(GjkdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZddlmZddlmZddlmZejeZejd dwd ZGddeZd ZdxdZdddydZhdZdzdZ d{d Z!d|d"Z"d}d%Z#d~d'Z$dd*Z%dd+Z&dd,Z'dd-Z(dd.Z)dd1Z* ddd4Z+dd5Z,dd6Z-dd8Z.dd:Z/dd;Z0dd=Z1dd>Z2dd@Z3ddDZ4dddFZ5ddGZ6ddHZ7ddIZ8ddLZ9ddSZ:ddUZ;dddWZdd_Z?dd`Z@ddaZAddbZBddcZCdddZDddeZEddfZFddgZGdhZHdiZIddkZJddlZKddmZLddnZMddpZNddqZOddtZPdduZQddvZRdS)uq``hermes plugins`` CLI subcommand — install, update, remove, and list plugins. Plugins are installed from Git repositories into ``~/.hermes/plugins/``. Supports full URLs and ``owner/repo`` shorthand (resolves to GitHub). After install, if the plugin ships an ``after-install.md`` file it is rendered with Rich Markdown. Otherwise a default confirmation is shown. ) annotationsN)Path)AnyOptional)get_hermes_home)cfg_get)masked_secret_prompt)maxsizereturn Optional[str]c 8tjd}|r|StjdkrBtjdd}tjdd}tjdd}tj|d d d tj|d d d tj|d d d tj|d d d g}|rY|tj|d d d d tj|d d d d fngd}|D]'}|r#tj |r|cS(dS)zResolve a git binary for subprocess use when ``PATH`` may be minimal. Matches other Hermes subprocess resolution: :func:`shutil.which` first, then common Git for Windows install paths and POSIX defaults. gitnt ProgramFileszC:\Program FileszProgramFiles(x86)zC:\Program Files (x86) LOCALAPPDATAGitcmdzgit.exebinPrograms)z /usr/bin/gitz/usr/local/bin/gitz/bin/gitN) shutilwhichosnameenvirongetpathjoinextendisfile)foundprogprog_x86local candidatescs >"57PQQ ~r22 GLLueY 7 7 GLLueY 7 7 GLL5% ; ; GLL5% ; ;      GLL E5)LLGLL E5)LL   HGG   "" HHH 4ceZdZdZdS)PluginOperationErrorzHRecoverable plugin install/update failure (CLI exits; HTTP maps to 4xx).N)__name__ __module__ __qualname____doc__r*r(r,r,@sRRRRr*r,rcVtdz }|dd|S)z9Return the user plugins directory, creating it if needed.pluginsT)parentsexist_ok)rmkdir)r3s r( _plugins_dirr7Js-)+G MM$M... Nr*F allow_subdirrstr plugins_dirr9boolc|std|r&|d}|std|dvrtd|d|rdnd}|D]}||vrtd|d|d ||z }|}||krtd|d  ||n!#t$rtd|d wxYw|S) aValidate a plugin name and return the safe target path inside *plugins_dir*. Raises ``ValueError`` if the name contains path-traversal sequences or would resolve outside the plugins directory. ``allow_subdir=True`` permits a single forward slash inside *name* so category-namespaced plugin keys like ``observability/langfuse`` or ``image_gen/openai`` (the registry keys emitted by ``_discover_all_plugins``) can be looked up. ``..`` and backslash are still rejected, leading and trailing slashes are stripped, and the resolved target must still live inside *plugins_dir*. Install paths leave this at the default ``False`` because a freshly-cloned plugin always lands top-level under ``~/.hermes/plugins//``. zPlugin name must not be empty./>...zInvalid plugin name 'z3': must not reference the plugins directory itself.)\r@)r>rAr@z': must not contain 'z'.z,': resolves to the plugins directory itself.z*': resolves outside the plugins directory.) ValueErrorstripresolve relative_to)rr;r9 bad_charsbadtargetplugins_resolveds r(_sanitize_plugin_namerJQs|( ;9:::?zz# ?=>> > { ]D ] ] ]   !-C 2CIYY $;;WTWWPSWWWXX X D ) ) + +F"**,, !!! VD V V V    +,,,,     TD T T T    Ms ;CC/> blobpulltreewikipullscommitissuesactionscommitsreleases identifiertuple[str, Optional[str]]c^|dr|dr7|tdd}|ddddddd}|d}t|d krt |dd r|d t vr|dd }d}|d d krOt|d kr#path/to/plugin → (, "path/to/plugin") NOTE: ``http://`` and ``file://`` schemes are accepted but will trigger a security warning at install time. )zhttps://http://zgit@zssh://file://zhttps://github.com/N?r r#r>.gitrMc3K|]}||V dSNr1.0ps r( z#_resolve_git_url..s'%@%@Aa%@a%@%@%@%@%@%@r*z.git/cg|]}||Sr1r1rbs r( z$_resolve_git_url..s > > >1A >Q > > >r*zInvalid plugin identifier: 'zi'. Use a Git URL or 'owner/repo' shorthand (optionally with a subdirectory: 'owner/repo/path/to/plugin').) startswithlensplitrCall_GITHUB_BROWSER_SEGMENTS removesuffixr partitionfindrB) rUrpartsreposubdirgit_url_fragmarkeridxowners r(_resolve_git_urlr{s6QRR  !6 7 7 Kc"788::;D::c1%%a(..sA66q9??DDDJJsOOE5zzQ3uRaRy>>eAhBZ6Z6ZQx,,V448v%%#e**// XX%@%@qrr%@%@%@@@FFsKKStFBU1XBBBBBFJJ *  )33C88 GQTZZ__45 5oof%% "99 !43V#4!45Gc&kk 1 3 34::3??FV^t, ,4 ? > ((--33C88 > > >E 5zzQAhat%)$$**3//::::::4((  (z ( ( (  r* clone_rootrtc<|}||z }||kr||jvrtd|d|std|d|std|d|S)aIResolve ``subdir`` inside ``clone_root``, rejecting path traversal. Guards against ``..`` segments, absolute paths, and symlinks that would escape the cloned repository. Returns the resolved directory path. Raises ``PluginOperationError`` if the path escapes the clone, doesn't exist, or is not a directory. zPlugin subdirectory 'z' escapes the repository.z#' does not exist in the repository.z' is not a directory.)rDr4r,existsis_dir)r|rt candidates r(_resolve_subdir_withinrs##%%Jf$--//IJ:Y5F#F#F" EF E E E         " OF O O O         " AF A A A    r*urlc|d}|dr |dd}|ddd}d|vr6|dddddd}|S)zCExtract the repo name from a Git URL for the plugin directory name.r>r^Nr rg:)rstripendswithrsplit)rrs r(_repo_name_from_urlrs ::c??D }}VCRCy ;;sA  r "D d{{{{3""2&--c155b9 Kr* plugin_dirdictc0|dz }|siS ddl}t|d5}||picdddS#1swxYwYdS#t$r(}t d||icYd}~Sd}~wwxYw)z;Read plugin.yaml and return the parsed dict, or empty dict. plugin.yamlrNutf-8encodingz$Failed to read plugin.yaml in %s: %s)r~yamlopen safe_load Exceptionloggerwarning)r manifest_filerfes r(_read_manifestrs.M    ! !  -' 2 2 2 +a>>!$$* + + + + + + + + + + + + + + + + + + =z1MMM s@A#A A#AA#AA## B-B BBNonecT|dD]}|j}||z }|so tj|||d|d|jdZ#t$r*}|d|jd|Yd}~d}~wwxYwdS)zCopy any .example files to their real names if they don't already exist. For example, ``config.yaml.example`` becomes ``config.yaml``. Skips files that already exist to avoid overwriting user config on reinstall. z *.examplez[dim] Created z from [/dim]z)[yellow]Warning:[/yellow] Failed to copy : N)globstemr~rcopy2printrOSError)rconsole example_file real_name real_pathrs r(_copy_example_filesrs # 44    % * !!   \9555 PiPP|7HPPP    X @QXXUVXX    s6A00 B$: BB$manifest list[str]cH|dpg}|sgSddlmg}|D]n}t|tr|d|i/t|t r*|dr||ofd|DS)zLReturn declared ``requires_env`` names that are unset in ``~/.hermes/.env``. requires_envr) get_env_valuerclg|]0}|d|d(|d1Sr)rrcsrs r(riz/_missing_requires_env_names..9sB [ [ [!AEE&MM [--PQRXPYBZBZ [AfI [ [ [r*)rhermes_cli.configr isinstancer:appendr)rr env_specsentryrs @r(_missing_requires_env_namesr*s<<//52L  //////I$$ eS ! ! $   fe_ - - - - t $ $ $6):): $   U # # # [ [ [ [y [ [ [[r*c|dpg}|sdSddlmm}ddlm}g}|D]n}t |tr|d|i/t |tr*|dr||ofd|D}|sdS|dd}| d |d |D]y} | d} | d d } | d d } | dd} d| }| r|d| z }| || r| d| d | r&td| d }n%td| d }n:#ttf$r&| d|dYdSwxYw|r>|| ||t j| <| d|dU| d| d|d{| dS)aPrompt for required environment variables declared in plugin.yaml. ``requires_env`` accepts two formats: Simple list (backwards-compatible):: requires_env: - MY_API_KEY Rich list with metadata:: requires_env: - name: MY_API_KEY description: "API key for Acme service" url: "https://acme.com/keys" secret: true Already-set variables are skipped. Values are saved to the user's ``.env``. rNr)rsave_env_value)display_hermes_homerc6g|]}|d|Srr1rs r(riz+_prompt_plugin_env_vars..`s,DDDQ==6+C+CDqDDDr*z this pluginz [bold]z6[/bold] requires the following environment variables: descriptionrrsecretF  — z [dim]Get yours at: rrz, [dim] Skipped (you can set these later in z /.env)[/dim]u [green]✓[/green] Saved to z/.envz [dim] Skipped (set z in z/.env later)[/dim])rrrrhermes_constantsrrr:rrrr rCinputEOFErrorKeyboardInterruptrr)rrrrrrrmissing plugin_namespecrdescrrlabelvaluers @r(_prompt_plugin_env_varsr<s(<<//52L ????????444444I$$ eS ! ! $   fe_ - - - - t $ $ $6):): $   U # # #EDDD)DDDG ,,v}55K MMa[aaabbbhhF|xx r**hhub!!