JjUdZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z ddl mZddlmZmZmZejeZiddd d d d d dddddddddddddddddddd d!d"d#d$d%d&d'id(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGZdHedI<ejdJZGdKdLeZe dMNGdOdPZdQZdRZddUZddWZ dd[Z!dd]Z"dd^Z#dd`Z$ddbZ%dddZ&ddeZ'ddfZ(ddgZ)ddhZ*ddiZ+djdkddpZ,ddqZ-ddrZ.dMdsdduZ/ddvZ0ddwZ1ddyZ2dzdsdd|Z3dzdsddZ4dS)u Lazy dependency installer for opt-in Hermes Agent backends. Many Hermes features (Mistral TTS, ElevenLabs TTS, Honcho memory, Bedrock, Slack, Matrix, etc.) require Python packages that not every user needs. The historical approach was to bundle them all under ``pyproject.toml`` extras (``hermes-agent[all]``) and install them eagerly at setup time. That has two problems: 1. **Fragility.** When one extra's transitive dependency becomes unavailable on PyPI (quarantined for malware, yanked, broken upload), the *entire* ``[all]`` resolve fails and fresh installs silently fall back to a stripped tier — losing 10+ unrelated extras at once. 2. **Bloat.** A user who only ever talks to one provider pulls hundreds of packages they will never import. The lazy-install pattern fixes both. Backends call :func:`ensure` at the top of their first-import path. If the deps are missing, ``ensure`` checks the ``security.allow_lazy_installs`` config flag (default true) and runs a venv-scoped pip install. If the user has explicitly disabled lazy installs, ``ensure`` raises :class:`FeatureUnavailable` with a clear remediation hint pointing at ``hermes tools`` or the manual pip command. Security model: * **Venv-scoped by default.** Installs target ``sys.executable`` in the active venv. We never touch the system Python. * **Durable-target mode (immutable images).** When the deployment seals the agent's own venv (the Docker image sets ``HERMES_DISABLE_LAZY_INSTALLS=1`` and makes ``/opt/hermes`` read-only), setting ``HERMES_LAZY_INSTALL_TARGET`` redirects lazy installs to a writable directory on the durable data volume (e.g. ``/opt/data/lazy-packages``). That directory is **appended to the end of ``sys.path``** — never prepended, never exported via ``PYTHONPATH`` — so the agent's own site-packages wins every name collision. A package installed this way can only ADD new importable modules; it can never shadow, downgrade, or break a module the core already ships. The worst a bad/incompatible backend package can do is fail to import and report itself unavailable — the agent core stays healthy. This is the structural guarantee that a lazily installed package cannot brick Hermes, which is what made it safe to seal the venv in the first place. Compiled-wheel safety across image rebuilds is handled by an ABI/Python-version stamp on the target subdir (see :func:`_ensure_target_ready`). * **PyPI by package name only.** Specs may be ``"package>=1.0,<2"`` etc. We do NOT support ``--index-url`` overrides, ``git+https://``, file: paths, or any other input that could be hijacked by a malicious config. * **Allowlist.** Only specs that appear in :data:`LAZY_DEPS` can be installed via this path. A typo in feature name doesn't get the user install-anything semantics. * **Opt-out.** Setting ``security.allow_lazy_installs: false`` in ``config.yaml`` disables runtime installs in BOTH modes. Users in restricted networks or strict security postures can pin themselves to whatever was installed at setup time. * **Offline detection.