+ Wjt a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t HtHt^RIHtHt^RIHt^RIHt^RIHt^R IHt^R IHtHtHtHtH t ^R I!H"t"H#t#H$t$H%t%H&t&H't'H(t(H)t)H*t*H+t+H,t,H-t-H.t.H/t/H0t0H1t1H2t2^R I3H4t4H5t5H6t6H7t7H8t8H9t9H:t:H;t;HH?t?H@t@HAtA^RIBHCtCHDtDHEtE^RIFHGtGHHtHHItIHJtJHKtK^RILHMtMHNtNHOtOHPtPHQtQHRtR]P!]T4tURtVRtWRtX]P!^R7RRl4tZ!RR][4t\!RR]\4t]Rt^Rt_RRlt`RR lta]b3R!R"lltcR#R$ltdR%R&lteR'R(ltfR)R*ltgR+R,lthR-R.ltiR/RR0R1/R2R3lltjR4R5ltkR6R7ltlR8R9ltmR:R1/R;R<lltn0RmtoRtpR=R>ltqR?R@ltrRARBltsRCRDlttRERFltuRGRHltvRIRJltwRKRLltxRMRNltyRORPltzRQRRlt{RSRTlt|RUR1/RVRWllt}]P!]fRXRY4t]P!]fRXRZ4tR[R\ltR]R^ltR_RR`RRaRbRcRRdR/ReRfllt]!RgRh04tRiRjltRkRlltRRmRnlltR`R/RoRplltRqRrlt/tRs]Rt&] EP!4tRuRvltRwRR`R/RxRylltRzR{ltR|R}ltR~RltRRltRRltRRRlltRRltRRltRRltRRlt]!0Rm4tRRltRRltRRltRRltRRRRRR]!4/RRlllt]P!]gRRRR7t]P!]gRRRR7t]P!]hRR4t]P!]hRR4tRRltRRltRR/RRlltRRltRRltRRltRRR1/RRllltRRltRtRtRt/RRbRRbRRbRRbR]bRRbRRbRRbRRbRRbRRbRRbRbRbRRbRRbRRbRRbRRR]RRRRRR/CtRRltR#)ul``hermes plugins`` CLI subcommand — install, update, remove, and list plugins. Facade: shared primitives (errors, console/config helpers, manifest reading, discovery, enable/disable selection) and the dispatch table live here; each verb family lives in a ``plugins_cmd_.py`` sibling (install, update, remove, git, capabilities, toggle, listing, catalog).) annotationsN)Path)AnyNoReturnOptional)get_hermes_homehermes_home_key)cfg_get) _child_dict)masked_secret_prompt)rmtree_readonly)_declared_capabilities_for_key$_declared_capabilities_from_manifest_resolve_tool_override_grant_run_capability_consentcmd_capabilities)_EXACT_COMMIT_RE_canonical_source_checkout_exact_revision_clone_plugin_repo_git_head_revision _git_or_raise_git_pull_plugin_dir_git_resolve_commit_normalize_exact_revision_pin_annotation_read_install_metadata_run_plugin_git_safe_git_error_scrub_cloned_origin_update_install_record_write_install_metadatapinned_revision) _check_manifest_version_consent_python_deps_display_after_install_install_plugin_core_install_plugin_python_deps_prompt_plugin_env_vars_python_dependency_summary_read_manifest_for_install cmd_installdashboard_install_plugin)_filter_plugin_entriescmd_listcmd_show)_remove_plugin_core cmd_removedashboard_remove_user_plugin)_discover_context_engines_persist_plugin_selection_provider_categories_run_composite_fallback cmd_toggle)_clear_plugin_bytecode cmd_adoptcmd_check_updatescmd_trust_update_url cmd_updatedashboard_update_user_plugini,izIOn a slow connection, raise plugins.clone_timeout_seconds in config.yaml.)maxsizecV^8dQhRR/#return Optional[str])formats"JC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\plugins_cmd.py __annotate__rG@sJJJc N\P!R4pV'dV#\PR8Xd\PP RR4\PP RR4.p\PP RR4pV'd0VP \PPVR 44VUUu.uF.pRF%p\PPVR VR 4NK' K0 pppM.ROp\R V4R 4#uuppi)zEResolve a git binary for subprocess use when ``PATH`` may be minimal.gitnt ProgramFileszC:\Program FileszProgramFiles(x86)zC:\Program Files (x86) LOCALAPPDATAProgramsGitzgit.exec3"TF7q'gK \PPV4'gK3VxK9 R#5iN)ospathisfile).0cs& rF *_resolve_git_executable..Ps%BJq!q0AJs A"A AN)cmdbin)z /usr/bin/gitz/usr/local/bin/gitz/bin/git) shutilwhichrSnameenvirongetappendrTjoinnext)foundrootslocalrsub candidatess rF_resolve_git_executablerj?s LL E   ww$ JJNN>+> ? JJNN.0I J  ~r2  LLeZ8 9FKfeWePSbggll1eS)a]tRt^StRtRtRR/RV3RllltRtV;t#)PluginOperationErroraRecoverable plugin install/update failure (CLI exits; HTTP maps to 4xx). ``failure_class`` names the raise site for the extension-install metric (a closed name from ``shared_metrics_contract.EXTENSION_PLUGIN_FAILURE_CLASSES``); untagged sites read ``other``. other failure_classNcV^8dQhRR/#)rArnrCrD)rEs"rFrG!PluginOperationError.__annotate__\s//]/rHc <<\SV`!V!Ve WnR#R#rR)super__init__rn)selfrnargs __class__s&$*rFrsPluginOperationError.__init__\s! $  $!.  %rHrn __name__ __module__ __qualname____firstlineno____doc__rnrs__static_attributes__ __classcell__rvs@rFrlrlSs% M/T///rHrlc:a]tRt^btRtRtRRV3RllltRtV;t#)PluginScanBlockedz6Plugin failed the security scan and was not installed. scan_blockedcV^8dQhRR/#)rAmessagestrrD)rEs"rFrGPluginScanBlocked.