sj[UdZddlmZddlZddlZddlZddlZddlZddlZddl m Z dZ de d<dd d d d d ddZ de d<dad4dZd5dZd6dZd7dZd8d Zd4d!Zd9d"Zd:d$Zd4d%Zd;d'Zdd.Zd/Zd/home/agent/.hermes/hermes-agent/hermes_cli/_early_recovery.py$_should_skip_external_secret_sourcesrDs ""rrcbttjjS)N)r__file__resolveparentrrr _project_rootr#Is >> ! ! # # * 11rpidintc|dkrdStjdkr% ddl}d}|dd}|j|j|jg|j_|j|j_ |j|jg|j _|j|j _ |jg|j _|j|j _ ||d|}|s| d kS | |dd k| |S#| |wxYw#t$rYdSwxYw tj|dn)#t $rYdSt"$rYdSt$$rYdSwxYwdS) aBest-effort stdlib-only process liveness probe. ``os.kill(pid, 0)`` is not a no-op on Windows, so use the Win32 process handle API there. An access-denied result is conservatively live: racing an elevated updater is worse than postponing recovery for one launch. rFwin32Nikernel32T)use_last_errori)sysplatformctypesWinDLLc_ulongc_int OpenProcessargtypesc_void_prestypeWaitForSingleObject CloseHandleget_last_error ExceptionoskillProcessLookupErrorPermissionErrorOSError)r$r- synchronizer(handles r_pid_is_runningr@Ms axxu |w  MMM$K}}Z}EEH -H ) ,2?H (5;_fn4UH ( 139>H ( 0-3_,=H )+1>#E$$V,,,,$$V,,,,   44  Q uu tt uu 4sHCD.%D>D.D++D.. D<;D<E E<# E</ E<;E<markerct |dd}n#t$rYdSwxYw|D]x}|d\}}}|r[|dkrC t t |cS#t$rYdSwxYwydS)z?True when a legacy update marker names a process still running.utf-8replaceencodingerrorsF=r$) read_textr= splitlines partitionstripr@r% ValueError)rAbodylinekey separatorvalues r_marker_owner_is_liverSzsCC uu!! $s 3 3Y  -- &s5;;=='9'9:::::   uuu  5s ((5-B%% B43B4packages list[str] project_rootc |dz }|s|S ddl}t|d5}||didgpg}dddn #1swxYwYn#t $r|cYSwxYwi |D]}|ddd}|}d D]$} | |vr|| dd}n%|d dd} | r| | < fd |DS) uMap bare package names to their pinned specs from pyproject.toml. Stdlib-only (tomllib + naive requirement-head parsing — ``packaging`` may itself be broken in the failure state this module exists for). Unknown packages fall back to their bare name. pyproject.tomlrNrbproject dependencies;)z==z>=z<=z~=>z!_pinned_specs..s1 C C C3L  SYY[[# . . C C Cr) is_filetomllibopenloadrbr8splitrLrc) rTrV pyprojectrifraw_depsspecheadbareoprPrfs @r _pinned_specsrts//I      )T " " Xa||A**9b99==nbQQWUWH X X X X X X X X X X X X X X X $&L % %zz#q!!!$**,,:  BTzzzz"a((+jjll  a((+113399;;  % $L  C C C C( C C CCs5B AA>2 B >BB BB BBc ddl}t|}| p|jdkS#t $rYdSwxYw)uTrue when certifi imports but its ``cacert.pem`` is missing/corrupt. A brew Python upgrade or an interrupted venv rebuild can leave certifi's distribution metadata (and even the module) intact while the bundled ``cacert.pem`` is gone or a dangling symlink — every TLS connection then fails with an opaque ``Could not find a suitable TLS CA certificate bundle`` from deep inside httpx/requests (#29866). An attribute probe alone passes in that state, so validate the bundle path itself. rNiT)r rwhererhstatst_sizer8)r bundles r_certifi_bundle_brokenrzsq gmmoo&&>>###Cv{{}}'">">">???9$$)?)A)A$!"IJJJ # # #.228<> t99     <  rc ddl}t|d}|dz rdS|jdz rdSn#t $rYnwxYwdS)aTrue when ``sys.executable`` is a uv/standalone-builds managed install. Those interpreters ship an ``EXTERNALLY-MANAGED`` marker next to their stdlib (PEP 668), so ``python -m pip install`` aborts with ``externally-managed-environment``. The early repair must then go through uv (or explicitly override pip) or the reinstall no-ops and the venv stays broken (#83569). rNstdlibzEXTERNALLY-MANAGEDTF) sysconfigrget_pathexistsr"r8)rrs r'_base_interpreter_is_externally_managedrs  