yj%UdZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlZddlmZddlmZmZmZmZddlmZejeZdedefdZdd lmZmZdd l m!Z!dd l"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)d ededefdZ*e*dde+dZ,e*dde-dZ.dZ/dZ0dede1fdZ2de3eefde1fdZ4dddZ5e3e6d <d!Z7d"Z8iZ9e3eefe6d#<e j:Z;e j<Z=d$Z>d%Z?d&Z@d'ZAdefd(ZBdefd)ZCd*eddfd+ZDdd,ZEdd-lFmGZHd.ede1fd/ZIdeeefde1fd0ZJ dd1ed2ed3e1de3fd4ZKeLd5ZMd6ede1fd7ZNd8ededzfd9ZOd:ed2edefd;ZPdZSdd@e+defdAZTdd1edCe+defdDZUdEede1fdFZVd1edGe+deWee+ffdHZXd1edeWee+ffdIZYd1ede+fdJZZde1fdKZ[d1edefdLZ\d1edzdeWedzedzffdMZ]ddNl^m_Z_ddOl`maZbddPl"mcZdddQlemfZgddRlhmiZjddSlkmlZmddTlnmoZpddUlqmrZrddlsZsdVZtiZueeefe6dW<iZveee-fe6dX<e j:ZwiZxeee j:fe6dY<e j:Zydazda{da|e j:Z}dZeeefddfd[Z~iZeeeeeffe6d\<iZeeefe6d]<e j:Zd^eed_eeddfd`Zd^eedeefdaZd^eddfdbZdceddeeeffdeZdcefdfZiZeeefe6dg<e j:ZdhedieeddfdjZdcedefdkZde1fdlZeLhdmZdceede1fdnZdceedefdoZdceedeeeffdpZdeeefdceedeefdqZe+dfd ededredefdsZdefdtZduZeLhdvZd_ede1fdwZdaddxZdeeeffdyZdzedzdeeeffd{Zdeeefde3fd|Zdeeefde3fd}Z dd2ed~ed_ede+de3dZe3de3dcedeefdZdde+fdZdZdZdZdcefdZddceefdZdcede1fdZdZdddcede1fdZdZe jed1ede+dedzfdZd1ede1fdZejdejejzZejdZejdZd1edefdZejdejejdejejdejejdejejdejejdejejdejejdejfZd1ede1fdZd1ededzfdZde1de1deWfdZdddd8eeded^eed2eedef dZ dd1ede1dee+dceedeede1d8eede1de1deeedefdZdceeddfdZde1fdZedkr\ededeZededed2edededededed_ededdededdesedesjdedededed¦edæedĦedŦedƦedǦedȦdZedejdd̦d͝edejdeedejddeedejdeedejdeedejdeddlmZedejdedܝedejddߦedejddddl mZdetdddddddddde,de,dddddddddddddddddidddd1gddZdZejddeeedddS(a Terminal Tool Module A terminal tool that executes commands in local, Docker, Modal, SSH, Singularity, Daytona, and Vercel Sandbox environments. Supports local execution, containerized backends, and cloud sandboxes, including managed Modal mode. Environment Selection (via TERMINAL_ENV environment variable): - "local": Execute directly on the host machine (default, fastest) - "docker": Execute in Docker containers (isolated, requires Docker) - "modal": Execute in Modal cloud sandboxes (direct Modal or managed gateway) - "vercel_sandbox": Execute in Vercel Sandbox cloud sandboxes Features: - Multiple execution backends (local, docker, modal, vercel_sandbox) - Background task support - VM/container lifecycle management - Automatic cleanup after inactivity Cloud sandbox note: - Persistent filesystems preserve working state across sandbox recreation - Persistent filesystems do NOT guarantee the same live sandbox or long-running processes survive cleanup, idle reaping, or Hermes exit Usage: from terminal_tool import terminal_tool # Execute a simple command result = terminal_tool("ls -la") # Execute in background result = terminal_tool("python server.py", background=True) N)Path)OptionalDictAnyList)env_var_enabledvaluereturncJddlm}||dnt|dS)z?Force-redact text before serializing a terminal error envelope.r)redact_sensitive_textNT)force) agent.redactr str)r r s 9/home/ragecks/.hermes/hermes-agent/tools/terminal_tool.py_redact_terminal_error_textr9s8222222 u}#e**D Q Q QQ)is_interrupted_interrupt_event) tool_error)_get_scratch_dir)coerce_modal_modehas_direct_modal_credentialsmanaged_nous_tools_enabled%nous_tool_gateway_unavailable_messageresolve_modal_backend_statenamedefault type_labelctj|}||dkr|S ||S#ttf$r#td|||||cYSwxYw)zParse module-level numeric env vars without breaking import. Terminal tool is imported by CLI, ACP, tests, and tool discovery. A single malformed env var must not make the whole module unloadable at import time. Nr z;Invalid value for %s: %r (expected %s). Falling back to %r.)osgetenv TypeError ValueErrorloggerwarningrr converterrraws r_safe_parse_import_envr*[s )D//C {cRii y~~ z " I        s +1AATERMINAL_MAX_FOREGROUND_TIMEOUTiXintegerTERMINAL_DISK_WARNING_GBg@@numberz/vercel/sandbox)node24node22z python3.13runtimec| p|tvSN)_SUPPORTED_VERCEL_RUNTIMES)r1s r_is_supported_vercel_runtimer5s; ?'