§ øžyjÜ)ãó¶—UdZddlmZddlZddlZddlZddlZddlZddlm Z dZ ded<dd d ddd ddœZded<d%d„Z d&d„Zd'd„Zd(d„Zd)d„Zd*d„Z d+d,d$„ZdS)-uçDependency-light venv recovery that runs BEFORE hermes_cli.main's imports. The ``hermes`` console entry point is ``hermes_cli.main:main``. Importing ``hermes_cli.main`` pulls in third-party packages at module level (``dotenv`` via ``hermes_cli.env_loader``, ``yaml`` via ``hermes_cli.config``, ...). In the exact failure state the update-recovery markers exist for â€” a failed lazy backend refresh or interrupted core install that wiped a core package's import files (#57828) â€” a normal launch crashes *while importing main.py*, before ``_recover_from_interrupted_install()`` can run. The marker system is unreachable precisely when it is needed most. This module is deliberately **stdlib-only** so importing it can never fail on a corrupted venv. ``hermes_cli.main`` imports and calls :func:`recover_if_needed` at the very top of its module body, before any third-party import. Scope: this early pass only repairs enough for ``hermes_cli.main`` to become importable again (force-reinstall of the known-fragile core packages, using the pins from pyproject.toml). It NEVER clears the recovery markers â€” the full, confirmed marker lifecycle stays with ``_recover_from_interrupted_install()`` in main.py, which runs right after import succeeds. é)ÚannotationsN)ÚPath))ÚyamlÚ SafeDumper)ÚdotenvÚload_dotenv)ÚclickÚCommand)ÚcertifiÚcontents)ÚrichÚprint)ÚcryptographyÚ__version__)ÚjwtÚencodeztuple[tuple[str, str], ...]ÚLAZY_REFRESH_IMPORT_PROBESÚPyYAMLz python-dotenvr rr rÚPyJWT)rrr rr rrzdict[str, str]ÚLAZY_REFRESH_REPAIR_PACKAGESÚreturnrcób—tt¦« ¦«jjS)N)rÚ__file__ÚresolveÚparent©óú@/home/ragecks/.hermes/hermes-agent/hermes_cli/_early_recovery.pyÚ _project_rootr;s €Ý•‰>Œ>×!Ò!Ñ#Ô#Ô*Ô1Ð1rÚpackagesú list[str]Úproject_rootcóÂ‡—|dz}| ¦«s|S ddl}t|d¦«5}| |¦« di¦« dg¦«pg}ddd¦«n#1swxYwYn#t $r|cYSwxYwiŠ|D]²}| dd¦«d ¦«}|}d D]$} | |vr| | d¦«d}nŒ%| ¦« d d¦«d ¦« ¦«} | r|‰| <Œ³ˆfd„|D¦«S)uMap bare package names to their pinned specs from pyproject.toml. Stdlib-only (tomllib + naive requirement-head parsing â€” ``packaging`` may itself be broken in the failure state this module exists for). Unknown packages fall back to their bare name. úpyproject.tomlrNÚrbÚprojectÚdependenciesú;é)z==z>=z<=z~=ú>úz!_pinned_specs..\s1ø€ÐCÐCÐC°3ˆL×Ò˜SŸYšY™[œ[¨#Ñ.Ô.ÐCÐCÐCr) Úis_fileÚtomllibÚopenÚloadr.Ú ExceptionÚsplitÚstripr/)r r"Ú pyprojectr5ÚfÚraw_depsÚspecÚheadÚbareÚopÚkeyr2s @rÚ _pinned_specsrC?såø€ðÐ/Ñ/€IØ×ÒÑÔðØˆðØˆˆˆå )˜TÑ "Ô "ð X aØ—|’| A‘”×*Ò*¨9°bÑ9Ô9×=Ò=¸nÈbÑQÔQÐWÐUWˆHð Xð Xð Xñ Xô Xð Xð Xð Xð Xð Xð Xøøøð Xð Xð Xð XøøåðððØˆˆˆðøøøð$&€LØð %ð %ˆØzŠz˜#˜qÑ!