i((2233 ) ) 1 1 3 3 4 M0 0 8 8 : : 4       5s=A A A-,A-specsc dt}|rt}|ritjdt |dz i}|dd|dd t j|dddg||d d d d | }|jd krd S|j p|j pddd}|rt|tj dS#t$r)}td|tj Yd}~dSd}~wwxYwtdtj  t jtjddddg|d n#t$rYnwxYwtjddddg}|r|d|| t j||d d d d }n6#t$r)}td|tj Yd}~dSd}~wwxYw|jd kr7|j p|j pddd}|rt|tj dSd S)u``uv pip`` (or stdlib ``pip``) force-reinstall of the given specs. Streams nothing to stdout (``hermes acp`` speaks JSON-RPC on stdout); output is captured and replayed to stderr only on failure. Never raises. Two installer paths, in priority order: 1. ``uv pip install`` with ``VIRTUAL_ENV`` pointed at the project venv — required when the base interpreter is uv-managed (Windows git checkouts install exactly this way: uv's Python declares PEP 668 ``EXTERNALLY-MANAGED`` and plain ``python -m pip`` refuses to run). 2. ``sys.executable -m pip`` as before, for self-contained venvs whose interpreter carries no PEP 668 marker. VIRTUAL_ENVvenv PYTHONHOMEN PYTHONPATHpipinstallz--force-reinstallTrCrD)cwdcapture_outputtextrFrGenvri0fileFu* ✗ Early venv repair could not run uv: uw ⚠ Base interpreter is externally managed and no uv binary was found; retrying repair via pip with PEP 668 override.z-m ensurepipz --upgradez --default-pip)rrz--break-system-packages)rrrrFrGu+ ✗ Early venv repair could not run pip: )rrr9environrpop subprocessrun returncodestderrstdoutrr+r8 executablerextend) rrVexternally_managedrrresulttailexcpip_cmds r_run_repair_installrsABB     KRZKL64I0J0JKKC GGL$ ' ' ' GGL$ ' ' ' # +>GG$#'  $))4 <<"effE1$SZ0000u   H3HHszZZZZuuuuu   D      ^T; _ M          ~tUI7JKG20111 NN5        ACAA SSSSuuuuuA 44"eff=  ) $SZ ( ( ( (u 4sH1,C5C D  DD (&E EEF88 G+G&&G+rootcdtjvo3|ttjjkS)uETrue when running under pytest AND ``root`` is this module's own checkout — the one whose venv is executing the suite right now. Lifecycle tests spawn real subprocesses that import ``hermes_cli.main`` with recovery armed; ``PYTEST_CURRENT_TEST`` rides the inherited env into those children. Without this guard, a genuinely-broken dev venv gets a REAL ``ensurepip`` + ``pip install --force-reinstall`` from inside a running test suite. Tests that sandbox ``project_root`` to a tmp_path are unaffected (same posture as ``managed_scope._under_pytest``).PYTEST_CURRENT_TEST)r9rrr r!r"rs r_pytest_owns_live_checkoutrQs8 + ; DNN**,,3: :r Path | Noneargvlist[str] | NoneNonec8 |tjddn|}|tn|}t|rdS|dz }|dz }|s|sdS|dz sdS|r+t |rdSt||}|rd|vrdadSd|vrdSt}|sdS|dz } tj |tj tj ztjz} tj| tjd tj| ns#t&$r[ t)j|jz d kr|n#t0$rYnwxYwYdSt0$rYnwxYw t3||} t5d d |tj t;| |r*tst5dtj nZt5dtj t5dtjdd| ztj  |dS#t0$rYdSwxYw# |w#t0$rYwwxYwxYw#t>$rYdSwxYw)u1Repair wiped core packages so ``hermes_cli.main`` can import at all. Fast path (no marker present) is two ``lstat`` calls. Only acts when a recovery marker from a prior ``hermes update`` exists AND an import probe confirms a core package is actually broken. Markers are intentionally NOT cleared here — ``_recover_from_interrupted_install()`` in main.py owns the confirmed marker lifecycle and runs immediately after import succeeds. Never raises: on any failure the import of main.py proceeds and surfaces the real error. Nr]z.update-incompletez.lazy-refresh-incompleterXupdateT.update-incomplete.lock uQ⚠ Core package(s) broken by an interrupted update — repairing before launch: z, ru ✓ Core packages repaired.u9 ✗ Automatic repair incomplete. Recover manually with:z z" -m pip install --force-reinstall  ) r+rr#rrrhrS_complete_pending_core_installrrr9rjO_CREATO_EXCLO_WRONLYwritegetpidrcloseFileExistsErrortimerwst_mtimeunlinkr=rtrjoinrrrr8) rVrargsr core_marker lazy_marker completedr lock_pathfdrs rrecover_if_neededras"[ #|sx||"."6}L %d + +  F11 77 !!