%???rconfigc&|dpd}t|s8dt}t d||dS|dd}|dvrt d |dStj d t d dSd dl m }t|d}t|d}t|d}t|d}|rdS|s|s|r$|r|r|rdSt ddSt ddS)z6Validate Vercel Sandbox terminal backend requirements.vercel_runtimer z, zVVercel Sandbox runtime %r is not supported. Set TERMINAL_VERCEL_RUNTIME to one of: %s.Fcontainer_disk>rr:zmVercel Sandbox does not support custom TERMINAL_CONTAINER_DISK=%s. Use the default shared setting (51200 MB).vercelNzNvercel is required for the Vercel Sandbox terminal backend: pip install vercelr get_secretVERCEL_OIDC_TOKEN VERCEL_TOKENVERCEL_PROJECT_IDVERCEL_TEAM_IDTzVercel Sandbox backend selected with token auth, but VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_ID must all be set together. VERCEL_OIDC_TOKEN is supported for one-off local development only.zVercel Sandbox backend selected but no supported auth configuration was found. Set VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_ID for normal use. VERCEL_OIDC_TOKEN is supported for one-off local development only.) getstripr5joinr4r%error importlibutil find_specagent.secret_scoper=bool) r6r1 supporteddiskr=has_oidc has_token has_projecthas_teams r"_check_vercel_sandbox_requirementsrQszz*++1r88::G ' 0 0II899   9      u ::& . .D :  9    u~))1 \   u------JJ23344HZZ//00Izz"56677KJJ/0011Ht K 8     4  &   u LL  5rgF) timestampresult_disk_usage_cachegr@c,ddl}|}|tdz tkr tdS t }d}ddl}|t |dz D]}t|dD]g}| rQ || j z }4#t$r&}td||Yd}~_d}~wwxYwh|dz }|tk} | r!td |t|td<| td<| S#t"$r(}td |d Yd}~d Sd}~wwxYw)a Check if total disk usage exceeds warning threshold. Result is cached for :data:`_DISK_USAGE_CACHE_TTL` seconds (default: 5 minutes) to avoid an expensive recursive filesystem scan on every terminal command. The check is advisory-only so a stale result is harmless. rNrRrShermes-**zCould not stat file %s: %si@z\Disk usage (%.1fGB) exceeds threshold (%.0fGB). Consider running cleanup_all_environments().z#Disk usage warning check failed: %sTexc_infoF)time monotonicrT_DISK_USAGE_CACHE_TTLrglobrrrglobis_filestatst_sizeOSErrorr%debugDISK_USAGE_WARNING_THRESHOLD_GBr& Exception) _time_modnow scratch_dir total_bytesr]pathfetotal_gbexceededs r_check_disk_usage_warningros     C { ++.CCC **&((   IIc+ ":;;<< I ID$ZZ%%c** I I99;;II#qvvxx'77 "III %A1aHHHHHHHHII I),==  F NNy#%D F F F)2)<)<)>)>+&&.(#  :A MMMuuuuusDA3E!4CE! DC<7E!<DAE!! F+FF_sudo_password_cachec.ttddS)N sudo_passwordgetattr _callback_tlsrr_get_sudo_password_callbackrws =/4 8 88rc.ttddS)Napprovalrsrvrr_get_approval_callbackrzs =*d 3 33rc|t_dS)uRegister a callback for sudo password prompts (used by CLI). Per-thread scope — ACP sessions that run concurrently in a ThreadPoolExecutor each have their own callback slot. N)rurrcbs rset_sudo_password_callbackr~s #%Mrc|t_dS)uRegister a callback for dangerous command approval prompts. Per-thread scope — ACP sessions that run concurrently in a ThreadPoolExecutor each have their own callback slot. See GHSA-qg5c-hvr5-hjgr. N)ruryr|s rset_approval_callbackrs Mrc ddlm}|dd}n%#t$rtjdd}YnwxYw|rd|St }|Zt |dd}t |dd}|$|"d t|d t|Sd t|Sd tj S) z6Return the cache scope for interactive sudo passwords.r)get_session_envHERMES_SESSION_KEYr zsession:N__self____func__zcallback-owner::z callback:zthread:) gateway.session_contextrrer!r"rwrtid threading get_ident)r session_keycallbackownerfuncs r_get_sudo_password_cache_scoper)s:;;;;;;%o&:B?? :::i 4b99 :('+'''*,,H*d33xT22  !1;RYY;;D;; ;)2h<<))) ,Y(** , ,,s 77ct}t5t|dcdddS#1swxYwYdS)z6Return the cached sudo password for the current scope.r N)r_sudo_password_cache_lockrprB)scopes r_get_cached_sudo_passwordr?s * , ,E "33#''r22333333333333333333s>AApasswordct}t5|r |t|<nt|dddddS#1swxYwYdS)z.Persist a sudo password for the current scope.N)rrrppop)rrs r_set_cached_sudo_passwordrFs * , ,E "22  2*2  ' ' $ $UD 1 1 1 222222222222222222s)A  AAcxt5tddddS#1swxYwYdS)z`Clear all cached sudo passwords. Internal helper for tests and process teardown paths. N)rrpclearrvrr_reset_cached_sudo_passwordsrPs #%%""$$$%%%%%%%%%%%%%%%%%%s /33)check_all_command_guards volume_specct|tsdS|}t|o=|dp(t |dko|ddko |ddvS)z>Return True when a docker volume spec bind-mounts a host path.F)/~z./z../r)r\) isinstancerrCrJ startswithlen)rvols r_docker_volume_uses_host_pathrbs{ k3 ' 'u     C 99  .