oq'jUdZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z mZmZddlmZddlmZejeZejejejhZd Zdaedzed <d efd Zd Z e!hdZ"dde#de#d efdZ$e!hdZ%d e#dzfdZ&dde#d e#dzfdZ'dde#d e#dzfdZ(dde#d efdZ)dde#de#d efdZ*dde#dede#d e#dzfdZ+de#d e,fdZ-de#d e,fdZ.dZ/dd hZ0da1e#dzed!<d"a2d e#dzfd#Z3dde#de#d e#dzfd$Z4dde#d e#dzfd%Z5dde#de#d e#dzfd&Z6d'e7d e,fd(Z8ej9Z:iZ;eeZNde#de#d dfd?ZOde#de#d dfd@ZPde#de#d e#dzfdAZQ dde#d5e#de#dBe,d e#f dCZR ddEe#de#dFe#dGe#dHe,dIe#de#dBe,d e#fdJZS ddMe#dNe#de#dOe#d;ed:edPe#dQede#d e#fdRZTddSlUmVZVmWZWdTZXdUdVdWdXdYdZd[d\d9d9d]d[d^d0d_d`dadgdbdcZYdddedWdXdfdZdXdgdZdhdid"djdkdd5gdbdcZZdIdldWdXdDdIgdmdDdndXdodZdXdpdZdXdqdZdhdrd"djdXdsdZdhdtd"djdudEgdbdcZ[dvdwdWdXdxdZdXd5dygdzd5dndXd{dKdjdXd|dZd[d}dLdjd[d~ddjdXgddd5dnd[dddjddMgdbdcZ\dZ]dZ^dZ_dZ`eVjadUdeYe]eXdd eVjadddeZe^eXdd eVjadIde[e_eXdd eVjadvde\e`eXdd dS)z6File Tools Module - LLM agent file manipulation tools.N)Path)get_read_block_error)has_binary_extension)ShellFileOperationsnormalize_read_paginationnormalize_search_pagination) file_state)redact_sensitive_texti_max_read_chars_cachedreturncttS ddlm}|}|d}t |t t fr|dkrt |atSn#t$rYnwxYwtatS)zReturn the configured max characters per file read. Reads ``file_read_max_chars`` from config.yaml on first call, caches the result for the lifetime of the process. Falls back to the built-in default if the config is missing or invalid. Nr) load_configfile_read_max_chars) r hermes_cli.configrget isinstanceintfloat Exception_DEFAULT_MAX_READ_CHARS)rcfgvals 5/home/ubuntu/.hermes/hermes-agent/tools/file_tools.py_get_max_read_charsr's)%% 111111kmmgg+,, cC< ( ( *S1WW%(XX ") )      4 !!sAA.. A;:A;i> /dev/tty /dev/fd/0 /dev/fd/1 /dev/fd/2 /dev/full /dev/zero /dev/stdin /dev/random /dev/stderr /dev/stdout /dev/console /dev/urandomdefaultfilepathtask_idc"t||S)zsResolve a path relative to TERMINAL_CWD (the worktree base directory) instead of the main repository root. )_resolve_path_for_task)r(r)s r _resolve_pathr,Qs "(G 4 44>./cwdauto.c&tjdpd}|t vrdStj|}tj|sdS|S)unReturn ``$TERMINAL_CWD`` only when it names a real directory anchor. Sentinel values (see ``_TERMINAL_CWD_SENTINELS``) and relative paths are rejected — a relative anchor is meaningless without knowing which cwd it is relative to, which is exactly the ambiguity that misroutes worktree edits. Only an absolute, sentinel-free value is honored. TERMINAL_CWDr/N) osenvironrstriplower_TERMINAL_CWD_SENTINELSpath expanduserisabs)rawexpandeds r_configured_terminal_cwdr?csv :>>. ) ) /R 6 6 8 8C yy{{---tw!!#&&H 7== " "t Or-cR ddlm}||}n#t$r|}YnwxYwt5t|pt|}dddn #1swxYwY|5t t |ddddpt |dd}|r|S ddlm}m}|5||p||}|t |ddnd}dddn #1swxYwY|r|Sn#t$rYnwxYwdS)zCReturn the task's live terminal cwd for bookkeeping when available.r)_resolve_container_task_idNenvr0)_active_environments _env_lock) tools.terminal_toolrAr_file_ops_lock_file_ops_cachergetattrrCrD)r)rA container_keycachedlive_cwdrCrDrBs r_get_live_tracking_cwdrLts5 BBBBBB227;;       TT $$]33S7J7J77S7STTTTTTTTTTTTTTT 765$77EE  E4J J   O  GGGGGGGG  N N&**=99^=Q=U=UV]=^=^C47OwsE4000H N N N N N N N N N N N N N N N  O        4sT ##5A..A25A21 D;AD; DD  DD D D$#D$cDt|}|r|StS)uTBest-effort absolute workspace root for divergence checks. Prefers the live terminal cwd (the directory the agent is actually working in). When no terminal command has run yet — so the live registry is empty — falls back to a sentinel-free absolute ``$TERMINAL_CWD``. This is what lets a worktree session warn about (and resolve into) the worktree from the very first ``write_file``/``patch``, before any ``cd`` has populated the live cwd. Returns ``None`` only when there is genuinely no reliable anchor, in which case callers fall back to the process cwd. )rLr?)r)lives r_authoritative_workspace_rootrOs* "' * *D  # % %%r-c>t|}|r"t|}n ttj}|s#ttj|z }|S)uReturn the ABSOLUTE base directory for resolving relative paths. Resolution order: 1. The task's live terminal cwd (the directory the agent is actually working in — e.g. a git worktree). Authoritative when known. 