Jj*N dZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddl mZddlZejeZehdZd>de d ed efd Zd?d ed ed efdZde d dfdZde d dfdZde ddd dfdZde ddd dfdZde ee fde ee fd efdZdddde ee fde dededzde d df d ZGd!d"ej Z!dddd#de ee fde d$ed%ed&edzd df d'Z"de ee fd(ede d dfd)Z#d@d*ed e d e fd+Z$da%d,Z&d-e d e fd.Z'dAd/ed ed efd0Z(dBd/ed e)d e)fd2Z*d>d/ed ed efd3Z+d4Z,d5edzd edzfd6Z-dCd7Z.d8ed efd9Z/d:ed efd;Z0d8ed1onyestrueFvaluedefaultreturnc||St|tr|St|tr-|t vSt|S)zDCoerce bool-ish values using the project's shared truthy string set.) isinstanceboolstrstriplowerTRUTHY_STRINGS)r r s +/home/rurouni/.hermes/hermes-agent/utils.pyis_truthy_valuers` }% %7{{}}""$$66 ;;namecJttj||dS)zBReturn True when an environment variable is set to a truthy value.Fr rosgetenv)rr s renv_var_enabledr!s! 29T733U C C CCrpathz int | Nonec |r+tj|jndS#t$rYdSwxYw)zBCapture the permission bits of *path* if it exists, else ``None``.N)existsstatS_IMODEst_modeOSError)r s r_preserve_file_moder'&sV48KKMMKt|DIIKK/000tK ttsAA AAztuple[int, int] | NonectjdkrdS |}n#t$rYdSwxYw|j|jfS)zACapture the owning uid/gid of *path* if the platform supports it.posixN)rrr#r&st_uidst_gid)r sts r_preserve_file_ownerr-.sY w't YY[[ tt 9bi s ) 77ownerc|ttdsdS tj||d|ddS#t$rYdSwxYw)aRe-apply uid/gid after an atomic replace when permitted. Docker and NAS-backed installs often run some commands as root while the persistent volume is owned by the runtime user. ``os.replace`` swaps in the temp file's owner, so a root-run config write can leave ``config.yaml`` owned by root. Best-effort chown preserves the existing owner for privileged callers and is harmless for unprivileged callers that cannot chown. Nchownr)hasattrrr0r&)r r.s r_restore_file_ownerr39se }GB00}  uQxq*****      s"? A  A modec\|dS tj||dS#t$rYdSwxYw)aRe-apply *mode* to *path* after an atomic replace. ``tempfile.mkstemp`` creates files with 0o600 (owner-only). After ``os.replace`` swaps the temp file into place the target inherits those restrictive permissions, breaking Docker / NAS volume mounts that rely on broader permissions set by the user. Calling this right after ``os.replace`` restores the original permissions. N)rchmodr&)r r4s r_restore_file_moder7JsM |  t      s  ++tmp_pathtargetc Lt|}tj|rtj|n|}t|} tj||n-#t $r}|jtjtj fvrt d||tj |j|jtj|| tj||n#t $rYnwxYw t#|d5}tj|dddn #1swxYwYn#t $rYnwxYwtj|Yd}~nd}~wwxYw|S)uAtomically move *tmp_path* onto *target*, preserving symlinks. ``os.replace(tmp, target)`` atomically swaps ``tmp`` into place at ``target``. When ``target`` is a symlink, the symlink itself is replaced with a regular file — silently detaching managed deployments that symlink ``config.yaml`` / ``SOUL.md`` / ``auth.json`` etc. from ``~/.hermes/`` to a git-tracked profile package or dotfiles repo (GitHub #16743). This helper resolves the symlink first so ``os.replace`` writes to the real file in-place while the symlink survives. For non-symlink and non-existent paths the behavior is identical to a plain ``os.replace`` call unless the rename fails with ``EXDEV`` or ``EBUSY``; those cases fall back to copy/fsync/unlink for cross-device, bind-mount, and busy-file deployments. Returns the resolved real path used for the replace, so callers that need to re-apply permissions can target it instead of the symlink. z=atomic_replace: %s -> %s failed with %s; falling back to copyrbN)rrr islinkrealpathreplacer&errnoEXDEVEBUSYloggerdebug errorcodegetshutilcopyfilecopystatopenfsyncfilenounlink)r8r9 target_str real_pathtmp_strexcfs ratomic_replacerR[s(VJ02z0J0JZ  ,,,PZI(mmG 7I&&&&  9U[%+6 6 6  K   O   39 5 5    +++  OGY / / / /    D  i&& %!$$$ % % % % % % % % % % % % % % %    D  ''( s A77 F!A:F=DF D FD  F$E34'E' E3'E+ +E3.E+ /E32F3 F=F?FFF!)indentr4datarT dump_kwargsc t|}|jdd|dnt|}t |}t jt|jd|jdd\}} |*ttdrtj ||tj |d d 5} tj|| f|d d || tj| dddn #1swxYwYt%||} t| } t'| ||) tj| |dS#t*$rYdSwxYwt-| |dS#t.