// D SQ B3q6S= BSV{-Brc|ddkrdS|dr|drdStd|dgDS) zIReturn True when a Docker sandbox exposes host paths through bind mounts.env_typedockerFhost_cwddocker_mount_cwd_to_workspaceTc34K|]}t|VdSr3)r).0rs r z*_docker_has_host_access..ts+^^c,S11^^^^^^rdocker_volumes)rBanyr6s r_docker_has_host_accessrnsx zz*))u zz*&**-L"M"Mt ^^VZZHXZ\=]=]^^^ ^ ^^rcommandrhas_host_accessc@t||t|S)zJDelegate to consolidated guard (tirith + dangerous cmd) with CLI callback.)approval_callbackr)_check_all_guards_implrz)rrrs r_check_all_guardsrws/ "'84J4L4L2A C C CCrz /\:_-.~ +@=,chc|sdSt|dkst|dkrdS|p|tvS)NF )ordisalnum_WORKDIR_SAFE_ASCII_CHARS)rs r_is_safe_workdir_charrsL u 2ww||s2ww#~~u ::<< :2!:::rworkdirc`|sdS|D]&}t|sdt|dcS'dS)zReject workdir values that don't look like a filesystem path. Uses an allowlist of safe characters rather than a deny-list, so novel shell metacharacters can't slip through. Returns None if safe, or an error message string if dangerous. Nz/Blocked: workdir contains disallowed character z<. Use a simple filesystem path without shell metacharacters.)rrepr)rrs r_validate_workdirrsk t$R(( M$r((MMM     4routputcxtd}|s|Sgd}|D]}||vrddlm}|d|dzcS |S)z Check for sudo failure and add helpful message for messaging contexts. Returns enhanced output if sudo failed in messaging context, else original. HERMES_GATEWAY_SESSION)zsudo: a password is requiredzsudo: no tty presentzsudo: a terminal is requiredrdisplay_hermes_homeu@ 💡 Tip: To enable sudo over messaging, add SUDO_PASSWORD to z/.env on the agent machine.)rhermes_constantsr)rr is_gateway sudo_failuresfailure_dhhs r_handle_sudo_failurers !!9::J  M !EE f   D D D D D DEaeaeagagEEEE E E E  Mr)zsudo: authentication failedz sudo: incorrect password attemptz1sudo: maximum 3 incorrect authentication attemptsz#sudo: 3 incorrect password attemptsct|sdS|tfdtDS)z0Return True when sudo rejected a piped password.Fc3 K|]}|vV dSr3rv)rmarkerlowereds rrz/_sudo_wrong_password_failure..s(LLVv LLLLLLr)lowerr_SUDO_WRONG_PASSWORD_MARKERS)rrs @r_sudo_wrong_password_failurersA ullnnG LLLL/KLLL L LLrcdtjvrdSt|sdSt|pddkrdSt sdSt ddS)uDrop a session-cached sudo password after sudo rejects it. Env-configured ``SUDO_PASSWORD`` is left alone — that is an explicit operator choice, not an interactive cache entry. SUDO_PASSWORDFr rT)r!environr_count_real_sudo_invocationsrr)rrs r'_invalidate_cached_sudo_on_auth_failurersm"*$$u ' / /u#GMr22a77u $ & &ub!!! 4r-timeout_secondscFddl}t}| |pdS#t$rYdSwxYwdddfd} dtjd<t jd ttd td td td tdtd|ddzdztdttdddtj |d}| | |dr~dpd}t|rtdntdt|j |dtjvrtjd=SStdtdt|j  dtjvrtjd=dSdS#ttf$rettdt|j Ydtjvrtjd=dSdSt$rT}td |d!|j Yd}~dtjvrtjd=dSdSd}~wwxYw#dtjvr tjd=wxYw)"a Prompt user for sudo password with timeout. Returns the password if entered, or empty string if: - User presses Enter without input (skip) - Timeout expires (45s default) - Any error occurs Only works in interactive mode (HERMES_INTERACTIVE=1). If a _sudo_password_callback is registered (by the CLI), delegates to it so the prompt integrates with prompt_toolkit's UI. Otherwise reads directly from /dev/tty with echo disabled. rNr F)rdonecd}d} tjdkr\ddl}g} |}|dvrn#|dkrt||  r rz/dev/ttyrr>  rutf-8replaceerrorsz)Failed to restore terminal attributes: %szFailed to close tty fd: %sr)platformsystemmsvcrtgetwchKeyboardInterruptappendrDtermiosr!openO_RDONLY tcgetattrECHO tcsetattr TCSAFLUSHreaddecodeEOFErrorrbrer%rcclose) tty_fd old_attrsrcharscr new_attrsb_termiosrlrSs rread_password_threadz7_prompt_for_sudo_password..read_password_threads * "  I-- $ AL((F{{//LLOOO $&(WWU^^z""R[99#--f55 #--f55 (|w|m; ! !!&'*;YGGG$**A^ 3 3LLOOO $ &)XXe__%;%;GI%;%V%Vz"+W5 $ $ $!#F:    $ $ $!#F:    $!i&;Q....&&vx/A9MMMM QQQLL!LaPPPPPPPPQ!BHV$$$$ BBBLL!=qAAAAAAAAB!F6NNN!i&;Q....&&vx/A9MMMM QQQLL!LaPPPPPPPPQ!BHV$$$$ BBBLL!=qAAAAAAAAB!F6N ! ! ! !sEEH5F 6H58F H5F  H5 F22 G!