2. A sentinel-free, absolute ``$TERMINAL_CWD`` (the worktree path set by ``cli.py``/``main.py`` for ``-w`` sessions). Used even before any terminal command has populated the live cwd registry. 3. The process cwd. The returned base is ALWAYS absolute. This is the core invariant that prevents the worktree-cwd divergence bug: a relative or sentinel ``TERMINAL_CWD`` (commonly the literal ``"."`` from a stale config) is meaningless as a resolution anchor — left to ``Path.resolve()`` it silently resolves against whatever the agent PROCESS cwd happens to be (e.g. the main repo while the terminal is in a worktree), routing edits to the wrong checkout. We therefore reject sentinel/relative ``TERMINAL_CWD`` values outright (rather than anchoring them to the process cwd) and fall through to the process cwd only as a last resort, deterministically. )rOrr;r5getcwd is_absoluteresolve)r)rootbases r_resolve_base_dirrVs* ) 1 1D !Dzz$$&&BIKK       (BIKK  4' <<>>r-ct|}|r|St ||z S)zResolve *filepath* against the task's absolute base directory. See :func:`_resolve_base_dir` for how the base is chosen. Absolute input paths are returned resolved-but-unanchored. )rr;rRrSrV)r(r)ps rr+r+sX X!!##A}}yy{{ g & & * 3 3 5 55r-resolvedc  t|rdSt|}|sdSt|} ||dS#t $r)d|dt|dt|dcYSwxYw#t$rYdSwxYw)uWarn when a relative path resolved OUTSIDE the task's workspace root. Surfaces the worktree-cwd divergence the moment it would matter: if the agent passes a relative path but it resolves under a directory that is not the workspace root (i.e. the edit is about to land in a different checkout than the one the agent is working in), return a message naming the absolute target. ``None`` when the path is absolute, the base is unknown, or the resolved path is correctly under the workspace root. The workspace root is the live terminal cwd when known, else a sentinel-free absolute ``$TERMINAL_CWD`` — so a worktree session whose terminal registry is still empty (no ``cd`` run yet) is warned on the very first write. NzRelative path z resolved to z), which is OUTSIDE the active workspace (z). The edit will land in a different directory than the terminal's cwd. If this is not intended (e.g. a git-worktree session writing into the main checkout), pass an absolute path under the workspace instead.) rr;rRrOrS relative_to ValueErrorstrr)r(rYr)workspace_rootrTs r_path_resolution_warningr_s  >> $ $ & & 2 2 4 4 46w?? 4N##..0088::    & & &4   QQQ#h--QQ14TQQQ     tts:3C C 3C >B0CC CC CCr:c tj|}|tvrdS|dr|drdS|dr|drdSdS)z=Return True for concrete device/fd paths that can hang reads.Tz/proc/)z/fd/0z/fd/1z/fd/2)z/environz/cmdlinez/mapsF)r5r:r;_BLOCKED_DEVICE_PATHS startswithendswith)r: normalizeds r_is_blocked_device_pathres##D))J***tX&&:+>+>#,,tX&&:+>+>),,t 5r-ctj|}t|rdS tj|}n#t t f$rYdSwxYw||krt|rdSdS)a2Return True if the path would hang the process (infinite output or blocking input). Check the literal path first so aliases like /dev/stdin are caught before they resolve to terminal-specific paths. Then check the resolved path so a workspace symlink to /dev/zero cannot bypass the guard. TF)r5r:r;rerealpathOSErrorr\)r(rdrYs r_is_blocked_deviceri s##H--Jz**t7##J// Z uu:"9("C"Ct 5sAA'&A')z/etc/z/boot/z/usr/lib/systemd/z /private/etc/z /private/var/z/var/run/docker.sockz/run/docker.sock_hermes_config_resolvedFcZtrtSda ddlm}t |and#t $rW t tdan#t $rdaYnwxYwYnwxYwtS)zEReturn the resolved absolute path of the Hermes config file (cached).Trget_config_pathz~/.hermes/config.yamlN) _hermes_config_resolved_loadedrjrrmr]rSrrr;rls r_get_hermes_config_resolvedro*s&'&&%)"+555555"%oo&7&7&?&?