__annotate__gs'''rHc 2<\SV`V4W nR#rR)rrrs scan_result)rtrrrvs&&&rFrsPluginScanBlocked.__init__gs !&rHrrRryrs@rFrrbs@"M'''rHrc^RIHpV!4#)z/A fresh Rich console (rich is imported lazily).Console) rich.consolerrs rF_consolerls $ 9rHc \^RIHpV!R/VBpVFwrEVPWER7K V#)zMA Rich ``Table(**kwargs)`` with ``(header, style)`` *columns* added in order.)Table)stylerD) rich.tabler add_column)columnskwargsrtableheaderrs&, rF_tablerrs2 OFOE  -! LrHcV^8dQhRR/#rArBboolrD)rEs"rFrGrG{s666rHc\PP4;'d\PP4#rR)sysstdinisattystdoutrDrHrF_is_ttyr{s* 99    5 5#**"3"3"55rHc V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrGsCHrHcTVPV4\P!^4R#)zPrint *message* and exit 1.N)printrexit)consolers&&rF_failrs MM'HHQKrHc V^8dQhRRRR/#)rApromptrrBrrD)rEs"rFrGrGs""S"4"rHcV!V4P4P4pTR9# \\3dR#i;i)z-One y/N question; EOF / Ctrl-C count as "no".F>yyes)striplowerEOFErrorKeyboardInterrupt)rreaderanswers&& rF_ask_yesrsI%%'--/ \ !! ' (s$+AAc$V^8dQhRRRRRR/#)rAkeysrdefaultrrBrD)rEs"rFrGrGs!ssrHc^^RIHp\V!4.VO5RV/# \dTu#i;i)zORead ``keys`` from config.yaml; *default* on a missing key or any load failure. load_configr)hermes_cli.configrr Exception)rrrs$* rF _config_valuers51{}=t=W== s  ,,cV^8dQhRR/#)rArBintrD)rEs"rFrGrGs   rHc&\RR\R7p\V\4'g\V\4'dV^8d!\ P R\4\#V\8d!\ P R\4\#V#)zIDeadline for plugin clone and pinned fetch, scoped to the active profile.pluginsclone_timeout_secondsrzCplugins.clone_timeout_seconds must be a positive integer; using %ssz3plugins.clone_timeout_seconds exceeds %ss; clamping)r_DEFAULT_CLONE_TIMEOUT_SECONDS isinstancerrloggerwarning_MAX_CLONE_TIMEOUT_SECONDS)values rF_clone_timeout_secondsrsm )%...)\r)rrr)r ValueErrorresolver)r^rr badtargetplugins_resolveds&&$ rF_sanitize_plugin_namerszz# 9:: {06ijkk+|1BB ;4TF:OPSuTVWX XC ) ) +F"**, !06bcdd~~-06`abb MrHc V^8dQhRRRR/#)rArrrBztuple[str, Optional[str]]rD)rEs"rFrGrG&s$)$)$))B$)rHc.VP\4'EdVPR4'EdV\R4RpVPR^4^,PR^4^,P R4pVPR4p\V4^8d\ VR,4'dV^,\ 9dV^,PR4pRpV^,R8XdI\V4^8d9RPR VR ,44P R4;'gRpRV^, RV R2V3#RV9d1VPR4wrVpYWP R4;'gR3#VPR 4wrXpV'd%VR,VP R4;'gR3#VR3#VPR4wrp VP R4PR4U u.uFq'gK V NK pp \V4^8d^RP.VR ,OV PR4O4P R4pRV^, RV^, R2T;'gR3#\R V R24huup i)zTurn an identifier into a cloneable Git URL and optional subdirectory. ``http://`` and ``file://`` are accepted but trigger a security warning at install time. zhttps://github.com/N?#r:NrAN.gittreec38"TFq'gK VxK R#5irRrD)rVps& rFrX#_resolve_git_url..4s%@Aaaas  :NNz.git/:rANNzInvalid plugin identifier: 'zi'. Use a Git URL or 'owner/repo' shorthand (optionally with a subdirectory: 'owner/repo/path/to/plugin').) startswith _URL_SCHEMESlensplitrall_GITHUB_BROWSER_SEGMENTS removesuffixrb partitionr) rrTpartsreposubdirgit_url_fragmarkerfragmentr!s & rF_resolve_git_urlr4&s^ \**  !6 7 7c"78:;D::c1%a(..sA6q9??DDJJsOE5zQ3uRy>>eAhBZ6ZQx,,V48v%#e*/ XX%@r%@@FFsKSStF,U1XJavTBFJJ * )33C8 GZZ_445 5","6"6w"? V#fll3&7&?&?4@ @4)2237J8"((-33C8 >81AQQ8E > 5zQ4PP  &zl3( ( )) ?s JJc$V^8dQhRRRRRR/#)rA clone_rootrr.rrBrD)rEs"rFrGrGMs!tSTrHc<VP4pW, P4pW 8wd"WP9d\RV R2RR7hVP4'g\RV R2RR7hVP 4'g\RV R2RR7hV#)zResolve ``subdir`` inside ``clone_root``; ``..``, absolute paths and symlinks may not escape the clone. Raises ``PluginOperationError`` if it escapes, is missing, or is a file.zPlugin subdirectory 'z' escapes the repository.invalid_sourcerxz#' does not exist in the repository.z' is not a directory.)rrrlexistsis_dir)r6r. candidates&& rF_resolve_subdir_withinr<Ms##%J$--/I:5F5F#F"%:6(B[#\1AC C     "%:6(Be#f1AC C     "%:6(BW#X1AC C rHc V^8dQhRRRR/#)rAurlrrBrD)rEs"rFrGrG^sSSrHcVPR4PR4PR^4R,pRV9d1VPR^4R,PR^4R,pV#)zZRepo name from a Git URL (last path component; ssh-style ``git@host:repo`` splits on ':').rr:)rstripr*rsplit)r>r^s& rF_repo_name_from_urlrD^s_ ::c? ' ' / 6 6sA >r BD d{{{3"2&--c15b9 KrHc V^8dQhRRRR/#)rArrrBOptional[Path]rD)rEs"rFrGrGfsXXdX~XrHct^RIHpV!V4# \dp\\ T4RR7ThRp?ii;i)zT``plugin.yaml`` (or ``plugin.yml``) under *plugin_dir*, or None when neither exists.)native_manifest_filemanifest_invalidrxN)pm.plugin_declarationsrHrrlr)rrHrs& rF_native_manifest_filerKfs=;X#J// X"3s8;MNTWWXs 727c V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrGps@@t@@rHcdVR, pVP4;'gVP4#)zUTrue when ``plugin.json`` exists (or is a symlink, even dangling) under *plugin_dir*. plugin.json)r9 is_symlink)r portable_files& rF_has_portable_manifestrQps,.M    ! ? ?]