## K,>,>,@,@  F''0022  F"      $[11 6t[III /X--*.' F t   F'))  F44  BJ$:R[$HIIB HRBIKK+++2244 5 5 5 HRLLLL    9;;!1!1!::TAA$$&&&     FF    D  !&$//E @,0IIf,=,=@@Z     #5$// 8N8P8P 5CJGGGGGOM3>MMMhhuoo&    """""       """"          s9L 2L 1L #L /L L L !L 'BE0/L 0 G ;AGG  G G  GG L  G L G  L $CK!:K KL KL !L#K87L8 LLLLL LLc |dz } tj|tjtjztjz}tj|tjdtj|dS#t$r[ tj | j z dkr| n#t$rYnwxYwYdSt$rYdSwxYw)z?Single-flight claim on the shared recovery lock. Never raises.rrTrF)r9rjrrrrrrrrrrwrrr=)rrrs r_claim_recovery_lockrs 00I WY RY 6 D E E  '''..00111  t  y{{Y^^--66==  """    D uu tts=BB DAC"!D" C/,D.C//D5 DDcX |dz dS#t$rYdSwxYw)z0Best-effort release of the shared recovery lock.rN)rr=rs r_release_recovery_lockrsG ) )1133333      s  ))rc   ddlm}d} |dd}|rUddl} t ||dd}n#ttf$rd}YnwxYwn#t$rd}YnwxYw|tkr!td|d tj d St|sd S td tj ||n#t"$rs}||}td |dtd|tj tdtj Yd}~t'|d Sd}~wwxYw t'|n#t'|wxYw |n#t$rYnwxYwtdtj dS#t"$rYd SwxYw)u Run the pending core install BEFORE main.py can import native modules. ``recover_if_needed`` invokes this when ``.update-incomplete`` exists — a prior ``hermes update`` (or the self-lock preflight, #83569) left the dependency sync deliberately unfinished. Completing it here matters on Windows: the deferral exists precisely because the process that wrote the marker had a native venv extension mapped; this process, running before ``hermes_cli.main``'s third-party imports, maps nothing yet, so the installer can replace ``.pyd`` files without hitting the lock. Marker lifecycle: cleared on success; kept (attempts counter bumped) on failure for the next launch or main.py's post-import recovery. An attempts ceiling caps automatic retries so a persistent installer failure does not block every launch (``hermes acp`` included). Never raises: any failure leaves the marker for the post-import path and returns ``False``. Returns ``True`` only after the install succeeds. r)_install_repairrCrDrENattemptsu:⚠ Pending interrupted-update install has already failed uJ times in the early pass — leaving it for the post-import recovery path.rFu⚠ A previous `hermes update` was interrupted mid-install — finishing dependency installation now (before any native extensions load)...u; ✗ Early interrupted-install completion failed (attempt /z): z] The next launch will retry; hermes will keep working from the current venv in the meantime.u: ✓ Dependency installation completed in the early pass.T) hermes_clirrIrLjsonr%loadsrbrMAttributeErrorr= _EARLY_CORE_INSTALL_MAX_ATTEMPTSrr+rrrun_core_installr8bump_marker_attemptsrr)rrirrraw_jsonr new_attemptss rrrs&B444444  '''KKQQSSC !$$$$!"5;;s#3#3#7#7 A#F#FGGHH"N3!!! HHH!   HHH  7 7 7 ----Z      5#D)) 5 ) &Z         % % % %   22;??L MMM"BMMGJMMZ     4Z     555 "4 ( ( ( ( (  & #4 ( ( ( ( "4 ( ( ( (         D  H    t uusG5/B 6A21B 2BB BB G5 BG5B-G5 G50D F F AF0F4G5F  FG5F//G53GG5 GG5GG55 HH)rr)rr)r$r%rr)rArrr)rTrUrVrrrU)rrU)rr)rrUrVrrr)rrrr)NN)rVrrrrr)rrrr)rrrrrr)__doc__ __future__rr|r9rrr+rpathlibrr__annotations__rrrr#r@rSrtrzrrrrrrrrrrrrrrs4.#"""""  ;   " 00  #### 2222****Z     DDDD@,2(.JJJJZ    "!%!l l l l l j$% *    UUUUUUr