.cj6hUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl m Z ddlmZmZddlmZejdkZejeZdedefd Zdedefd Zdedefd Zd edefd Zd edefdZd edefdZdedefdZ dZ!e"dhZ#de"fdZ$e$Z%dZ&dedefdZ'de(ddfdZ)de(ddfdZ*dJde(dzde(dzde(fdZ+de(eefde(eeffdZ,e"hdZ-e"ee.d<d d!d"ede(eeffd#Z/defd$Z0iZ1e(eefe.d%<iZ2e(eefe.d&<da3d'e.d(<d)Z4d*edefd+Z5dKd,Z6d-edefd.Z7dLd-ed*edefd0Z8d-edefd1Z9da:d2e.d3<de;efd4Zdefd8Z?d9Z@eAZBeBaCd:e.d;<dedzfd<ZDd5edefd=ZEd5edefd>ZFde(ddfd?ZGd@e(dedzfdAZHde(de(fdBZIdeJe;eeffdCZKde;efdDZLdEedFe;edefdGZMGdHdIeZNdS)MuELocal execution environment — spawn-per-call with session snapshot.N)Path)BaseEnvironment _pipe_stdin)windows_hide_flagsWindowscwdreturnctr|s|Stjd|}|s|S|d}|dpddd}|d|pt dS) u[Translate a Git Bash / MSYS-style POSIX path (``/c/Users/x``) to the native Windows form (``C:\Users\x``) so ``os.path.isdir`` and ``subprocess.Popen(..., cwd=...)`` can find it. Also accepts the Cygwin (``/cygdrive/c/...``) and WSL-mount (``/mnt/c/...``) spellings of a drive root. Multi-segment POSIX paths like ``/home/x`` or ``/tmp/foo`` are left untouched. No-ops on non-Windows hosts or for paths that aren't in MSYS form. Returns the input unchanged when no translation applies. This is idempotent — calling it on an already-Windows path returns it as-is. z)^/(?:(?:cygdrive|mnt)/)?([a-zA-Z])(/.*)?$/\:\) _IS_WINDOWSrematchgroupupperreplacechrrmdrivetails :/home/ice/.hermes/hermes-agent/tools/environments/local.py_msys_to_windows_pathrs c  =sCCA   GGAJJ    E GGAJJ " % %c4 0 0D ' 'doc"gg ' ''cz|rtj|ntj}tr%t |}ddl}|j|r|Stj|r|Stj|}tj}tj |sht|j }t|j }|r>t|t|kr|t| d|kr|S|S)aResolve the local backend's initial cwd to an absolute host path. ``TERMINAL_CWD`` can be populated from config.yaml before the terminal backend is created. If that value is relative and happens to match the directory Hermes was already launched from (for example ``hermes-agent`` while the process cwd is ``~/.hermes/hermes-agent``), passing it through unchanged makes the wrapper run ``cd hermes-agent`` *inside* the project and fail with a confusing nested-path error. Anchor relative local cwd values once, up front, so both ``subprocess.Popen(cwd=...)`` and the in-shell ``cd`` use the same absolute directory. rN) ospath expandusergetcwdrrntpathisabsabspathisdirrpartslen)rexpandedr% candidatecurrent wanted_parts current_partss r_resolve_local_initial_cwdr04s+.>rw!!#&&&29;;H(22  6< ! ! O w}}X))IikkG 7== # #H~~+ W +  C --]1C1CCCc,///001\AA rc4tr|s|Stjd|}|s|S|d}|dpdddd}|rd|d|nd|dS)a+Translate a native Windows path (``C:\Users\x``) to Git Bash / MSYS form (``/c/Users/x``) so ``builtin cd`` resolves it reliably. No-ops on non-Windows hosts or for paths that aren't drive-qualified native Windows paths. Returns the input unchanged when no translation applies. z^([a-zA-Z]):[\\/]*(.*)$r r r rr)rrrrlowerrlstriprs r_windows_to_msys_pathr4\s c  +S11A  GGAJJ    E GGAJJ " % %dC 0 0 7 7 < z#_resolve_safe_cwd..ssrr ) rrr?r!r"r(loggerwarninggetattrdirnametempfile gettempdir)rparent next_parents r_resolve_safe_cwdrNs ()4 <  $ $ $C {3   rw}}S!!   3X{{3355    &) 0RW__S ! ! !bF  v   Mgoof-- &       r_HERMES_FORCE_AWS_BEARER_TOKEN_BEDROCKct} ddlm}|D]b}||j|jdkr|t|jr| |jcn#t$rYnwxYw ddl m }| D]d\}}|d}|dvr| |4|dkr*|dr| |en#t$rYnwxYw|hd |d t!