%=%=%??rHcV^8dQhRR/#)rA manifest_filerrD)rEs"rFrGrGvs//t/rHc^RIHpV!V4#)zZ``yaml.safe_load`` of *manifest_file* (``{}`` when empty); raises on any read/parse error.)read_native_manifest)rJrU)rSrUs& rF_load_yaml_manifestrVvs;  ..rHc V^8dQhRRRR/#)rArrrBdictrD)rEs"rFrGrG}strHcJ\V4pVf*\V4'g/#^RIHpV!V4^,#\V4# \d#p\ P RY4/uRp?#Rp?ii;i \d#p\ P RY4/uRp?#Rp?ii;i)z;Read a native or portable manifest, preferring native YAML.Nread_agent_plugin_manifestz$Failed to read plugin.json in %s: %sz$Failed to read plugin.yaml in %s: %s)rKrQhermes_cli.agent_pluginsr[rrrrV)rrSr[es& rF_read_manifestr^}s)*5M%j11I  K-j9!< <"=11   NNA: QI  =zM s:A A5 A2A-'A2-A25 B"BB"B"c V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrGs..4.D.rHc\V4RJ;'g7VR, P4;'gVR, P4#)zOTrue when *target* has a native/portable manifest or a package ``__init__.py``.NrNz __init__.py)rKr9)rs&rF_looks_like_plugin_dirrasL f%T1 - - ] " * * , - - ] " * * ,.rHc V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrGs ` `D `d `rHctVPR4FhpVPpW, pVP4'dK/\P!W$4VP RV RVP R24Kj R# \d-pTP RTP RT 24Rp?KRp?ii;i)zCopy ``*.example`` files to their real names (``config.yaml.example`` -> ``config.yaml``), never overwriting an existing file so reinstall keeps user config.z *.examplez[dim] Created z from [/dim]z)[yellow]Warning:[/yellow] Failed to copy z: N)globstemr9r\copy2rr^OSError)rr example_file real_name real_pathr]s&& rF_copy_example_filesrls# 4  %% *       ` LL 1 MMOI;f\=N=N Rich ``console.print``: escape the git output so ``[...]`` in it is not parsed as markup.escapez#Could not download the plugin from z. Check the address (browse the catalog with `hermes plugins search`), check your internet connection, or, if the repository is private, sign in first with `gh auth login` (or set GITHUB_TOKEN in your .env). Details: ) rich.markuprzr)r/rwrzs&& rF_clone_failure_messager|s1 #1';y012 45rHc$V^8dQhRRRRRR/#)rAr^rrrrBrD)rEs"rFrGrGs!  C d  rHc\WRR7pXP4'g'\ V4pVf\V\ VRR74V# \dp\TRT 24Rp?L]Rp?ii;i)z\The plugin path if it exists; else exit 1 (invalid name, or a listing of installed plugins).Tr [red]Error:[/red] N)downloaded_only)rrrr9_resolved_user_plugin_dir_unknown_plugin_message)r^rrrr]s&&& rF_require_installed_pluginrsm1&ttL ==??*40 > '24N O M 1 g+A3/001s A A1A,,A1rc$V^8dQhRRRRRR/#)rAr^rrrrBrD)rEs"rFrGrGs& B B# B4 BC BrHchV'dRMRp^RIHpV!V4;p'd RV RV 2#RV RV R2#)zV``No plugin named ...`` with the exact-name rule and the two commands that resolve it.z] This command only works on downloaded plugins; bundled ones can only be enabled or disabled.z1 Bundled plugins can only be enabled or disabled.)moved_plugin_hintz[red]No plugin named 'z '.[/red] zr'.[/red] Run `hermes plugins list` to see the exact names (nested plugins use their full key, e.g. web/firecrawl).z3 To add one: `hermes plugins install `.)hermes_cli.left_core_migrationr)r^rscopermoveds&$ rFrrs` m%X @!$''u''vYug>>$TF+GGLgNA ABrHrdisabledenabledc V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrGsstrHc ^RIHpV!4R#)zHFrozen old-updater import: never resurrect a raw plugin-selection write.)stop_for_relaunchN)hermes_cli._old_updaterr)rrs& rF_save_enabled_setrs 9rHcV^8dQhRR/#)rArBrrD)rEs"rFrGrGsCC3CrHcP^RIHpV!\4R, 4;'gR#)_digestz config.yamlmissing)hermes_cli.runtime_staterrrs rF_plugin_selection_versionrs 0 ?$}4 5 B BBrH extra_dirsractionenableexpected_configpluginc ,V^8dQhRRRRRRRRRR /#) rArrrrrrrCrBrrD)rEs"rFrGrGs6!! !!IL! ! !rHc N^RIHp^RIHpHp Hp V !W\ 4W%VR7R# T d?p Te5TPRT!