(E**T   $ ^T^^ #E e  ? MM=#=== > > >  5,]$]]];;AACCm4mmm,,2244+,    MMmJ]J]J_J_mmm n n n FFF   h N4 ' ' '$BJt  MMW;N;N;P;PWWW X X X X MMf4ff=P=P=R=Rfff g g g g MMOOOOOs.A F<<2G32G3cddlm}ddlm}ddlm}|}|dz }|rl|d}||}||||dd |dS|||d |d |dd d |dS)z@Show after-install.md if it exists, otherwise a default message.rConsole)Markdown)Panelafter-install.mdrrgreenF) border_styleexpandz![green bold]Plugin installed:[/] z [dim]Location:[/] u ✓ Installed)rtitlerN) rich.consoler rich.markdownr rich.panelrr~ read_textr) rrUrrrr after_installcontentmds r(_display_after_installrs9$$$$$$&&&&&&      giiG!33M))7);; Xg    eeBWUCCCDDD   E2J22%/22$%         r*cddlm}|}||d|d||dS)z*Show confirmation after removing a plugin.rru[red]✗[/red] Plugin [bold]z[/bold] removed from N)rrr)rr;rrs r(_display_removedrs`$$$$$$giiG MMOOO MMYYYKYYZZZ MMOOOOOr*ct||d}|sedd|Dpd}|d|d|d|t jd |S) zUReturn the plugin path if it exists, or exit with an error listing installed plugins.Tr8z, c3LK|]}||jV dSra)rr)rcds r(rez,_require_installed_plugin..s1RRqxxzzRafRRRRRRr*z(none)[red]Error:[/red] Plugin 'z' not found in z. Installed plugins: r )rJr~riterdirrsysexit)rr;rrH installeds r(_require_installed_pluginrs "44 H H HF ==??IIRRk.A.A.C.CRRRRR^V^   . . .k . ."+ . .     Mr*forcetuple[Path, dict, str]c ddl} t|\}}n/#t$r"}tt ||d}~wwxYwt }|5}t|dz }t} | std tj | ddd|t |gddd } nD#t$r}td|d}~wtj $r}td |d}~wwxYw| j dkr4| jp| jpd } td | |rt#||} n|} t%| } | dp?|r/|ddddnt-|} t/||}n/#t$r"}tt ||d}~wwxYw| d}|x t1|}n,#tt2f$rtd|d|ddwxYw|t4kr0ddlm}td|d|dt4d|d d|r,|std|d|dt=j|t=j t | t |dddn #1swxYwY|dz p|dz }|s2|dz stB"d |dd!l#m$}tK||t%|}|dp|j&}|||fS)"zClone Git plugin into ``~/.hermes/plugins``. Returns ``(target_dir, installed_manifest, canonical_name)``. Raises ``PluginOperationError`` on failure. rNplugin$git is not installed or not in PATH.clonez--depth1T<)capture_outputtexttimeoutz%Git clone timed out after 60 seconds.rzGit clone failed: rr>r rgmanifest_versionPlugin 'z ' has invalid manifest_version 'z' (expected an integer).)recommended_update_commandz' requires manifest_version z), but this installer only supports up to z. Run z to update Hermes.zD' already exists. Use force reinstall or run `hermes plugins update z`.r plugin.yml __init__.pyz>%s has no plugin.yaml / __init__.py; may not be a valid pluginr)'tempfiler{rBr,r:r7TemporaryDirectoryrr) subprocessrunFileNotFoundErrorTimeoutExpired returncodestderrstdoutrCrrrrrrrJint TypeError_SUPPORTED_MANIFEST_VERSIONrrr~rrmtreemoverrrrrr)rUrrrurtrr;tmp tmp_clonegit_exeresulterr tmp_targetrrrHmvmv_intrhas_yamlrinstalled_manifestinstalled_names r(_install_plugin_corers OOO2*:66 222"3q66**12..K  $ $ & &E2#II( )++ O&'MNN N ^'9c7C NNK# FF !   &6 (   &7     ! !=7FM7R>>@@C&'BS'B'BCC C  #/ 6BBJJ"J!*--ll6** 5; ]FMM#   % %c1 - -b 1 1ATU\A]A]  6*; DDFF 6 6 6&s1vv..A 5 6\\, - - > R *   *5{55555  333HHHHHH*L{LLLL>YLL5577LLL  ==?? " *E{EE5@EEE M& ! ! ! C OOS[[111KE2E2E2E2E2E2E2E2E2E2E2E2E2E2E2N&..00TVl5J4R4R4T4TH  Vm3;;==  L    %$$$$$ ***'//'++F33Bv{N %~ 55s AAA*2L+C L D C##D 5DD  B;LGL H!G>>HLH.-L.)IB-LLLenableOptional[bool]c&ddlm}|} t|\}}nC#t$r6}|d|t jdYd}~nd}~wwxYw|dr|d|r|d|d |d n|d|d  t|| \}} } nC#t$r6}|d|t jdYd}~nd}~wwxYw|d z sG|dz s0|dz s|d| dt| |t|||} | t j rtt jrV t!d| d} | dv} n#t&t(f$rd} YnwxYwd} | r~t+} t-}| | || t3| t5||d| dn|d| d|d|d|dS)zInstall a plugin from a Git URL or owner/repo shorthand. After install, prompt "Enable now? [y/N]" unless *enable* is provided (True = auto-enable without prompting, False = install disabled). rr[red]Error:[/red] r NrXrYzs[yellow]Warning:[/yellow] Using insecure/local URL scheme. Consider using https:// or git@ for production installs.z [dim]Cloning z (subdir: z )...