|S) z=Derive the blocklist from provider, tool, and gateway config.r)PROVIDER_REGISTRYaws_sdk)OPTIONAL_ENV_VARScategory>tool messagingsettingpassword>AGH_TOKENHASS_URL LLM_MODEL HASS_TOKEN XAI_API_KEY GROQ_API_KEY EMAIL_ADDRESS GITHUB_APP_ID OPENAI_ORG_ID WHATSAPP_MODECOHERE_API_KEYEMAIL_PASSWORDGOOGLE_API_KEYMODAL_TOKEN_IDOPENAI_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENDAYTONA_API_KEYEMAIL_IMAP_HOSTEMAIL_SMTP_HOSTMISTRAL_API_KEYOPENAI_API_BASEOPENAI_BASE_URLSIGNAL_HTTP_URLDEEPSEEK_API_KEYGATEWAY_RELAY_IDHELICONE_API_KEYPARALLEL_API_KEYTOGETHER_API_KEYWHATSAPP_ENABLEDANTHROPIC_API_KEYFIRECRAWL_API_KEYFIRECRAWL_API_URLFIREWORKS_API_KEYANTHROPIC_BASE_URLEMAIL_HOME_ADDRESSMODAL_TOKEN_SECRETOPENROUTER_API_KEYPERPLEXITY_API_KEYSLACK_HOME_CHANNELDISCORD_AUTO_THREADOPENAI_ORGANIZATIONSIGNAL_HOME_CHANNELSLACK_ALLOWED_USERSDISCORD_HOME_CHANNELGATEWAY_RELAY_SECRETSIGNAL_ALLOWED_USERSGATEWAY_ALLOWED_USERSSIGNAL_IGNORE_STORIESTELEGRAM_HOME_CHANNELWHATSAPP_ALLOWED_USERSDISCORD_REQUIRE_MENTIONEMAIL_HOME_ADDRESS_NAMESLACK_HOME_CHANNEL_NAMEVERTEX_CREDENTIALS_PATHSIGNAL_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNEL_NAMEGATEWAY_RELAY_DELIVERY_KEYGITHUB_APP_INSTALLATION_IDSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_HOME_CHANNEL_NAMEGITHUB_APP_PRIVATE_KEY_PATHDISCORD_FREE_RESPONSE_CHANNELSGOOGLE_APPLICATION_CREDENTIALSHERMES_DASHBOARD_SESSION_TOKENCLAUDE_CODE_OAUTH_TOKEN)sethermes_cli.authrRvaluesupdateapi_key_env_vars auth_type_AWS_SDK_CREDENTIAL_ENV_VARSbase_url_env_varadd ImportErrorhermes_cli.configrTitemsgetdiscard frozenset)blockedrRpconfigrTnamemetadatarUs r_build_provider_env_blocklistrsG  555555(//11 6 6G NN73 4 4 4 I--;<<<' 6 G4555  6        777777/5577 " "ND(||J//H000 D!!!!Y&&8<< +C+C& D!!!  "       NNDDDDDD\ OO-... W  s%A=B BBA?D D,+D,) VIRTUAL_ENV CONDA_PREFIXkeyc\|}|dr,|ds|drdS|drA|ds*|ds|drdSd S) uReturn True for Hermes-internal secrets injected under *dynamic* names. ``_HERMES_PROVIDER_ENV_BLOCKLIST`` is name-based and derived from the provider/tool registries, but the gateway and CLI also inject secrets into ``os.environ`` at runtime under names no static registry knows about: - ``AUXILIARY__API_KEY`` / ``AUXILIARY__BASE_URL`` — per-task side-LLM credentials bridged from ``config.yaml[auxiliary]`` by ``gateway/run.py`` and ``cli.py`` (vision, web_extract, approval, compression, and any plugin-registered auxiliary task). These are separate, often higher-spend API keys plus base URLs that may point at private endpoints; a model-authored shell command must never see them. - ``GATEWAY_RELAY_*_SECRET`` / ``GATEWAY_RELAY_*_KEY`` / ``GATEWAY_RELAY_*_TOKEN`` — relay-auth material provisioned by the gateway (``GATEWAY_RELAY_SECRET``, ``GATEWAY_RELAY_DELIVERY_KEY``). These are Tier-1 gateway secrets, like the messaging bot tokens in ``_ALWAYS_STRIP_KEYS``. Non-secret ``GATEWAY_RELAY_*`` routing hints (``GATEWAY_RELAY_URL``, ``GATEWAY_RELAY_PLATFORMS``, …) are NOT matched and remain visible. ``code_execution_tool.py`` already catches these via substring matching on ``KEY`` / ``SECRET`` / ``TOKEN``; the terminal backend's narrower name-based blocklist did not, which is the leak this predicate closes. This is the single source of truth for "Hermes-internal dynamic secret" across every spawn path — the terminal ``_make_run_env`` / ``_sanitize_subprocess_env`` filters, the Docker passthrough filter, and the non-terminal :func:`hermes_subprocess_env` helper all call it, so the dynamic patterns are stripped **unconditionally** regardless of ``env_passthrough`` skill registration or ``inherit_credentials``. Nothing a model-driving CLI legitimately needs matches these patterns. AUXILIARY__API_KEY _BASE_URLTGATEWAY_RELAY__SECRET_KEY_TOKENF)r startswithendswith)rrs r_is_hermes_internal_secretr[sB IIKKE  %% z""&+nn[&A&At ()) y!!%*^^F%;%;?D~~h?W?Wt 5renvc\ ddlm}|}|r||d<dSdS#t$rYdSwxYw)zBBridge the context-local Hermes home override into subprocess env.r)get_hermes_home_override HERMES_HOMEN)hermes_constantsr Exception)rrvalues r_inject_context_hermes_homersk ======((**  '!