\T 44 24TPR4hRp ? iTd3p Te)TPRT RT 24TPR4hRp ? ii;i) uONE admission authority for proposed enabled/disabled sets (C13): the candidate union is resolved against the ACTIVE environment and the config commits inside the same worker-owned PM transaction — a refusal or a config-write failure publishes nothing: previous config bytes AND previous environment stay exactly in place. Raises :class:`AdmissionRefused` (UI callers catch and surface it — admission never auto-disables to fit); a resolver conflict raises its :class:`DependencyConflict` subclass naming *plugin*.ry)AdmissionRefusedDependencyConflictadmit_plugin_set_change)active_plugins_dirrrrNu[red]✗[/red] z@[dim]config.yaml and the active environment are unchanged.[/dim]z refused: z}[dim]config.yaml and the active environment are unchanged. Run `hermes pm install` to resolve dependencies, then retry.[/dim]) r{rzhermes_cli.plugins_admissionrrrr rr) rrrrrrrrzrrrrs &&$$$$$ rF_admit_and_save_plugin_setsrs#jj ,.Z     MMOF3s8,<+=> ? MM\ ]    MMOF8:cUC D MMU  s&(B$9A((B$1B$2-BB$basiczdashboard_auth/basicc V^8dQhRRRR/#)rAcfgrXrBrrD)rEs"rFrGrGs  D T rHc&VPR4p\V\4'dVPR4MRp\V\4'd\ V4\ ,'gR#\ \ V4\ , 4VR&R#)a Drop the bundled basic dashboard-auth plugin from ``plugins.disabled`` in *cfg*. ``hermes setup`` / ``hermes plugins disable basic`` can park it there while ``dashboard.basic_auth`` is configured, and password auth then silently fails. Returns True when modified. rrNFT)r`rrXrr_BASIC_AUTH_PLUGIN_KEYSr)r plugins_cfgrs& rF*ensure_basic_auth_plugin_enabled_in_configrsj'')$K.8d.K.K{z*QUH h % %c(m>U.U.U$S]5L%LMK  rHc$V^8dQhRRRRRR/#)rAnamesrrrrBrrD)rEs"rFrGrG"s!&&&3&4&rHcvVPV4VPVPR4R,4R#)zDrop *key* and its bare leaf (``web/exa`` -> ``exa``) from *names*, so a stale legacy bare-name entry can't keep vetoing the canonical key.rNrA)discardr')rrs&&rF_discard_key_and_leafr"s) MM# MM#))C.$%rHc$V^8dQhRRRRRR/#)rArrentrieszOptional[list]rBrrD)rEs"rFrGrG)s!~rHca^RIHpSSPR4R,0V!S4mpTPV3RlVf \ 4MT44V#)agEvery spelling a config list may hold for *key*: the key, its bare leaf and the manifest name. The loader matches BOTH the canonical key (``web/firecrawl``) and the manifest name (``web-firecrawl``), so a stale entry under any form vetoes an enable ("explicit disable wins"). Pass *entries* to reuse one :func:`_discover_all_plugins` scan across several keys.)legacy_plugin_keysrc3T<"TFq^,S8XgKV^,xK R#5i)NrD)rVr]rs& rFrX"_plugin_aliases..0s'h W!^_\`dg\g1 Ws((rA)rrr'update_discover_all_plugins)rrrrsf& rF_plugin_aliasesr)sP B #))C.$ ?'9#'> ?E LLh7? 5 7PW Whh LrHc$V^8dQhRRRRRR/#)rArrrrrBrD)rEs"rFrGrG4s!  s t d rHc\4\4rC\V4pV'dW43MWC3wrgW9dWW,'gR#\WWRR7R#)aFTransactionally persist canonical *key*, purging aliases from the opposing list. False when the lists already say so (nothing written). PM owns the selection and dependency publication together, so every CLI/dashboard activation surface goes through the same admission transaction instead of writing ``config.yaml`` directly.F)raliasesrT)_get_enabled_set_get_disabled_setr_set_plugin_enabled)rrrrrrrrms&$$ rF _activate_keyr4sH )*,=,?Xc"G+1W'7JMF }gooGM rHc V^8dQhRRRR/#)rArrrBdict[str, Any]rD)rEs"rFrGrGCs3>rHc^RIHpHpV!4pRp/pVPR4p\ V\ 4'dR FepVPV4p\ V\ 4'gK,V\V4,'gKF\\V4V, 4Wg&RpKg VPR4p \ V \ 4'd6V\V 4,'dV\V 4,Fp WK RpVPR4p \ V \ 4'dB\V PR4;'gR4P4V9d RV R&RR R/rTV'd V!V4V#) a(Drop every trace of a removed plugin (its :func:`_plugin_aliases`, taken BEFORE the tree went) from config.yaml: allow/deny-list entries, ``plugins.entries.`` grants and a ``memory.provider`` selection naming it. A later reinstall under the same name must start from the "Enable now?" decision, not inherit a stale enable or grant (#54336); a dangling ``memory.provider`` would make the next agent init re-clone the plugin from the catalog, silently undoing the uninstall. Returns ``{"cleared_memory_provider": True}`` when the selection was reset.rFrTrmemoryproviderrNcleared_memory_provider)rr) rrrr`rrXrrrrr) rrrrchangedrrlist_keyrralias memory_cfgs & rF_forget_plugin_configrCs5; ]FGF**Y'K+t$$/HOOH-E%&&7SZ+?+?(.s5zG/C(D % 0 //), gt $ $3w<)?)? 3w<//N0GH%J*d##JNN:,F,L,L"(M(S(S(UY`(`!