&A&A"B"B +++ +&)$/F*G*G*R*R*T*T*\*\*^*^&_&_ # # + + +&* # # # ++ #"s6/A B# AB B# BB#BB#"B#c tt||}n#ttf$r|}YnwxYwtjtj|}d|d}tD]0}| |s| |r|cS1|tvs |tvr|St}|r||ks||krd|dSdS)zHReturn an error message if the path targets a sensitive system location.z,Refusing to write to sensitive system path: zD Use the terminal tool with sudo if you need to modify system files.z)Refusing to write to Hermes config file: zz Agent cannot modify security-sensitive configuration. Edit ~/.hermes/config.yaml directly or use 'hermes config' instead.N) r]r+rhr\r5r:normpathr;_SENSITIVE_PATH_PREFIXESrb_SENSITIVE_EXACT_PATHSro)r(r)rYrd_errprefix hermes_configs r_check_sensitive_pathrw;sC-h@@AA Z !!"'"4"4X">">??J Nx N N N +   v & & **?*?*G*G KKK )))Z;Q-Q-Q 011M (m33z]7R7R R R R R 4s  66c ddlm}m}m}m}||}n#t $rYdSwxYw |5||p||}dddn #1swxYwY|2|jjdkr tt|ddrdSdS|}n#t $rYdSwxYw|dd kr|d d rdSdS) zEReturn the container-side Hermes mirror prefix for Docker file tools.r)rCrD_get_env_configrANDockerEnvironment _persistentFz /root/.hermesenv_typedockercontainer_persistentT) rErCrDryrArr __class____name__boolrH)r)rCrDryrArIrBconfigs r%_get_container_mirror_prefix_for_taskrYs             327;; tt   _ _&**=99^=Q=U=UV]=^=^C _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ?}%)<<<]E22BB<'4 "" ttzz*))fjj9OQU.V.V) 4sF ((B/+A% B/%A))B/,A)-3B/$ B// B=<B=c ddlm}m}m}n#t$rYdSwxYw t t ||}n#ttf$r|}YnwxYw||}||S||}||S||t|S)uReturn a soft-guard warning when ``filepath`` lands in another Hermes profile's scoped area, a host-side sandbox-mirror of authoritative profile state, or the Docker container's sandbox mirror of Hermes state. Three detectors run in order: * cross-profile (#TBD) — writes that hit another profile's ``skills/plugins/cron/memories`` directory. * sandbox-mirror (#32049) — writes that hit the ``…/sandboxes///home/.hermes/…`` mirror created by a non-local terminal backend (Docker, Daytona, etc.), where the host Hermes process never reads the mirror and the authoritative file is left untouched. * container-mirror (#32049 follow-up) — writes from inside a Docker container whose bind-mounted home strips the ``sandboxes/`` prefix, so the agent sees a plain ``/root/.hermes/…`` path. Returns ``None`` when the write is in-scope or outside Hermes scope. All detectors are soft guards — the agent can override any by passing ``cross_profile=True`` to its write tool after explicit user direction. Defense-in-depth, NOT a security boundary — the terminal tool runs as the same OS user and can write any of these paths directly. See ``agent/file_safety.classify_cross_profile_target``, ``classify_sandbox_mirror_target`` and ``classify_container_mirror_target`` for the detection rules. r)get_container_mirror_warningget_cross_profile_warningget_sandbox_mirror_warningN) mirror_prefix) agent.file_safetyrrrrr]r+rhr\r)r(r)rrrrYwarnings r_check_cross_profile_pathr{s 6            tt-h@@AA Z ('11G((22G ' ';GDD   s =AAexcc~t|trdSt|tr|jtvrdSdS)zFReturn True for expected write denials that should not hit error logs.TF)rPermissionErrorrherrno_EXPECTED_WRITE_ERRNOS)rs r_is_expected_write_exceptionrsB#''t#wCI1G$G$Gt 5r-rG _read_tracker_patch_failure_tracker resolved_pathcRt5t|i}t|dkr5||vr1 t t |}||=n#t $rYnwxYw||ddz||<||cdddS#1swxYwYdS)zAIncrement and return the consecutive-failure count for this path.@rN)_patch_failure_lockr setdefaultlennextiter StopIterationr)r)r task_failures first_keys r_record_patch_failurers   , ,.99'2FF  }   # # ](J(J  m!4!455 !),,     '4'8'8'J'JQ'N m$]+ , , , , , , , , , , , , , , , , , ,s43BAB A)&B(A))&BB #B resolved_pathsc|sdSt5t|}|s ddddS|D]}||d ddddS#1swxYwYdS)z5Clear consecutive-failure counts for the given paths.N)rrrpop)r)rrrps r_reset_patch_failuresrs  ((.227;;   ((((((((! ( (B   b$ ' ' ' ' ( ((((((((((((((((((sA A  A$'A$iuFile unchanged since last read. The content from the earlier read_file result in this conversation is still current — refer to that instead of re-reading. task_datac|d}|gt|tkrOt|tz }t|D](} |#t $rYnwxYw|d}|t|t krqt|t z }t|D]J} |tt|3#tt f$rYnwxYw|d}|t|t krqt|t z }t|D]J} |tt|3#tt f$rYnwxYw|d}|t|tkrtt|tz }t|D]O} |tt|3#tt f$rYdSwxYwdSdSdS)aEnforce size caps on the per-task read-tracker sub-containers. Must be called with ``_read_tracker_lock`` held. Eviction policy: * ``read_history`` (set): pop arbitrary entries on overflow. This is fine because the set only feeds diagnostic summaries; losing old entries just trims the summary's tail. * ``dedup`` / ``read_timestamps`` (dict): pop oldest by insertion order (Python 3.7+ dicts). Evicted entries lose their dedup skip on a future re-read (the file gets re-sent once) and external-edit mtime comparison (the write/patch falls back to a non-mtime check). Both are graceful degradations, not bugs. read_historyNdedup dedup_hitsread_timestamps) rr_READ_HISTORY_CAPrangerKeyError _DEDUP_CAPrrr_READ_TIMESTAMPS_CAP)rrhexcess_rrtss r_cap_read_tracker_datar sy ~ & &B ~#b''$555R,,v  A      MM' " "E SZZ*44Uj(v  A  $tE{{++,,,,!8,    |,,J#j//J">">Z:-v  A tD$4$4556666!8,     ( ) )B ~#b''$888R//v  A tDHH~~&&&&!8,     ~88  sHA.. A<;A</DDD7/F''F<;F</IIIcontentct|tsdS|}|sdS|tkrdSt|vr*t |dt tzkrdSdS)uReturn True when content looks like an internal file-tool status, not real file bytes. The read_file dedup status message must never be persisted as file content. The obvious shape is the model echoing the message verbatim, but in practice it also wraps it with small framing text (a leading "Note:", a trailing newline + short comment, etc.) before calling write_file. We treat any short-ish write whose body is dominated by the status message as the same class of corruption. Heuristic: * Strict equality (after strip) — the verbatim shape. * OR the stripped content contains the full status message AND is short enough that the status dominates it (<=2x the message length). Short, status-dominated writes can't plausibly be real files — legitimate docs/notes that happen to quote this internal message are always dramatically longer. FT)rr]r7_READ_DEDUP_STATUS_MESSAGEr)rstrippeds r_is_internal_file_status_textr=sz$ gs # #u}}H u---t!X-- MMQ%?!@!@@ @ @t 5r-c ddlm}m}m}m}m}m}m}m}m } ddl } | |}t5t |} dddn #1swxYwY| }|5||vr%| ||<| cdddSt5t|ddddn #1swxYwYdddn #1swxYwY|5||vrtj||<||} dddn #1swxYwY| 5|5||vr | ||<||} nd} dddn #1swxYwY| ddlm}|}|d}| |i}|dkr| dp|d}nn|dkr| d p|d }nJ|d kr| d p|d }n&|d kr| d p|d }nd}| dp|d}t$d||ddd}|dvr| dd| dd| dd| dd| dg| dd| dg| ddd }d}|d!krl| d"d| d#d| d$d%| d&d| d'dd(}d}|d)krd*| d+di}|||||d,||||| d-. } |5| ||<| ||<dddn #1swxYwY|t$d/||dddddn #1swxYwYt)| }t5|t|<dddn #1swxYwY|S)0aGet or create ShellFileOperations for a terminal environment. Respects the TERMINAL_ENV setting -- if the task_id doesn't have an environment yet, creates one using the configured backend (local, docker, modal, etc.) rather than always defaulting to local. Thread-safe: uses the same per-task creation locks as terminal_tool to prevent duplicate sandbox creation from concurrent tool calls. Note: subagent task_ids are collapsed to "default" via ``_resolve_container_task_id`` so delegate_task children share the parent's container and its cached file_ops. RL/benchmark task_ids with a registered env override keep their isolation. r) rCrD_create_environmentry_last_activity_start_cleanup_thread_creation_locks_creation_locks_lockrAN)_task_env_overridesr|r} docker_image singularitysingularity_imagemodal modal_imagedaytona daytona_imager/r0z*Creating new %s environment for task %s...>rr}rr container_cpurcontainer_memoryicontainer_diskir~Tdocker_volumesdocker_mount_cwd_to_workspaceFdocker_forward_envdocker_run_as_host_user)rrrr~rrrrsshssh_hostssh_userssh_portssh_keyssh_persistent)hostuserportkey persistentlocalrlocal_persistenttimeouthost_cwd) r|imager0r ssh_configcontainer_config local_configr)rz %s environment ready for task %s)rErCrDrryrrrrrAtimerFrGrr threadingLockrloggerinfor)r)rCrDrryrrrrrArrJ task_lock terminal_envrrr| overridesrr0rrrfile_opss r _get_file_opsr\sKKK((11G .. $$W--...............   7 7...*.))++w' 7 7 7 7 7 7 7 7 $77#''666777777777777777  7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 -- / ) )'0~'7'7OG $#G, --------------- LSLS  $ $...