[/dim] ...[/dim]rrrrz[yellow]Warning:[/yellow] zQ doesn't contain plugin.yaml or __init__.py. It may not be a valid Hermes plugin.z Enable 'z' now? [y/N]: >yyesF [green]✓[/green] Plugin [bold]z[/bold] enabled.zB[dim]Plugin installed but not enabled. Run `hermes plugins enable z` to activate.[/dim]z=[dim]Restart the gateway for the plugin to take effect:[/dim]z#[dim] hermes gateway restart[/dim])rrr{rBrrrrjrr,r~rrstdinisattyrrrClowerrr_get_enabled_set_get_disabled_setadddiscard_save_enabled_set_save_disabled_set)rUrrrrru_subdirrrHrr should_enableanswerenableddisableds r( cmd_installr*%s%$$$$$giiG+J77  .1..///  011   G   : LgLLLLLMMMM 8g8889995I 6 6 6 2"NN  .1..///   ] " * * , , f|6K5S5S5U5U  fhh    D D D D   .8886:...M 9     "#*"3"3"5"5 " &????%''%%''!', 6 /0 & & & %  &"M "$$$&& N###((('"""8$$$ O~ O O O       O*8 O O O    MMQRRR MM7888 MMOOOOOs>% A%,A  A% C!! D!+,DD!#;HH54H5cddlm}|}t} t|||}nC#t$r6}|d|t jdYd}~nd}~wwxYw|dz s-|d|dt jd|d |d t|\}}|s,|d|t jdt||| }d |vr|d |d dS|d |d|d|ddS)zAUpdate an installed plugin by pulling latest from its git remote.rrrr Nr^rz@' was not installed from git (no .git directory). Cannot update.z[dim]Updating rAlready up to daterz[/bold] is already up to date.z[/bold] updated.[dim]r) rrr7rrBrrrr~_git_pull_plugin_dirrrC) rrrr;rHrokoutputouts r( cmd_updater2{s$$$$$$giiG..K*4gFF  .1..///   VO # # % %  3 3 3 3      MM24222333%f--JB  3633444  ((( ,,..Cs"" St S S S       OOOOPPP )c)))*****2 A2,A--A2c6ddlm}|}t} t|||}nC#t$r6}|d|t jdYd}~nd}~wwxYwtj |t||dS)z#Remove an installed plugin by name.rrrr N) rrr7rrBrrrrrr)rrrr;rHrs r( cmd_remover5s$$$$$$giiG..K*4gFF  .1..///   M&T;'''''r3setc ddlm}|}t|ddg}t|trt |n t S#t $rt cYSwxYw)zRead the disabled plugins set from config.yaml. An explicit deny-list. A plugin name here never loads, even if also listed in ``plugins.enabled``. r load_configr3r)default)rr9rrlistr6r)r9configr)s r(r r s 11111169j"EEE *8T : :Es8}}}E uu sAAA21A2r)cddlm}m}|}d|vri|d<t||dd<||dS)z/Write the disabled plugins list to config.yaml.rr9 save_configr3r)Nrr9r@sorted)r)r9r@r=s r(r$r$sg:::::::: []]Fy$*8$4$4F9j!Kr*cb ddlm}|}|di}t|tst S|dg}t|t rt |n t S#t$rt cYSwxYw)zRead the enabled plugins allow-list from config.yaml. Plugins are opt-in: only names here are loaded. Returns ``set()`` if the key is missing (same behaviour as "nothing enabled yet"). rr8r3r()rr9rrrr6r<r)r9r= plugins_cfgr(s r(rrs 111111jjB// +t,, 55L//)R00)'488Cs7|||ceeC uu sAB ABB.-B.r(cddlm}m}|}d|vri|d<t||dd<||dS)z.Write the enabled plugins list to config.yaml.rr?r3r(NrA)r(r9r@r=s r(r#r#se:::::::: []]Fy#)'??F9i Kr*ct}|D]$}|dks |dkr |dcS%fd|D}t|dkr|dSdS)u]Resolve a user-supplied plugin identifier to its canonical registry key. Accepts either the bare manifest name (``nemo_relay``), the directory name, or the full path-derived key (``observability/nemo_relay``) and returns the canonical key the loader gates on (``manifest.key`` or, for a flat plugin, the bare name). Returns ``None`` when no plugin matches. This is the single normalization point so ``hermes plugins enable`` / ``disable`` write the same key that ``PluginManager`` matches against — nested category plugins (e.g. ``observability/nemo_relay``) included. r_rcjg|]/}|dddk'|d0S)r_r>rgrlrcrrs r(riz'_resolve_plugin_key..s=UUUTU1X^^C=P=PQS=T5T5TE!H5T5T5Tr*r N_discover_all_pluginsrkrentriesr leaf_matchess` r(_resolve_plugin_keyrOs$%%G 58  tuQx//8OOO 0 VUUU'UUUL <AA 4r*Optional[tuple]ct}|D],}|dks |dkr|d|dfcS-fd|D}t|dkr|dSdS)a3Resolve *name* to ``(canonical_key, source)`` or ``None`` if no match. Mirrors :func:`_resolve_plugin_key`'s normalization but also returns the plugin's source (``"bundled"``, ``"user"``, ``"project"``, ...) so the enable path can tell whether a built-in-override consent prompt is needed. r_rr\czg|]7}|dddk'|d|df8S)r_r>rgr\rHrIs r(riz2_resolve_plugin_key_and_source..sP!