.cjS .dZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddl mZddlZejeZehdZdBde d ed efd ZdCd ed ed efdZde d dfdZde d dfdZde ddd dfdZde ddd dfdZde ee fde ee fd efdZdddde ee fde dededzde d df d Zd dd!de ee fd"ed#ej dzd efd$Z!Gd%d&ej"Z#dddd'de ee fde d(ed)ed*edzd df d+Z$de ee fd,ede d dfd-Z%dDd.ed e d e fd/Z&da'd0Z(d1e d e fd2Z)dEd3ed ed efd4Z*dFd3ed e+d e+fd6Z,dBd3ed ed efd7Z-d8Z.d9edzd edzfd:Z/dGd;Z0ded efd?Z2d1onyestrueFvaluedefaultreturnc||St|tr|St|tr-|t vSt|S)zDCoerce bool-ish values using the project's shared truthy string set.) isinstanceboolstrstriplowerTRUTHY_STRINGS)r r s '/home/ice/.hermes/hermes-agent/utils.pyis_truthy_valuers` }% %7{{}}""$$66 ;;namecJttj||dS)zBReturn True when an environment variable is set to a truthy value.Fr rosgetenv)rr s renv_var_enabledr!s! 29T733U C C CCrpathz int | Nonec |r+tj|jndS#t$rYdSwxYw)zBCapture the permission bits of *path* if it exists, else ``None``.N)existsstatS_IMODEst_modeOSError)r s r_preserve_file_moder'&sV48KKMMKt|DIIKK/000tK ttsAA AAztuple[int, int] | NonectjdkrdS |}n#t$rYdSwxYw|j|jfS)zACapture the owning uid/gid of *path* if the platform supports it.posixN)rrr#r&st_uidst_gid)r sts r_preserve_file_ownerr-.sY w't YY[[ tt 9bi s ) 77ownerc|ttdsdS tj||d|ddS#t$rYdSwxYw)aRe-apply uid/gid after an atomic replace when permitted. Docker and NAS-backed installs often run some commands as root while the persistent volume is owned by the runtime user. ``os.replace`` swaps in the temp file's owner, so a root-run config write can leave ``config.yaml`` owned by root. Best-effort chown preserves the existing owner for privileged callers and is harmless for unprivileged callers that cannot chown. Nchownr)hasattrrr0r&)r r.s r_restore_file_ownerr39se }GB00}  uQxq*****      s"? A  A modec\|dS tj||dS#t$rYdSwxYw)aRe-apply *mode* to *path* after an atomic replace. ``tempfile.mkstemp`` creates files with 0o600 (owner-only). After ``os.replace`` swaps the temp file into place the target inherits those restrictive permissions, breaking Docker / NAS volume mounts that rely on broader permissions set by the user. Calling this right after ``os.replace`` restores the original permissions. N)rchmodr&)r r4s r_restore_file_moder7JsM |  t      s  ++tmp_pathtargetc Lt|}tj|rtj|n|}t|} tj||n-#t $r}|jtjtj fvrt d||tj |j|jtj|| tj||n#t $rYnwxYw t#|d5}tj|dddn #1swxYwYn#t $rYnwxYwtj|Yd}~nd}~wwxYw|S)uAtomically move *tmp_path* onto *target*, preserving symlinks. ``os.replace(tmp, target)`` atomically swaps ``tmp`` into place at ``target``. When ``target`` is a symlink, the symlink itself is replaced with a regular file — silently detaching managed deployments that symlink ``config.yaml`` / ``SOUL.md`` / ``auth.json`` etc. from ``~/.hermes/`` to a git-tracked profile package or dotfiles repo (GitHub #16743). This helper resolves the symlink first so ``os.replace`` writes to the real file in-place while the symlink survives. For non-symlink and non-existent paths the behavior is identical to a plain ``os.replace`` call unless the