** If the install fails (offline, mirror down, PyPI 404 / quarantine), we surface the failure as :class:`FeatureUnavailable` with the actual pip stderr — no silent retries, no caching of bad state. Adding a new backend: 1. Add an entry to :data:`LAZY_DEPS` with the package specs. 2. At the top of the backend module's import path, call ``ensure("feature.name")`` inside a try/except that converts :class:`FeatureUnavailable` to a useful runtime error. ) annotationsN) dataclass)Path)AnyCallableOptionalzprovider.anthropic)zanthropic==0.87.0zprovider.bedrock)zboto3==1.42.89zprovider.vertex)zgoogle-auth==2.55.1zprovider.azure_identity)zazure-identity==1.25.3z search.exa)zexa-py==2.10.2zsearch.firecrawl)zfirecrawl-py==4.17.0zsearch.parallel)zparallel-web==0.4.2z tts.mistral)zmistralai==2.4.8ztts.edge)zedge-tts==7.2.7ztts.elevenlabs)zelevenlabs==1.59.0z stt.mistralzstt.faster_whisper)zfaster-whisper==1.2.1zsounddevice==0.5.5z numpy==2.4.3z image.fal)zfal-client==0.13.1z memory.honcho)zhoncho-ai==2.0.1zmemory.hindsight)zhindsight-client==0.6.1zmemory.supermemory)zsupermemory==3.50.0z memory.mem0)zmem0ai==2.0.10zplatform.telegram)z#python-telegram-bot[webhooks]==22.6zplatform.discord)zdiscord.py[voice]==2.7.1zbrotlicffi==1.2.0.1aiohttp==3.14.1zplatform.slack)zslack-bolt==1.27.0zslack-sdk==3.40.1r platform.matrix)zmautrix[encryption]==0.21.0zaiosqlite==0.22.1zasyncpg==0.31.0zaiohttp-socks==0.11.0r zplatform.dingtalk)zdingtalk-stream==0.24.3zalibabacloud-dingtalk==2.2.42 qrcode==7.4.2zplatform.feishu)zlark-oapi==1.5.3r zplatform.wecom_callback)zdefusedxml==0.7.1zplatform.teams)zmicrosoft-teams-apps==2.0.13.4r zterminal.modal)z modal==1.3.4zterminal.daytona)zdaytona==0.155.0zskill.google_workspace)z!google-api-python-client==2.194.0zgoogle-auth-oauthlib==1.3.1zgoogle-auth-httplib2==0.3.1z skill.youtube)zyoutube-transcript-api==1.2.4ztool.acp)zagent-client-protocol==0.9.0ztool.dashboard)zfastapi==0.133.1zuvicorn[standard]==0.41.0starlette==1.0.1zpython-multipart==0.0.27z tool.vision)zPillow==12.2.0ztool.computer_use)z mcp==1.26.0r zdict[str, tuple[str, ...]] LAZY_DEPSz]^[A-Za-z0-9_][A-Za-z0-9_.\-]*(?:\[[A-Za-z0-9_,\-]+\])?(?:[<>=!~]=?[A-Za-z0-9_.\-+,*<>=!~]+)?$c,eZdZdZd fd Zd d ZxZS) FeatureUnavailablezA lazily-installable feature is missing and cannot be made available. Either the deps were never installed and the user has disabled lazy installs, or the install attempt failed. featurestrmissingtuple[str, ...]reasonc||_||_||_t|dSN)rrrsuper__init___format)selfrrr __class__s 5/home/rurouni/.hermes/hermes-agent/tools/lazy_deps.pyrzFeatureUnavailable.__init__s>    (((((returnc |dd|jD}d|jd|jd|d|d S)N c34K|]}t|VdSrrepr.0ss r z-FeatureUnavailable._format.. s(;;T!WW;;;;;;rzFeature z unavailable: z%. To enable manually: uv pip install z (or: pip install z).)joinrrr)r spec_lists rrzFeatureUnavailable._format siHH;;dl;;;;;  .t| . .T[ . .2; . . ) . . . r)rrrrrrrr)__name__ __module__ __qualname____doc__rr __classcell__)rs@rrrs[ ))))))         rrT)frozenc.eZdZUded<ded<ded<dS)_InstallResultboolsuccessrstdoutstderrN)r+r,r-__annotations__rrr2r2s+MMMKKKKKKKKrr2HERMES_LAZY_INSTALL_TARGETz .python-abirrctjjdtjj}t jdpd}|d|S)aA