& 58>>#&&r* * * q58 * * *r*r NrJrLs` r(_resolve_plugin_key_and_sourcerSs$%%G(( 58  tuQx//!HeAh' ' ' ' 0*1L <AA 4r* plugin_idkeyrcddlm}m}|}|di}t |t si}||d<|di}t |t si}||d<||i}t |t si}|||<t |||<||dS)zEWrite ``plugins.entries.. = value`` into config.yaml.rr?r3rMN)rr9r@ setdefaultrrr<) rTrUrr9r@r=rDrMrs r(_set_plugin_entry_flagrXs:::::::: []]F##Ir22K k4 ( (( 'y$$Y33G gt $ $)!( I   y" - -E eT " "#" eE#JKr*allow_tool_overridecddlm}|}t|}|-|d|dt jd|\}}t }t}||vo||v} | s||| || dd} | |kr| | t|t||d |d n|d |d |d krdSt|||dS)aAdd a plugin to the enabled allow-list (and remove it from disabled). For non-bundled plugins, prompt the operator about granting the privileged ``allow_tool_override`` capability (replacing built-in tools like ``shell_exec`` / ``write_file``). ``allow_tool_override`` is a tri-state: ``True`` grants without prompting, ``False`` declines without prompting, ``None`` (default) asks interactively. Bundled plugins are trusted and never prompted. rrN [red]Plugin '$' is not installed or bundled.[/red]r r>rgrz.[/bold] enabled. Takes effect on next session. [dim]Plugin 'z' is already enabled.[/dim]bundled)rrrSrrrrr r!r"rlr#r$_resolve_tool_override_grant) rrYrrresolvedrUsourcer(r)already_enabledbares r( cmd_enablerd-s%$$$$$giiG.d33H PdPPPQQQ  KC  G ""HWn<H)rrrYu![green]✓[/green] Granted [bold]zD[/bold] permission to override built-in tools ([dim]plugins.entries.z".allow_tool_override: true[/dim]).r-z@ may not override built-in tools. Re-run `hermes plugins enable z2 --allow-tool-override` to grant this later.[/dim])rrCrrrrXr)rrUrYpromptr'rTs r(r_r__s(" !  ]]6**002288::FF+,   FFF $ 4I9&;=PQQQ    S S S%. S S S       C  &)        s9AAAcNddlm}|}t|}|-|d|dt jdt }t}||vr||vr|d|ddS||| d d }||kr||| |t|t||d |d dS) zBRemove a plugin from the enabled allow-list (and add to disabled).rrNr[r\r r]z' is already disabled.[/dim]r>rgu"[yellow]⊘[/yellow] Plugin [bold]z/[/bold] disabled. Takes effect on next session.) rrrOrrrrr r"rlr!r#r$)rrrrUr(r)rcs r( cmd_disablerhsO$$$$$$giiG d # #C { PdPPPQQQ    G ""H 'cXoo GcGGGHHH OOC 99S>>" D s{{ LLgx    MM ( ( ( (r*c$t|duS)z>Return True if a plugin with *name* (bare name or key) exists.N)rOrs r(_plugin_existsrjs t $ $D 00r*rprefixc|dz }|s|dz }|sdS ddl}n#t$rd}YnwxYw|j}d}d}|r t |d5}||pi}dddn #1swxYwY|d|j}|d d}|d d}n#t$rYnwxYw|r |d |jn|} |||| fS) z|Read a plugin.yaml manifest and return (name, version, description, key). Returns None if no manifest file exists. rrNrrrrrversionrr>)r~r ImportErrorrrrrr) rrkrrrrmrrrrUs r(_read_manifest_inforos  %M    ! !)L(    ! !t  6DGK  mg666 3!>>!,,2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3<<//Dll9b11G",,}b99KK    D "( 2V  af   dC +s **sF; A  A C#,B C#BC#BA C## C0/C0basera skip_namesdepthrseenc |sdSt|D]}|s|dkr |r |j|vr)t ||}|?|\}} } } | |vr|dkrM|} |dkr|dz rd} || | | || f|| <z|dkr|r |d|jn|j} t ||t| |dz|dS) zRecursive directory scan matching PluginManager._scan_directory_level. Populates *seen* with key -> (name, version, description, source, dir, key). Nrr^userr^rr r>)rrBrrror~ _scan_levelr6)rprarqrkrrrsrinforrmrrU src_label sub_prefixs r(rvrvsA ;;== DLLNN # #CCxxzz   A::*::)=)= "1f--  .2 +D';d{{v22IQZ$7$7$9$9! w Y3GDI  A:: -3?))))) Avsuuj%!)TBBBB%CCr*r<c i}ddlm}|}|dddhftdtffD]\}}}t |||dd|t |S)u0Return a list of (name, version, description, source, dir_path, key) for every plugin the loader can see — user + bundled + project. Matches the ordering/dedup of ``PluginManager.discover_and_load``: bundled first, then user, then project; user overrides bundled on key collision. rget_bundled_plugins_dirr^memorycontext_enginerur)hermes_cli.pluginsr|r7r6rvr<values)rsr| repo_pluginsrpraskips r(rKrKsD;:::::**,,L y8-=">? '55fd D&$At4444   r*rc.