+ Wja0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIH t ^RI H t H t ^RI Ht]!4^RIHtHt]P$!]4t] !R4t]P,!4t/tR]R &/tR]R &R R ltR RltRRltRRltRRltRRlt RRlt!RRlt"RRlt#R%RRllt$RR lt%R!R"lt&R#R$lt'R#)&uManaged scope — IT-pushed, user-immutable config & env layer. DISTINCT from ``hermes_cli.config.is_managed()`` / ``HERMES_MANAGED`` (a coarse package-manager write-lock that blocks all mutation); this layer injects specific immutable values. The two are independent and may coexist. v1 enforcement is filesystem permissions only (see ``docs/design/managed-scope.md`` §7); ``get_managed_dir()`` is the single seam for adding macOS / Windows native locations later. ) annotationsN)Path)DictOptional)drop_stale_root_modules)fast_safe_loadfile_signaturez /etc/hermesdict[str, tuple] _CONFIG_CACHE _ENV_CACHEcV^8dQhRR/#)returnbool)formats"LC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\managed_scope.py __annotate__r's//t/c(R\P9#)zTrue inside the test suite: ignore the system ``/etc/hermes`` so a real managed scope on a dev/CI box can't leak policy into the suite. An explicit ``HERMES_MANAGED_DIR`` still wins.PYTEST_CURRENT_TEST)osenvironrrr _under_pytestr's !BJJ ..rcV^8dQhRR/#)r rzOptional[Path]r)rs"rrr-s%%%rc\PPRR4P4pV'd \ V4pM\ 4'dR#\ pVP4'dV#R#)ubResolve the managed-scope directory, or None when no scope is present. Priority: ``$HERMES_MANAGED_DIR`` (IT-only bootstrap override; never persisted to any .env; honored only when non-empty AND the directory exists), then ``/etc/hermes`` when it exists. A missing directory resolves to None — the common case, so it must be cheap + side-effect-free. HERMES_MANAGED_DIRN)rrgetstriprr_DEFAULT_MANAGED_DIRis_dir)overrideps rget_managed_dirr$-sRzz~~2B7==?H N   1$$rcV^8dQhRR/#)r rNoner)rs"rrr>s$rc\;_uu_4\P4\P4RRR4R# +'giR#;i)z@Drop cached managed config/env. For tests and post-edit reloads.N) _CACHE_LOCKr clearr rrrinvalidate_managed_cacher*>s+  s )A A c V^8dQhRRRR/#)r pathrcacher r)rs"rrrEst$4rc|VP4p\T4p\T4p\;_uu_4TP T4pTeDTR\ T4T8Xd1\P!T\ T4,4uuRRR4#RRR4T!T4p\;_uu_4.TO\P!T4N5Y&RRR4T# \dR#i;i +'giLa;i \d"p\PRY4Rp?R#Rp?ii;i +'giT#;i)u*Shared stat-signature-keyed read; returns a deepcopy of the parsed value. ``None`` when the file is absent or fails to parse (fail-open). A parse failure is logged LOUDLY — the admin needs to know their policy isn't applied — but never raises, so a malformed managed file can't brick startup. Numanaged scope: failed to parse %s: %s — IGNORING this managed file. Admin policy from this file is NOT being applied. Fix and restart.) statOSErrorrstrr(rlencopydeepcopy Exceptionloggerwarning) r,r-parsestkeypath_keyhitparsedexcs &&& r _cached_readr?Es YY[  C4yH ii! ?s9CH~4==SX/ t 7C7v!67  M%    Q     MsACAC(C;.D* C%$C%( C8 ; D'D""D'* D; c$V^8dQhRRRRRR/#)r namer1r-r rdictr)rs"rrrcs"66S6)96T6rcz\4pVf/#\W0, W4p\V\4'dV#/#)N)r$r? isinstancerB)rAr-r8 managed_dirr=s&&& r_load_managed_filerFcs;!#K +,e ;F--6525rcV^8dQhRR/#)r rrBr)rs"rrrksTrc&\R\R4#)zDParsed managed config.yaml, or {} when absent/malformed (fail-open).z config.yamlcL\VPRR74;'g/#) utf-8-sigencoding)r read_text)r#s&r%load_managed_config..ms%nUVU`U`juU`UvFwF}F}{}F}r)rFr rrrload_managed_configrPks m]<} ~~rcV^8dQhRR/#)r rdict[str, str]r)rs"rrrpsFF.Frc,\R\\4#)z?Parsed managed .env (KEY=VALUE), or {} when absent (fail-open).z.env)rFr _parse_managed_envrrrload_managed_envrUps fj2D EErc V^8dQhRRRR/#)r r,rrrRr)rs"rrrusTnrcB^RIHpVPRR7V!V4#)) load_env_filerJrK)agent.secret_scoperYrM)r,rYs& rrTrTus0NNKN(  rc V^8dQhRRRR/#)r configrBrr)rs"rrr|s$4rc<\4pV'gV#^RIHpHpHpV!V!V44p\ VP R4\4'd\V4pRVR,/VR&V!W4# \d\PRRR7Tu#i;i)aOverlay administrator-pinned config values on top of an already-built dict. ``${VAR}`` refs in the managed config expand against the PROCESS env only, so a user cannot shadow a managed literal via a ref they control; a bare root ``model: x/y`` string is promoted to ``model.default`` so it can't clobber the dict shape callers expect; managed values deep-merge ON TOP per leaf while sibling keys stay user-controlled. Fail-open: returns ``config`` unchanged when no scope is present or on any error. Mutates and returns ``config``. ) _deep_merge_expand_env_vars_normalize_root_model_keysmodeldefaultz-managed scope: failed to apply config overlayT)exc_info) rPhermes_cli.configr^r_r`rDrr1rBr5r6r7)r\managedr^r_r`managed_expandeds& rapply_managed_overlayrg|s%'M__56Fw6OP &**73S 9 9#$45 )24DW4M(N W %644 FQUV sA4AA44$BBc$V^8dQhRRRRRR/#)r drBprefixr1rsetr)rs"rrrs!T3rc\4pVP4Fbwr4V'dV RV 2M \V4p\V\4'dV'dV\ WE4,pKQVP V4Kd V#).)rkitemsr1rDrB _flatten_keysadd)rirjkeyskvdotteds&& rroroscD $*F81QCA a  1 M!, ,D HHV   KrcV^8dQhRR/#)r rrkr)rs"rrrs00S0rc(\\44#)zGDotted leaf keys pinned by the managed config (e.g. {'model.default'}).)rorPrrrmanaged_config_keysrws ,. //rc V^8dQhRRRR/#)r dotted_keyr1rrr)rs"rrrs//s/t/rcV\49#)zCTrue if the exact dotted config key is pinned by the managed layer.)rw)rys&ris_key_managedr{s ,. ..rc V^8dQhRRRR/#)r rAr1rrr)rs"rrrs&&&&rcV\49#)z=True if the env var name is pinned by the managed .env layer.)rU)rAs&ris_env_managedr~s #% %%r)r)(__conditional_annotations____doc__ __future__rr3loggingr threadingpathlibrtypingrrhermes_cli.stale_modulesrutilsrr getLogger__name__r6r Lockr(r __annotations__r rr$r*r?rFrPrUrTrgrorwr{r~)rs@rrs#  ! =0   8 $M*nn "$ $! !/ %"<6 F 80 / &r