&C    ' '      s  ++c ddlm}m}m}n#t$rYdSwxYw|}|D]L\}}|}||ur|dnt|||<4|r||dMdS)uBridge gateway session ContextVars into a subprocess environment dict. ContextVars don't propagate to child processes, so the live session vars (HERMES_SESSION_*) are bridged onto the child env here. 🔴 Cross-session leak guard. The session vars also have a process-global os.environ mirror (written last-writer-wins as a CLI/cron fallback, never cleared). Under a concurrent multi-session host (the messaging gateway, ACP adapter, API server, TUI) that global belongs to *whichever turn wrote it last* — NOT necessarily this task. A subprocess spawned from a task whose ContextVar is _UNSET (e.g. a sibling message task that never bound, or one that inherited another session's context) would otherwise inherit the FOREIGN global and act on another session's identity. So once the session-context machinery is engaged in this process (any host has called set_session_vars), the session vars are ContextVar-authoritative: - ContextVar set (incl. explicitly-empty "") → that value wins, overriding any stale snapshot/global value. - ContextVar _UNSET → STRIP the var from the child env rather than inherit the possibly-foreign process-global. In a pure single-process CLI/one-shot that never engaged the session-context system there is no concurrency to leak across, so the inherited fallback is kept. See gateway/session_context.session_context_engaged and tests/tools/test_local_env_session_leak.py. r)_UNSET_VAR_MAPsession_context_engagedNr ) gateway.session_contextrrrrrrstrpop)rrrr_engagedvar_namevarrs r_inject_session_context_envrs4           '&((H!))$$ #    "'-BBSZZCMM  $ GGHd # # #$$s base_env extra_envc ddlm}n#t$rd}YnwxYwi}|piD]I\}}|t r t |r0|tvs ||r|||<J|piD]z\}}|t r2|tt d}t |rK|||<Qt |ra|tvs ||r|||<{t|ddl m }||t|tD]}||dt|t!|}|S)z.ErNapply_subprocess_home_env)tools.env_passthroughrrrr!_HERMES_PROVIDER_ENV_FORCE_PREFIXr_HERMES_PROVIDER_ENV_BLOCKLISTr*rrrr_ACTIVE_VENV_MARKER_VARSr%_apply_windows_msys_bash_env_defaults!_scrub_delegated_child_kanban_env) rr_is_passthrough sanitizedrrreal_keyr_markers r_sanitize_subprocess_envrs*OOOOOOO ***)/*!#I~2,,..## U >>; < <   %c * *   4 4 48L8L 4"IcN B--// # # U >>; < < #3@AABBCH)(33 "'Ih   ' , , #  6 6 6//#:N:N 6"IcN ***::::::i((( ***+%% gt$$$$))4441)<rZr] GITHUB_TOKENrarergrkSLACK_APP_TOKENSLACK_BOT_TOKENrsDISCORD_BOT_TOKENr~TELEGRAM_BOT_TOKENrSLACK_SIGNING_SECRETrGATEWAY_ALLOW_ALL_USERSrrrr_ALWAYS_STRIP_KEYSF)inherit_credentialsrctj}tD]}||dt |D]X}|tr||d3t|r||dY|s tD]}||d| ddt|ddl m }||tD]}||dt|t!|t#|}|S)uBuild a sanitized environment dict for a spawned subprocess. Centralized helper for the **non-terminal** spawn surface (browser, ACP/CLI executors, computer-use driver, dep-ensure, TUI Node host, detached gateway). Use this instead of copying ``os.environ`` directly so strip-by-default is the uniform policy across every spawn site, with a single source of truth (``_HERMES_PROVIDER_ENV_BLOCKLIST``). The terminal / execute_code path keeps using :func:`_sanitize_subprocess_env`, which is skill-aware (``env_passthrough``); this helper is for spawns that have no skill-passthrough concept. Two-tier stripping: * **Tier 1 (always):** ``_ALWAYS_STRIP_KEYS`` — gateway bot tokens, GitHub auth, and remote-compute secrets are removed regardless of ``inherit_credentials``. No child Hermes spawns legitimately needs them. * **Tier 2 (conditional):** the rest of ``_HERMES_PROVIDER_ENV_BLOCKLIST`` (LLM provider API keys, tool secrets) is removed unless the caller passes ``inherit_credentials=True``. Pass ``inherit_credentials=True`` **only** when the child legitimately needs LLM