# :!:D AF MrHzdict[str, threading.Lock]_SELECTION_LOCKScV^8dQhRR/#)rArBzthreading.LockrD)rEs"rFrGrGjsPPPrHc\;_uu_4\P\4\P !44uuRRR4# +'giR#;irR)_SELECTION_LOCKS_GUARDrrr threadingLockrDrHrF_selection_lockrjs1  **?+NO   s 1A  A rc$V^8dQhRRRRRR/#)rAr^rrrrBrrD)rEs"rFrGrGos' e ec ed eQU erHc ^RIHp\4;_uu_4\4pV!\ 44;'g/pVP R4;'g/p\ VP R4;'gR 4p\ VP R4;'gR 4p \WWVR7\YTV'dRMR RV R 2YQ'dTMR R 7R R R 4R # +'giR #;i) zESubmit the command's delta with the version of the selection it read.)read_home_selectionrrrrEnableDisablez ''N)rrrrrD) pm.plugins_staterrrrr`r_apply_activationr) r^rrrrrrrrrs &$$$ rFrros4   35$_%67==2**Y'--2gkk),223w{{:.44"5'T6J#Gw9?XY,OrRVQWWX*Y3BSY4_c e    sC"" C3 c ,V^8dQhRRRRRRRRRR /#) rArrrrrrrrBrrD)rEs"rFrGrGs1//s/c//QU/Z^/rHcV'dTMTp\WR4VPV4V'dTMTPV4R#)z`Add canonical *key* to the target list and purge it, its bare leaf and *aliases* from the other.N)rdifference_updateadd)rrrrrremoveds&&&&$ rFrrs3 hgG'' g&WH))#.rHc V^8dQhRRRR/#rAr^rrBrCrD)rEs"rFrGrGs--c-m-rHc>\V4pV'd V^,#R#)zCanonical registry key for a manifest name / directory name / path key, or ``None``. The single normalization point so enable/disable write the key ``PluginManager`` gates on.N)_resolve_plugin_key_and_source)r^resolveds& rF_resolve_plugin_keyrs.d3H"8A;,,rHc V^8dQhRRRR/#rAr^rrBrFrD)rEs"rFrGrGs / / / /rHcR^RIHp\\44pTUu.uFPp\ 4T, ;pP 4'gK,T!T4;p'gK>TR,T8XgKNTNKR pp\T4^8Xd T^,#R# \dR#i;iuupi)aEInstall dir whose installer-owned record names catalog entry *name* (``hermes-memory-wiki`` is installed as ``plugins/memory-wiki``), else None (also when two dirs claim it). Read through :func:`catalog_install_record` (``.install-metadata.json``), never the tree, so a URL-installed repo cannot claim a catalog entry's name.)catalog_install_recordN catalog_name)hermes_cli.plugins_cmd_catalogrrrrlr r:r&)r^rrrrrecordrs& rF_catalog_installed_dirrs F*,-# _ds#1E'Ev&M&M&OF1&999 ?En?UY]?] FdD _$i1n47.$.  _s(B)B$ B$ B$/B$ B! B!c V^8dQhRRRR/#rAr^rrBzOptional[tuple]rD)rEs"rFrGrGsS_rHc~a\4p^RIHpV!V4;'gTo\V3RlV4R4pVeV#VUu.uF*q@V^,P R4R,8XgK(VNK, ppV'd\ V4^8Xd V^,#R#\ V4o\V3RlV4R4#uupi)aTHE plugin name resolver for every verb (enable/disable/show/capabilities/remove/update, the dashboard and the Desktop hub): the discovered ``(name, version, description, source, dir_path, key)`` entry for a canonical key or manifest name; else a bare leaf (``exa`` -> ``web/exa``) only when unique; else the catalog name the plugin was installed under. Never guesses between two candidates.)legacy_plugin_aliasc3Z<"TF pSV^,V^,39gKVxK" R#5i)rNrDrVrrrs& rFrX%_find_plugin_entry..s'OWE58U1X:N0N%%Ws+ +Nrc3<"TF@pSfK V^,'gK\\V^,44S8XgK<VxKB R#5irR)rrrs& rFrXrs<qG5veAhhSWX[\abc\dXeSfjpSpGsA  A A  A rA)rrrrcr'r&r)r^rrexactrr leaf_matchesrs& @rF_find_plugin_entryrs $%GB  & . .$F OWOQU VE  '.Rwe%(..:Mb:Q2QEEwLR"%l"3q"8|ABdB #D )F qGq  Ss %B:.B:c V^8dQhRRRR/#rrD)rEs"rFrGrGs3333rHcP\V4pV'dV^,V^,3#R#)z]Resolve *name* to ``(canonical_key, source)`` or ``None`` through :func:`_find_plugin_entry`.N)r)r^rrs& rFrrs& t $E#(E!HeAh 2d2rHc$V^8dQhRRRRRR/#)rAr^rallow_tool_overrideOptional[bool]rBrrD)rEs"rFrGrGs!)1)1S)1~)1)1rHc xa a a ^RIHo Ho \4o RV V V 3RllpV!V4\ V4pVf\ S \ V44VwrEV!V4VR8wd:^RIHpVPV\VPR^4R,44\VR S R 7pV'd&^R IHp S P!R V R 24V !S V4MS P!RV R24VR8wd \#S WA4V'd\%VR R7R#R# \dp\ S RT 24Rp?LRp?ii;i)aAdd a plugin to the enabled allow-list (and remove it from disabled). Non-bundled plugins request consent for declared capabilities. The legacy ``allow_tool_override`` grant changes only with an explicit True/False flag; None leaves it unchanged. Bundled plugins are trusted. )LEGACY_RELAY_PLUGIN_KEYSRELAY_PLUGINS_CONFIG_ENVc V^8dQhRRRR/#)rArrrBrrD)rEs"rFrG cmd_enable..__annotate__sTTSTTTrHc@<VS9d\SRV RS R24R#R#)z [red]Plugin 'z}' was removed.[/red] Relay lifecycle is owned by Hermes core; configure a standard user or system Relay plugins.toml, or use z$ for an explicit user-file override.N)r)rrrrs&rF_refuse_legacy_relay(cmd_enable.._refuse_legacy_relays8 - - 'x(b+,,PR T .rHNbundledplugins_cmd_catalogrrTrr)report_activationu [green]✓[/green] Plugin [bold]z[/bold] enabled. [dim]Plugin 'z' is already enabled.