs r__init__zCheckpointManager.__init__vs[  C $67!$Q,=(>!? #As+;'< =,/E.2rrNc8|jjy)zAReset per-turn dedup. Call at the start of each agent iteration.N)rclear)rs rnew_turnzCheckpointManager.new_turns %%'rr!reasonc2|jsy|j=tjddu|_|jstj d|jsyt t|}|dt tjhvrtj d|y||jvry|jj| |j||S#t$r }tj d|Yd}~yd}~wwxYw)uTake a checkpoint if enabled and not already done this turn. Returns True if a checkpoint was taken, False otherwise. Never raises — all errors are silently logged. FNrrz#Checkpoints disabled: git not foundrGz,Checkpoint skipped: directory too broad (%s)z!Checkpoint failed (non-fatal): %s)rrrwhichrfrgr2r&rhomeradd_taker)rr!rabs_dires rensure_checkpointz#CheckpointManager.ensure_checkpoints ||    &"(,,u"5T"AD && BC""ok23 sC ,- - LLG Q d-- - ##G, ::gv. .  LLH#(8<<O,&&($/XY Y { +UG As$k]+/V [D* * 7B;rPQ?BSSTUV ) 1 &/S" dN ; 7L1$4! FC $1A#/G [D* *& M4 5ug Z # &r?   &F6N rct|}|jr|}n |j}hd}|jk7r;tfd|Dr t Sjjk7r;t |S)z?Resolve a file path to its working directory for checkpointing.> .hg.gitgo.modpom.xml Cargo.toml package.jsonpyproject.tomlGemfileMakefilec3DK|]}|z jywrB)rd).0rchecks r z=CheckpointManager.get_working_dir_for_path.._s9AEAI%%'9s )r&rranyr2)rr r$ candidatemarkersrMs @rget_working_dir_for_pathz*CheckpointManager.get_working_dir_for_pathSsxy) ;;=I IGu||#9995z!LLEu||# 9~rctt}t||}|rtj d|yt ||t |tkDrtj dt|yt|}t||}t|}|jrDtdd|dzg||dh\}} } |r| rtd | g|||dh n/ |jn|jj!d d td dg||t"dz|\} } }| stj d|y|j$dkDr|j'|||tdd|dzg||dh\}} } |xr t)| } | r2tddd| g||dh|\} } } | rUtj d|ytddg|||\}}} |r'|j+stj d|ytdg|||\}}}|r|stj d|yd|d|d g}| r d|d!| d|d g}t||||\}}}|r|stj d"|yd#||g}| rd#||| g}t|||\}} }|stj d$|ytj d%|||d&d'|j-||||j/|y #t$rYwxYw)(z*Take a snapshot. Returns True on success.z Checkpoint store init failed: %sFz#Checkpoint skipped: >%d files in %s rev-parsez--verifyz ^{commit}rrr*r+Trarr'rr(zCheckpoint git-add failed: %srz diff-indexr)--quietr)rorMz$Checkpoint skipped: no changes in %sls-filesrtz$Checkpoint skipped: empty tree in %sz write-treez Checkpoint write-tree failed: %s commit-tree-m --no-gpg-sign-pz!Checkpoint commit-tree failed: %s update-refz Checkpoint update-ref failed: %szCheckpoint taken in %s: %s (%s)Nr1)r=r;rrfrgrrrr8rErIrdrunlinkrhrrerr_drop_oversize_from_indexboolr_prune_enforce_size_cap)rr!rr rr@rMrok_ref ref_commitrrhas_refr.ok_lsls_outok_treetree_sha commit_args ok_commitnew_sha update_args ok_updates rrzCheckpointManager._takeis[O,%-  LL;S Auk* ; '* 4 LL> K X - 1 !    $,j# *;<{%(E% !FJ * *-;)), %%'    # #D4 # @  DM5+ 1$ As LL8# >  1 $  * *5+z J !) *cK&7 8 ;!$!  A -T*- $z9jA{%&C% MGQ  C[Q (Z({%  E61 V\\^ C[Q"* NE;!" 3h LL;S A%hfoN ((D*dFTcdK"*  !#  7C LL%d MB) from index)rmr)rUr5rr+) rrrr&rrrhrrfrgrrange)rr r!rMcaprrrrpathsr*oversizerelsizeBATCHichunks rr]z+CheckpointManager._drop_oversize_from_indexsF##d*T1 !8  * ;: FA #LL06qA66%k2   %C #c)//199cz$  %  J M400 q#h-/ AQq5y)E 3e;{z%(E  '7   sDD'D  DDrcdtdd|g||dh\}}}|sy t|}||jkrytdd|g||\}} }|r| sy| j } | |j d} d} | D]f} td| dg||\}}}|r|sytd d d | g||\}}}|r|r|nd }d |d|dg}| d |d| d|dg}t|||\}}}|r|sy|} h| ytd|| g||tgd||tgd||t dzt |y#t$rYywxYw)uKeep only the last ``max_snapshots`` commits on the per-project ref. v1's ``_prune`` was documented as a no-op (``git``'s pack mechanism was supposed to handle it, but only the log view was limited — loose objects accumulated forever). v2 actually rewrites the ref to drop commits older than ``max_snapshots`` and then runs ``git gc`` on the store so unreachable objects are reclaimed. rev-list--countrrN --reverserT^{tree}rr6r7 checkpointrWrXrYrZr[reflogexpirez --expire=nowz--allgcz --prune=nowrUrrn)rrr)rr rrl)rr r!rrrrrok_listlist_outcommitskeep new_parentsharfrgok_msgr commit_msgrmrirjs rr_zCheckpointManager._prunes! C (%!$ FA  KE D&& &  ( c *E; 1h %%'***+,%)  !C#+Y/0%$ GXq(% tS15+NFC!'3LJ!8T:OD%%xzj/;$,T5+$F !IwG J# !&   ,Z0%E  9 ;   , ; q(8  u%a   s D## D/.D/c j|jdkry|jdzdz}t|}||krytjd|j|dzt ddt g|t |jdh \}}}|r|sy|jDcgc]}|js|}}d } td D]{}t|}||krnh|D][} t d d | g|t |jdh \} } } | r t| nd} | dkrDt d d| g|t |j\}}}|r|sp|j}|dd}d}d }|D]}t d|dg|t |j\}}}|r|sd}nrt ddd|g|t |j\}}}|r|r|nd}d|d|dg}| d|d|d|dg}t ||t |j\}}}|r|sd}n|}|s|7t d| |g|t |jd} ^| r|nt gd|t |jt gd|t |jtdzt|ycc}w#t$rd} YwxYw) zIf total store size exceeds ``max_total_size_mb``, drop oldest checkpoints across ALL projects until under the cap. rNrnuACheckpoint store exceeded %d MB (actual %d MB) — pruning oldest for-each-ref--format=%(refname)rrFr|r}rr~rTrTrr6r7rrWrXrYrZr[rrrr)rrrfrrrHr2rr rrrrr)rrl)rr cap_bytesrwrrrrrefs any_droppedrok_count count_outrrrrrrfailrrfrgrrrrmrirjs rr`z#CheckpointManager._enforce_size_cap`s  ! !Q & **T1D8 u% 9   O  " "D[$9 ! 2L A 3u||$!$ FA  !,,.  u%="EsJ3JJ## J21J2)Frir)rN)autorB)__name__ __module__ __qualname____doc__r^rrrr2rrrr staticmethodrr r@rRrrr]r_r`rrrr`st.!