provider credentials — a user-blessed ``claude`` / ``codex`` / ``gemini`` CLI executor, or the TUI Node host that makes model calls. The flag is grep-able for audit: ``grep -rn 'inherit_credentials=True'`` lists every spawn site that still receives provider credentials. Callers that need a *specific* non-provider secret (e.g. the browser worker needs ``BROWSERBASE_API_KEY`` / ``FIRECRAWL_API_KEY``) should call with ``inherit_credentials=False`` and copy just those keys back from ``os.environ`` into the returned dict. N PYTHONUTF81rr)r!environcopyrrlistrrrr setdefaultrrrrrrr)rrrrrs rhermes_subprocess_envr,su@ *//  C" T Cyy >>; < <  GGC     ' , ,  GGC    1  C GGC    NN<%%%$$$::::::c""", )#... $$$ ,C 0 0C Jrc ts{tjdpftjdrdndpCtjdrdndp tjdpdSg}tjd}|r4tj|r||tjdd }|r!tj |d d nd }|r~tj |d d tj |dd d fD]:}tj|r||vr||;tj tjdddd d tj tjdddd d |r#tj |ddd d nd fD]<}|r8tj|r||vr||=tjd}|r||vr|||D]X}t|rG||kr=|r;tj|rt d|||cSY|rkd fd|D}tdust|r#tt!|d||dStd)z Find bash for command execution.bashz /usr/bin/bashNz /bin/bashSHELLz/bin/shHERMES_GIT_BASH_PATH LOCALAPPDATAr hermesgitbinzbash.exeusr ProgramFileszC:\Program FilesGitzProgramFiles(x86)zC:\Program Files (x86)Programsz8HERMES_GIT_BASH_PATH=%s fails to start; using %s instead c3TK|]"}t|xV#dSN)_bash_probe_details_cacher).0r,details r z_find_bash..sP" " 377 BBB" " " " " " " rTrzGit Bash not found. Hermes Agent requires Git for Windows on Windows. Install it from: https://git-scm.com/download/win Or set HERMES_GIT_BASH_PATH to your bash.exe location.)rshutilwhichr!r"isfilerrappendjoin _bash_startsrFrG_mandatory_aslr_enabled_looks_like_msys_spawn_failure RuntimeError_git_bash_aslr_help) candidatescustom_local_appdata_hermes_portable_gitr,found probe_detailsrs @r _find_bashr!s  L  #%7>>/#B#BL !w~~k::D  z~~g&&   J Z^^2 3 3F ""'..(("&!!!Z^^NB77NLZb27<<%HHH`b- GLL-uj A A GLL-ueZ H H  - -Iw~~i(( -Yj-H-H!!),,,  RZ^^N4GHH%QVXbcc  RZ^^$79RSSUZ\acmnnN\d ^ZzJJJbd))  ) 22 )y 7R7R   i ( ( ( L E !j((%      " " F""v""'..2H2H"N      " " " " '" " "   # $ $ , ,0N 1 1 ,2:a=-PPQQ Q !}  A  r_bash_starts_cacher  bool | None_mandatory_aslr_enabled_cachez0/usr/bin/true; /usr/bin/cat --version >/dev/nulldetailscb|tfddDS)zAMatch Git-for-Windows child-launch failures associated with ASLR.c3 K|]}|vV dSr rD)rmarkerlowereds rrz1_looks_like_msys_spawn_failure..s<  'r)zdofork:z child_copy: 0xc0000142 0xc0000005)r2any)r%r)s @rrrsJmmooG    rcttS tjdpd}tj|ddddgdddt }|jd krdS|jpd  }|d krdadS|d vrdadSn2#t$r%}t d|Yd}~nd}~wwxYwdS)zEReturn Windows' system-wide ForceRelocateImages state when available.Nzpowershell.exez -NoProfilez-NonInteractivez-CommandzC(Get-ProcessMitigation -System).Aslr.ForceRelocateImages.ToString()T capture_outputtexttimeout creationflagsrr ON>OFFNOTSETFz0Could not query Windows Mandatory ASLR state: %s) r$rr subprocessrunr returncodestdoutstriprrrFdebug) powershellresultrexcs rrrs!%0,,N\"233G7G !U   ,..       ! !4$"++--3355 D==,0 )4 % % %,1 )5 & NNN GMMMMMMMMN 4s$A B5BB C 'CC rcrtjtj|}tj|dkrtj|Stj|}tj|dkrtj|S|S)zAResolve Git's root from either /bin or /usr/bin bash.rr)r%rInormpathbasenamer2)rbin_dirrLs r_git_root_from_bashrDsnV_T2233G w%%''500~g&&& ^G $ $F v$$&&%//~f%%% Mrr ct|}|dd}|r d|ddnd}d|d|d |d S) z:Build the targeted per-program Mandatory-ASLR remediation.'z''z Git Bash probe output: Nir z Git Bash at z cannot launch required MSYS child processes while Windows Mandatory ASLR (ForceRelocateImages) is enabled, or its output matches that Git-for-Windows failure class.zw Reinstalling Git will not change the Windows mitigation policy. Open PowerShell as Administrator and run: $gitRoot = 'a=' Get-Item "$gitRoot\bin\bash.exe", "$gitRoot\usr\bin\*.exe" -ErrorAction