+ WjLVa0t$Rt^RIHt^RIt^RIt^RIt^RIt^RI H t ^RI H t ^RI HtHt^RIHtHt^RIHt] !RRR 7tR ]R &] R R l4t]P0!R4tRRltRRltRRlt]!RR44tRRlt]!4RR/RRll4tRR/t RRlt!R R!lt"R"R#lt#RCR$R%llt$R&t%R']% 2t&R(]% R)2t'R*R+lt(R,R-lt)R.R/lt*R0R1/R2R3llt+R4R5lt,R6R7lt-R8R9lt.R:R;lt/]P0!R<4t0R=R>lt1R?R@lt2RARBlt3R#)DuQhermes pm update: resolve the latest versions and re-pin the lockfile. Each Package subclass declares how to find its own latest via ``latest_versions(target)`` (see pm/package.py); this module is the driver: it intersects those candidate lists across the targets the package serves, compares against the lockfile, and (in real mode) re-pins + reinstalls. Two version styles (``Package.version_style``): semver — one shared version across targets (node 26.7.0, uv 0.12.3). The update is the highest version every relevant target serves. minor — the lockfile ``version`` field is major.minor; each target's exact patch lives in ITS artifact urls. Used when the package has no shared release cadence across its sources (ffmpeg's posix martin-riedl builds vs win32 BtbN autobuilds drift in patch). An update moves to the highest MAJOR.MINOR every relevant target serves; within it each target pins its own newest patch. The ``--check`` command is dry-run only: it hits the upstream indexes (small HTTP GETs) but never writes the lockfile, the store, or the venv, and never downloads an artifact. Real ``pm update`` re-pins changed packages (``pm lock``-style artifact hashing), installs them, then refreshes the venv (uv sync) — and with the dep legs enabled, uv.lock + package-lock.json. ) annotationsN)contextmanager) ContextVar) dataclassfield)IteratorOptional) retry_networkpm_index_responses)defaultzContextVar[dict | None]_index_responsescV^8dQhRR/#)returnzIterator[None])formats"=C:\Users\johnn\AppData\Local\hermes\hermes-agent\pm\update.py __annotate__r.s&&~&c#"\P/4pRx\PV4R# \PT4i;i5i)zGShare successful index reads only within this resolve or pin operation.N)r setreset)tokens rreuse_index_responsesr-s<   $E& u%u%sA4AA  Az \d+|[A-Za-z]+c V^8dQhRRRR/#)rversionstrrtupler)rs"rrr>s    rc2.pVPRR4PR4Ffp\PV4FJpVP 4'dVP ^\ V434K7VP ^V34KL Kh \V4#)zA sortable key for a version string. Handles dot-separated numerics, +suffixes (python's 3.14.7+20260901, git's 2.53.0+3), and plain build numbers (llamacpp's 10362). Non-numeric segments sort after numerics so a prerelease never beats its release.-.)replacesplit_VERSION_PART_REfindallisdigitappendintr)rkeychunkms& r version_keyr+>sy Cc*005!))