||vs||vrdS||vs||vrdSdS)zAReturn the user-facing activation state for a plugin name or key.r)r(z not enabledr1)rr(r)rUs r(_plugin_statusrs5 x3(??z w#..y =r*rMargsrc|}t|ddst|ddr d|D}t|ddrfd|D}|S)z*Apply ``hermes plugins list`` CLI filters. no_bundledFruc*g|]}|ddk|S)r\r^r1)rcrs r(riz*_filter_plugin_entries..s&IIIe58y3H3HE3H3H3Hr*r(c Zg|]'}t|d|ddk%|(S)rr_rUr()r)rcrr)r(s r(riz*_filter_plugin_entries..sG   eAhuQxHHHIUU UUUr*)getattr)rMrr(r)filtereds `` r(_filter_plugin_entriesr sHt\5))JWT65-I-IJIIxIIItY&&      '    Or* Any | Nonec Jddlm}ddlm}|}t }|s,|d|ddSt tt||}t|ddr4fd |D}t tj |d dSt|d drK|D]F\}}}} } } t|| } t | dd| ddt|dd|GdS|s|ddS|dd} | dd| d| dd| d| dd|D]V\}}}} } } t|| }|dkrd} n |dkrd} nd } | || t||| W||| ||d!|d"|d#|d$dS)%z>List all plugins (bundled + user) with enabled/disabled state.rr)Tablez [dim]No plugins installed.[/dim]:[dim]Install with:[/dim] hermes plugins install owner/repoNjsonFc jg|]/\}}}}}}|t||t|||d0S)r)rstatusrmrra)rr:) rcrrmrra_dirrUr)r(s r(rizcmd_list..)sd    >g{FD# (wcJJJw<<*       r*r])indentplainr12 8z3[dim]No plugins matched the selected filters.[/dim]Plugins)r show_linesNamebold)styleStatusVersiondim DescriptionSourcer)z[red]disabled[/red]r(z[green]enabled[/green]z[yellow]not enabled[/yellow]zA[dim]Compact view:[/dim] hermes plugins list --plain --no-bundledz-[dim]Interactive toggle:[/dim] hermes pluginsz?[dim]Enable/disable:[/dim] hermes plugins enable/disable uI[dim]Plugins are opt-in by default — only 'enabled' plugins load.[/dim])rr rich.tablerrKrrr rrrdumpsrr: add_columnadd_row)rrrrrMpayloadrrm _descriptionrarrUrtabler status_namer)r(s @@r(cmd_listrs3$$$$$$      giiG#%%G  8999 RSSS  G ""H$WdGXFFGtVU##       BI     dj+++,,,tWe$$>E E E :D'<s#D'8EEEF VCCCCCCCLLCCCTCC D D D D  KLLL E e 4 4 4E V6*** X Ye,,, ]### XU+++9@GG5g{FD#$T7H#FFF * $ $*FF I % %-FF3F dFCLL+vFFFF MMOOO MM% MMOOO MMUVVV MMABBB MMSTTT MM]^^^^^r*list[tuple[str, str]]c\ ddlm}d|DS#t$rgcYSwxYw)zAReturn [(name, description), ...] for available memory providers.rdiscover_memory_providerscg|] \}}}||f Sr1r1)rcrr_avails r(riz._discover_memory_providers..cs#SSS!3tVt SSSr*)plugins.memoryrrrs r(_discover_memory_providersr_s[<<<<<<SS7P7P7R7RSSSS  s  ++cg}t} ddlm}|D]6\}}}||vr,|||f||7n#t $rYnwxYw ddlm}m}||}|r6t|ddr%|j |vr||j dfn#t $rYnwxYw|S)aZReturn [(name, description), ...] for available context engines. Includes repo-shipped engines from ``plugins/context_engine/`` AND plugin-registered engines (third-party engines installed as Hermes plugins via ``ctx.register_context_engine``). Repo-shipped descriptions win when a plugin-registered engine collides on name. r)discover_context_engines)discover_pluginsget_plugin_context_enginerNzinstalled plugin) r6plugins.context_enginerrr!rrrrrr) enginesrsrrrrrr plugin_engines r(_discover_context_enginesrhsH&(GUUD CCCCCC":":"<"<   D$4d|,,,        RRRRRRRR1133  EW]FDAA EmFX`dFdFd NNM.0BC D D D       Ns%AA A'&A'+AC C  C cp ddlm}|}t|dddpdS#t$rYdSwxYw)zBReturn the current memory.provider from config (empty = built-in).rr8r}providerrr:rr9rrr9r=s r(_get_current_memory_providerrsb111111vxR@@@FBF rr $' 55cp ddlm}|}t|dddpdS#t$rYdSwxYw)z.Return the current context.engine from config.rr8contextengine compressorr:rrs r(_get_current_context_enginersb111111vy(LIIIY\Y ||rchddlm}m}|}d|vri|d<||dd<||dS)z'Persist memory.provider to config.yaml.rr?r}rNrr9r@rr9r@r=s r(_save_memory_providerrs_:::::::: []]Fvx#'F8Z Kr*chddlm}m}|}d|vri|d<||dd<||dS)z&Persist context.engine to config.yaml.rr?rrNrrs r(_save_context_enginers_:::::::: []]Fy"&F9hKr*cddlm}t}t}dg}dg}d}|D]R\}}|||r|d|n|}||||krt |dz }S|rC||vr?