stable token identifying the running interpreter's ABI. Combines the X.Y version with the EXT_SUFFIX (which encodes the ABI tag and platform, e.g. ``cpython-313-x86_64-linux-gnu``). Two interpreters that can share compiled wheels produce the same token. . EXT_SUFFIX:)sys version_infomajorminor sysconfigget_config_var)verexts r_python_abi_tagrG1sH  # > >c&6&< > >C  "< 0 0 6BC>>C>>rOptional[Path]ctjtd}|sdSt |S)zReturn the durable install-target dir, or None for venv-scoped mode. Returns a path only when :data:`_LAZY_TARGET_ENV` is set to a non-empty value. The directory is created on demand by :func:`_ensure_target_ready`. r=N)osenvironget_LAZY_TARGET_ENVstripr)raws r_lazy_install_targetrP=s? *..)2 . . 4 4 6 6C t 99rtargetr Optional[str]ct}|tz } |rd} |d}n#t t f$rd}YnwxYw|r||krtd|||| D]f}| r+| stj |dA |W#t $rYcwxYw|dd||dn#t $r}d|d |cYd }~Sd }~wwxYwd S) aCreate the target dir and validate its ABI stamp. If the stamp is missing it is written. If it is present but records a different interpreter ABI than the one now running (e.g. the container image was rebuilt onto a newer Python), the directory's contents are wiped and the stamp rewritten, so stale compiled wheels can't be imported against an incompatible interpreter. Returns ``None`` on success, or an error string if the directory can't be created / written (e.g. read-only mount, permission error). r=utf-8encodingzYLazy install target %s was built for ABI %r but running ABI is %r; wiping stale packages.T) ignore_errors)parentsexist_okzlazy install target z is not writable: N)rG_TARGET_STAMP_NAMEexists read_textrNOSErrorFileNotFoundErrorloggerinfoiterdiris_dir is_symlinkshutilrmtreeunlinkmkdir write_text)rQwantstamphavechildes r_ensure_target_readyrnIs   D ' 'ED ==?? !D 88>>@@./     !  8D$ $^^--!!E||~~!e.>.>.@.@! e4@@@@@!!LLNNNN&!!! D! TD 111 0000 DDDCfCCCCCCCCCCD 4seE(AEA0-E/A00A=E.DE D ED1E E EEENonecft|}ttj|vrt j|fdtjDr*fdtjDztjdd< ddl}|dS#t$rYdSwxYw)uAppend the durable target to ``sys.path`` so its packages import. Appended to the END (never prepended) so the agent's own venv site-packages takes precedence on every name collision. Idempotent. Uses :func:`site.addsitedir` so ``.pth`` files (namespace packages, editable installs) inside the target are honoured, then enforces the append ordering — ``addsitedir`` would otherwise insert near the front. cg|]}|v| Sr8r8)r%pbefores r z/_activate_target_on_syspath..s:::!6//1///rcg|]}|v| Sr8r8)r%rr new_entriess rrtz/_activate_target_on_syspath..s#CCCQa{.B.Bq.B.B.BrNr) rlistr?pathsite addsitedir importlibinvalidate_caches Exception)rQ target_strr{rsrvs @@r_activate_target_on_syspathrssVJ #(^^F  ###;:::ch:::KRCCCC#(CCCkQ  ##%%%%%      sB"" B0/B0ct}|dS |rt|dSdS#t$r'}td||Yd}~dSd}~wwxYw)aSPublic: wire the durable lazy-install target onto ``sys.path``. Safe no-op when :data:`_LAZY_TARGET_ENV` is unset or the directory does not yet exist. Called once early in process startup (before backends import) so packages installed into the durable store on a previous run are importable on this run. Never raises. Nz-Failed to activate durable lazy target %s: %s)rPr[rr}r_debug)rQrms ractivate_durable_lazy_targetrs" # #F ~Q ==?? 