$r( tj|n#t*$rYnwxYwwxYw)aWrite JSON data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: JSON-serializable data to write. indent: JSON indentation (default 2). mode: Optional final permission mode. When set, the temp file is created and replaced with this mode, avoiding chmod-after-write TOCTOU exposure for secret-bearing files. **dump_kwargs: Additional keyword args forwarded to json.dump(), such as default=str for non-native types. Tparentsexist_okN._.tmpdirprefixsuffixfchmodwutf-8encodingF)rT ensure_ascii)rparentmkdirr'r-tempfilemkstemprstemr2rrbfdopenjsondumpflushrJrKrRr3r6r&r7 BaseExceptionrL) r rUrTr4rV original_modeoriginal_ownerfdr8rQrN real_path_objs ratomic_json_writervs\0 ::DKdT222 ,DD2Ed2K2KM)$//N#   49LB "  H 5 5  Ib$    Yr3 1 1 1 !Q I "         GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! !#8T22 Y M>:::   -----     }m < < < < <   Ih        D  stAFAD$ F$D((F+D(,4F!E88 FFFF G &F;:G ; GG GG c$eZdZdZdfd ZxZS) IndentDumperuDPyYAML dumper that indents list items under mapping keys (2-space). Default PyYAML emits "indentless" sequences — list items start at the same column as their parent mapping key. ``ruamel.yaml`` (used by :func:`atomic_roundtrip_yaml_update`) emits 2-space-indented sequences. Mixing both styles in the same ``config.yaml`` produces a file that stricter parsers like ``js-yaml`` reject with ``bad indentation of a mapping entry``. Forcing ``indentless=False`` aligns the two serializers so all write paths emit byte-identical layouts (#31999). FcHt|dS)NF)superincrease_indent)selfflow indentless __class__s rr{zIndentDumper.increase_indentsww&&tU333r)FF)__name__ __module__ __qualname____doc__r{ __classcell__)rs@rrxrxsG  4444444444rrx)default_flow_style sort_keys extra_contentrrrc *t|}|jddt|}t |}t jt|jd|jdd\}} tj |dd 5} tj || t||d |r| || tj| d d d n #1swxYwYt%||} t| } t'| |t)| |d S#t*$r( tj|n#t.$rYnwxYwwxYw) anWrite YAML data to a file atomically. Uses temp file + fsync + os.replace to ensure the target file is never left in a partially-written state. If the process crashes mid-write, the previous version of the file remains intact. Args: path: Target file path (will be created or overwritten). data: YAML-serializable data to write. default_flow_style: YAML flow style (default False). sort_keys: Whether to sort dict keys (default False). extra_content: Optional string to append after the YAML dump (e.g. commented-out sections for user reference). TrXr[r\r]r^rcrdre)Dumperrr allow_unicodeN)rrhrir'r-rjrkrrlrrmyamlrorxwriterprJrKrRr3r7rqrLr&) r rUrrrrrrsrtr8rQrNrus ratomic_yaml_writers, ::DKdT222'--M)$//N#   49LB ! Yr3 1 1 1 !Q I##5#"      ' &&& GGIII HQXXZZ ' ! ! ! ! ! ! ! ! ! ! ! ! ! ! !*#8T22 Y M>:::=-88888   Ih        D  sVE A1D E DE DAE F+F?F F  F F  Fkey_pathcNddlm}ddlm}t |}|jdd|d}d|_d|_d|_ | d d d | rO| d d 5}| |p |}dddn #1swxYwYn |}t||s ||}|}|d} | ddD]8} || } t| |s|} | || <| }9||| d<t#|} t%|} t'jt+|jd|jdd\}} t/j|dd 5}||||t/j|dddn #1swxYwYt;||}t |}t=|| t?|| dS#t@$r( t/j!|n#tD$rYnwxYwwxYw)a_Update one dotted YAML key while preserving comments and readable text. This is intentionally narrower than :func:`atomic_yaml_write`: it is for user-edited config files where comments, ordering, quoting, and Unicode should survive a single setting mutation. Writes still use the same temp file + fsync + atomic replace pattern. r)YAML) CommentedMapTrXrt)typFrS)mappingsequenceoffsetrrdreNr[r\r]r^rc)# ruamel.yamlrruamel.yaml.commentsrrrhripreserve_quotesrrrTr"rIloadrsplitrEr'r-rjrkrrlrrmrorprJrKrRr3r7rqrLr&)r rr rryaml_rtrQconfigcurrentkeyskey next_valuerrrsrtr8rNrus ratomic_roundtrip_yaml_updater(s[!     111111 ::DKdT222dtnnnG"G G!&G NN1qN333 {{}} YYsWY - - 7\\!