+ WjHRt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t ^RI H t ^RI HtHt^RIHt^RIHt^RIHtR t]P.!R 4tR R ltR RltRRlt]P8!4t] R4tRRltRaUPlugin install metadata (``.install-metadata.json`` source/revision/pin records) and the git plumbing behind clone, exact-revision checkout, credential scrubbing and the autostashing ``git pull``. Sibling of :mod:`hermes_cli.plugins_cmd` (the facade re-exports the names other modules use and is imported late here, never at module level). ) annotationsN)contextmanager)Path)CallableOptional)noninteractive_git_envget_hermes_home)atomic_write_textc^RIHpV#)z`The facade, read at call time: tests patch ``plugins_cmd.`` and sibling calls must see it. plugins_cmd) hermes_clir r s NC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\plugins_cmd_git.py_pcrs & z^[0-9a-fA-F]{40}$cV^8dQhRR/#)returnr)formats"r __annotate__r!sDDDrc2\4R, R, #)pluginsz.install-metadata.jsonrrrr_install_metadata_pathr!s  y (+C CCrcV^8dQhRR/#)rrdict[str, dict[str, object]]r)rs"rrr%s   < rcv\4pVP4'g/#\P!VP RR74p\T\4'g\4PR4hT# \ \P 3d#p\4PRT 24ThRp?ii;i)z@Read profile-local, non-secret plugin source metadata from disk.z utf-8-sigencodingz(Could not read plugin install metadata: Nz.Plugin install metadata must be a JSON object.) rexistsjsonloads read_textOSErrorJSONDecodeErrorrPluginOperationError isinstancedict)pathvalueexcs r_read_install_metadatar,%s ! #D ;;== d 4>>;>?@ eT " "e(()YZZ L T)) *de((+STWSX)YZ`ccds&A;;B8B33B8c V^8dQhRRRR/#)rmetadatarrNoner)rs"rrr3see&Beterc \4p\V\P!V^RR7R,VP R2R7R#)zEAtomically replace the profile-local plugin install metadata sidecar.T)indent sort_keys z.tmp-) tmp_prefixN)rr r!dumpsname)r.r)s& r_write_install_metadatar73s< ! #D djj!t# " ! #TN %%h/ " ! ! !s;B B B c$V^8dQhRRRRRR/#)rr6r?r.zOptional[dict]r Optional[str]r)rs"rrrZs!#=rcVeTM\4P4PV4p\V\4'dDVPR4RJd/\VPR4\ 4'd VR,#R#)zCFull SHA a ``--ref`` install of *name* is pinned to, else ``None``.NpinnedTrevision)rr,rBr'r(r?)r6r.entrys&& rpinned_revisionrKZsg!-X353O3O3Q V VW[ \E%599X#6$#>:eiiXbNcehCiCiZ  rc$V^8dQhRRRRRR/#)rr6r?r.r(rrFr)rs"rrrbs!44#44-4rcD\W4pV'd RVR, 2#R#)z git pinned@:NNN)rK)r6r.shas&& r_pin_annotationrPbs$ $ )C&)[R "3t3rc V^8dQhRRRR/#)rrefr?rr)rs"rrrgs33rc\V\4'd\PV4'g\ 4P R4hVP 4#)zLLowercase a full 40-hex commit SHA; anything else is a PluginOperationError.z---ref must be a full 40-character commit SHA.)r'r?