<GG!'G<< H+H&&H+5K; IK J &JKJ  KJ&%K& K0K KK K1HERMES_SPINNER_PAUSEg?u┌──────────────────────────────────────────────────────────┐uA│ 🔐 SUDO PASSWORD REQUIRED │u├──────────────────────────────────────────────────────────┤u?│ Enter password below (input is hidden), or: │uA│ • Press Enter to skip (command fails gracefully) │u│ • Wait zs to auto-skipz u│u└──────────────────────────────────────────────────────────┘z Password (hidden): T)endflushtargetdaemontimeoutrru1 ✓ Password received (cached for this session)u' ⏭ Skipped - continuing without sudou( ⏱ Timeout - continuing without sudoz (Press Enter to dismiss)u) ⏭ Cancelled - continuing without sudoz [sudo prompt error: z] - continuing without sudo )sysrwrer!rrZsleepprintrThreadstartrDstdoutr rr)rr_sudo_cbrpassword_threadrrlrSs @r_prompt_for_sudo_passwordrsJJJ+,,H 8::# #   22  . .F."."."."."`03-0 )* 3  ())) CDDD ())) OPPP QRRR @@@@8KeSTTT ()))  %2T::::#*2FtTTT_555 &> j)/RH GGG AIJJJJ?@@@ GGG J     & "RZ / / 122 0# = > > > 0 1 1 1 GGG J      "RZ / / 1222 0 / ' (  9:::   "RZ / / 1222 0 /  IIIIJJJ rrr !RZ / / 1222 0 /  "RZ / / 12 2 2 2 2sJ # 11E-H. AH..ALL# L,,K;L;LLL limitc|dSt|tr |d|S t|d|S#t$rdt |jdcYSwxYw)z>Return a log-safe preview for possibly-invalid command values.Nz<>)rrrretype__name__)rrs r_safe_command_previewrbsx'3vv-G}}VeV$$ ---,4==),,,,,,-s<"A! A!tokencd|vs|drdS|dd\}}ttjd|S)zCReturn True when *token* is a leading shell environment assignment.=Frz^[A-Za-z_][A-Za-z0-9_]*$)rsplitrJrematch)r r_values r_looks_like_env_assignmentr'msW %5++C00u;;sA&&LD& 4d;; < <> " MM!M a a%%d 773<< ##rc$d}d}t|}d}||kr||}|r|dkrd}|dz }0|dkr"|r |d|}|dkrn|}X|d|s,|d|s|d |r|d z }d}|d vr|dz }d}|d kr|dz }d }t ||\}}|r |dkr|dz }|rt |rd}nd }|}||k|S)zReturn how many real sudo command words appear in *command*. Lightweight scan that reuses the same tokeniser as ``_rewrite_real_sudo_invocations`` but skips the string-building, so it is cheap to call from the result-processing path. rTrrr1r2r3r4r5rr6r7Fr8)rr+r9rr/r') rcountr,r-r;rr=r r>s rrrs E A G AM a%% QZ ::<< Tzz $ FA  999!,,tQ//Kb  A    dA & & '*<*> " MM!M O a%%R Lrc6tjddpd}|dkrdS t jgdtjtjtjdd}|jdkS#t$rYdSwxYw)aNReturn True when local sudo currently works without prompting. Only probes for the `local` terminal backend; Docker/SSH/Modal/etc. must not inherit the host's sudo state. Re-probes every call (no process-level cache) so an expired sudo timestamp cannot make a later command silently block waiting for a password. TERMINAL_ENVlocalF)r8z-ntruer)stdinrstderrrcheckr) r!r"rCr subprocessrunDEVNULL returncodere) terminal_envprobes r_sudo_nopasswd_worksrOs9^W55;;==CCEEPLwu  " " "$%%    1$$ uusAB BBcTt|}d}d}d}d}g}||krv||}|dkr|dkr|dkrd}|dz })|r|dz }C|dkr!|d|}|dkrn|}j|dkr|dz|kr|dz }|dvr't||\} } t | |dz}|d kr |dz }|dz }|d krt d|dz }|dz }|d krA|dz|kr8||dzs||dzdkr |dz }|dz }!|d kr|dkr|dz}d}|dz };|dks|dkr|dz }N|d |s|d|r |dz}|dz }|dkr d}|dz }|dkr d}|dz }|dkr|dz|kr||dzdkr|dz }|dz } | dkr?|| r%| dz} | dkr|| %| dkr|| dvr|dz }*|dkr|||fd}|dz }Pt||\} } t | |dz}||kv|s|S|} t|D]{\} }| }||kr?| |r%|dz }||kr| |%| d|}| ||}| |dzd}|dz|zdz|z} || S)uWrap `A && B &` (or `A || B &`) to `A && { B & }` at depth 0. Bash parses ``A && B &`` with `&&` tighter than `&`, so it forks a subshell for the whole `A && B` compound and backgrounds it. Inside the subshell, `B` runs foreground, so the subshell waits for `B` to finish. When `B` is a long-running process (`python3 -m http.server`, `yes > /dev/null`, anything that doesn't naturally exit), the subshell never exits. It leaks as a process stuck in ``wait4`` forever — and on the way, its open stdout pipe can prevent the terminal tool from returning promptly. Rewriting the tail to `A && { B & }` preserves `&&`'s error semantics (skip B if A fails) while replacing the subshell with a brace group. The brace group runs in the current shell (no fork), backgrounds B as a simple command (bash doesn't wait for it in non-interactive mode), and exits immediately. B runs as a normal backgrounded child, orphaned when the parent shell exits. Handles redirects (``&>``, ``2>&1``) and skips content inside quoted strings and parenthesised subshells. Leaves simple ``cmd &`` alone — that construct doesn't have the subshell-wait bug. rr2rrr1rr>r*r)(r7{}r3r4;|&rz<>Nz{ z& })rr+r9r/maxrrreversed)rr-r, paren_depth brace_depthlast_chain_op_endrewritesrnl_r>jrS chain_endamp_pos insert_posprefixmiddlesuffixs r_rewrite_compound_backgroundrf+sg. G A AKK&(H a%% QZ ::+**{a/?