0 ' / / / / / 0 0 QQQ DfaPPPPPPPPPQs#; A,A''A,r3c0 ddlm}|}n#t$rd}YnwxYw|<|dpi}t |ddsdSt jdd krtduSdS) uFReturn whether lazy installs are permitted in this environment. Resolution order: 1. ``security.allow_lazy_installs: false`` in config.yaml is an absolute opt-out — it disables installs in BOTH venv-scoped and durable-target modes. This is the user-facing kill switch. 2. ``HERMES_DISABLE_LAZY_INSTALLS=1`` seals the *agent venv* (set by the immutable Docker image). It blocks venv-scoped installs — UNLESS a durable install target is configured, in which case installs are redirected there (a path that structurally cannot break the sealed venv) and are therefore allowed. Defaults to True. If config is unreadable we fail open (allow), because refusing to install would lock people out of their own backends; the decision to block is an explicit user opt-in. r) load_configNsecurityallow_lazy_installsTFHERMES_DISABLE_LAZY_INSTALLS1)hermes_cli.configrr}rLr3rJrKrP)rcfgsecs r_allow_lazy_installsrs&111111kmm  ggj!!'RCGG148899 5  z~~455<<#%%T11 4s  ""rc8tjdkr |dkr dSdS)a Return why a lazy feature cannot work on this host, or ``None``. This is a platform capability gate, not a security policy gate. It keeps known-impossible installs out of both first-use lazy installation and the ``hermes update`` lazy-refresh pass. win32r zunsupported on Windows: Matrix E2EE depends on python-olm, which has no Windows wheel and requires make + libolm to build from sdist. Run Hermes under WSL to use Matrix on Windows.N)r?platformrs r_unsupported_feature_reasonrs3 |w7.?#?#? I  4rspeccrtdkrdStfddDrdSdsdvsdvrdSttS)zCReject pip specs that contain URLs, paths, or shell metacharacters.Fc3 K|]}|vV dSrr8)r%chrs rr'z _spec_is_safe..s' R R"2: R R R R R Rr) ;|&`$   \)-/r;z://@)lenany startswithr3 _SAFE_SPECmatch)rs`r _spec_is_safers 3t99s??u R R R R Q R R RRRu ''5D==C4KKu    && ' ''rc^tjd|}|r|dn|S)uExtract the bare package name from a pip spec. ``"slack-bolt>=1.18.0,<2"`` → ``"slack-bolt"`` ``"mautrix[encryption]>=0.20"`` → ``"mautrix"`` z^([A-Za-z0-9_][A-Za-z0-9_.\-]*))rergrouprms r_pkg_name_from_specrs/ 3T::A $1771:::$rcltjd|}|sdS||dS)uExtract just the version-specifier portion of a pip spec. ``"honcho-ai==2.0.1"`` → ``"==2.0.1"`` ``"mautrix[encryption]>=0.20,<1"`` → ``">=0.20,<1"`` ``"package"`` → ``""`` (no version constraint) z6^[A-Za-z0-9_][A-Za-z0-9_.\-]*(?:\[[A-Za-z0-9_,\-]+\])?r=N)rrendrs r_specifier_from_specrs9 JDQQA r >rcbt|} ddlm}m}n#t$rYdSwxYw ||}n#|$rYdSt $rYdSwxYwt |}|sdS ddlm}m }ddl m }m } n#t$rYdSwxYw | |||vS#||t f$rYdSwxYw)a^Is ``spec`` already satisfied in the current env? Checks both presence AND version. If the package is installed at a version outside the spec's range, returns False so the caller will upgrade/downgrade to the pinned version. This is what makes ``hermes update`` propagate pin bumps in :data:`LAZY_DEPS` to already- installed backends instead of silently leaving stale versions in place. If ``packaging`` is unavailable for any reason (it's a transitive of pip so this should never happen), we fall back to a presence-only check so we err on the side of "don't churn". rPackageNotFoundErrorversionFT)InvalidSpecifier SpecifierSet)InvalidVersionVersion) rimportlib.metadatarr ImportErrorr}rpackaging.specifiersrrpackaging.versionrr) rpkgrr installed spec_tailrrrrs r _is_satisfiedrse d # #CDDDDDDDDD uuGCLL uu uu%T**I tGGGGGGGG========= ttwy!!