[/dim]rrA)hermes_cli.relay_plugin_cutoverrrrrrr hermes_clir refuse_if_installed_removed_user_installed_plugin_dirrCrlrhermes_cli.plugins_activationrr_enable_consent_toggle_plugin_toolset) r^rrrrrcatalogrrrrrrs && @@@rF cmd_enablers)cjGTT-d3H g.t45KC = 7  / /5OPSPZPZ[^`aPbcePf5g hCg>GC 8=MNO'3' cU*EFG :s40$ 7 '/u5 6 6 7s'2D D9 D44D9c$V^8dQhRRRRRR/#)rArrrrrBrrD)rEs"rFrGrGs& H H# HN Ht HrHcl\V4pV'd\WVRR7Ve\WV4R#R#)zXCapability consent and the legacy tool-override grant for a non-bundled plugin's enable.r)contextN)r rr)rrr declared_capss&&& rFrrs5 337MmXN&$W3FG'rHc V^8dQhRRRR/#)rAr^rrBrrD)rEs"rFrGrGs V Vc Vd VrHcf\4p\V4pVf\V\V44\ V4p\ VRVR7'gVP RV R24R#\VRVR7^RIH pH pVP RV R 24VP R V!V!4V4 R 24R#) zBRemove a plugin from the enabled allow-list (and add to disabled).NFr rz' is already disabled.[/dim]r toolset_key)gateway_reload_hintreload_running_gatewayu"[yellow]⊘[/yellow] Plugin [bold]z[/bold] disabled.z[dim]rd) rrrr_saved_list_toolset_keyrrrrr!r")r^rrr r!r"s& rF cmd_disabler$sjG d #C { g.t45)#.K UG < < cU*FGH3u+FY MM6se;LMN MME-.D.FLMVTUrHc V^8dQhRRRR/#)rAdrprefixrrD)rEs"rFrGrGsSS4SSrHc\V4pVf4\V4'gR#^RIHpV!V4^,pVR,pM@\ V4p\ V\4'g/pVPRVP4pV'dV RVP 2MTpWTPRR4VPRR4V3# \dR#i;i \d/pLi;i)z?Read a native or portable manifest and return display metadata.NrZr^rversionrN description) rKrQr\r[rrVrrXr`r^)r&r'rSr[rnr^rs&& rF_read_manifest_infor+s)!,M%a((  K1!4Q7HF#D  *=9H(D))H||FAFF+"(VHAaffX dC i,hll=".Ms RR    H s#C C CC C%$C%cV^8dQhRR/#rrD)rEs"rFrGrGsrHc\V4pVP4;'d!\V4RJ;'d \V4# \dR#i;i)zYTrue for an Agent Plugins v1 package (``plugin.json`` only; native ``plugin.yaml`` wins).NF)rr:rKrQrh)dir_pathr&s& rF_is_portable_plugin_dirr/sP Nxxz\\3A6$>\\CYZ[C\\ s!AA A AAc V^8dQhRRRR/#)rArrrBrrD)rEs"rFrGrG(scc#c$crHc.\V4pVP4'gR#VR8wdf^RIHp\ 4pVP P R4'gVPWDR, 39dR#VPV8Xd V!V4#\V4pVfR#\\V4PRR44P4P4pTR8H;'gTR8H;'d T\9# \dR#i;i) aTrue when a plugin is active without a ``plugins.enabled`` entry (portable ``plugin.json`` packages have no kind, so never). Bundled default-on kinds always; a user model provider only where providers/ discovery loads it (``providers._scan_home_layer``): a ``plugins/model-providers//`` child whose kind is model-provider, or a flat ``plugins//`` child declaring exactly ``kind: model-provider``. Discovery imports any other ``model-providers/`` child too, but nothing calls its ``register(ctx)``, so it is not on. Entry-point rows store ``module:attr`` in the path slot. That string is not a directory; opening it as one is WinError 123 on Windows and aborts the whole plugin list. Fr )_declares_model_provider_kindmodel-providerskind standalonemodel-provider)r0r)rr: providersr2r r^r$parentrKrrVr`rrr_BUNDLED_DEFAULT_ON_KINDS)r.rrTr2rootrSr4s&& rF _default_onr;(s >D ;;== ;~ 99   + +t{{4PaIaBb/b ;;$ 06 6)$/M&}599&,OPVVX^^` # # b b)(;(a(aHa@ab s"AD DDc4V^8dQhRRRRRRRRRR R R R R /#)rAbaserrr skip_namesrr'depthrseenrXrBrrD)rEs"rFrGrGGsHDDdDCDSD#DcDY]DbfDrHc VP4'gR#\VP44pTFpTP4'd!T^8XdT'dTP T9dK<\Y4p T fDT^8Xd;\Y\4T'dT RTP 2M TP ^T4KT wrrY9d TR8XdKTR8Xd TR, P4'dRMTpYYY3Y]&K R# \d"p\P RY4Rp?R#Rp?ii;i \\3d#p\P RY4Rp?EK4Rp?ii;i)zFRecursive directory scan matching PluginManager._scan_directory_level.Nz+Skipping unreadable plugin directory %s: %srr userrrJ) r:riterdirrhrrr^r+rl _scan_levelrr9)r=rr>r'r?r@childrenrr&rr^r)r*r src_labels&&&&&& rFrDrDGs6 ;;==$,,.) 88::%1**@T&q1D <zAsuf!&&.BRSRXRXZ[]ab *.'{ ;6Y. #v-1v:2E2E2G2GEV KAC % DdP-.  NNH! Q   s:D $D;D;1 D; D8D33D8;E. E))E.cV^8dQhRR/#)rArBrrD)rEs"rFrGrGestrHc /p^RIHpHpV!4R0Rm3\4R\ 433Fwr4p\ W4VR^V4K V!4FWpVP VPVPVPVPRVPVP34KY \VP44#)u``(name, version, description, source, dir_path, key)`` for every plugin the loader sees, in ``PluginManager.discover_and_load`` order: bundled, user, then entry points — which never displace a directory plugin of the same key (see ``PluginManager._discover_and_load_inner``).)discover_entrypoint_manifestsget_bundled_plugins_dirr rBrN entrypoint>r computer_usecontext_enginer3) hermes_cli.pluginsrIrJr rrDrr^r)r*rTrvalues)r@rIrJr=rskipms rFrresDZ "I/no 'd D$At4  + , AMM.provider`` config rather than ``plugins.enabled`` (the live memory provider), so status never calls them "not enabled".)