/? "  FA  ::<<  FA  99dA&&BRxxA  ::!a%!)) FA    )'155IAvFAE""A  99 1 K FA  99aq11K FA  99QA(>(>(@(@GAPQENVZDZDZ 1 K FA  99q 1 K "  FA  ??kAoo FA    dA & & '*<*#> " C C C#%:>>/#B#B  C ???!z~~o>>?2$> # ) & ( ( #==Q=S=S}:<A>ct|pd}t5t|cdddS#1swxYwYdS)aReturn the recorded working directory for *session_key*, if any. No fallback chain here on purpose: callers decide what an absent record means (config default, TERMINAL_CWD seed, process cwd). ``None``/empty keys read the ``"default"`` record. rN)rrrrB)rrs rget_session_cwdrs k&Y ' 'C %%$$%%%%%%%%%%%%%%%%%%sAAAc|t5t|dddddS#1swxYwYdS)z/Drop a session's cwd record (session teardown).N)rrr)rs rclear_session_cwdrs ,,d+++,,,,,,,,,,,,,,,,,,s 155task_id overridesc|t|<|d}t|tr|rt ||t |}t5t|pt|}dddn #1swxYwY|t|dd||_ dSdSdSdSdS)a# Register environment overrides for a specific task/rollout. Called by Atropos environments before the agent loop to configure per-task sandbox settings (e.g., a custom Dockerfile for the Modal image). Supported override keys: - modal_image: str -- Path to Dockerfile or Docker Hub image name - docker_image: str -- Docker image name - cwd: str -- Working directory inside the sandbox Args: task_id: The rollout's unique task identifier overrides: Dict of config keys to override rN) rrBrrrCr_resolve_container_task_id _env_lockryrtr)rrnew_cwd container_idenvs rregister_task_env_overridesrs: $- mmE""G'3 GMMOO  7G,,, 2'::  ^ ^&**733]7K7O7OP\7]7]C ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ?wsE488DCGGG     ?DDs/5B00B47B4ct|dt|t5t|dddddS#1swxYwYdS)z Clear environment overrides for a task after rollout completes. Called during cleanup to avoid stale entries accumulating. N)rrr_container_alias_lock_container_aliasesrs rclear_task_env_overridesrs GT***g ..w---..................sAA"Ar child_task_idparent_task_idc|sdSt5t|pdt|<ddddS#1swxYwYdS)a&Make *child_task_id* resolve to *parent_task_id*'s container. Called by ``delegate_task`` at child spawn so subagents share the parent session's sandbox under per-session container isolation. A missing/empty parent id aliases the child to ``"default"`` (top-level CLI parent). Nr)rrr)rrs rregister_container_aliasrs  MM,/0K),L,L=)MMMMMMMMMMMMMMMMMMs 377ct}|}t5|tvr3||vr/||t|}|tvr||v/dddn #1swxYwY|S)uAFollow the child→parent alias chain (cycle-safe) for *task_id*.N)setrradd)rseenrs r_resolve_container_aliasrs 55D C **'''CtOO HHSMMM$S)C'''CtOO*************** Js=A!!A%(A%cttjdddkrdStjdddvS)aTrue when docker sessions get their OWN containers (issue: stale workspace mounts leaking between desktop sessions). Gated on ``terminal.backend: docker`` + ``container_persistent: false``: a non-persistent sandbox is a statement that state must not survive the session, so sharing one container across sessions contradicts it. With ``container_persistent: true`` the documented ONE-long-lived-container contract is unchanged. rCrDrFTERMINAL_CONTAINER_PERSISTENTrE>ryesrE)_ensure_terminal_env_bridgedr!r"rrvrr!