\\)%<%<<< ni 8ttsE (( 8A  A  A $A55 BBB B.-B.ct|} ddlm}m}n#t$rYdSwxYw ||dS#|$rYdSt $rYdSwxYw)zCheap presence-only check (package name installed at any version). Used by :func:`active_features` to detect backends the user has previously activated, regardless of whether the version pin moved. rrFT)rrrrrr})rrrrs r _is_presentr's d # #CDDDDDDDDD uu t uu uus! (( 9A A Ac ddlm}n#t$rYdSwxYw ddl}g}t }|D]l}|jr |jdnd}|j}|r|s$|}||vr=||| |d|m|sdS| dd\}} tj |d d 5} | d t|d zdddn #1swxYwYt!| S#t"$r&} t$d | Yd} ~ dSd} ~ wwxYw)uWrite a pip constraints file pinning every package already importable in the core environment to its installed version. Passed as ``--constraint`` for durable-target installs so the resolver pins shared transitive deps (httpx, pydantic, aiohttp, …) to the exact versions the core venv already ships, instead of pulling newer copies into the durable store. Two payoffs: * The durable store stays minimal — only genuinely-new packages land there; shared deps resolve to "already satisfied" against core. * A backend that *requires* a version conflicting with core fails loudly at install time (resolver conflict) rather than silently installing a shadowed copy that can never win on sys.path anyway. Returns the path to a temp constraints file, or None if enumeration failed (in which case the caller installs without constraints — still safe, just less tidy). r) distributionsNNamez==zhermes-core-constraints-z.txt)prefixsuffixwrTrUrz)Could not build core constraints file: %s)rrrtempfilesetmetadatarloweraddappendmkstemprJfdopenwriter(sortedrr}r_r) rrlinesseendistnamerEkeyfdrxfrms r_core_constraints_filer;s&4444444 ttuu!MOO + +D,0MC4=((tD,C s **,,Cd{{ HHSMMM LLD))C)) * * * * 4##+Ef#UUD Yr3 1 1 1 5Q GGDIIfUmm,,t3 4 4 4 5 5 5 5 5 5 5 5 5 5 5 5 5 5 5Dzz  @!DDDtttttsN B D:*1D:9D  D: D$$D:'D$(D:: E*E%%E*i,)timeoutspecsrrintc |stdddSt}d}|0t|}|rtdd|St}g}|dt |g}g}|dt |g} t t jjj}ddl m }|d } t || d <tj d } | r tj| d d g|||dd|| tj} | jdkrX|t#|td| jpd| jpd|& |S#t*$rYSwxYwSt,d| jn>#tjt2f$r%} t,d| Yd} ~ nd} ~ wwxYwt jdd g} tj| dgzdddtj}|jdkrt3dn#tjt2f$r tjt jddddgddddtjnf#tjtjf$rH} tddd| cYd} ~ cY|& |S#t*$rYSwxYwSd} ~ wwxYwYnwxYw tj| d g|||zdd|tj} | jdkr|t#|t| jdk| jpd| jpd|& |S#t*$rYSwxYwS#tj$rF} tddd| cYd} ~ |& |S#t*$rYSwxYwSd} ~ wt6$rF} tddd| cYd} ~ |& |S#t*$rYSwxYwSd} ~ wwxYw#|& |w#t*$rYwwxYwwxYw)uInstall ``specs`` using the uv → pip → ensurepip ladder. Two modes: * **Venv-scoped (default).** Installs into the active venv (``sys.executable``). Used on normal installs. * **Durable-target.** When :data:`_LAZY_TARGET_ENV` is set, installs into that directory via ``--target`` and constrains shared deps to the core venv's versions (see :func:`_core_constraints_file`). The target is append-only on ``sys.path`` so it can never shadow core. Used by the immutable Docker image to keep lazy installs off the sealed venv. Mirrors the strategy in ``hermes_cli.tools_config._pip_install`` but kept independent here so this module has no CLI dependency. Tr=NFz--targetz --constraintr)hermes_subprocess_env)inherit_credentials VIRTUAL_ENVuvpipinstall)capture_outputtextrenvstdinzuv pip install failed: %szuv invocation failed: %sz-mz --version)rrrrzpip not in venv ensurepipz --upgradez --default-pipx)rrrcheckrz(pip not available and ensurepip failed: zpip install timed out: pip install failed: )r2rPrnrrrr? executableparenttools.environments.localrrdwhich subprocessrunDEVNULL returncoderr5r6rfr]r_rTimeoutExpiredr^CalledProcessErrorr})rrrQ constraintserr target_argsconstraint_args venv_rootruv_envuv_binrrmpip_cmdprobes r_venv_pip_installrks  ,dB+++ ! # #F"&K "6**  2!