SilentlyContinue | ForEach-Object { Set-ProcessMitigation -Name $_.FullName -Disable ForceRelocateImages } Then restart Hermes. If the override is blocked or later re-applied, ask your Windows administrator to allow this per-program exception.)rDr)rr%git_root escaped_root detail_lines rrrs"4((H##C..LAHP=gdsdm===bK Nt N N6A N N $ N N N rcht|}||S tj|dddtgdddt rt nd}|jdk}|sn|jpd |j pd }| dd t|<t d || dd nT#t$rG}t|dd t|<t d ||d}Yd}~nd}~wwxYw|t|<|S)aTrue if *bash* can launch external MSYS programs. Uses ``--noprofile --norc`` so a broken login post-install (``Directory \drivers\etc``) does not falsely condemn an otherwise usable bash. The external ``true`` and ``cat`` calls are intentional: a builtin-only ``exit 0`` probe misses Git-for-Windows fork/spawn failures under system-wide Mandatory ASLR. Cached per path for the process lifetime. Nz --noprofilez--norc-cTrr/r izbash probe failed for %s: %szbash probe error for %s: %sF)r"rr7r8_BASH_EXTERNAL_PROGRAM_PROBErrr9r:stderrr;r rFr<rr)rcachedr>okcombinedr?s rrr0s[ # #D ) )F   =(D2N O2=D,...1     ! # W --2Dv}/BDDH.6nn.>.>uu.E %d + LL7x~~?O?OPTQTPT?U V V V *-c((5D5/!$' 2D#>>>  "t IsB3C D%=D  D%zlist[str] | None_git_bash_bin_dirs_cachec~ttSts gatSg} t}n#t$r gatcYSwxYwtj|}tj|}tj|dkrtj|n|}tj |ddtj |ddtj |dddtj |ddtj |dfD]:}tj |r||vr| |;|a|S)uGit Bash's coreutils/binary dirs, in ``/etc/profile`` precedence order. A non-login ``bash -c`` (the fallback used when ``bash -l`` is broken — the classic Windows ``Directory \drivers\etc does not exist`` failure) never sources ``/etc/profile``, so it never gets ``…\usr\bin`` on PATH. That directory holds every coreutil the file/terminal tools shell out to (``cat``, ``mktemp``, ``mv``, ``wc``, ``head``, ``stat``, ``chmod``, ``mkdir``, ``find`` …). Without it, ``write_file`` fails with an empty error (the failure text went to a missing binary's stderr) and terminal commands exit 127. We derive these dirs from the resolved ``bash.exe`` so the fallback shell can find coreutils regardless of the login shell. Returns ``[]`` off Windows or when bash can't be located. Dirs are returned in the order Git Bash's own ``/etc/profile`` prepends them (mingw first, then usr/bin, then bin) and only if they exist on disk. Nrmingw64rmingw32local) rSrr!rr!r"rIrBr2rr(r)dirsrrCrLrootr,s r_git_bash_bin_dirsrZVs$ +'' (#% ''D(|| (((#% ''''(good##G W__W % %F&(g&6&6v&>&>&D&D&F&F%&O&O27??6 " " "U[D  T9e,,  T9e,,  T5'511  T5%((  T5!! ##  7== # # # (=(= KK " " "# Ks1AA existing_pathct}|s|Stj}|rd||Dngfd|D}|s|S|g|S)aPrepend Git Bash's binary dirs to ``existing_path`` if missing. No-op off Windows or when the dirs can't be resolved. First-occurrence wins, so a PATH that already lists a dir keeps its position. This is what lets the non-login ``bash -c`` fallback find coreutils; in the healthy case the session snapshot re-exports the full login PATH inside the shell, so this only matters when that snapshot is absent. cg|]}||SrDrDres r z*_prepend_git_bash_dirs..888Qa8q888rcg|]}|v| SrDrD)rdentriess rr`z*_prepend_git_bash_dirs..s#777Qaw&6&6q&6&6&6r)rZr!pathsepsplitr)r[git_dirssepmissingrds @r_prepend_git_bash_dirsrjs"##H  *Cshkshzshrdashmkshc$ts|tjd}|r[tj|r"]``, and that ``-lic`` bundle + ``set +m`` job-control syntax is NOT understood by fish, csh/tcsh, nushell, elvish, xonsh, etc. Returning such a ``$SHELL`` would trade the bash-3.2 swallow for a parse error on every background command, so for any non-allowlisted shell we fall back to ``_find_bash`` (the prior behaviour). On Windows, ``$SHELL`` is typically bash (Git Bash), so behaviour is unchanged — we fall through to ``_find_bash``. r) rr!rrr"rr=r>rr_SPAWN_COMPATIBLE_SHELLSr!) user_shells