+ Wj/ Rt^RIHt^RIHt^RIHt^RIHt^RI t RRlt RRR R R R /R R llt RRlt RRRR RR RRRR/RRllt R#)zQPublish plugin code and its dependency selection through one recoverable handoff.) annotations)Callable)Path)AnyNc(V^8dQhRRRRRRRR/#)projectrrowdictjournalreturnNone)formats"RC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\plugins_transaction.py __annotate__r s(77747$747c$^RIHpV!WV4R#)zERecover a shipped caller's row through the stdlib boot-journal owner.)_recover_plugin_publicationN)hermes_cli.runtime_stater)rr r rs&&& rrecover_plugin_publicationr sDg6r target_digestrequire_consentFassume_consentc8V^8dQhRRRRRRRRRRR R R R R R /#)rstagedrtarget old_metadatar new_metadatarz str | Nonerboolrr r r)rs"rrrsI  4  T QU %/ IM #' 48 rc^RIHp^RIHp^RIHp V'dV'g^RIHp ^RIH p VP4V !VR79dV PV PV4W P44wrV 'gSVP4'dRMRp^R IHpT P#VP%V 4V!V 4;'gR R 7hT!R T!R \'VP44R\'VP)44RTRTRVeTMVP4'd V !V4MR/4R7R#)a8Publish *staged* into *target*. *assume_consent* is consent the caller already holds (``--yes-deps``, or a memory-provider migration under ``security.allow_lazy_installs``): the active-replacement consent veto is skipped, so an unattended install carries that decision instead of being refused non-interactively.) sync_venv) StagedUpdate tree_digest plugins_cmd)enabled_plugin_dirs installingzRReinstall declined: {}. The installed plugin and active environment are unchanged.z,Install declined: {}. Nothing was installed.)tagged_failure_classother) failure_classTrrrrrN)explicitplugins) pm.clientr!pm.plugin_inputsr"pm.storer$ hermes_clir& pm.workspacer'resolve_install_plugin_python_deps_read_manifest_for_install_consoleexists.hermes_cli.observability.shared_metrics_fieldsr*PluginOperationErrorrstrabsolute)rrrrrrrr!r"r$r&r' consentedreasonoutcomer*s&&&&$$$ rpublish_pluginr@s$-$~*4 >> 2fE E + G G66v>H\H\H^!` I$mmoop3a`!66NN6*:Nv:V:a:aZa7cct\#fnn&'3v7H3I nl-*Cagananapap+V\J]vz3&rc ,V^8dQhRRRRRRRRRR /#) rrrrmanifestr interactiverr r r)rs"rrr4s8$f$f4$f$f$f_c$fhl$frcDaaa a ^RIHp^RIHo ^RIHp^RIHpHpSR, P4'dSR, P4'dSR, P4'dE\;QJd!V VV3RlR4F 'gK RM R M!V VV3RlR44'd(V!SRR 7pV'dVPR V R 24hSP4V!SR 79dR#V!S4V!S4uo p \;QJd!.V 3RlV P4FNK 5M!V 3RlV P44p V 'g'V P 'dS P 'dR#V'g<TPRRP#V 4;'gR RSP$ R24hVP'VP)RSP$4WP+44wrV 'gVPRV R 24hR#)a3Dependency changes carried by an update clear the same gates as an install. New Python requirements install packages into the shared environment: install and reinstall prompt for that, so an update prompts too, and an unattended one (dashboard, ``plugins.auto_apply`` from the gateway) is REFUSED rather than consented on the user's behalf. Publication replaces the whole tree, so a Node sidecar the user accepted earlier is rebuilt in the staged copy when its package.json/lock moved (custom pulls copy a stale node_modules; catalog re-pins clone without one). r%)_bytes)read_python_declaration)r'install_node_sidecar node_modules package.jsonc3b<"TF$pS!SV, 4S!SV, 48gxK& R#5iNr).0namerErrs& r 1_refresh_declared_dependencies..Es*tNsd6&4-(F6D=,AANss,/TF)r-z*Node dependencies could not be refreshed: z<. The installed plugin and active environment are unchanged.r(Nc3L<"TFqSP9gKVxK R#5irK)install_requirements)rLspecbefores& rrNrONs i#=4VMhMhAh$$#=s$ $z-The update declares new Python dependencies (z, zin its pyproject.tomlz); run `hermes plugins update z` in a terminal to review them.rMzUpdate declined: )rIzpackage-lock.json)r2r&rrEpm.plugin_declarationsrFr3r'rGis_diris_fileanyr:r4tuplerQinstalls_packagesjoinrM_consent_python_depsgetr7)rrrBrCpcrFr'rGr>afteraddedr=rErSsff&$ @@r_refresh_declared_dependenciesr`4s-/>F''))v/F.O.O.Q.Q.(0022stNstssstNsttt%ft< ))R7;_uu_4p\AV4R, pV'dVPCV 4wppVPEVVVPF4pV'dVPIVV4MTpRV 2pRVPRVPJRVPLRVPFRV/pV POVRVPQVV4R7V PSR R4V PSR!R4^R"IH*pV!VVV4M\VPX!VVR\VPZ!R#4R$7V 'dqVP]4pVP_VVR%R&R'R(7p V P`Pc4'dVPR)4hVPeVVV 4R*V 2pM-VPgV4wp!pV!'gVPV4hVPiVVP]44pVe V!V4MRp"VPkV4p#\V#PR4;'g VP4p$Vf#V$VP8wdVPR+4hVPmV$VP>4p%T%T8wd,T%Pq4'dTPR,T$ R-24hTP;T#T$4TPsTT T"Y4TRJR.7TPuTTPw44\yTTT#TR/7T !T4T8wdTPR04hTT R1&T%T8XdT !T4T8Xd TuuRRR4#\{TT%T /T CT$T /CT%T8XdTMRR27TuuRRR4# \nd!p&TP\T&44T&hRp&?&ii;i TPdh\|d(p&TPRTP R3T& 24T&hRp&?&ii;i +'giR#;i)4aPrepare a catalog re-pin or custom Git pull without changing the live tree. *interactive*: a terminal user is present to consent to newly declared dependencies; the dashboard and the gateway's auto-apply pass False and get a refusal instead. Every update is scanned: *force* accepts a caution verdict (the user already saw it), and *scan_decision_cb(result)* may accept one by asking; a dangerous verdict always blocks. *carry_user_files(staged)* may merge user-owned state into the staged tree before manifest validation, example-file generation, dependency preparation and publication; it returns the carried paths so a scan block can attribute findings to them.Nr%)refuse_if_installed_removedr#pinnedzPlugin 'z;' is pinned; reinstall with an explicit --ref to change it.sourcez.gitz7' has no owned Git checkout; reinstall from its source.) ProvenanceProvenanceClass)check_local_provenance default_fetchparse_feed_yml update_url artifactsgit#z] - -C S[H\HbHb`bDcF m+Vf_4L4L4N4N%% =t&uvvMMdd(FKKATATV\)ef    ))'*>*>? ? ::l # #!-|0D"EFD-3388CH"",,X66 ( 0 &,,sA*>q*A!BB--.lmmxx %%**,=tL?Q+RTZT_T_` V4  F  $ $JFMM $ J Jii8+F n"$"5"5f"=00-BSBSTFL2266BRX28*=M..M..M..=,,8 " *//@  >40 >40W,V^XNfF\F\]jFkl 446C--c68]dF-GF}}**,, 556xyy//]K6}oFF!#!8!8!@JB 55f==009S9S9UV1A1M%f-SWF44VrsW"$ 7 26 PU */ F$fN{n{n {n  {n 6: {n<@{n{nr