rename fails with ``EXDEV`` or ``EBUSY``; those cases fall back to copy/fsync/unlink for cross-device, bind-mount, and busy-file deployments. Returns the resolved real path used for the replace, so callers that need to re-apply permissions can target it instead of the symlink. z=atomic_replace: %s -> %s failed with %s; falling back to copyrbN)rrr islinkrealpathreplacer&errnoEXDEVEBUSYloggerdebug errorcodegetshutilcopyfilecopystatopenfsyncfilenounlink)r8r9 target_str real_pathtmp_strexcfs ratomic_replacerR[s(VJ02z0J0JZ  ,,,PZI(mmG 7I&&&&  9U[%+6 6 6  K   O   39 5 5    +++  OGY / / / /    D  i&& %!$$$ % % % % % % % % % % % % % % %    D  ''( s A77 F!A:F=DF D FD  F$E34'E' E3'E+ +E3.E+ /E32F3 F=F?FFF!)indentr4datarT dump_kwargsc t|}|jdd|dnt|}t |}t jt|jd|jdd\}} |*ttdrtj ||tj |d d 5} tj|| f|d d || tj| dddn #1swxYwYt%||} t| } t'| ||) tj| |dS#t*$rYdSwxYwt-| |dS#t.$r( tj|n#t*$rYnwxYwwxYw)aWrite JSON data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: JSON-serializable data to write. indent: JSON indentation (default 2). mode: Optional final permission mode. When set, the temp file is created and replaced with this mode, avoiding chmod-after-write TOCTOU exposure for secret-bearing files. **dump_kwargs: Additional keyword args forwarded to json.dump(), such as default=str for non-native types. Tparentsexist_okN._.tmpdirprefixsuffixfchmodwutf-8encodingF)rT ensure_ascii)rparentmkdirr'r-tempfilemkstemprstemr2rrbfdopenjsondumpflushrJrKrRr3r6r&r7 BaseExceptionrL) r rUrTr4rV original_modeoriginal_ownerfdr8rQrN real_path_objs ratomic_json_writervs\0 ::DKdT222 ,DD2Ed2K2KM)$//N#   49LB "  H 5 5  Ib$    Yr3 1 1 1 !Q I "         GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! !#8T22 Y M>:::   -----     }m < < < < <   Ih        D  stAFAD$ F$D((F+D(,4F!E88 FFFF G &F;:G ; GG GG )labellogrwrxc\t|}|pt} |j}n#t$rYdSwxYwt jdkrdS|tjtjzzsdS| d|r|dnd|jtj ||dS)ajWarn (once per call) when a credential file is group/world-readable. Secret-bearing files that users create by hand (or that older Hermes versions wrote without an explicit mode) commonly end up 0o644 under the default umask. This helper is the shared read-time check for that class: call it before loading any token/credential file so the owner gets a remediation hint in the logs. Returns True when a warning was emitted. No-ops (returns False) on platforms without POSIX permission bits semantics (best effort), when the file is missing, or when permissions are already tight. Fr)zO%s%s is group/world-readable (mode 0%o) and contains secrets. Run: chmod 600 %s rT) rrBr#r%r&rrS_IRGRPS_IROTHwarningr$)r rwrxp_log file_modes r(warn_if_credential_file_broadly_readablers$ T A =&DFFHH$ uu w'u  4 5uLL $5 "  Y  4s4 AAc$eZdZdZdfd ZxZS) IndentDumperuDPyYAML dumper that indents list items under mapping keys (2-space). Default PyYAML emits "indentless" sequences — list items start at the same column as their parent mapping key. ``ruamel.yaml`` (used by :func:`atomic_roundtrip_yaml_update`) emits 2-space-indented