r _find_shellrss~< Z^^G,,  z**  *bg.. Z  %)AAA  <<rza/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binzstr | None | object_HERMES_BIN_DIRctturtSd}tjd}|rtj|}|tjrtjdnd}tj | }tj |rY|dks| dr>tj |rtj|}|tjr)tjtjnd}|rJtrdnd}tj tj||r|}|r!tj|sd}|a|S)uReturn the directory holding the ``hermes`` console-script, or None. The terminal tool runs in a freshly-spawned subshell whose PATH is the agent process's PATH plus a static set of system dirs (``_SANE_PATH``). When the gateway is launched by something that does NOT source the user's shell rc — systemd, a service manager, a desktop launcher, cron — the hermes install dir (``~/.local/bin``, the venv ``bin``/``Scripts``, pipx, nix) is absent from that PATH, so plugins shelling out to bare ``hermes`` via the terminal tool hit ``command not found`` (exit 127) even though ``hermes`` works fine in the user's own interactive terminal. We resolve the install dir once (it never changes within a process) and prepend-if-missing it to the subshell PATH so bare ``hermes`` resolves regardless of how the gateway was started. Resolution order (cheap, no heavy imports): 1. ``shutil.which("hermes")`` — normal PATH-installed shim. 2. The directory of ``sys.argv[0]`` when it's an absolute path to a real ``hermes`` executable (covers nix-store / venv wrappers). 3. The directory of ``sys.executable`` — the running interpreter's venv ``bin``/``Scripts`` is where its console-scripts live. Nrrr zhermes.z hermes.exe)rt _SENTINELrrr!r"rIsysargvrBr2r&rr executablerrr()r,rargv0baseexe_dirshims r_resolve_hermes_bin_dirr~ss0i'' I L " "E +GOOE** "x/ Rw&&,,.. GMM%  /!!T__Y%?%?!u%%"..I58^K"'//#.111  $#.<<. rar)r~r!rerfr)r[rCrhrds r_prepend_hermes_bin_dirrs{&''G  *C.?sFFFeFEFFFrr)r _SANE_PATHrfrrrr)r[ sane_entriesseenordered_entriesrs r!_append_missing_sane_path_entriesr&s,FFz'7'7'<'<FFFL &xx %%%UUD!#O$$S))&&   u%%%%**     " "5 ) ) ) 88O $ $$rcptsdS|dd|dddS)ucDisable MSYS argument path conversion for Git Bash subprocesses. Git Bash rewrites arguments that look like Unix paths (``/FO``, ``/TN``, ``/Create``) into ``C:/.../git/FO``-style paths, which breaks native Windows commands such as ``tasklist``, ``schtasks``, and ``wmic``. Hermes runs terminal commands through bash on Windows, so set the standard MSYS opt-out by default. Users who need conversion can override in their env. Refs #56700. ``MSYS_NO_PATHCONV`` is honored by Git for Windows bash only. MSYS2-proper and Cygwin bash (which ``_find_bash`` can still return via the final ``shutil.which`` fallback) ignore it and honor ``MSYS2_ARG_CONV_EXCL`` instead, so set both. ``*`` disables all argv conversion — the semantic equivalent of ``MSYS_NO_PATHCONV=1``. Also fixes ``cmd /c`` mangling (#56147). NMSYS_NO_PATHCONVrMSYS2_ARG_CONV_EXCL*)rr)rs rrrVsA" NN%s+++NN(#.....rrun_envcZtsdS|D]}|dkr|cSdS)aReturn the PATH env key to update without altering Windows casing. Note: this is deliberately a *second* Windows guard, distinct from the early-return in ``_append_missing_sane_path_entries``. Its job is to pick the correctly-cased key (``Path`` vs ``PATH``) so completion writes back to the key the caller already used; the helper's guard makes that helper safe to call standalone (it is, e.g. in the Windows unit tests). Both are intentional. PATHN)rr)rrs r _path_env_keyrmsF v 99;;& JJJ ! 4rc ddlm}n#t$rd}YnwxYwttj|z}i}|D]z\}}|tr2|ttd}t|rK|||<Qt|ra|tvs ||r|||<{t|}|Dt||d}t|}t!|||<t#|ddlm} | |t)|t*D]} || dt/|t1|}|S)zDBuild a run environment with a sane PATH and provider-var stripping.rrcdSrrDrs rrEz_make_run_env..rrNr r)rrrdictr!rrrrr*rrrrrrjrrrrrrrrr) rrmergedrkvrpath_keynew_pathrrs r _make_run_envrs*OOOOOOO ***)/*"*s" # #FG   1 <<9 : : >??