*.))++w'3G< #  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $   ? ? ? ? ? ?$_&&Fj)H+//<YW$$! m44M}8MY&&! o66Q&:Q--&&7&-C KKDhPWXZYZXZP[ \ \ \# HHH%+ZZ%C%C(. 3Et(L(L&,jj1A5&I&I,2JJ7Mt,T,T&,jj1A2&F&F5;ZZ@_af5g5g*0**5I2*N*N/5zz:SUZ/[/[ $ $ J5  "JJz266"JJz266"JJz266!::i44"(**-=u"E"E   L7"" &**-?"G"G  /.!y)%!1)J//   L 6 60<$W-*.))++w' 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 " ! # # # KK:Hgbqbk R R RYLSLSLSLSLSLSLSLSLSLSLSLSLSLSLS^#<00H ,,#+ ,,,,,,,,,,,,,,, OsAAA#C CB<0 C<C CC CCC #DDDQ'E QE QE I;QO>2 Q>P QP 1QQ Q$ Q;;Q?Q?ct5|rt|dntddddS#1swxYwYdS)z Clear the file operations cache.N)rFrGrclear)r)s rclear_file_ops_cachers $$  $    . . . .  ! ! # # # $$$$$$$$$$$$$$$$$$s8A  AAroffsetlimitc  t||\}}t|rtjdd|diSt ||}t t |r6|j}tjdd|d|diStt |}|rtjd|iSt |}|||f}t5t |ddtiiid } d | vri| d <d | vri| d <| d i|} dddn #1swxYwY| tj|} | | krt5| d |dd z} | | d |<t%| dddn #1swxYwY| dkr$tjd| d zd|| d zddStjdt&|ddddSn#t($rYnwxYwt+|} | |||}|}t1|jpd}|dd}t5}||kr=|dd}tjd|dd|dd|d|||d dS|jr%t7|jd!|_|j|d"<|rA|t8kr6|d#kr0|d$r| d%d&|dd'd(|||f}t5d | vri| d <d | vri| d <| d |d| d)|||f| d*|kr| d+xxd z cc<n || d*<d | d+<| d+} tj|}|| d |<|| d i|<n#t($rYnwxYwt%| dddn #1swxYwY |d kp!t?|d$}tAj!|||,n,#tD$rtF$d-d.YnwxYw|d/krtjd0|d1||ddS|d2kr d3|d4|d5<tj|dS#tD$r&}tKt |cYd}~Sd}~wwxYw)6z-Read a file with pagination and line numbers.errorz Cannot read 'zE': this is a device file that would block or produce infinite output.zCannot read binary file 'z' (zF). Use vision_analyze for images, or terminal to inspect binary files.Nr)last_key consecutiverrrrrrrrrz8BLOCKED: You have called read_file on this exact region u times and the file has NOT changed. STOP calling read_file for this path — the content from your earlier read_file result in this conversation is still current. Proceed with your task using the information you already have.)rr: already_readF ensure_ascii unchangedT)statusmessager:rcontent_returnedr/ file_size total_linesunknownzRead produced ,z, characters which exceeds the safety limit (zD chars). Use offset and limit to read a smaller range. The file has z lines total.)rr:rr code_filer truncated_hintzThis file is large (zj bytes). Consider reading only the section you need with offset and limit to keep context usage efficient.readrrr)partialzfile_state.record_read failedexc_infoz.BLOCKED: You have read this exact file region z| times in a row. The content has NOT changed. You already have this information. STOP re-reading and proceed with your task.z%You have read this exact file region z times consecutively. The content has not changed since your last read. Use the information you already have. If you are stuck in a loop, stop reading and proceed with writing or responding._warning)&rrijsondumpsr+rr]suffixr8r_read_tracker_lockrrsetrr5r:getmtimerrrhr read_fileto_dictrrrr _LARGE_FILE_HINT_BYTESraddrr record_readrrdebug tool_error)r:rrr) _resolved_ext block_error resolved_str dedup_keyr cached_mtime current_mtimehitsrresult result_dict content_lenr max_charsrread_keycount _mtime_now_partiales rread_file_toolr/sT"1&%@@  d # # :8D888 +499  I / / #))++D:ZZZZZZ +3y>>::  6:w 455 5 9~~ !651  E E%00  # R;;I9,,*, ,' 11/1 +,$=="5599)DDL E E E E E E E E E E E E E E E  #$  " 0 0 > >  L00 ,::(6::9aHH1L=A ,/ :.y999::::::::::::::: qyy#z!D04q!D!D!D%),01H + +). / / / / :"-#= $!%,1 '' %* ++++51B    !))##D&%88nn&& &..B// OOK33 '))  " "%//-CCK:?[N??)2???