_get_current_memory_provider)ns rF_category_active_namesrVxs(568 >8!AAA8 >> >s %%rNrr.activec4V^8dQhRRRRRRRRRRRR R R/#) rAr^rrrrrrrWzfrozenset | setrBrD)rEs"rFrGrG~s@   s c  UX *9 LO rHcW0pWr,'dR#Wq,'gWv,'dR#Ve\WT4'dR#R#)uXUser-facing activation state for a plugin name or key. Mirrors ``gate_manifest``: an explicit disable wins, then the allow-list, then the activations that need no list entry — bundled backends/platforms and model providers from any source (*source* + *dir_path*) and category-selected providers (*active*, see :func:`_category_active_names`).rrz not enabled)r;)r^rrrrr.rWrs&&&&$$$ rF_plugin_statusrZ~s= KE  %.. H = = rHrrrrengine compressorc V^8dQhRRRR/#rrD)rEs"rFrGrGs!!#!-!rHcaaa^RIHoRT3RlloRTT3RllpRTT3RllpY3FpT!4;p'dTu#K R# \dR#i;i \dK=i;i) zToolset key a plugin registers its tools under, or None: from the live registry (plugin already loaded), else from ``provides_tools`` in plugin.yaml looked up in the registry.)registryNcV^8dQhRR/#r@rD)rEs"rFrG-_get_plugin_toolset_key..__annotate__siimirHc4<a\VV3RlV4R4#)c3<"TF@pSPV4;o'gKSP'gK2SPxKB R#5irR) get_entrytoolset)rVtr]r_s& rFrXB_get_plugin_toolset_key.._first_toolset..s7a 1H._first_toolsetsa acghhrHcV^8dQhRR/#r@rD)rEs"rFrGrasrHc<^RIHpHpV!4V!4PP 4F;wr#VP P S8Xg VS8XgK)S!VP4u# R#)r)discover_pluginsget_plugin_managerN)rNrmrn_pluginsitemsrnr^tools_registered)rmrn_keyloadedrir^s rF_from_loaded_plugin4_get_plugin_toolset_key.._from_loaded_pluginsYK.099??ALD##t+tt|%f&=&=>>BrHcV^8dQhRR/#r@rD)rEs"rFrGrasMrHc`<a^RIHp\VVV3RlV!4\434R4#)r)rJc3 <"TFypVP4'gKVS, P4'gK:S!\VS, 4PR4;'g.4;o'gKuSxK{ R#5i)provides_toolsN)r:r^r`)rVr=rir^res& rFrXJ_get_plugin_toolset_key.._from_manifest_on_disk..sk K{{} "&+!5!5!7 *>$++F+J+JK[+\+b+b`bccc G KsBB)B) B: BN)rNrJrcr )rJrerir^s @rF_from_manifest_on_disk7_get_plugin_toolset_key.._from_manifest_on_disks/> !8!:LN K    rH)tools.registryr_r)r^rtr{lookuprerir_sf @@rF_get_plugin_toolset_keyrs+ii'?  ("w"#@ 9 4   s"AA AA A)(A)c V^8dQhRRRR/#rrD)rEs"rFrGrGs))#)-)rHcFa^RIHp^RIHoV!4P R4p\ V\ 4'd]\;QJd-V3RlVP44F 'dK RM" RM!V3RlVP444'dR#\V4#)zThe plugin's toolset key, or None without loading any plugin when no platform has a SAVED ``platform_toolsets`` list (the only lists :func:`_toggle_plugin_toolset` edits).rparse_platform_toolsets_valueplatform_toolsetsc38<"TFpS!V4RJxK R#5irRrD)rVvrs& rFrX*_saved_list_toolset_key..s)k\jWX*G*Jd*R\jsFTN) rrhermes_cli.toolset_validationrr`rrXr(rOr)r^rsavedrs& @rFr#r#sm.K M  1 2E eT " "cc)k\a\h\h\j)kccc)k\a\h\h\j)k&k&k "4 ((rHr c(V^8dQhRRRRRRRR/#) rAr^rrrr rCrBrrD)rEs"rFrGrGs)M]arHc|T;'g \V4pV'gR#^RIHpHp^RIHpV!4p\ VR4pRp\VP44FJwrV!V 4p V fKWV 98wgKV'd V PM V P!V4WV &RpKL V'd V!V4R#R#)aAdd/remove a plugin's toolset in every SAVED ``platform_toolsets`` list (no-op when the plugin provides no tools). Platforms with no saved list are left alone: a plugin toolset is already on there by default, and seeding ``[]`` would replace the core composite and strip every built-in tool. The key resolves only while the plugin is loaded, so enable calls this after the plugin loads and disable resolves *toolset_key* before the disable is written.NrrrFT) r#rrrrrr rrpraremove) r^rr rrrrrrplatformrawts_lists &$$ rFrrs >>!8!>K :K ]F#F,?@G/5578 04  6W.D#E%W^^7>> 9; G*1h 'G9FrHc$V^8dQhRRRRRR/#)rAr^rrrrBrrD)rEs"rFrGrGs&"\"\S"\d"\~"\rHc \V4pVf RRRRV R2/#^RIHpV'dRM \V4p\ W!R7pT'd.T'd&^R IHpRR R TR R/T!T4Cp\TR R7T#T'd\TRTR7RR R TR T'*R T/# Td pRRR\ T4R TR R R R/uRp?#Rp?ii;i)uEnable or disable a plugin in ``config.yaml`` (runtime allow/deny lists). *name* may be the canonical key, the manifest name or a unique bare leaf; the canonical key is what gets written (the loader never matches a bare leaf, and a stale key in ``disabled`` outranks a manifest-name entry in ``enabled`` — so writing the raw identifier reported success while the plugin stayed off).NokFerrorzPlugin 'z' is not installed or bundled.)rrr^ unchangedTrestart_required)activate_plugin_nowr) rrrr#rrrrr) r^rrrr rrrrs &$ rF"dashboard_set_agent_plugin_enabledrs d #C {eW6T&UVV=!