@@AH)(33  !GH   ' * *   4 4 48J8J 4GAJW%%H4W[[25N5NOO*(334H==(((::::::g&&&  (((+## GT"""")'222/88G Nrc< ddlm}|pi}|dpi}|dpg}t|tsg}t |dd}d|D|fS#t $rgdfcYSwxYw)uReturn (shell_init_files, auto_source_bashrc) from config.yaml. Best-effort — returns sensible defaults on any failure so terminal execution never breaks because the config file is unreadable. r) load_configterminalshell_init_filesauto_source_bashrcTc0g|]}|t|SrD)r)rfs rr`z4_read_terminal_shell_init_config..s#+++1+A+++r)rrr isinstancerboolr)rcfg terminal_cfgfiles auto_bashrcs r _read_terminal_shell_init_configrs 111111kmm!rwwz**0b   !344:%&& E<++,@$GGHH +++++[88 4xsBB BBct\}}g}|r||n |rts|gdg}|D]} tjtj|}n#t$rYLwxYw|r4tj|r| ||S)uhResolve the list of files to source before the login-shell snapshot. Expands ``~`` and ``${VAR}`` references and drops anything that doesn't exist on disk, so a missing ``~/.bashrc`` never breaks the snapshot. The ``auto_source_bashrc`` path runs only when the user hasn't supplied an explicit list — once they have, Hermes trusts them. )z ~/.profilez~/.bash_profilez ~/.bashrc) rextendrr!r" expandvarsr#rrr)explicitrrresolvedrawr"s r_resolve_shell_init_filesrs=>>HkJJ(#### J[J HHHIIIH"" 7%%bg&8&8&=&=>>DD    H   "BGNN4(( " OOD ! ! ! Os`` lines (guarded + silent) to a bash script. Each file is wrapped so a failing rc file doesn't abort the whole bootstrap: ``set +e`` keeps going on errors, ``2>/dev/null`` hides noisy prompts, and ``|| true`` neutralises the exit status. zset +erFz'\''z[ -r 'z ' ] && . 'z' 2>/dev/null || truer )rrr)rr prelude_partsr"safepreludes r_prepend_shell_initrs JMSS||C))QdQQdQQQRRRRii &&-G Z rc eZdZdZddededeffd Zd efd Ze ded efd Z d ed efd Z dddddede dededzd e jf dZdZdefdZdeffd ZdZxZS)LocalEnvironmentzRun commands directly on the host machine. Spawn-per-call: every execute() spawns a fresh bash process. Session snapshot preserves env vars across calls. CWD persists via file-based read after each command. r <Nrr2rct|}t||||dS)N)rr2r)r0super__init__ init_session)selfrr2r __class__s rrzLocalEnvironment.__init__sG(-- S's;;; rr ctr ddlm}|dz dz }n3#t$r&t t jdz }YnwxYw|ddt| dd Sd D]k}|j |ptj |}|r.|d r|d pd cSltjd r.tjd tjtjzrd St j}|d r|d pd Sd S) uReturn a shell-safe writable temp dir for local execution. Termux does not provide /tmp by default, but exposes a POSIX TMPDIR. Prefer POSIX-style env vars when available, keep using /tmp on regular Unix systems, and only fall back to tempfile.gettempdir() when it also resolves to a POSIX path. Check the environment configured for this backend first so callers can override the temp root explicitly (for example via terminal.env or a custom TMPDIR), then fall back to the host process environment. **Windows:** hardcoded ``/tmp`` is wrong in two ways — native Python can't open the path, and the Windows default temp (``%TEMP%``) often contains spaces (``C:\Users\Some Name\AppData\Local\Temp``) that break unquoted bash interpolations. Use a dedicated cache dir under ``HERMES_HOME`` instead — single-word path, guaranteed to exist, same string resolves in both Git Bash and native Python. r)get_hermes_homecacherhermes_terminalT)parentsexist_okrr)TMPDIRTMPTEMPz/tmp)rrrrrrJrKmkdirrrrrr!rrrstripr"r(r=W_OKr>)rr cache_direnv_varr,s r get_temp_dirzLocalEnvironment.get_temp_dirs&  5  L<<<<<<+O--7*D  L L L !4!6!677:KK  L OOD4O 8 8 8y>>))$44 40 4 4G W--H1H1HI 4Y11#66 4 '',,3333 7==  RYvrw7H%I%I 6'))    $ $ 0##C((/C /vs -AAcDtjt|S)z@Use native paths for Python, but Git Bash-friendly paths for cd.)r_quote_cwd_for_cdr4)rs rrz"LocalEnvironment._quote_cwd_for_cdEs01Fs1K1KLLLrr"c t|S)z?Rewrite