%0??? *&  " # # # # > 426>TRRRFN%+^K "  )&<<<CKKOOK00  " "73y=333   D&%0  . .i''%' '"9,,*, ,' l # ' ' 4 8 8 8 n % ) )4*? @ @ @$00-(((A-(((((0 *%+, -(m,E  W--l;; 0: '"9-LV $$%6;;LII     #9 - - -A . . . . . . . . . . . . . . .R I ItKOOK,H,H'I'IH  "7L( K K K K K I I I LL84L H H H H H I A:::BUBBB %"### #aZZcccc  # z+E:::: """#a&&!!!!!!!!"s;T,A!T, 3T,T,/A*E% T,%E))T,,E)-T,3,H<:G% H<%G))H<,G)-,H< H<;T,< I T,I  B9T,A}d|vr|dd|vr|d?ddddS#1swxYwYdS)uClear the deduplication cache for file reads. Called after context compression — the original read content has been summarised away, so the model needs the full content if it reads the same file again. Without this, reads after compression would return a "file unchanged" stub pointing at content that no longer exists in context. Call with a task_id to clear just that task, or without to clear all. rrN)rrrrvaluesr)rs rreset_file_dedupr3s6  4 4  4%))'22I 4i''g&,,...9,,l+11333*1133 4 4 i''g&,,...9,,l+11333 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4sB4C  C C ct5t|}|r(d|d<d|d<d|vr|dddddS#1swxYwYdS)uReset consecutive read/search counter for a task. Called by the tool dispatcher (model_tools.py) whenever a tool OTHER than read_file / search_files is executed. This ensures we only warn or block on *truly consecutive* repeated reads — if the agent does anything else in between (write, patch, terminal, etc.) the counter resets and the next read is treated as fresh. Nrrrr)rrrrr2s rnotify_other_tool_callr5s 00!%%g..  0$(Ij !'(Im $y((,'--///000000000000000000sAAA!Ac tt|n#ttf$rYdSwxYwt5t |}| ddddS|d}|s ddddSfd|D}|D]}||= ddddS#1swxYwYdS)uRemove all dedup cache entries whose resolved path matches *filepath*. Called after write_file and patch so that a subsequent read_file on the same path always returns fresh content instead of a stale "File unchanged" stub. The dedup cache keys are tuples of ``(resolved_path, offset, limit)``; we must evict **all** offset/limit combinations for the written path because any cached range could now be stale. Must be called with ``_read_tracker_lock`` **not** held — acquires it internally. Nrc,g|]}|dk|S)r).0krYs r z._invalidate_dedup_for_path.. s';;;A!A$(*:*:a*:*:*:r-)r]r,rhr\rrr)r(r)rr stale_keysr:rYs @r_invalidate_dedup_for_pathr=sr}X..// Z    !%%g..            g&&          <;;;;;;   Aa                   s) 55B3*B3B33B7:B7ct|| tt||}tj|}n#t tf$rYdSwxYwt5t |}|(|| di|<t|ddddS#1swxYwYdS)uRecord the file's current modification time after a successful write. Called after write_file and patch so that consecutive edits by the same task don't trigger false staleness warnings — each write refreshes the stored timestamp to match the file's new state. Also invalidates the dedup cache for the written path so that subsequent reads return fresh content (fixes #13144). Nr) r=r]r+r5r:rrhr\rrrrr)r(r)rYr$rs r_update_read_timestampr?sx111-h@@AA((22 Z  ..!%%g..  DQI !2B 7 7 A "9 - - - ..................s$>> >  !) , , : :'27IFFM1$@@M34i'RRK$W--H((G<} tC| | | }|rt)j"||?tG|d fd|DDdddn #1swxYwY|drwdt|dvr`d}|d kr)|r' |p|}tI||}|dkr d|d|d|d<ndt|dvrd|d<tKj&|d S#t$r&}tt|cYd}~Sd}~wwxYw)!zPatch a file using replace mode or V4A patch format. ``cross_profile`` opts out of the soft cross-Hermes-profile guard for targets under another profile's skills/plugins/cron/memories directory. Same shape as ``write_file``'s flag. rVrN)has_traversal_componentz/^\*\*\*\s+(?:Update|Add|Delete)\s+File:\s*(.+)$rz*V4A patch header contains '..' traversal: z. Use the agent's cwd-relative path (no '..') or an absolute path in '*** Update File:' / '*** Add File:' / '*** Delete File:' headers.) ExitStackrQz path requiredz"old_string and new_string requiredzpatch content requiredzUnknown mode: z | rc>g|]}|p|Sr8rr9_p_path_to_resolveds rr;zpatch_tool..s:"""46!%%b))/R"""r-rrErcg|]}||Sr8r8)r9_rs rr;zpatch_tool..s.000Z\0000r-c3BK|]}|VdSNr[r\s r zpatch_tool..s2!V!V"3"7"7";";!V!V!V!V!V!Vr-zCould not findrzThis is failure #z patching a. Stop retrying with variations of the same old_string. Either: (1) re-read the file fresh to verify current content, (2) use a longer / more unique old_string with surrounding context lines, or (3) use write_file to replace the entire file if the targeted region is hard to anchor.r z#Did you mean one of these sections?zfold_string not found. Use read_file to verify the current content, or search_files to locate the text.Fr)'appendretools.path_securityrXfinditer MULTILINEgroupr7rrwrrr]r+rrsort contextlibrY enter_contextr rGrHrBr_rrr patch_replace patch_v4arrjoinr?rIrrrr)!rRr:rSrTrUrVr)rC_paths_to_check_rerX_mv4a_pathr]rKrL_resolved_paths_seenr`rY_locksstale_warnings_cross_swr_replace_targetr&r'_resolved_modified failure_countrYr.r^s! @r patch_toolr}sO %t$$$ w5??????,,QSXZ]Zghh - -Bxx{{((**H'&x00 !aaaa  " "8 , , , ,11-b'::  -m,, , , , 15b'BBM 1!