_docker_session_isolation_enabledr&sQ!""" y))X55u 94f = = C C E EMa aar>r modal_image docker_image daytona_imagesingularity_imagec|r |tvrdSttt|tzS)uTrue when *task_id* registered backend-image/env_type overrides. The single owner of the "is this an RL/benchmark-style isolated rollout" predicate — shared by container-key resolution and container creation so the two can't drift. F)rrJrkeys_ISOLATION_OVERRIDE_KEYSrs r_has_isolation_overridesr<sJ g%888u '0557788;SS T TTrcj|rt|r|S|rtrt|SdS)uE Map a tool-call ``task_id`` to the container/sandbox key used by ``_active_environments``. The top-level agent passes ``task_id=None`` and lands on ``"default"``. ``delegate_task`` children pass their own subagent ID so that file-state tracking, the active-subagents registry, and TUI events stay distinct per child -- but we deliberately collapse that ID back to ``"default"`` here so subagents share the parent's long-lived container (one bash, one /workspace, one set of installed packages). Exception: RL / benchmark environments (TerminalBench2, HermesSweEnv, ...) call ``register_task_env_overrides(task_id, {...})`` to request a per-task Docker/Modal image. When an override is registered for a task_id, we honour it by returning the task_id unchanged -- those rollouts need their own isolated sandbox, which is the whole point of the override. CWD-only overrides (registered by the ACP adapter for workspace tracking) are *not* isolation signals — they should not cause each session to spin up its own container. Only overrides containing backend-specific image keys or ``env_type`` trigger isolation. Per-session container isolation (docker + ``container_persistent: false``): each session's task_id is its own container key, so a fresh chat gets a fresh sandbox with only ITS mounts — a previous session's workspace can no longer appear in a new session's container. ``delegate_task`` children keep sharing the parent's container via the alias registry (``register_container_alias``). r)rrrrs rrrHsJ>+G4414661'000 9rc|pd}t|p(tt|piS)aReturn the env overrides for *task_id*, raw key first then collapsed. ``register_task_env_overrides`` writes under the *raw* task/session id, but a CWD-only override collapses (:func:`_resolve_container_task_id`) to the shared ``"default"`` container so per-session surfaces (ACP/gateway/ dashboard) don't each spin up their own sandbox. Callers that need the override (terminal command setup, file-tool cwd resolution) must therefore read the raw id FIRST and only fall back to the collapsed container id, or the originating session's override is silently dropped. This is the single source of that lookup so the terminal and file layers can't drift apart. r)rrBr)rr)s rresolve_task_overridesrnsK  YC$$   " "#=c#B#B C C  rc|ddkrdS|dsdSts|dSt|dkr|dSt|}|ddkrdS|d }t |t r|sdStj tj |}tj |sdS| d rdS|S) uHost directory to bind-mount at ``/workspace`` for *task_id*'s container. The single owner of the cwd-mount policy, shared by every environment creation site (terminal tool, file tools, execute_code, lazy bring-up): * Shared-container mode (the default): the process-global ``TERMINAL_CWD``-derived ``config["host_cwd"]`` — unchanged legacy behavior, ONE container whose mount tracks the configured workspace. * Per-session isolation mode (docker + ``container_persistent: false``): only the SESSION's own registered workspace may mount. The process env var is a launch artifact — the TUI/desktop workspace picker writes ``os.environ["TERMINAL_CWD"]`` and it outlives the session that set it, so deriving a fresh session's mount from it leaks the previous session's directory into a chat that never attached one. Overrides tagged ``cwd_source: "process"`` (gateway fallback to the global env var) are likewise refused as mount sources; only a workspace the user actually attached to THIS session (``cwd_source: "session"`` or an untagged override from ACP/RL surfaces) mounts. rrNrrr cwd_sourceprocessr /workspace/root) rBrrrrrrCr!rjabspath expanduserisdirr)r6rr candidates r_resolve_task_host_cwdrsA(zz*))t ::5 6 6t , . .&zz*%%%!'