_EXACT_COMMIT_RE fullmatchrr&lower)rRs&r_normalize_exact_revisionrWgs@ c3  '7'A'A#'F'Fe(()XYY 99;rc$V^8dQhRRRRRR/#)rresultsubprocess.CompletedProcess source_urlr?rr)rs"rrrns#((7(S(RU(rc^RIHpVP;'gVP;'gRP 4pV'dVP V\ V44pV!V4#)z` names the tag object, not the commit it points at. Git detaches at the commit, so comparing HEAD against the tag object's sha refuses a correct checkout (and the catalog installer then cannot install that entry at all). Peeling first keeps the guard — HEAD must still BE that commit — while admitting the pins authors actually publish. Returns `revision` unchanged when it resolves to nothing, so the mismatch guard below still fires. rx--verifyz--quietz ^{commit}rg) rrsr$ subprocessTimeoutExpiredrarbrVrt)rkrjrIrZresolveds&&& r_git_resolve_commitrs&& ; I(;?Wac'  }}""$**,H((A-(8HH Z.. /s"A))B B c ,V^8dQhRRRRRRRRRR/#) rrkrrjr?rIr\rr/r)rs"rrrs1**4*#**RU*_c*rc \4P4pRRRRRV3RV R23RRRV3R V R 233FwrVp\W.VO5R VR VR VRV/K \4PW4p V \WV48wd#\4P RV RV R2RR7hR# \Pd@p\4P RT RT RT R\4P 2RR7ThRp?ii;i)zFetch and detach at one immutable commit, then verify the resulting HEAD. The checkout is a network verb too: in a partial (subdirectory) clone it downloads the file contents.fetch--depth1originz Git commit 'z' could not be fetched: checkoutz--detachzGit checkout of commit 'z ' failed: rmr\rhrgzGit z of commit 'z' timed out after seconds. rprqNzChecked-out revision 'z#' does not match requested commit 'z'.) r_clone_timeout_secondsrurrr&_CLONE_TIMEOUT_HINTr{r) rkrjrIr\rgverbrlrmr+actuals &&&& r_checkout_exact_revisionrsYe**,G 7IsHh? @ 'U % %d 4F $TH==e(($VH,OPXzY[ \()* *> (( 7%,,tfL 2DWIZX[X]XqXqWrs,-.36 7 7sB!!C56:C00C5c V^8dQhRRRR/#)rgit_urlr?rr)rs"rrrsCCrc\PPV4pVPR9dVP'dRVP9dRVP R2M VPpVP eV RVP 2p\PP VPW!PRR34#V#)z?Strip credentials and query/fragment data from an HTTP Git URL.:[]rX>httphttps)urllibparseurlsplitschemehostnameport urlunsplitr))rparsedhosts& rrdrds \\ " "7 +F }}))fooo),)?6??#1%V__ ;; "V1V[[M*D||&& t[["b'QRR Nrc$V^8dQhRRRRRR/#)rrr?subdirrFrr)rs"rrrs!::s:M:c:rc:\V4pV'dV RV 2#T#)#)rd)rrscrubbeds&& r_canonical_sourcers$g&H%+hZq !99rc(V^8dQhRRRRRRRR/#)rrkrrjr?rrr/r)rs"rrrs.]]t]c]C]D]rc R\V4pW28wd\WRRRV^RVR7 R#R#)zFEnsure credentials used for cloning do not survive in ``.git/config``.remotezset-urlrz)Could not sanitize installed Git remote: )rgrmr\N)rdru)rkrjrrs&&& r_scrub_cloned_originrs3g&H 8Y(BGT[ ]rc(V^8dQhRRRRRRRR/#)rrkrrjr?rrr/r)rs"rrrs.@@t@c@3@4@rc  \WRRR^RR7VR, R, R, pVPPR R R 7\P!R R VP R 44pVP R V R2RR7R#)zSparse-check-out only *subdir*. Written as the classic ``info/sparse-checkout`` file rather than ``git sparse-checkout set`` so older Git clients work too.configzcore.sparseCheckouttruez"Could not enable sparse checkout: rzz.gitinfozsparse-checkoutT)parentsexist_okz ([\\*?