native/mixed Windows paths before quoting for Git Bash.)r;)rr"s r_quote_shell_pathz"LocalEnvironment._quote_shell_pathJs%%%rFx)loginr2 stdin_datarrrc t}|r t}|rt||}|r|dd|gn|d|g}t|j}t |j} | |jkrPtrt|jn|j} | | kr!t d|j| | |_|j} trdtini} tj |fd|ddtjtj| tjn tjd| d | } ts0 t#j| j| _n#t*$rYnwxYw|t-| || S) Nz-lrKzaLocalEnvironment cwd %r is missing on disk; falling back to %r so terminal commands keep working.r3Tzutf-8r) r1rencodingerrorsr:rOstdinstart_new_sessionr)r!rrrrrNrrrrFrGrr7PopenPIPESTDOUTDEVNULLr!getpgidpid _hermes_pgidProcessLookupErrorr)rrrr2rr init_filesargsrsafe_cwd normalized _popen_cwd _popen_kwargsprocs r _run_bashzLocalEnvironment._run_bashNs||  I244J I0ZHH 16TdD*--T4*>??TV    ?$%/%;*//AS"        $&Jtx$8$8!!%      ! j ) ) ) s1E EEcdtdtfddtdtdtffd } trt ddlm}|jd n$#t$rYnwxYw  d d S#tj tf$rYd SwxYw tjj}n$#t$rt!d d }|YnwxYw tj|t$jn#t$rYd SwxYw||drd S tj|t$jn#t$rYd SwxYw||d   d d S#tj tf$rYd SwxYw#tt*tf$r+ Yd S#t$rYYd SwxYwwxYw)z-Kill the entire process group (all children).pgidr cl tj|ddS#t$rYdSt$rYdSwxYw)NrTF)r!killpgrPermissionError)rs r _group_alivez4LocalEnvironment._kill_process.._group_alivesY  $"""t%   uu"   tt s 3 33r2c~tj|z}tj|kr^ n#t$rYnwxYw|sdStjdtj|k^ n#t$rYnwxYw| S)NTg?)time monotonicpollrsleep)rr2deadlinerrs r_wait_for_group_exitz._wait_for_group_exits~'''1H.""X--IIKKKK D#|D)) 4 4   .""X--      #|D))) )s#A AAB## B0/B0r) terminate_pidT)forceg@)r2rNg?g?)intrfloatrgateway.statusrrrkillwaitr7TimeoutExpiredOSErrorr!rrrHrsignalSIGTERMSIGKILLr)rrrrrrs ` @r _kill_processzLocalEnvironment._kill_processs s t     *s *U *t * * * * * * *$- '  <<<<<<!M$($77777    IIKKKKK IIcI*****"17;DD:dh//DD)"4>>D|$| IdFN3333)FF ('c22FIdFN3333)FF$$T3///IIcI*****"17;DD"OW=          sF AF A41F 3A44F 8BB*&F )B**F .CF C)&F (C))F -D F DF DF -E F EF EF +FFF FF G"8G GG"GG"r>c0||dS)aUpdate cwd from the stdout marker emitted by the wrapped command. The base command wrapper already appends ``pwd -P`` to stdout inside a session-specific marker, so the local backend can share the same parser as remote backends instead of re-reading the temp file it just wrote. ``_extract_cwd_from_output`` keeps the local Windows normalization and stale-path rollback semantics intact. N)_extract_cwd_from_output)rr>s r _update_cwdzLocalEnvironment._update_cwds %%f-----rc|j}t||j|krUtrt |jn|j}|r(t j|r ||_dS||_dSdS)uSame semantics as the base class, but on Windows the value emitted by ``pwd -P`` inside Git Bash is in MSYS form (``/c/Users/x``). Normalize to native Windows form and validate the directory exists before assigning to ``self.cwd`` — otherwise ``_run_bash``'s safe-cwd recovery would warn on every subsequent command. Always defers to the base class for stripping the marker text from ``result["output"]`` so output formatting is identical. N)rrrrrr!r"r()rr>prev_cwdrrs rrz)LocalEnvironment._extract_cwd_from_outputs8 ((000 8x  ;B=A>>B BB)r rN)__name__ __module__ __qualname____doc__rrrrr staticmethodrrrr7rrrrrr __classcell__)rs@rrrsCsd .c....`MsMsMMM\M&c&c&&&&;@!$+/DDDCD4DD!DjD4>4DDDDDLMMM^ .$ . . . .$t$$$$$$0rrr )r r#)r )Orloggingr%r!platformrrrr7rwrJrpathlibrtools.environments.baserrhermes_cli._subprocess_compatrsystemr getLoggerrrFrrr0r4r7r;rr?rNrrrrrrrrrrrrr__annotations__rr!r"r r$rNrrrDrrrSrrZrjrqrsrobjectrvrtr~rrrrrtuplerrrrrDrrr sKKK    @@@@@@@@<<<<<<ho9,  8 $ $(s(s((((8%C%C%%%%P8s8s8888$##,.3.3.... !@!@;*C*D****Z  T  d     ,$T,$d,$,$,$,$^,,td{,td{,VZ,,,,^ 4S> d38n    .&/Y 0 0 0 & &IcN   F:?RRR$R4S>RRRRjUCUUUUp')DdO(((,.4S>.../3}333Q C D        FcccC( s t    F04,3332DI2222j*#*#****0%9%Q%Q%QRR'S''''XC  FHH )2&2226t6666r)3)3))))"-%S-%S-%-%-%-%`/t/////.4C$J$3t33333l%S 4*@('49''''T C S  c    *OOOOOOOOOOr