%S11 1,.. K !3v;;/ !#O)3{+;+;<>((/6 BBBBBB&&5AAA #I}d##  < <NUIV VoVPUV#'dG$, <1$$)3F;;;)$BBOOP  " ""$$$$     #O 8!(CCCC-/@A < < < 7;;;;;;;; <>4/ VN;-'#$ (E 1$$'(9:::%)+<= V V V V^T; _U#'dCt$, 1:3LM V V V%eR&TQR&T&TVVVVVVVVV"  " ""$$$$     #% V  V I9M{M_MuMM#$ (A |q  V%7+F333!!,!"3QX^QX^QSTT  " ""$$$$     # ( L L L!%-Jq-J-JKK K K K K K  " ""$$$$     # I I I!%-GA-G-GHH H H H H H  " ""$$$$     # I  " ""$$$$     #sZAPA'F E E+*E+/ FPG &GPG  PAH P K73I+*K+KK KKP#J88 KK KKPKPA0M1 M  M-,M-1POPPN00 N=<N= PP!P"P)O>> P  P PPQP0/Q0 P=:Q<P==QcR|tvrtd|t|S)z=Return the registered specs for a feature, or raise KeyError.zUnknown lazy feature: )r KeyErrorrs r feature_specsrs/i;;;<<< W rcNtdt|DS)zCReturn the subset of specs for ``feature`` not currently installed.c38K|]}t||VdSr)rr$s rr'z"feature_missing..s/KKq-:J:JKKKKKKKr)tuplerrs rfeature_missingr s' KKM'22KKK K KKrpromptr cR|tvrt|dd|dt|}|sdSt|}|rt||||D]%}t |st||d|&t st||dd}dt jvr9 d d lm }|}|duot|d d}n#t$rd}YnwxYw|r|st j rt j rd |} t!d |d|d} n#t&t(f$rd} YnwxYw| r| dvrt||dt*dd||t/|} | jsD| jp| jpd} | r | dd} t||d| pd d dlm} t9| dr| n#t$rYnwxYwt|} | rt|| dt*d|dS)uMake sure all packages for ``feature`` are importable. If they're missing, attempts to install them in the active venv. Raises :class:`FeatureUnavailable` if the user has disabled lazy installs or if the install attempt fails. ``prompt``: when True (default) and stdin is a TTY, asks the user to confirm before installing. Non-interactive callers (gateway, cron, batch) get prompt=False and skip the confirmation — config flag is the gate in that case. r8zfeature z not in LAZY_DEPS allowlistNz refusing to install unsafe spec z;lazy installs disabled (security.allow_lazy_installs=false)Fz"prompt_toolkit.application.currentr)get_app_or_none is_runningz, z Feature z requires: z) Install into the active venv now? [Y/n] n>yyeszuser declined install at promptz!Lazy-installing %s for feature %rr r=i0rzno error output _cache_clearzWinstall reported success but packages still not importable (may require Python restart)z$Lazy install complete for feature %r)r rr rrrr?modules"prompt_toolkit.application.currentrgetattrr}risattyr5r(inputrNrEOFErrorKeyboardInterruptr_r`rr4r6rrhasattrr)rr r unsupportedr _pt_activer_appr)answerresultsnippet_md still_missings rensurer%si RJGJJJ   g&&G -g66K@ ';???T"" $;4;;   ! !  W I   J+s{::  J J J J J J"?$$DT)PgdL%.P.PJJ   JJJ  j SY%5%5%7%7 CJ  =7FM7R>>@@  &effoG W A7#?.? A A    (((((( 3 ' '             $G,,M  ] +    KK6@@@@@s6,%C C! C!::E55F  F /*I I'&I'c8|tvrdSt| S)z8Return True if the feature's deps are already satisfied.F)r r rs r is_availabler'Is#iuw'' ''rcv|tvrdSt|}ddd|DzS)zFReturn the ``pip install`` command a user could run manually, or None.Nzuv pip install r c34K|]}t|VdSrr"r$s rr'z*feature_install_command..Us('?'?AQ'?'?'?'?'?'?r)r r()rrs rfeature_install_commandr*PsBit g E sxx'?'?'?'?'