\[])z\\\1/z/ utf-8rN)ruparentmkdirresubrb write_text)rkrjr pattern_fileescapeds&&& r_restrict_checkout_to_subdirrs'+@&RT!FH&=6),==LdT:ff]GV\\#->?Gay,w?rc ,V^8dQhRRRRRRRRRR/#) r tmp_clonerrr?rIrFrrr)rs"rrrs1'8'8$'8'8 '8,'88;'8rc p\4P4pV'g\4PRRR7h\4P4pV'dR.M.pV'g V'dR.M.p.ROVOVOVN\ V4Np\4P !W@P .VO5RVRV/p T P^8wd=\4P\4PT\Y44R R7h\YT4T'd \YT4T'd\!YY!R 7MT'd\#Y@R RYQTRR7\4P%Y4# \d"p \4PRRR7T hRp ? i\Pd:p \4PR T R \4P 2R R7T hRp ? ii;i \Pd:p \4PRT R \4P 2R R7T hRp ? ii;i)aShallow-clone *git_url* into *tmp_clone* (detached at *revision* when given), scrub any credentials from the recorded origin, and return the installed HEAD SHA. A *subdir* install is a blobless clone with a sparse checkout of that subdirectory: a plugin living in a monorepo (Hindsight: 170 MB at depth 1, 2 MB for its plugin folder) otherwise downloads every file in the repository, which times out on slow connections.$git is not installed or not in PATH. git_missingrqz--filter=blob:nonez --no-checkoutrhrgNzGit clone timed out after rrp)r\rryz0Git checkout of the plugin subdirectory failed: )rgr\rhrmzGit checkout timed out after )clonerr)r_resolve_git_executabler&rr?rsrFileNotFoundErrorrrrrt_clone_failure_messagerfrrrrur{) rrrIrrj clone_timeoutpartial no_checkout clone_argsrZes &&&& r_clone_plugin_reporse++-G e(()O_l(mmE002M(.#$BG'/6?#rK[G[k[7[CPYN[JN&&w0@0@8:8X_8)68Ae(()E)Eg_eOo)p7E)G GW5 $Y@ XR  5 'j&-#*;n p 5 # #I 77+ ue(()O_l(mstt  $ $Ne((+Em_T^_b_d_x_x^y)z7E)GLM NN(( 5%,,/ jIbIbHcd,-.34 5 5sB *E,G', G$7FG$*G$+4GG$'H5<4H00H5c 0V^8dQhRRRRRRRRRRR R /#) rrjr?targetrrlrgrnrhrr[r)rs"rrrsD N N  N N'* N58 NIL N  Nrc X^RIHpV!V.VOV\4RRRRV\V4R7 #)aRun one git command inside a plugin checkout (non-interactive). *auth_url* names the remote a network verb talks to; it runs anonymously first and a stored user credential for that host is attached only when the remote refuses anonymous access (private repos).) run_git_with_credential_fallbackTrrc)envcapture_outputtextrerrorsrgcwd)hermes_cli.git_credentialsrrr?)rjrrgrhrlrs&&$$* rrsrss= L + 4((>(@QU\`GV NNrc$V^8dQhRRRRRR/#)rrjr?rrrr)rs"rrrs&AAATAcArc\4PWRRR4pVP^8XdVPP 4#R#)zDCurrent ``refs/stash`` commit, or empty string when no stash exists.rxr~z refs/stashrX)rrsrtrarb)rjrprobes&& r _stash_refrs? E ! !'; L YE#(#3#3q#85<<   @b@rc(V^8dQhRRRRRRRR/#)rrjr?rr stash_sharboolr)rs"rrrs(C#$rc2\4PWRRV4p\4PWRRR4pVP^8wg!VPP 4'dR#\ W4V8Xd\4PWRR4R#) a``stash apply`` the autostash commit *stash_sha*; drop it on a clean apply. False when it applied with errors or left unmerged paths (the stash entry is kept in that case). Git is addressed by the stash's commit sha, never a ``stash@{N}`` selector: on native Windows the MSYS runtime re-parses git.exe's argv and strips the braces, so ``stash@{0}`` reaches git as ``stash@0`` and both the apply and the drop fail (#87542).stashapplydiffz --name-onlyz--diff-filter=UFdropT)rrsrtrarbr)rjrrrestoreunmergeds&&& r_reapply_stashrs~e##GWgyQGu$$WfmM^_HQ(//"7"7"9"9'"i/ gw? rc$V^8dQhRRRRRR/#)rrjr?rrrztuple[str, str]r)rs"rrr(s!3rc V\4PWRRR4pVP^8wg!VPP 4'gR#^RIHpV!VP4pV'd\4P!WRR.VO5!