sequences. Mixing both styles in the same ``config.yaml`` produces a file that stricter parsers like ``js-yaml`` reject with ``bad indentation of a mapping entry``. Forcing ``indentless=False`` aligns the two serializers so all write paths emit byte-identical layouts (#31999). FcHt|dS)NF)superincrease_indent)selfflow indentless __class__s rrzIndentDumper.increase_indentsww&&tU333r)FF)__name__ __module__ __qualname____doc__r __classcell__)rs@rrrsG  4444444444rr)default_flow_style sort_keys extra_contentrrrc *t|}|jddt|}t |}t jt|jd|jdd\}} tj |dd 5} tj || t||d |r| || tj| d d d n #1swxYwYt%||} t| } t'| |t)| |d S#t*$r( tj|n#t.$rYnwxYwwxYw) anWrite YAML data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: YAML-serializable data to write. default_flow_style: YAML flow style (default False). sort_keys: Whether to sort dict keys (default False). extra_content: Optional string to append after the YAML dump (e.g. commented-out sections for user reference). TrXr[r\r]r^rcrdre)Dumperrr allow_unicodeN)rrhrir'r-rjrkrrlrrmyamlrorwriterprJrKrRr3r7rqrLr&) r rUrrrrrrsrtr8rQrNrus ratomic_yaml_writer s, ::DKdT222'--M)$//N#   49LB ! Yr3 1 1 1 !Q I##5#"      ' &&& GGIII HQXXZZ ' ! ! ! ! ! ! ! ! ! ! ! ! ! ! !*#8T22 Y M>:::=-88888   Ih        D  sVE A1D E DE DAE F+F?F F  F F  Fkey_pathcNddlm}ddlm}t |}|jdd|d}d|_d|_d|_ | d d d | rO| d d 5}| |p |}dddn #1swxYwYn |}t||s ||}|}|d} | ddD]8} || } t| |s|} | || <| }9||| d<t#|} t%|} t'jt+|jd|jdd\}} t/j|dd 5}||||t/j|dddn #1swxYwYt;||}t |}t=|| t?|| dS#t@$r( t/j!|n#tD$rYnwxYwwxYw)a_Update one dotted YAML key while preserving comments and readable text. This is intentionally narrower than :func:`atomic_yaml_write`: it is for user-edited config files where comments, ordering, quoting, and Unicode should survive a single setting mutation. Writes still use the same temp file + fsync + atomic replace pattern. r)YAML) CommentedMapTrXrt)typFrS)mappingsequenceoffsetrrdreNr[r\r]r^rc)# ruamel.yamlrruamel.yaml.commentsrrrhripreserve_quotesrrrTr"rIloadrsplitrEr'r-rjrkrrlrrmrorprJrKrRr3r7rqrLr&)r rr rryaml_rtrQconfigcurrentkeyskey next_valuerrrsrtr8rNrus ratomic_roundtrip_yaml_updaterQs[!     111111 ::DKdT222dtnnnG"G G!&G NN1qN333 {{}} YYsWY - - 7\\!__6 F 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 fl + +&f%%G >>#  DCRCy[[%% *l33 &%J%GCLGDH'--M)$//N#   49LB  Yr3 1 1 1 !Q LL # # # GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! !#8T22 Y M>:::=-88888   Ih        D  sh CC C 2I2 AH& I2&H**I2-H*.AI22 J$=JJ$ JJ$JJ$textct tj|S#tjttf$r|cYSwxYw)zParse JSON, returning *default* on any parse error. Replaces the ``try: json.loads(x) except (JSONDecodeError, TypeError)`` pattern duplicated across display.py, anthropic_adapter.py, auxiliary_client.py, and others. )rnloadsJSONDecodeError TypeError ValueError)rr s rsafe_json_loadsrsEz$  )Z 8s 77cbt"ttddp tjatS)N CSafeLoader)_fast_yaml_loadergetattrr SafeLoaderrr_get_fast_yaml_loaderrs' #D->>Q$/ rstreamcFtj|tS)uy``yaml.safe_load`` using the libyaml C loader when available. Accepts the same inputs