**i77zz*%%%&w//I}}\""i//t e$$I i % %Y__->->t 2 29 = =>>I 7== # #t344t rr(c tj||} ||S#ttjf$rtd|d|d|dwxYw)zParse an environment variable with *converter*, raising a clear error on bad values. Without this wrapper, a single malformed env var (e.g. TERMINAL_TIMEOUT=5m) causes an unhandled ValueError that kills every terminal command. zInvalid value for : z (expected z1). Check ~/.hermes/.env or environment variables.)r!r"r$jsonJSONDecodeErrorr's r_parse_env_varrs )D' " "C y~~ , -    > > > > >: > > >    s "0Ac tjS#t$r6tjdptjdcYSwxYw)amReturn the current working directory, tolerating a deleted CWD. ``os.getcwd()`` raises FileNotFoundError when the process's working directory has been removed out from under it (e.g. a scratch workspace that was cleaned up mid-session). Fall back to TERMINAL_CWD, then the user's home directory, so terminal setup never crashes on a stale CWD. TERMINAL_CWDr)r!getcwdFileNotFoundErrorr"rjrrvrr _safe_getcwdrs^Dy{{ DDDy((CBG,>,>s,C,CCCCDs=AA)z/Users/z/home/zC:\zC:/>modalrdaytona singularityvercel_sandboxcsdStfdtDrdStjsdSdS)aReturn True if *cwd* is a host/relative path that won't work as the working directory inside a container sandbox. A container's cwd must be an absolute path that exists *inside* the sandbox (e.g. ``/workspace`` or ``/root``). A host path (``/home/user``, ``C:\Users\me``) or a relative path (``.``, ``src/``) is meaningless to ``docker run -w`` and makes the container fail to start (exit 125). Fc3BK|]}|VdSr3r)rprs rrz-_is_unusable_container_cwd..s/ 9 93>>!   9 9 9 9 9 9rT)r_HOST_CWD_PREFIXESr!rjisabs)rs`r_is_unusable_container_cwdrs_ u 9 9 9 9&8 9 9 999t 7==  t 5rcHtrdSda ddlm}m}|}t |dt }|r|dddSdtjvr|dddSdS#t$r t d d YdSwxYw) u-Backfill TERMINAL_* env vars from config.yaml when no launcher did. terminal_tool reads ALL terminal settings from os.environ (TERMINAL_*). The CLI (cli.py ``env_mappings``), the gateway (gateway/run.py ``_terminal_env_map``), and TUI/dashboard PTY launches (``apply_terminal_config_to_env``) bridge ``terminal.*`` config into env vars at startup — but processes that skip all of those paths (``hermes serve`` / the Desktop app backend's in-process agents, the desktop cron ticker, ACP) used to silently fall back to the local backend even when config.yaml selects ``terminal.backend: docker``, running commands on the host the user intended to sandbox (#63141, #54449, #61115, #65696). Explicit terminal config keys win: when config.yaml has a ``terminal`` section, each key present there overrides its matching env value (which may be stale from ``hermes setup``). Environment values for omitted terminal keys are preserved. When no terminal section exists, exported/.env values keep working unchanged. NTr)apply_terminal_config_to_envread_raw_configterminal)roverriderCFu.terminal config → env fallback bridge failedrX) !_terminal_config_bridge_attemptedhermes_cli.configrrrrBdictr!rrer%rc)rr raw_confighas_terminal_sections rrrs()(,%VSSSSSSSS%_&& )*..*D*DdKK  C ( (TD A A A A A A 2: - - ) (TE B B B B B B. - VVV  EPT UUUUUUVsA A7A77&B! B!cD d}ttjdd}tjdddv}|dv}|dk}|r8t d d t d }t d d }t dd}nd}d}d}|rt ddt jd}t ddt jd} t ddt jd} t ddt jd} tjdd} n g}g} i} g} d} |dkrt} n|dkrd} n|dkrt} nd} tjd | }d!d"l m }|r+|||stj |}d#}|dkr|rtjd p t}tj tj |tfd$t DsStj r8tj rd%s}d&}n?|t(vr6|r4t+|r%|| krt,d'||| | }id(|d)t1tjd*d+d,tjd-|d.|d/tjd0d1|d2tjd3|d4tjd5|d6tjd7d8d9|d:|d;|dd?t d@dAdBtjdCd8dDtjdEd8dFt dGdHdItjdJd8tjdKtjdLdMdvtjdNddv|||tjdOdMdv| | tjdPddvtjdQdMdv| | tjdRdMdvtjdSdMdvdTS)UzBGet terminal environment configuration from environment variables.*nikolaik/python-nodejs:python3.11-nodejs20rCrD&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACEfalse>rrrE>rrrrrrTERMINAL_CONTAINER_CPUrr.TERMINAL_CONTAINER_MEMORY5120TERMINAL_CONTAINER_DISK51200g?r:TERMINAL_DOCKER_FORWARD_ENVz[]z valid JSONTERMINAL_DOCKER_VOLUMESTERMINAL_DOCKER_ENVz{}TERMINAL_DOCKER_EXTRA_ARGSTERMINAL_DOCKER_SHM_SIZE1gsshrrrrr)_is_ssh_remote_tilde_cwdNc3BK|]}|VdSr3r)rrrs rrz"_get_env_config..