Ô! !Ô$×*Ò*Ñ,Ô,ˆØˆØ:ð ð ˆBØTˆzˆzØ—z’z " aÑ(Ô(¨Ô+ØððjŠj‰lŒl× Ò aÑ(Ô(¨Ô+×1Ò1Ñ3Ô3×9Ò9Ñ;Ô;ˆØð %Ø $ˆL˜ÑøØCÐCÐCÐC¸(ÐCÑCÔCÐCs5žB ²AA>Á2B Á>BÂB ÂBÂB Â BÂBÚboolcóÔ— ddl}t| ¦«¦«}| ¦«p| ¦«jdkS#t$rYdSwxYw)uTrue when certifi imports but its ``cacert.pem`` is missing/corrupt. A brew Python upgrade or an interrupted venv rebuild can leave certifi's distribution metadata (and even the module) intact while the bundled ``cacert.pem`` is gone or a dangling symlink â€” every TLS connection then fails with an opaque ``Could not find a suitable TLS CA certificate bundle`` from deep inside httpx/requests (#29866). An attribute probe alone passes in that state, so validate the bundle path itself. rNiT)rrÚwherer4ÚstatÚst_sizer8)rÚbundles rÚ_certifi_bundle_brokenrJ_sq€ð Øˆˆˆåg—m’m‘o”oÑ&Ô&ˆà—>’>Ñ#Ô#Ð#ÐC v§{¢{¡}¤}Ô'<¸tÒ'CÐCøÝððððˆtˆtðøøøs‚AAÁ A'Á&A'cóf—g}tD]¦\}} tj|¦«}t||¦«st |›d|›¦«‚|dkrt¦«rt d¦«‚Œb#t$r8t |¦«}|r||vr| |¦«YŒ£wxYw|S)a£Import-probe the fragile core packages in THIS process. Returns repair package names (deduped, probe order) for modules that fail to import or lack their sentinel attribute. Failed imports leave nothing in ``sys.modules``, so a post-repair retry in the same process works. certifi additionally gets a bundle-file check: the module can import cleanly while ``cacert.pem`` is missing (#29866). z missing rz%certifi cacert.pem missing or corrupt) rÚ importlibÚ import_moduleÚhasattrÚImportErrorrJr8rr.Úappend)ÚbrokenÚmod_nameÚattrÚmodr1s rÚ_probe_broken_packagesrUusâ€ð€FÝ4ð #ð #‰ˆ$ð #ÝÔ)¨(Ñ3Ô3ˆCÝ˜3 Ñ%Ô%ð @Ý! XÐ">Ð">¸Ð">Ð">Ñ?Ô?Ð?Ø˜9Ò$Ð$Õ)?Ñ)AÔ)AÐ$Ý!Ð"IÑJÔJÐJøøÝð #ð #ð #Ý.×2Ò2°8Ñ<Ô<ˆCØð #s &Ð(Ð(Ø— ’ ˜cÑ"Ô"Ð"øøð #øøøð€MsAA,Á,?B.Â-B.ÚspecscóÀ— tjtjddddg|d¬¦«n#t$rYnwxYw tjtjdddd g|¢|ddd d¬¦«}n6#t$r)}td |›tj¬¦«Yd}~dSd}~wwxYw|jdkr7|jp|jpddd…}|rt|tj¬¦«dSdS)zÜensurepip + ``pip install --force-reinstall`` the given specs. Streams nothing to stdout (``hermes acp`` speaks JSON-RPC on stdout); output is captured and replayed to stderr only on failure. Never raises. z-mÚ ensurepipz --upgradez --default-pipT)ÚcwdÚcapture_outputÚpipÚinstallz--force-reinstallzutf-8Úreplace)rYrZÚtextÚencodingÚerrorsu+ âœ— Early venv repair could not run pip: ©ÚfileNFrÚi0øÿÿ) Ú subprocessÚrunÚsysÚ executabler8rÚstderrÚ returncodeÚstdout)rVr"ÚresultÚexcÚtails rÚ_run_repair_installrnŽs<€ð ÝŒÝ Œ^˜T ;°¸_ÐMØØð ñ ô ð ð øõ ð ð ð Øˆð øøøð Ý”Ý Œ^˜T 5¨)Ð5HÐQÈ5ÐQØØØ ° ð ñ ô ˆˆøõðððÝ ÐA¸CÐAÐAÍÌ ÐSÑSÔSÐSØˆuˆuˆuˆuˆuøøøøðøøøðÔ˜AÒÐØ” Ð4 ¤Ð4°"°e°f°fÔ=ˆØð )Ý$SœZÐ(Ñ(Ô(Ð(ØˆuØˆ4s#‚&)© 6µ6º+A&Á& BÁ0BÂBÚrootcó†—dtjvo3|tt¦« ¦«jjkS)uETrue when running under pytest AND ``root`` is this module's own checkout â€” the