%0Ayy{{ As1v;' Aq6" 16 :rc V^8dQhRRRR/#)rrrrzOptional[tuple[int, int]]r)rs"rrrMsc7rc\PV4Uu.uF%qP4'gK\V4NK' pp\ V4^8dR#V^,V^,3#uupi)zD(major, minor) of a semver-ish string; None when not 2-part numeric.N)r#r$r%r'len)rr*numss& rminor_ofr0MsV,44W= M=qFCF=D M 4y1} GT!W  Ns A)A)c$V^8dQhRRRRRR/#)rversions list[str]minorztuple[int, int]r Optional[str]r)rs"rrrUs!Io-rcRpVF6p\V4V8XgKVe\V4\V48gK4TpK8 V#)z?The highest version in `versions` whose major.minor == `minor`.N)r0r+)r2r4bestvs&& r best_in_minorr9Us> D  A;% T\[^kRVFW5WD Krc]tRt^ct$RtR]R&R]R&R]R&RtR]R&]!]R 7t R ]R &R t R]R &]!]R 7t R]R&] RRl4t RtR#)Resolvedz)What `pm update` decided for ONE package.rnamer5lockedstyleNr)default_factoryzdict[str, str] per_targetreasondict[str, list[str]]artifact_updatescV^8dQhRR/#)rrboolr)rs"rrResolved.__annotate__psDDDrc JVPfR#VPfR#VPR8XdI\VP4;'g,\ VP4\ VP48g#\ VP4\ VP48#)NFTr4)rr=r>rFrDr0r+)selfs&rchangedResolved.changedosx <<  ;;  :: --.aa(4<<2HHUYU`U`La2a a4<<(;t{{+CCCrr)__name__ __module__ __qualname____firstlineno____doc____annotations__rrdictr@rBrDpropertyrJ__static_attributes__rrrr;r;cs]3 I  J!G]!!&t!rr;r)rs"rrrzsA(d(d (d*(d (d  (d  (drc VP4UUu/uFwrEV'gKWEbK pppV'g\WVRR7#VR8XdVP4Uu.uFp\RV44NK pp\ V4^8d\P !V!M\V^,4pV'g\WVRR7#\ V4p VP4UUu/uFwrEV\WY4bK p pp\VVVV ^, RV ^, 2V R7#VP4Uu.uFp\V4NK p p\ V 4^8d\P !V !M\V ^,4pV'g\WVRR7#\ V\R 7p \YYresolve_best..sAr!Xa[+(1++rs--zno shared minorr )rr@zno shared version)r() itemsr;valuesrr. intersectionmaxr9r+) r<rVr=r>tvspresent minor_setscommon shared_minorr@setsrs &&&& r resolve_bestrhzs#3"8"8":A":buqu":GA eK@@ LSNNL\]L\bcArAAL\ ]25j/A2E!!:.3zZ[}K]D%8IJ J6{ rr@r]get isinstance fetch_urlsrDr0) packagerkr=riralatestdecisiontargetrcurrenturlsrows &&&$ rresolve_packager|s0 A 4'''9??R @@ GLL&':O:OPH~~ X%5%5%AiF['2288:OFmmFMM%,DEG!+GT!:!:g G%%g6Dg6gsE g6648))&1 ;  (8+;+;"<@P"P%  O7s#E E*E z User-Agentz hermes-pmcV^8dQhRR/#rrrRr)rs"rrrsrc\\4p\PP R4;'g \PP R4pV'd RV 2VR&V#)uHeaders for GitHub API calls. A GH_TOKEN / GITHUB_TOKEN env var lifts the unauthenticated 60 req/hr cap to 5000 — a full `pm update --check` across every github-sourced package burns the anonymous budget fast.GH_TOKEN GITHUB_TOKENBearer Authorization)rR_UAosenvironrrheadersrs r_github_headersrsM3iG JJNN: & H H"**..*HE %,UG#4 Nrc V^8dQhRRRR/#)rrnrrrRr)rs"rrrsrc^RIHpV!V4pVR8Xd \4#VR8Xd/\C\ 4C#\ \4#)) url_origin)httpszapi.github.com)rzhuggingface.cor)hermes_cli.urllib_securityrrr _hf_headersrR)rnrorigins& r_index_headersrsE5 _F 11   11'#''' 9rc V^8dQhRRRR/#)rrnrrz dict | listr)rs"rrrs""3";"rc6aa^RIHoVV3Rlp\V4#)ropen_credentialed_urlc<\S4pS\\VP444R3p\P 4pVeW9d W!,#S!\ PPSVR7^.requests %E&12F;$((*  S%5> ! " NN " "3 " 8"  YYt_F   #IN   s B22 C )rrr )rnrrsf @r _get_jsonrs@   !!rc$V^8dQhRRRRRR/#)rrnrrzOptional[dict]rr)rs"rrrs!""3""3"rcaaa^RIHo\S4oV'dSPV4VVV3Rlp\ V4#)rrc<S\\SP444R3p\P 4pVeW9d W,#S!\ P PSSR7^.requestsE&./8$((*  S%5> ! " NN " "3 " 5r  YY['';F   #IN   s >!B11 C )rrrupdater )rnrrrrsf& @@r _get_textrs1@ # D G   !!rzggml-org/install.shz#https://huggingface.co/api/buckets/zhttps://huggingface.co/buckets/z/resolvecV^8dQhRR/#r~r)rs"rrrsTrch/p\PPR4pV'd RV 2VR&V#)zYOptional bearer auth for HF bucket fetches (HF_TOKEN), like the installer's own requests.HF_TOKENrr)rrrrrs rrrs4G JJNN: &E %,UG#4 NrcV^8dQhRR/#)rrr5r)rs"rrrs % %- %rc\\ R2\4R7p\P !RT4pT'dTP ^4#R# \dR#i;i)uThe build tag the llama.app installer's `latest` pointer currently resolves to — the updater's "next version". Returns the bare build number ("10679") or None when unreachable.z/latestrNz(\d+))r_LLAMA_BUCKET_RESOLVEr Exceptionresearchgroup)rr*s rllama_app_latestrsY12':KMR (D!A1771:$$ sA AAcV^8dQhRR/#rrr3r)rs"rrr+s&&9&rc.p\4p\\ R24pT;'g.Fp\P !RTP RR44pT'gK4TP^4R,pYQ9gKTTPT4TP\T44K TPRR7TUu.uFp\T4NK up# \d.u#i;iuupi)uBuild numbers visible in the llama.app bucket, newest-first. The HF bucket tree API IGNORES the offset param (verified: every offset returns the same first page — the oldest ~1000 paths, sorted by path ascending). So the tree can only ever enumerate the OLDEST builds, never the newest — the `latest` pointer (llama_app_latest) is the authoritative "next version" source. This helper returns what the tree CAN see (deduped, sorted by build number descending) as a bounded supplement; callers should put llama_app_latest() first. z/tree?limit=1000&offset=0z^(b\d+)/pathrA:NNT)reverse) rr_LLAMA_BUCKET_APIrrmatchrrraddr&r'sortr)r2seendataentryr*tagr8s rllama_app_bucket_versionsr+sH 5D-..GHI HH[%))FB"7 8 1''!*R.C C)  MM$M$ %HqCFH %%   &sCC/ C,+C, strip_prefixrAc$V^8dQhRRRRRR/#)rreporrrr3r)rs"rrrGs!cCrc.p\^^4Fp\RV RV 24pV'gV#VFpVPR4'gVPR4'dK3VPRR4pVR8XdKNV'd&VPV4'dV\ V4RpV'dV^,P 4'gKVP V4K \ V4^8gKV# V#) uNewest-first release tag names for a GitHub repo (releases, not all tags — no drafts/prereleases, and a rolling 'latest' pseudo-release is skipped). ``strip_prefix`` removes a tag prefix (e.g. 'v', 'b'). Only version-shaped tags survive the strip — cua-driver's repo also tags sandbox/experimental builds (cua-driver-rs-vsandbox-v0.4.3) that must never appear as update candidates.zhttps://api.github.com/repos/z/releases?per_page=30&page=draft prereleasetag_namerArvN)rangerrr startswithr.r%r&)rrtagspagerreleasers&$ rgithub_release_tagsrGs Da 8>YZ^Y_`a  KG{{7##w{{<'@'@++j"-Ch| < <#l+,-c!fnn.. KK  t9r>  K#" Krc V^8dQhRRRR/#)rr<rrrRr)rs"rrrcsNNNNrcX^RIHp\V!\P4 RV R24#)r) npm_registryz -/package/z /dist-tags)pm.index_configrrrr)r<rs& r npm_dist_tagsrcs',  RZZ01D6L MMrcV^8dQhRR/#rr)rs"rrrisirc.p\R4FVpVPRR4pVPR4p\P!RV4'gKEVP V4KX V#)zCNewest-first node versions from nodejs.org's index (strip the 'v').z"https://nodejs.org/dist/index.jsonrrAr8z \d+\.\d+\.\d+)rrr removeprefixr fullmatchr&)outrr8s rnode_latest_versionsrisZ C?@ IIi $ NN3  <<(! , , JJqM A JrcV^8dQhRR/#)rrzdict[str, dict[str, str]]r)rs"rrrts5rcZ\R4p/p\P!RT4FnpTP 4wr4rVTR8XdRMTpTR8XdRMR RT 2pTP T/4p Yi9g"\ T4\ Y,48gKjYYT&Kp T# \d/u#i;i) uffmpeg.martin-riedl.de index: target -> {version: epoch}. The site has no directory listing or API — the root page is the index, and it lists the CURRENT build per platform (both snapshot builds like N-126314-g... and release builds like 9.0.1). Parse every _ download dir; snapshots never match the numeric pattern. The epoch is needed to reconstruct the download URL at pin time, so the index maps version -> epoch per target.zhttps://ffmpeg.martin-riedl.de/zG/download/(macos|linux)/(amd64|arm64)/(\d+)_(\d+\.