$ " 3 3 3 3  3$( S # 4 D'C'DJ'R 1C 1 1 1 10 0 #0 $0 d737S7S7TX7r##,DDcDdDL,,(+,9=, ,\A&DA&sA&A&A&FV&tV&V&rrr:c ~|sd|Sd|dg}t|dD]\}}|d}d|vrY|jddjddjd dd d }|djdd}|d |}|jd d}|jdd}|jdd} |rd|d|dk7rdndd|d| d } nd} |jd|d|dd|d|d| |jd|jd|jddj |S)z+Format checkpoint list for display to user.zNo checkpoints found for u📸 Checkpoints for z: rrT+rrNrqr r r z (z filesrsz, +z/-r2z z. rrz4 /rollback restore to checkpoint Nz> /rollback diff preview changes since checkpoint NzC /rollback restore a single file from checkpoint Nr) enumeraterrrr}) r r:linesrycptsdatefilesinsdelers rformat_checkpoint_listrs| *9+66$YKs 3 4E;*O2  _ "9#q!'',Q/55c:1=bqABk?((-a0D62$B*ff\1%vvk1% uEQJSB$?s3%r$qQDD r!Br,/02$bHtfMNO" LLHI LLQR LLVW 99U rz .last_prunercZtdd|g|t|jdh\}}}|S)z6Delete a ref from the store. Returns True on success.r[z-drr)rr2r)r rrrs r _delete_refrs5 tS!5#ell*; EHB1 Irretention_daysdelete_orphanscheckpoint_baserc  |xst}dddddd}|js|St|}d}|dkDrtj|dzz }|j D]}|j s|j tk(r)|j jtrc|dkrN |jj} | |k\ro t|} tj||dxx| z cc<|dxxdz cc<|d z js|d xxdz cc<d } |rUd } |d z }|jr! |j#dj%} | t)| jsd} | R|dkDrMd} |j+dD])} |jj}t-||}+ |dkDr||krd} | } t|} tj||dxx| z cc<| dk(r|dxxdz cc<n |dxxdz cc<t/|}|d z jrut1|D]$}|j3dxsd}|j3dxsd} |s1|d xxdz cc<d } |r| rt)| jsd} n0|dkDr+t5|j3ddxsd}|dkDr||krd} | t7|}t9|| t;||}|jr|j= t?||}|jr|j=| dk(r|dxxdz cc<|dxxdz cc<'tAgd|tC|tAgd|tC|tDdztG||dkDr|dzdz}tIdD]}t|} | |krntAdd tJg|tC|d!h"\}}}|r/|jMDcgc]}|j%s|c}ng}|sn.d#} |D]}tAd$d%|g|tC|d!h"\}!}"} |!r tO|"nd}#|#dkr:tAd$d&|g|tC|\}$}%}|$r|%s\|%jM}&|&dd }'d }(d#})|'D]}*tAd'|*d(g|tC|\}+},}|+r|,sd)})n^tAd*d+d,|*g|tC|\}-} }|-r| r| nd-}.d.|,d/|.d0g}/|( d.|,d1|(d/|.d0g}/tA|/|tC|\}0}1}|0r|1sd)})n|1}(|)s|(tAd2||(g|tC|d)} "| rntAgd|tC|tAgd|tC|tDdztG|t|}2||2z }3t-|d|3|d<|S#t$rYwxYw#t$r/} |dxxdz cc<tj!d || Yd } ~ d } ~ wwxYw#tt&f$rd } YwxYw#t$rYwxYw#t$rYwxYw#t$r9} |dxxdz cc<tj!d|j | Yd } ~ Fd } ~ wwxYw#t$rYwxYw#t$rYnwxYwcc}w#tP$rd}#YYwxYw)3uDelete stale/orphan checkpoints and reclaim store space. A project entry is deleted when either: * ``delete_orphans=True`` and its ``workdir`` no longer exists on disk (the original project was deleted / moved); OR * its ``last_touch`` is older than ``retention_days`` days. Additionally, if ``max_total_size_mb > 0`` and the store exceeds that after orphan/stale pruning, the oldest commit per remaining project is dropped until the store is under the cap. Legacy-archive