one whose venv is executing the suite right now. Lifecycle tests spawn real subprocesses that import ``hermes_cli.main`` with recovery armed; ``PYTEST_CURRENT_TEST`` rides the inherited env into those children. Without this guard, a genuinely-broken dev venv gets a REAL ``ensurepip`` + ``pip install --force-reinstall`` from inside a running test suite. Tests that sandbox ``project_root`` to a tmp_path are unaffected (same posture as ``managed_scope._under_pytest``).ÚPYTEST_CURRENT_TEST)ÚosÚenvironrrrr)ros rÚ_pytest_owns_live_checkoutrt®s8€ð ¥¤Ð+ð ;Ø•D‘N”N×*Ò*Ñ,Ô,Ô3Ô:Ò:ðrúPath | NoneÚargvúlist[str] | NoneÚNonecóº— |€tjdd…n|}d|vrdS|€t¦«n|}t|¦«rdS|dz}|dz}| ¦«s| ¦«sdS|dz ¦«sdSt ¦«}|sdS|dz} tj|tj tj ztjz¦«}tj|tj ¦«›d ¦«¦«tj|¦«ns#t $r[ t#j¦«| ¦«jz d kr| ¦«n#t*$rYnwxYwYdSt*$rYnwxYw t-||¦«} t/d d |¦«›tj¬¦«t5| |¦«r*t ¦«st/d tj¬¦«nZt/dtj¬¦«t/dtj›dd | ¦«ztj¬¦« | ¦«dS#t*$rYdSwxYw# | ¦«w#t*$rYwwxYwxYw#t8$rYdSwxYw)u1Repair wiped core packages so ``hermes_cli.main`` can import at all. Fast path (no marker present) is two ``lstat`` calls. Only acts when a recovery marker from a prior ``hermes update`` exists AND an import probe confirms a core package is actually broken. Markers are intentionally NOT cleared here â€” ``_recover_from_interrupted_install()`` in main.py owns the confirmed marker lifecycle and runs immediately after import succeeds. Never raises: on any failure the import of main.py proceeds and surfaces the real error. Nr)Úupdatez.update-incompletez.lazy-refresh-incompleter$z.update-incomplete.lockú iuQâš Core package(s) broken by an interrupted update â€” repairing before launch: z, rau âœ“ Core packages repaired.u9 âœ— Automatic repair incomplete. Recover manually with:z z" -m pip install --force-reinstall ú )rfrvrrtÚexistsr4rUrrr6ÚO_CREATÚO_EXCLÚO_WRONLYÚwriteÚgetpidrÚcloseÚFileExistsErrorÚtimerGÚst_mtimeÚunlinkÚOSErrorrCrÚjoinrhrnrgr8) r"rvÚargsroÚcore_markerÚlazy_markerrQÚ lock_pathÚfdrVs rÚrecover_if_neededr¾s`€ðB Ø#˜|sŒx˜˜˜Œ|ˆ|°ˆðtÐÐØˆFØ".Ð"6}‰Œˆ¸LˆÝ% dÑ+Ô+ð ØˆFØÐ1Ñ1ˆØÐ7Ñ7ˆØ×!Ò!Ñ#Ô#ð ¨K×,>Ò,>Ñ,@Ô,@ð ØˆFðÐ'Ñ'×0Ò0Ñ2Ô2ð ØˆFå'Ñ)Ô)ˆØð àˆFðÐ4Ñ4ˆ ð Ý”˜¥B¤Jµ´Ñ$:½R¼[Ñ$HÑIÔIˆBÝŒHRBœI™KœKÐ+Ð+Ð+×2Ò2Ñ4Ô4Ñ5Ô5Ð5ÝŒHR‰LŒLˆLˆLøÝð ð ð ð Ý”9‘;”; §¢Ñ!1Ô!1Ô!:Ñ:¸TÒAÐAØ×$Ò$Ñ&Ô&Ð&øøÝð ð ð Øð øøøàˆFˆFÝð ð ð ØˆDð øøøð Ý! &¨$Ñ/Ô/ˆEÝð@Ø,0¯IªI°fÑ,=Ô,=ð@ð@å”Zð ñ ô ð õ # 5¨$Ñ/Ô/ð Õ8NÑ8PÔ8Pð ÝÐ5½C¼JÐGÑGÔGÐGÐGåØOÝœðñôðõØM3œ>ÐMÐMÐMØ—h’h˜u‘o”oñ&åœðñôðð Ø× Ò Ñ"Ô"Ð"Ð"Ð"øÝð ð ð Øð øøøøð Ø× Ò Ñ"Ô"Ð"Ð"øÝð ð ð Øð øøøøøøøåð ð ð àˆˆð øøøsÙ‚K !KÁ2KÁ7KÂKÂ"KÂ(BD1Ä0KÄ1 F!Är”sqððððð.#Ð"Ð"Ð"Ð"Ð"àÐÐÐØ € € € ØÐÐÐØ € € € Ø€€€ØÐÐÐÐÐð;Ððððñð ØØ ØØØ"Øð0ð0Ððððñð2ð2ð2ð2ðDðDðDðDð@ðððð,ðððð2ðððð@ ð ð ð ð"!%Ø!ðQ ðQ ðQ ðQ ðQ ðQ ðQ r