$'>s'CK  47 Ffc;ZATUXAYZ s40 s5kJ $[g+?QSZ [[+  % SX C      s BC#B=7C=Cc V^8dQhRRRR/#rrD)rEs"rFrGrGsJJSJ^JrHc\V\4RR7pTP4'dT#\ T4# \dR#i;i)zResolved path under ``~/.hermes/plugins/`` if it exists, else the user install :func:`_find_plugin_entry` resolves *name* to (its manifest or catalog name).TrN)rr rr:r)r^rs& rFrrsH&t\^$O]]__6I*CD*II s; A  A c V^8dQhRRRR/#rrD)rEs"rFrGrGsCCCCNCrHc\V4pV'd9V^,R9d+V^,'d\\V^,44MRpVeVP4'dV#R#)zaDir of the user install :func:`_find_plugin_entry` resolves *name* to (manifest or catalog name).N)rBrJ)rrrr:)r^rrrds& rFrrsQ t $E#(U1X-HUSTXXDU1X [_E%%,,..5BdBrHcic$V^8dQhRRRRRR/#)rArrrrrBrrD)rEs"rFrGrGs!crHc^RIHpV!V4p\4PVP 44V'd VP 'g \ ^4hR#R#)z?Validate one plugin through runtime discovery and registration.) doctor_pluginN)hermes_cli.plugin_devrrr format_textr SystemExit)rrrreports&$ rFcmd_plugin_doctorrsD3 6 "F JV'')* &)))mrrHc$V^8dQhRRRRRR/#)rAyes_attrrno_attrrBrrD)rEs"rFrGrG s&jjCj#j.jrHcV\WR4'dR#\WR4'dR#R#)zQMap an argparse ``--x`` / ``--no-x`` pair to True / False / None (neither given).FTN)getattr)rurrs&&&rF_tri_state_flagr s,45114iX]A^A^idhirHc^RIHpV#)rr )rr r s rF_catalogr%s . rHcBVP'dL\VRR4'd\\4R4\ VP\VRR4R7R#\VRR4'd\\4R4^RIHpV!\VRR4R7R#) rFzM[red]Error:[/red] --yes only applies to `hermes plugins update` with no name.rrNz^[red]Error:[/red] --force applies to one named plugin: `hermes plugins update --force`.)cmd_update_all)r)r^rrrr<!hermes_cli.plugins_cmd_update_allr)rurs& rF_action_updater*sq yyy 4 & & (*m n499GD'5$ABtWe$$ hjz{@wtUE23rHc"^RIHpV!V4R#)r) pack_commandN)hermes_cli.plugin_packsr)rurs& rF _action_packr6s 4rHinstallc \VP\VRR4\VRR4\VRR4\VRR4\VRR4\VRR4R 7#) rFr no_enablerefN allow_removedno_depsyes_deps)rrrrrr)r+rrrrus&rFr=sXK dGU+tX{; D% &dOU;i/z513rHsearchcx\4P\VRR4;'gR\VRR4R7#)termrNjsonF) json_output)r cmd_searchrrs&rFrrEs68:00fb!''RWT655Q1SrHbrowsec4\4PR4#rN)rrrs&rFrrGs8:004rHvalidatec z\4PVP\VRR4\VRR4R7#)rF install_deps)as_jsonr)r cmd_validaterTrrs&rFrrHs6XZ44 747gdTbdiFj5lrHradoptc,\VP4#rR)r9r^rs&rFrrKs )DII.rHztrust-update-urlc,\VP4#rR)r;r^rs&rFrrLs%9$))%DrHz check-updatesc\V4#rRr:rs&rFrrMs "3D"9rHcheckc\V4#rRrrs&rFrrNs +D1rHrc,\VP4#rRr1r^rs&rFrrOs :dii0rHrmc,\VP4#rRrrs&rFrrPs z$)),rH uninstallc,\VP4#rRrrs&rFrrQs j3rHcF\VP\VRR4R7#)rno_allow_tool_override)r)rr^rrs&rFrrRs: +D2GIabdrHdisablec,\VP4#rR)r$r^rs&rFrrUs K 2rH capabilitiesc.\\VRR44#)r^N)rrrs&rFrrVs!1'$2M!NrHrc\V4#rRr.rs&rFrrWs$rHlsc\V4#rRrrs&rFrrXsx~rHdoctorcF\VP\VRR4R7#)rF)r)rrrrs&rFrrYs,T[[WT4QV=WXrHpackshowc,\VP4#rR)r/r^rs&rFrr[s $)),rHrcH\4PVP4#rR)rcmd_infor^rs&rFrr\s,,TYY7rHc\4#rR)r7rs&rFrr]sz|rHcV^8dQhRR/#)rArBrrD)rEs"rFrGrGasTrHc\VRR4p\PV4pVf\\ 4RV R24V!V4R#)z$Dispatch hermes plugins subcommands.plugins_actionNz[red]Unknown plugins action: z[/red])r_PLUGIN_ACTIONSr`rr)rurhandlers& rFplugins_commandrasC T+T 2F!!&)G hj9&HI DMrH> blobpullrwikipullscommitissuesactionscommitsreleases)zhttps://zhttp://zgit@zssh://zfile://rDrR>backendrr6r)r)__conditional_annotations__r~ __future__r functoolsloggingrSr\rrpathlibrtypingrrrhermes_constantsrrrr hermes_cli.plugin_capabilitiesr hermes_cli.secret_promptr utilsr #hermes_cli.plugins_cmd_capabilitiesr rrrrhermes_cli.plugins_cmd_gitrrrrrrrrrrrrrrr r!r"hermes_cli.plugins_cmd_installr#r$r%r&r'r(r)r*r+r,hermes_cli.plugins_cmd_listingr-r.r/hermes_cli.plugins_cmd_remover0r1r2hermes_cli.plugins_cmd_toggler3r4r5r6r7hermes_cli.plugins_cmd_updater8r9r:r;r<r= getLoggerrzrrr_CLONE_TIMEOUT_HINT lru_cacherjrrlrrrrrinputrrrrrrrrrrr rr)r%r4r<rDrKrQrVr^rarlrur|rrpartialrrrrr frozensetrrrrrrr__annotations__rrrrrrrrrrrr$r+r/r9r;rDrrVrZrT_get_current_context_engine_save_memory_provider_save_context_enginerr#rrrrrrrrrrr)rs@rFrsS # **=%69!     8 $!$!a QJ J& /9 /',' 6 "'" < < K %Z^%+0%P  jPU4D $)N"X@ /&. ` B 5  B% B%%&6 :N$$%5y)LC !/1!;?!OW!im! !J$W.D$EF & T F/1+0")P eB e e /- /(3 )1X H V S2&&OPc>D<&? []