as ``yaml.safe_load`` (a ``str``/``bytes`` document or a readable file object) and returns the same parsed structure. Falls back to PyYAML's pure-Python ``SafeLoader`` when ``CSafeLoader`` isn't available, so behavior is identical everywhere — only the speed differs. )Loader)rrr)rs rfast_safe_loadrs  9V$9$;$; < < <dS)zARewrite supported proxy env vars to canonical URL forms in-place.rN)_PROXY_ENV_KEYSrrrenviron)rr normalizeds rnormalize_proxy_env_varsrsW)) #r""(//  )*--(BJsO ))rbase_urlc|pd}|sdStd|vr|nd|}|jpddS)aReturn the lowercased hostname for a base URL, or ``""`` if absent. Use exact-hostname comparisons against known provider hosts (``api.openai.com``, ``api.x.ai``, ``api.anthropic.com``) instead of substring matches on the raw URL. Substring checks treat attacker- or proxy-controlled paths/hosts like ``https://api.openai.com.example/v1`` or ``https://proxy.test/api.openai.com/v1`` as native endpoints, which leads to wrong api_mode / auth routing. rz://z//r[)rrhostnamerrstrip)rrparseds rbase_url_hostnamersl >r " "C r Uc\\cczCzz : :F O !r ( ( * * 1 1# 6 66rmodelc|pd}|sdSd|vr|ddd}|dph|dpS|dp>|d p)|d p|d S) uAReturn True for model families that require ``max_completion_tokens``. OpenAI's newer families reject ``max_tokens`` on /v1/chat/completions with HTTP 400 ``unsupported_parameter`` — the caller must send ``max_completion_tokens`` instead. This covers: - ``gpt-4o`` / ``gpt-4o-mini`` / ``gpt-4o-*`` - ``gpt-4.1`` / ``gpt-4.1-*`` - ``gpt-5`` / ``gpt-5.x`` / ``gpt-5-*`` - ``o1`` / ``o1-*`` - ``o3`` / ``o3-*`` - ``o4`` / ``o4-*`` Handles vendor prefixes like ``openai/gpt-5.4`` by stripping to the tail. The URL-based check (``base_url_hostname == "api.openai.com"``) misses third-party OpenAI-compatible endpoints (custom OpenAI gateways, OpenRouter) that front these models and enforce the same parameter constraint, so name-based detection is required as a fallback. rF/r1rzgpt-4ozgpt-4.1zgpt-5o1o3o4)rrrsplitr)rms r"model_forces_max_completion_tokensrs( "##%%A u axx HHS!  R  X  << " "  <<   <<    <<     <<   rdomainct|}|sdS|pdd}|sdS||kp|d|zS)acReturn True when the base URL's hostname is ``domain`` or a subdomain. Safer counterpart to ``domain in base_url``, which is the substring false-positive class documented on ``base_url_hostname``. Accepts bare hosts, full URLs, and URLs with paths. base_url_host_matches("https://api.moonshot.ai/v1", "moonshot.ai") == True base_url_host_matches("https://moonshot.ai", "moonshot.ai") == True base_url_host_matches("https://evil.com/moonshot.ai/v1", "moonshot.ai") == False base_url_host_matches("https://moonshot.ai.evil/v1", "moonshot.ai") == False Frr[)rrrrendswith)rrrs rbase_url_host_matchesr9s|!**H ul ! ! # # ) ) + + 2 23 7 7F u v  @!2!23rsv00  !!!!!!  8 $ $555663$DD#DDTDDDD d| t (@     d +C     " T  $    "-U39--uS$Y7G-C----h EEE T E E  E * E  E EEEEV!% &&& T & & $  &  &&&&R 4 4 4 4 44? 4 4 4( % $ BBB T B B B  B : B BBBBJ@ T @@ @ @@@@L  #  s    (=3=3====s33@@#@@@@@@ 3: #*    ))))777777( c d    FACAAAAAAAAr