\d+\.\d+)/ffmpeg\.zipamd64x64macosdarwinlinuxr)rrrfinditergroups setdefaultr') rrr*osnamearchepochr target_archrxr2s rmartin_riedl_indexrts:;&(C [[R ()xxz$e#weD &' 1Hw?q N>>&"-  "c%j3x7H3I&I %W  J  s B B*)B*c V^8dQhRRRR/#rrxrrr3r)rs"rrrsAA#A)Arcv\\4PV4;'g/P44#)zHNewest-first release versions the martin-riedl index lists for `target`.)rorrrkeysrxs&rmartin_riedl_versionsrs- #%))&177R==? @@rz+autobuild-(\d{4})-(\d{2})-\d{2}-\d{2}-\d{2}cV^8dQhRR/#)rrz%dict[str, dict[str, tuple[str, str]]]r)rs"rrrs3393rcX.p\^^4F>p\RV 24pV'gM'VPV4\V4^8gK>M /pRp\ 4p\ VRRR7EF7pVP R4'gVP R4'dK4VP RR 4p\PV4pV'gKeVP4p VfT pW8XgW9dKVPV 4VP R .4Fp V P R R 4p \P!R V 4p V 'gK6V P4wrpVR 8XdRMRpT RVR8XdRMR 2pVPV/4PWV 34K EK: V#)aNewest retained (month-end) static GPL asset per target/version, as (tag, name). BtbN keeps only its 14 newest autobuild tags (about two weeks of dailies) plus the last build of each month for two years (util/prunetags.sh), so a pin on a daily tag 404s two weeks later. The current month's newest tag is still a daily the next build displaces, so the newest eligible tag is last month's final build. Releases also contain macOS, shared and LGPL builds. Retain target identity here so discovery and pinning select the same artifact. zJhttps://api.github.com/repos/BtbN/FFmpeg-Builds/releases?per_page=30&page=Nc&VPRR4#)rrA)rr)rs&rbtbn_index..s!%% B2GrT)r(rrrrrAassetsr<zNffmpeg-n(\d+\.\d+\.\d+)-.+-(win|linux)(64|arm64)-gpl-\d+\.\d+\.(?:zip|tar\.xz)winwin32rr64rarm64) rrextendr.rrrr _BTBN_TAGrrrrr)releasesrrr newest_month months_seenrrdatedmonthassetr<r*rrros_keyrxs r btbn_indexr sHa efjeklm  t9r>  24CL(+K((GQUVV ;;w  7;;|#<#< kk*b)##C(     L  E$8 [[2.E99VR(D GA q() %$*eO"81ddlU$HIvr*55gT{K/W8 Jrc V^8dQhRRRR/#rr)rs"rrrs..#.).rcH\\4PV/44#)z=Release versions with a supported BtbN asset for this target.)ror rrrs&r btbn_versionsrs    , --rc$V^8dQhRRRRRR/#)rr4rtriplerr3r)rs"rrrs!SYrc \^^4EF-p\RV 24pV'g.#VFpVPR4'gVPR4'dK3VPRR4p\P!RV4'gKdR\P !V4 RV R \P !V4 R 2pVPR .4FIp\P!WgPR R44pV'gK3VP ^4.uuu# K \V4^8gEK-.# .#) zPReturn the exact interpreter identity advertised by the newest matching release.zYhttps://api.github.com/repos/astral-sh/python-build-standalone/releases?per_page=30&page=rrrrAz[0-9]{8}z cpython-(z \.[0-9]+\+z)-z-install_only\.tar\.gzrr<)rrrrrrescaperr.) r4rrrrrpatternr rs && r pbs_versionsrsa tuytz{|  IG{{7##w{{<'@'@++j"-C<< S11"299U#3"4Jse2biiPVFWEXXnoG Xr2 Wii.CD5!KKN++3 t9r>  I#" IrrY)4__conditional_annotations__rP __future__rrrrurllib.requestr contextlibr contextvarsr dataclassesrrtypingrr pm.networkr r rQrcompiler#r+r0r9r;rhr|rrrrr _LLAMA_BUCKETrrrrrrrrrrrr rr)rs@rr sO2# %"(%$ -77KUY,Z)Z&&::./  DD D,(dVdh.[!"("H& 9-I9-Q %&8"8N 8A JJE F 3l. r