-00000"&(%%!  B /G<<==     boo&&r*** "  )((((( Y[[E F% ? ?$$Z%9"%=%=>>>>)+N02 % / /3B@@AABB BBB(*!"%@BL/<<<B 5b' B BJrJ32tBxxIIC/"))#...$W--Hy  7%o667E E E E E E E E 8%);%&JKK;E E E E E E E E F#4"7"7"="="E!//ZYdee@%&>??OE E E E E E E E P"++E22!"94"9"9::UE E E E E E E E X!..**K x?B>?R?RVW?W?W.*;*;]b]g]ghv]w]w J'"""":I"""  ??7++ 0B ,-)**a//3Ea3HK0);;B*2w777*..r22B;"-gr:::&g00!V!V!V!Vo!V!V!V000GE E E E E E E E E E E E E E E T ??7 # # (8C G@T$ 5gx H H !!! !!!!!G$$7c+gBV>W>WWWCG$z+E:::: """#a&&!!!!!!!!"s6S' D)(S') D85S'7D88AS'5P:G$#P:$ G30P:2G33BP: S'P:$ S'1AP:7 S''P:+ S'8C6P:. S':P>>S'P>B$S'' T1T TTr22patterntarget file_glob output_modecontextc  t||\}}d||t||pd||f} t5t|ddt d} | d| kr| dxxdz cc<n | | d<d| d<| d} dddn #1swxYwY| d krt jd | d || d d St|} | ||||||||} t| dr<| j D]4}t|dr"|j rt|j d|_ 5| }| dkr d| d|d<t j|d }|dr||z}|d|dz }|S#t $r&}t#t|cYd}~Sd}~wwxYw)zSearch for content or files.searchr/Nr)rrrrrrrz(BLOCKED: You have run this exact search z times in a row. The results have NOT changed. You already have this information. STOP re-searching and proceed with your task.)rralready_searchedFr)rr:rrrrrrmatchesrTrrzYou have run this exact search zY times consecutively. The results have not changed. Use the information you already have.rrz' [Hint: Results truncated. Use offset=zC to see more, or narrow with a more specific pattern or file_glob.])rr]rrrrrrrrhasattrrrr rrrr)rrr:rrrrrr) search_keyrr+rr&mr' result_json next_offsetr.s r search_toolrAs >"3FEBB     II O    - -%00 CEE;;I$ 22-(((A-(((((2 *%+, -(m,E - - - - - - - - - - - - - - - A:::DuDDD#$)"### #!))$vK!   69 % % Q^ Q Q1i((QQYQ 5ai4 P P PAInn&& A::V%VVV  # j5AAA  ??; ' ' X 5.K X{XXX XK """#a&&!!!!!!!!"sH2F AB F BF "B#&F CF G*G G G)registryrc"ddlm}|S)z=Lazy wrapper to avoid circular import with tools/__init__.py.rcheck_file_requirements)toolsrrs r_check_file_reqsrs#------ " " $ $$r-ruRead a text file with line numbers and pagination. Use this instead of cat/head/tail in terminal. Output format: 'LINE_NUM|CONTENT'. Suggests similar filenames if not found. Use offset and limit for large files. Reads exceeding ~100K characters are rejected; use offset and limit to read specific sections of large files. NOTE: Cannot read images or binary files — use vision_analyze for images.objectstringz8Path to the file to read (absolute, relative, or ~/path))rJ descriptionintegerz9Line number to start reading from (1-indexed, default: 1))rJrr'minimumz9Maximum number of lines to read (default: 500, max: 2000)i)rJrr'maximum)r:rr)rJ propertiesrequired)namer parametersrFuWrite content to a file, completely replacing existing content. Use this instead of echo/cat heredoc in terminal. Creates parent directories automatically. OVERWRITES the entire file — use 'patch' for targeted edits. Auto-runs syntax checks on .py/.json/.yaml/.toml and other linted languages; only NEW errors introduced by this write are surfaced (pre-existing errors are filtered out).zWPath to the file to write (will be created if it doesn't exist, overwritten if it does)z%Complete content to write to the filebooleanu0Opt out of the cross-profile soft guard. Defaults to false. Set true ONLY after explicit user direction to edit another Hermes profile's skills/plugins/cron/memories — by default these writes are blocked with a warning because they affect a different profile than the one this session is running under.)rJrr')r:rrCaTargeted find-and-replace edits in files. Use this instead of sed/awk in terminal. Uses fuzzy matching (9 strategies) so minor whitespace/indentation differences won't break it. Returns a unified diff. Auto-runs syntax checks after editing. REPLACE MODE (mode='replace', default): find a unique string and replace it. REQUIRED PARAMETERS: mode, path, old_string, new_string. PATCH MODE (mode='patch'): apply V4A multi-file patches for bulk changes. REQUIRED PARAMETERS: mode, patch.znEdit mode. 