||||dt |dz }|d|| } || } | |krt | d Sd S) zDLaunch a radio picker for memory providers. Returns True if changed.rcurses_radiolistzbuilt-in (default)rrr (not found)zMemory Provider (select one)ritemsselectedTF)hermes_cli.curses_uirrrrrkr) rcurrent providersrnamesrrrrchoice new_providers r(_configure_memory_providerrsK555555*,,G*,,I" "E DEH&& d T+/94'''''T U 7??5zzA~H"7%'' W ---...u::>  ,F =Lwl+++t 5r*cddlm}t}t}dg}dg}d}|D]R\}}|||r|d|n|}||||krt |dz }S|dkrC||vr?||||dt |dz }|d|| } || } | |krt | d Sd S) zCLaunch a radio picker for context engines. Returns True if changed.rrzcompressor (default)rrr rzContext Engine (select one)rTF)rrrrrrkr) rrrrrrrrrr new_engines r(_configure_context_enginersN555555)++G'))G$ $E NEH&& d T+/94'''''T U 7??5zzA~H,7%#7#7 W ---...u::>  +F vJWZ(((t 5r*c ddlm}|}t}t}t }g}g}t }t |D]q\}\} } } } } }| r| d| n| }| dkr|d}|| ||| |vs||vr| |vr||vr||rtpd}t}d|tfd|tfg}t|}t|}|s.|s,|d |d d Stjs|d d S dd l}t'|||||||d S#t($rt+||||||Yd SwxYw) uJInteractive composite UI — general plugins + provider plugin categories.rrrr^z [bundled]built-inzMemory ProviderzContext EnginezE[dim]No plugins installed and no provider categories available.[/dim]rNz0[dim]Interactive mode requires a terminal.[/dim])rrrKrr r6 enumeraterr!rrrrr<rrrrcurses_run_composite_uirn_run_composite_fallback)rrrM enabled_set disabled_set plugin_names plugin_labelsplugin_selectedir_versionrra_drUrcurrent_memorycurrent_context categories has_pluginshas_categoriesrs r( cmd_togglersi$$$$$$giiG$%%G"$$K$&&LLMeeO=Fw=O=O##9 9D(KS2=G4.....4 Y  (((ED!!!U### K  3+#5#54|;S;SX[coXoXo    " " "233AzN133O N,FG ?,EFJ |$$K*%%N ~ ]^^^ RSSS 9     HIIIC &, & G = = = = = CCC m_ ,j' C C C C C CCsFGGc ddlm}t|t|tzdddfd}||t} t|} t |D]I\} } | vr+| | | | 4| | Jt} | | k}| |k}|s|ret| t| | dt| dt|t| z dndkr| d d r:tpd }t}| d |d |ddksd r| d| dS)z._drawGs       T     % % ' ' '   Q 2B 7 7 7   Q 3R 8 8 8   Q 12 6 6 6   QV]Q%6%6F->$>??F''&&Q a00CI%%66x@@@@ )+BB--------- 6@n3 8V"(&(("AEM*=>!*PRVWPWPW < > > L*%@%B%B & .JrN"(!1!1   d+++!,,..d"..000"55777",,Q0BBGGG",,Q0CRHHH",,Q0A2FFF",,QV]Q5F5FFL^`bccc***)2r222I%%7;M"34F )+BB--------- 6@n3 8V"(&(("AEM*=> )PRVWPWPW < > > L*%@%B%B & .JrN "(!1!1   d+++!,,..d"..000"55777",,Q0BBGGG",,Q0CRHHH",,Q0A2FFF",,QV]Q5F5FFL^`bccc***SXX&&37 /0}~ s]A0E22 E?>E?4AH HH=K K'&K'AM M-,M-4P PPu% [green]✓[/green] General plugins: z enabled, z disabled.z& [dim]General plugins unchanged.[/dim]rru*[green]✓[/green] Memory provider: [bold]z[/bold] Context engine: [bold]z[/bold]z/[dim]Changes take effect on next session.[/dim]N)rrr6rkwrapperrr!r"rr#r$rrr)rrrrr)rrrrC new_enabled new_disabledrr prev_enabledenabled_changeddisabled_changed new_memory new_contextr>r?r@rArBs` ` ` @@@@@r(rr9s100000  ! !FL!!Iz??Ll*K(-EJJMJJJJJJJJJJJJX NN5KMMM uuKH L\**##4 ;; OOD ! ! !   & & & &   T " " " "#%%L!\1O#x/A*A+&&&<(((  @K8H8H @ @<  3{#3#33 @ @ @     Q ?@@@() 133Az 133   :J : :%0 : : :   1}} &9:} GHHH MMOOOOOr*c Tddlm}m}t|d|j|rt |}t|d|jt|d|j t|D]8\} } | |vr|d|jnd} td | d | d zd d | 9t t|d|j } | snst| d z } d| cxkrt|krnn| | hn#ttt f$rYdSwxYwtt }t |}t|D]I\} }| |vr+||||4||Jt'}||ks||krt)|t+||rt|d|jt|D]%\}\}}}td |d zd |d|d&t t|d|j } | rEt| d z }d|cxkrt|krnn||dn#ttt f$rYnwxYwtdS)z1Text-based fallback for the composite plugins UI.r)Colorscolorz Pluginsz General Pluginsz& Toggle by number, Enter to confirm. Tu[✓]z[ ]rrr z>2z. z" Toggle # (or Enter to confirm): Nz Provider Pluginsr]z" Configure # (or Enter to skip): r])hermes_cli.colorsrMrNrYELLOWr6DIMrGREENrrCrrkr rBrrr!r"rr#r$)rrrr)rrrMrNr>rrrxvalryrErFrrGr5r6r7r<s r(rr>s0/////// %% v} - -... -_%% ee)6=99::: ee=vzJJKKK %m44 9 95<=KKz6<888U7677AE777778888 GGG EE"F SSTTZZ\\#hhl////c,///////66u=== 18<     GGG  55 MM  .. ' 'GAtF{{%%%$$T****  &&&&')) , & &,(*B*B k * * * | , , ,  ee*FM::;;;3>>>>>,,.. ? - -D;;== t I!! -))44!).