__6 F 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 fl + +&f%%G >>#  DCRCy[[%% *l33 &%J%GCLGDH'--M)$//N#   49LB  Yr3 1 1 1 !Q LL # # # GGIII HQXXZZ  ! ! ! ! ! ! ! ! ! ! ! ! ! ! !#8T22 Y M>:::=-88888   Ih        D  sh CC C 2I2 AH& I2&H**I2-H*.AI22 J$=JJ$ JJ$JJ$textct tj|S#tjttf$r|cYSwxYw)zParse JSON, returning *default* on any parse error. Replaces the ``try: json.loads(x) except (JSONDecodeError, TypeError)`` pattern duplicated across display.py, anthropic_adapter.py, auxiliary_client.py, and others. )rnloadsJSONDecodeError TypeError ValueError)rr s rsafe_json_loadsrnsEz$  )Z 8s 77cbt"ttddp tjatS)N CSafeLoader)_fast_yaml_loadergetattrr SafeLoaderrr_get_fast_yaml_loaderrs' #D->>Q$/ rstreamcFtj|tS)uy``yaml.safe_load`` using the libyaml C loader when available. Accepts the same inputs as ``yaml.safe_load`` (a ``str``/``bytes`` document or a readable file object) and returns the same parsed structure. Falls back to PyYAML's pure-Python ``SafeLoader`` when ``CSafeLoader`` isn't available, so behavior is identical everywhere — only the speed differs. )Loader)rrr)rs rfast_safe_loadrs  9V$9$;$; < < <dS)zARewrite supported proxy env vars to canonical URL forms in-place.rN)_PROXY_ENV_KEYSrrrenviron)rr normalizeds rnormalize_proxy_env_varsrsW)) #r""(//  )*--(BJsO ))rbase_urlc|pd}|sdStd|vr|nd|}|jpddS)aReturn the lowercased hostname for a base URL, or ``""`` if absent. Use exact-hostname comparisons against known provider hosts (``api.openai.com``, ``api.x.ai``, ``api.anthropic.com``) instead of substring matches on the raw URL. Substring checks treat attacker- or proxy-controlled paths/hosts like ``https://api.openai.com.example/v1`` or ``https://proxy.test/api.openai.com/v1`` as native endpoints, which leads to wrong api_mode / auth routing. rz://z//r[)rrhostnamerrstrip)rrparseds rbase_url_hostnamersl >r " "C r Uc\\cczCzz : :F O !r ( ( * * 1 1# 6 66rmodelc|pd}|sdSd|vr|ddd}|dph|dpS|dp>|d p)|d p|d S) uAReturn True for model families that require ``max_completion_tokens``. OpenAI's newer families reject ``max_tokens`` on /v1/chat/completions with HTTP 400 ``unsupported_parameter`` — the caller must send ``max_completion_tokens`` instead. This covers: - ``gpt-4o`` / ``gpt-4o-mini`` / ``gpt-4o-*`` - ``gpt-4.1`` / ``gpt-4.1-*`` - ``gpt-5`` / ``gpt-5.x`` / ``gpt-5-*`` - ``o1`` / ``o1-*`` - ``o3`` / ``o3-*`` - ``o4`` / ``o4-*`` Handles vendor prefixes like ``openai/gpt-5.4`` by stripping to the tail. The URL-based check (``base_url_hostname == "api.openai.com"``) misses third-party OpenAI-compatible endpoints (custom OpenAI gateways, OpenRouter) that front these models and enforce the same parameter constraint, so name-based detection is required as a fallback. rF/r1rzgpt-4ozgpt-4.1zgpt-5o1o3o4)rrrsplitr)rms r"model_forces_max_completion_tokensrs( "##%%A u axx HHS!  R  X  << " "  <<   <<    <<     <<   rdomainct|}|sdS|pdd}|sdS||kp|d|zS)acReturn True when the base URL's hostname is ``domain`` or a subdomain. Safer counterpart to ``domain in base_url``, which is the substring false-positive class documented on ``base_url_hostname``. Accepts bare hosts, full URLs, and URLs with paths. base_url_host_matches("https://api.moonshot.ai/v1", "moonshot.ai") == True base_url_host_matches("https://moonshot.ai", "moonshot.ai") == True base_url_host_matches("https://evil.com/moonshot.ai/v1", "moonshot.ai") == False base_url_host_matches("https://moonshot.ai.evil/v1", "moonshot.ai") == False Frr[)rrrrendswith)rrrs rbase_url_host_matchesrs|!**H ul ! ! # # ) ) + + 2 23 7 7F u v  @!2!23rs00  !!!!!!  8 $ $555663$DD#DDTDDDD d| t (@     d +C     " T  $    "-U39--uS$Y7G-C----h EEE T E E  E * E  E EEEEP 4 4 4 4 44? 4 4 4( % $ BBB T B B B  B : B BBBBJ@ T @@ @ @@@@L  #  s    (=3=3====s33@@#@@@@@@ 3: #*    ))))777777( c d    FACAAAAAAAAr