dirs (``legacy-*``) older than ``retention_days`` are also deleted. Returns a dict with counts ``{"scanned", "deleted_orphan", "deleted_stale", "errors", "bytes_freed"}``. Never raises — maintenance must never block interactive startup. rscanneddeleted_orphan deleted_staleerrors bytes_freedgiQrrrrz&Failed to delete legacy archive %s: %sNrrrrrorphanrstalerz&Failed to prune checkpoint repo %s: %srrsrrrrrrrnrrrrrFr|r}r~rTrTrr6r7rrWrXrYrZr[))r;rdrrrrrr<rrrst_mtimerhrrmtreerfrirrUnicodeDecodeErrorrrrr=rrfloatrIrrEr\rLrr2rrlrrrHr rr))4rrrrr9r size_beforecutoffrrrwrkrr wd_markernewestrmtr rr@rridxmpr_irrrrrany_dropok_crrok_llorrrrrok_ttshaok_mrrmok_cmrj size_afterdeltas4 rprune_checkpointsrs4  -oD F ;;= !$'K F~55@V||~  :: '  ::  0" JJL))F{ U&u- e$}%-%'1,' &&( yQ $ %)G 00I!#'1171CIIKGd7m&:&:&<! >nq0F S)!A!VVX..!$VR!zfvo  >  V"5)D MM% = !T ) !!'(A-('1,'{@VF  E  "5)! -Dxx(.BHhhy)/RG 9  " Fwd7m6J6J6L!!#"488L!#<#AB >j6&9$F~H%C s # !%2::<JJL 'x899;IIK!'(A-('1,'C! -H  9 3t9   , 3t9lQ&6  u% q )D047IBi: &u-9$ (#%:LI3t9),! FA IK6#4#4#6Da!'')DPR +$C)1#Y4eSY-0E*&D)Q"26IAz "*#[#6s4y#KD"a r  mmoG"12;D04J D#-(0(SE*;ejj33NC &u- # $ , $ ZZ\** ! " ) ) "+ ".d3C J=" G      s6G; H -H; H  H  HH H,+H,c|xst}ddd}|js|St|} tj|||d<d|d<|S#t $r"}t jd||Yd}~|Sd}~wwxYw) z{Nuke the entire checkpoint base (store + legacy). Irreversible. Returns ``{"bytes_freed": N, "deleted": bool}``. rFrdeletedrTrz&Could not clear checkpoint base %s: %sN)r;rdrrrrhrfri)rr9rrwrks r clear_allres  -oD .C ;;= 4 DL d!MI J L?sKK JLsA A:A55A:c|xst}ddd}|js|St|jD]m}|j r|j j ts3 t|}tj||dxx|z cc<|dxxdz cc<o|S#t$r!}tjd||Yd}~d}~wwxYw)zhDelete all ``legacy-*`` archive directories. Returns ``{"bytes_freed": N, "deleted": count}``. rrrrrz&Could not delete legacy archive %s: %sN)r;rdr~rrrrrrrrrhrfri)rr9rrrwrks r clear_legacyrxs  -oD *C ;;= dlln% Q||~UZZ%:%:>%J  Q"5)D MM%  $ &   Na N Q J Q NNCUC P P Qs/:B-- C6CCrB)TNr)rTNr)Jrr3rloggingr#rrrrpathlibrhermes_constantsrhermes_cli._subprocess_compatrtypingrrrr r utilsr getLoggerrrfr;r<rHrCrKrrrminrr__annotations__rcompilerr2rr,r&r8r=r?rErIrLrr^rlr^rrrrrrrrrrrrrrobjectrrrrrrrrss0d   ,<33   8 $ "#m3 =@CG,G$LMN cN "**34 s x}  3SXc],333 >s>s> 6htn66 34/t/s/t/(((:d:c:d:"&" """ "J$44 .2!% A# s)A# A#A# A# "#c(+ A#  A# 4c>A#P--$-`AtA#A(3-AHPTPPP*Q$QSQTQ,$4:& # #  $ 3 (4chsm6V &V &rT ssJ#t#$&* nnnd^n n  #s(^ nd &* @@@@d^ @  @  #v+ @N@(4.@D@Fx~c3h&(4.DcNr