>!?!?!E2--I$..y99E--$},,,,, -       4s= BB"B"" B/.B/3BEE E"!E"ct|}|sdSddlm}m}|}|d}t |t si}||d<d}|D]T\}} t | ts|r|| vr| |d}9|| vr| |d}U|r |s |s|g|d<d}|r ||dSdS)zAdd or remove a plugin's toolset from platform_toolsets for all platforms. Only acts if the plugin actually provides tools (has a toolset key). Nrr?platform_toolsetsFTcli) rnrr9r@rrrrr<rremove) rr toolset_keyr9r@r=rpr=platformts_lists r(_toggle_plugin_toolsetrvsS *$//K :::::::: []]F #677 ' . .8&7"#G.4466  ''4((    ')){+++ G # # NN; ' ' 'Gg&7$/=%  Fr*c"t|s dd|ddSt}t}|rm||vr ||vrd|ddS||||t |t |t|dd|ddS||vr ||vrd|ddS||||t |t |t|dd|ddS)zEnable or disable a plugin in ``config.yaml`` (runtime allow/deny lists). For plugins that provide tools (toolsets), also toggles the toolset in ``platform_toolsets`` so the agent actually sees the tools in sessions. Frz' is not installed or bundled.rWT)r/r unchanged)r)rjrr r!r"r#r$rv)rr(r\r]s r("dashboard_set_agent_plugin_enabledrysO $  W&U&U&U&UVVV   B   C> 2::$c//4@@ @ t  D"3tD1111Du=== 2~~$#++Dt<<<JJtGGDMMMbs4....5 9 99r*Optional[Path]ct} t||d}n#t$rYdSwxYw|r|ndS)z>Resolved path under ``~/.hermes/plugins/`` if it exists.Tr8N)r7rJrBr)rr;rHs r(_user_installed_plugin_dirr| s_..K&t[tLLL tt]]__ .66$.s # 11ct|}|dd|dtddS|dz s dd|ddSt|\}}|sd|dSd d lm}t ||d |v}d |||d S)z1``git pull`` inside ``~/.hermes/plugins/``.NFr' was not found under r?rWr^z-' is not a git checkout; cannot pull updates.rrr,T)r/rr0rx)r|r7r~r.rrr)rrHr/msgrrxs r(dashboard_update_user_pluginr*s ' - -F ~MMMLNNMMM   VO # # % % SSSS   #6**GB +c***$$$$$$ ***$+I) L LLr*rHtuple[bool, str]c t}|sdS tj|ddgdddt|}n"#t$rYdStj$rYdSwxYw|jdkr:|jpd p|j }d |pd fSd|j fS) N)FrrLz --ff-onlyTr)rrrcwd)Fz$Git pull timed out after 60 seconds.rrFzgit pull failed.) r)rrr:rrrrrCr)rHrr r s r(r.r.Ds%''G =<< = fk *F     ===<<<  $===<<<=A}"))++Dv}/B/B/D/Dc//// $$&& &&s)> A AAct}tD]\}}}}}}||kr |dkrdddcSt|}| dd|d|ddStj|d |d S) z7Delete a plugin tree under ``~/.hermes/plugins/`` only.r^Fz5Bundled plugins cannot be removed from the dashboard.rWNrr~r?T)r/r)r7rKr|rr) rr;n_verrsrc_pathrkrHs r(dashboard_remove_user_pluginr[s..K)>)@)@cc%4S% 99 ))*abb b b b ' - -F ~JJJKJJJ    M& % %%r*ct|dd}|dkrQd}t|ddrd}nt|ddrd}t|jt|dd| dS|d krt|jdS|d vrt |jdS|dkrAd}t|d drd}nt|d drd}t |j|dS|dkrt|jdS|dvrt|dS|tdSddl m }| d|dtjddS)z$Dispatch hermes plugins subcommands.plugins_actionNinstallrFT no_enabler)rrupdate>rmrr uninstallrYno_allow_tool_override)rYdisable>lsr<rrz[red]Unknown plugins action: z[/red]r )rr*rUr2rr5rdrhrrrrrrr)raction enable_argallow_overriders r(plugins_commandrms T+T 2 2F  45 ) ) JJ T; . . J O$//      8  49 0 0 049 8   4. 6 6 #!NN T3U ; ; #"N49.AAAAAA 9  DI > ! !  (((((( FFFFGGG  r*)r r )r r)rr:r;rr9r<r r)rUr:r rV)r|rrtr:r r)rr:r r:)rrr r)rrr r)rrr r)rrr r)rrrUr:r r)rr:r;rr r)rr:r;rr r)rUr:rr<r r)FN)rUr:rr<rrr r)rr:r r)r r6)r)r6r r)r(r6r r)rr:r r )rr:r rP)rTr:rUr:rr<r rra)rr:rYrr r)rUr:rYrr r)rr:r r<)rrrkr:)rprrar:rqr6rkr:rrrrsrr r)r r<)r) rr:r(r6r)r6rUr:r r:) rMr<rrr(r6r)r6r r<)rrr r)r r)r r:)r r<)r r)rUr:rr<rr<r rU)rr:rr<r r)rr:r(r<r rU)rr:r rz)rr:r rU)rHrr r)Sr0 __future__r functoolsrloggingrrrrpathlibrtypingrrrrrrhermes_cli.secret_promptr getLoggerr-r lru_cacher)rr,rr7rJrnr{rrrrrrrrrrr*r2r5r r$rr#rOrSrXrdr_rhrjrorvrKrrrrrrrrrrrrrrr`rnrvryr|rr.rrr1r*r(rs#"""""    ,,,,,,%%%%%%999999  8 $ $Q DSSSSS9SSS  666666r   @@@@F:        *\\\\$HHHHV:    $b6b6b6b6N!SSSSSl%+%+%+%+P(((("    $6*(/D/D/D/D/Dd% % % % P@1111 ++++< C C C CF*    ?_?_?_?_?_N@####L####V5C5C5C5CpBBBJ9 9 9 x....b++++\####L::::B////MMMM4''''.&&&&$''''''r*