??? ??r list[str]cg}tD]3\}}td|Dr||4|S)aReturn the list of features the user has ever lazy-installed. A feature counts as "active" if at least one of its declared packages is currently installed in the venv (presence check, ignoring version). Features the user has never enabled stay quiet. Used by ``hermes update`` to figure out which lazy backends need a refresh pass when pins move in :data:`LAZY_DEPS`. c34K|]}t|VdSr)rr$s rr'z"active_features..ds(--!{1~~------r)r itemsrr)activerrs ractive_featuresr0Xs]F#//++## --u--- - - # MM' " " " MrFdict[str, str]ci}tD]}t|}|sd||<t|}|r d|||<3 t||d||<K#t$ra}dt |vs+dt |vs|jdrd|j||<n d|j||<Yd }~d }~wt$r}d|||<Yd }~d }~wwxYw|S) ujRe-run ``ensure`` for every feature the user has previously activated. Returns a ``{feature: status}`` map where status is one of: ``"current"`` — pins already satisfied, no install run ``"refreshed"`` — pins were stale, reinstall succeeded ``"failed: "`` — install attempt failed; caller decides whether to surface it (we don't raise) ``"skipped: "`` — gated off (config flag, user decline) Intended for ``hermes update``. Never raises; lazy-install failures here must not block the rest of the update flow. currentz skipped: r  refreshedzlazy installs disableddeclinedz unsupported zfailed: N) r0r rr%rrrrr})r resultsrrrrms rrefresh_active_featuresr7isV!G"$$..!'** (GG  1'::  8;88GG   . 76 * * * **GG  ! 9 9 9 )CFF22Q''8&&~66($:qx#9#9  #8ah#8#8  . . .-!~~GG       . Ns%A C!&AC C!CC!importerCallable[[], dict[str, Any]]target_globalsdictc t||n#ttf$rYdSwxYw |}n#t$rYdSwxYw||dS)aEnsure a feature is installed, then rebind names into the caller's globals. Combines :func:`ensure` with a post-install import step that rebinds module-level names. This eliminates the error-prone pattern of manually listing every global that needs updating after lazy-install. ``importer`` is a zero-arg callable that returns a dict of ``{name: value}`` for all symbols the caller needs rebound. It is called only after :func:`ensure` succeeds (or if the packages are already installed). Returns True on success, False if deps couldn't be installed or imported. Example usage in a platform adapter:: def check_slack_requirements() -> bool: if SLACK_AVAILABLE: return True def _import(): from slack_bolt.async_app import AsyncApp from slack_bolt.adapter.socket_mode.async_handler import AsyncSocketModeHandler from slack_sdk.web.async_client import AsyncWebClient import aiohttp return { "AsyncApp": AsyncApp, "AsyncSocketModeHandler": AsyncSocketModeHandler, "AsyncWebClient": AsyncWebClient, "aiohttp": aiohttp, "SLACK_AVAILABLE": True, } return ensure_and_bind("platform.slack", _import, globals(), prompt=False) r FT)r%rr}rupdate)rr8r:r bindingss rensure_and_bindr?sNwv&&&&&  *uu8:: uu(### 4s)) 8 AAr*)rrH)rQrrrR)rQrrro)rro)rr3)rrrrR)rrrr3)rrrr)rrrrrr2)rrrr)rrr r3rro)rrrr3)rr+)r r3rr1) rrr8r9r:r;r r3rr3)5r. __future__rloggingrJrrdryrr?rC dataclassesrpathlibrtypingrrr getLoggerr+r_r r7compiler RuntimeErrorrr2rMrZrGrPrnrrrrrrrrrrrrr r%r'r*r0r7r?r8rrrHsAAAF#"""""  !!!!!!**********  8 $ $R)0 R) + R)/R):R)$%%R)&1'R)(/)R)>(?R)@$AR)B-CR)H(IR)JKR)X(YR)^*_R)`4aR)p2qR)r&sR)R)xAyR)DER)VWR)` aR)tuR)~R)L5MR)VKWR)\']R)^-_R)deR)n7oR)v1wR)z{R)P&QR)\]R)R) RRRRpRZ          , $"0#        ''''T    :QQQQ$####L     ((((%%%%    ))))X(----`ADbbbbbbTLLLL ,0eAeAeAeAeAeAP((((@@@@"/4******d 22222222r