\W4p\4PWRR R R R 4p\W4pV'dWu8Xd+\V4pRR V'd RV 2,3#R,3#VP^8wd\4PWRRR4VR3#)zStash local edits before a pull. Returns ``(stash_sha, error)``; *stash_sha* is empty when the tree was clean, and a non-empty error means the tree is dirty but nothing was saved, so the pull must not run.statusz --porcelainz-zrX)_intent_to_add_pathsaddz--rpushz--include-untrackedz-mzhermes-plugin-update-autostashzgLocal changes in the plugin checkout could not be stashed; update aborted before touching the checkout.r3reset--hardry)rXrX) rrsrtrarbhermes_cli.update_cmd_stashrrrf) rjrrr intent_to_add pre_stashr post_stasherrs && r_autostash_dirty_treer(s U " "7HmT RF AV]]%8%8%:%: A(7M gudK]K7+I 5 &*?Gg iDG,J 0d# D C5z *+ +') *+ + ! gw&I r>rc V^8dQhRRRR/#)rrrrztuple[bool, str]r)rs"rrrGs/B/B/B*:/Brc \4P4pV'gR#\W4wr#V'dRV3#\4PWRRR^R7p\4PWRRVPP 4R7pVP ^8wdB\V4;'gR pV'gRV3#\WV4'dR pMR pRV R V 23#VPP 4pV'gR V3#\WV4'd R VR,3#\4PWRRR4R VRV R2,3# \dRu#\PdRu#i;i)u}``git pull --ff-only`` a plugin checkout, autostashing local edits (users patch installed plugins in place, and a plain ff-only pull would then refuse forever). Users tweak installed plugins in place (config constants, small patches), and a plain ``pull --ff-only`` then aborts with "Your local changes ... would be overwritten by merge" — making the plugin permanently un-updatable until they hand-run git. Same UX class Factory Droid fixed in v0.188 ("Updating a plugin marketplace now succeeds when its checkout has local changes"), and the same autostash approach ``hermes update`` already uses for the main checkout (PR #70161). Frzget-urlrrpullz --ff-only)rhzgit pull failed.zLocal changes were restored.zGLocal changes are preserved in git stash (restore with: git stash pop).r3Tz4 Local changes were re-applied on top of the update.rrryu ⚠ Local changes in this plugin conflicted with the update and were NOT re-applied. They are preserved in git stash — inspect with `git stash show -p` and re-apply with `git stash pop` inside .)Fr)Fz)Git operation timed out after 60 seconds.) rrrrsrarbrtrfrrrr)rrjrrrrZnotepulleds& r_git_pull_plugin_dirrGse++-G <<"B.w? #: &&w)X_a&b&&w V\VcVcViViVk&l    !!&)??-?Ccz!gy995`SED6** *$$&<  '9 5 5"YYY Y gw&IV &'-XQ 011 1 =<<  $ $BAABsMEA5E3 E>EE"!EEE%*E E8E82E87E8)N)rX)2__doc__ __future__rr!rr threading urllib.parser contextlibrpathlibrtypingrrhermes_cli._subprocess_compatrhermes_constantsr utilsr rcompilerTrr,r7localr<r=rDrKrPrWrfrur{rrrdrrrrrsrrrrrrrrs # %%@,# ::23D e!* 1   0 4 ( NP df  I,*,: ]@'8T N;= NOQ NA $>/Br