'replace' (default): requires path + old_string + new_string. 'patch': requires patch content only.)rJenumrr'z0REQUIRED when mode='replace'. File path to edit.zREQUIRED when mode='replace'. Exact text to find and replace. Must be unique in the file unless replace_all=true. Include surrounding context lines to ensure uniqueness.z`REQUIRED when mode='replace'. Replacement text. Pass empty string '' to delete the matched text.zLReplace all occurrences instead of requiring a unique match (default: false)zREQUIRED when mode='patch'. V4A format patch content. Format: *** Begin Patch *** Update File: path/to/file @@ context hint @@ context line -removed line +added line *** End PatchzOpt out of the cross-profile soft guard. Defaults to false. Set true ONLY after explicit user direction to edit another Hermes profile's skills/plugins/cron/memories.)rRr:rSrTrUrVrC search_filesuSearch file contents or find files by name. Use this instead of grep/rg/find/ls in terminal. Ripgrep-backed, faster than shell equivalents. Content search (target='content'): Regex search inside files. Output modes: full matches with line numbers, file paths only, or match counts. File search (target='files'): Find files by glob pattern (e.g., '*.py', '*config*'). Also use this instead of ls — results sorted by modification time.zPRegex pattern for content search, or glob pattern (e.g., '*.py') for file searchfileszK'content' searches inside file contents, 'files' searches for files by namezCDirectory or file to search in (default: current working directory)zOFilter files by pattern in grep mode (e.g., '*.py' to only search Python files)z1Maximum number of results to return (default: 50)z0Skip first N results for pagination (default: 0))r files_onlyr+zOutput format for grep mode: 'content' shows matching lines with line numbers, 'files_only' lists file paths, 'count' shows match counts per filezDNumber of context lines before and after each match (grep mode only))rrr:rrrrrc |dpd}t|dd|dd|dd| S) Nr)r'r:r/rrrr)r:rrr))rr/argskwtids r_handle_read_filers_ &&   (yC txx33DHHXq.>#D#D  -        d9os + +  1DO$$- 1 1 1     &\4 ?C488OU;;<<   r-c |dpd}t|dd|d|d|d|dd |d |t|d d  S) Nr)r'rRrQr:rSrTrUFrVrC)rRr:rSrTrUrVr)rC)rr}rrs r _handle_patchrs &&   (yC  XXfi ( (txx/?/?88L))dhh|6L6LHH]E22$((7:K:KUX488OU;;<<    r-c |dpd}ddd}|dd}|||}t|dd||d d |d |d d |dd|dd|dd| S)Nr)r'rr)grepfindrrr/r:r2rrr~rrrr) rrr:rrrrrr))rr)rrr target_map raw_targetrs r_handle_search_filesr$s &&   (yC#W55J(I..J ^^J 3 3F B''TXXfc=R=R((;''txx/D/DTXXV^`aMbMbHH]I66TU@V@V`c e e eer-fileu📖)rtoolsetschemahandlercheck_fnemojimax_result_size_charsu✍️u🔧u🔎)r'rb)rrr')r'F)rQNNNFNr'F)rr2Nr~rrrr')b__doc__rrloggingr5rpathlibrrrtools.binary_extensionsrtools.file_operationsrrrrr agent.redactr getLoggerrrEACCESEPERMEROFSrrr r__annotations__rr frozensetrar]r,r9r?rLrOrVr+r_rrerirrrsrjrnrorwrrrrrrFrGdictrrrrrlistrrrrrrrrrr/r3r5r=r?rBrPr}rtools.registryrrrREAD_FILE_SCHEMAWRITE_FILE_SCHEMA PATCH_SCHEMASEARCH_FILES_SCHEMArrrrregisterr8r-rrs <<<  222222888888 ......  8 $ $ , U[A"%)d )))"S""""0! " # # #  55C5#5d5555$)$B$B$BCC#*"Cd >&&3&sTz&&&&$s4D 6 6S 63 6t 6 6 6 6""s"d"S"Y\_cYc""""J#$&*12DE&*t***!&#S4Z####"C#cDj<3sTzD999c9#PT*9999xiD !!"$Y^%% t%in&&!!!!,3,s,s,,,," (3 ( ( ( ( ( ("  =0d0t0000f34>AA3A/BAAAAH$$#$$$$V"V"V"cV"cV"#V"^aV"V"V"V"v44c4444600C0000(st<.S.3.4....0C##*>=F*/K"K"#K"K"cK"#'K"47K"K"K"K"\KOOS?Dh"h"Sh"Ch"Ch"h"48h"ILh"h"8<h"ILh"h"h"h"VDGFG=>(C"C"C"cC"SC"C".1C"@CC" C"7:C"C".1C"C"C"C"V0///////%%% c%6pqq(9tBCPQRR'8sADQUVV  H   [%7PQQ (9`aa! R   Y'  &  ,!"G, P$ !Q ! K ! B "m  ! ] " H 9! ! DHI%%11 h O (:LMM')W1EWdqz{{%6{ILMM"*Q[o{KSYqxyyyyyyr-