`s1DDA $$Q''DDDDDDrrrzeIgnoring TERMINAL_CWD=%r for %s backend (host/relative path won't work in sandbox). Using %r instead.r modal_modeTERMINAL_MODAL_MODEautorTERMINAL_DOCKER_IMAGEdocker_forward_envrTERMINAL_SINGULARITY_IMAGE docker://rTERMINAL_MODAL_IMAGErTERMINAL_DAYTONA_IMAGEr8TERMINAL_VERCEL_RUNTIMEr rrrrTERMINAL_TIMEOUT180lifetime_secondsrrssh_hostTERMINAL_SSH_HOSTssh_userTERMINAL_SSH_USERssh_portTERMINAL_SSH_PORT22ssh_keyTERMINAL_SSH_KEYTERMINAL_SSH_PERSISTENTTERMINAL_PERSISTENT_SHELLrETERMINAL_LOCAL_PERSISTENTr TERMINAL_DOCKER_RUN_AS_HOST_USERTERMINAL_DOCKER_NETWORK(TERMINAL_DOCKER_PERSIST_ACROSS_PROCESSESTERMINAL_DOCKER_ORPHAN_REAPER)ssh_persistentlocal_persistent container_cpucontainer_memoryr9container_persistentr docker_envdocker_run_as_host_userdocker_networkdocker_extra_argsdocker_shm_sizedocker_persist_across_processesr~)rr!r"rrfloatrloadsr_VERCEL_SANDBOX_DEFAULT_CWDrrrjrrrrrrr_CONTAINER_BACKENDSrr%rrrC) default_imagermount_docker_cwdcontainer_backenddocker_backendr r!r9rrr#r&r' default_cwdrrrdocker_cwd_sourcers @r_get_env_configr3"sAM """y11Hy!I7SSYY[[_ss $cc)N &'?eXVV )*EvNN'(A7KK  +,I4QUQ[]ijj'(A4Uabb#$94\ZZ *+Gtz[ghh)$>EE  7"nn U   % % %1  )NK 0 0C:::::: &++Hc::&g  %%H8 0In55GGOOBG$6$67H$I$IJJ DDDD1CDDD D D  i(( -/W]]9-E-E NWNbNbczN{N{ !HC ( ( (S ( %c * * sk/A/A KKXX{ 4 4 4C7 H7 ' 2G(P(PQQ7   "9=II7  0 7  RY'CE`Q^E`E`aa 7  ry!7GG 7  #;]KK7  ")$=rBBHHJJ7  s7  H7  ()97  >"4e<<7  N+FNN7  BI12667  BI1266!7 " N#6==#7 $ 29/44%7 ,) % I16 : :   %'')*I&A7KKQQSSWkk',( " *I6 R R X X Z Z^r r( #%9-OQX#Y#Y#_#_#a#aey#y)$=vFFLLNNRff.*,.9 6, , %''),*!# +V! ! %'')!*i7 7 7 7rrcXt|ttdS)z2Resolve direct vs managed Modal backend selection.r) has_direct managed_ready)rrrx)rs r_get_modal_backend_stater7s0 &/113G<<   rc|dd|dd|dd|dd|ddd S) aBuild the ``ssh_config`` dict passed to :func:`_create_environment`. Shared by the terminal tool's own get-or-create path and the lazy :func:`ensure_task_env` bring-up so both derive SSH connection settings from the resolved config identically. rr rrrrF)hostuserportr persistentrBrs r_ssh_config_from_configr?si :r** :r** :r**zz)R((jj!1599   rcid|ddd|ddd|ddd|ddd |d d d |d d d |d gd|ddd|dgd|did|ddd|dgd|ddd|ddd|ddd|ddS)zBuild the ``container_config`` dict passed to :func:`_create_environment`. Shared by the terminal tool's own get-or-create path and the lazy :func:`ensure_task_env` bring-up (see :func:`_ssh_config_from_config`). r rr!rr9r:r"Trrr8r rrFrr#r$r&r'rr%r(r~r>rs r_container_config_from_configrAs  OQ77 FJJ'94@@  &**%5u==   +A4 H H   fjjv66   &**%5r::   &**%5r::  (4SUZ)[)[  fjj)=rBB  fjjr22  "6::.G#O#O  VZZ(;R@@  6::&7>>  &**%5t<<  *6::6WY]+^+^   +A4 H H! rimager ssh_config local_configrc |pi} | dd} | dd} | dd} | dd} | d g}| d g}| d i}| d g}| d d}|dkrt||S|dkrt| to|dkot | }t dOid|d|d|d| d| d| d| d|d|d|d| ddd|d |d!| d"dd#|d$|d%|rdn| d&dd'| d(d)}|r d|_n#t$rYnwxYw|S|d*krt|||| | | | |+S|d,krXi}| d-kr| |d<| d-kr| |d<| d-krE d-d.l }d-d.l }d/| |j j jvr| |d/<n#t$rYnwxYwt!| d0}|d1d2krt#||||| |3S|d1d4kr|d5r"t%d6t'd7zd8z|d9d2krt%d:t'd7z|d9d4krt%d;d<}t)rd=}t%|t+||||| |3S|d>kr&d-d?lm}||||t1| | | | |+S|d@kr.d-dAlm}|| dBpd.||| | | | |CS|dDkr|r*|dEr|dFst%dGt7|dE|dF|dHdI|dJdK||LSt%dM|dN)Pa Create an execution environment for sandboxed command execution. Args: env_type: One of "local", "docker", "singularity", "modal", "daytona", "vercel_sandbox", "ssh" image: Docker/Singularity/Modal image name (ignored for local/ssh/vercel) cwd: Working directory timeout: Default command timeout ssh_config: SSH connection config (for env_type="ssh") container_config: Resource config for container backends (cpu, memory, disk, persistent) task_id: Task identifier for environment reuse and snapshot keying host_cwd: Optional host working directory to bind into Docker when explicitly enabled Returns: Environment instance with execute() method r rr!rr9r:r"Trrr#r&r%rD)rrrrrBrrcpumemoryrLpersistent_filesystemrvolumesrauto_mount_cwdrF forward_envrrun_as_host_userr$network extra_argspersist_across_processesr(shm_sizer'rr)rBrrrFrGrLrHrrrNephemeral_diskrselected_backendmanaged)rBrrmodal_sandbox_kwargsrHrdirectmanaged_mode_blockedzModal backend is configured for managed mode, but Nous Tool Gateway access is not currently available and no direct Modal credentials/config were found. managed Modal executionzH Choose TERMINAL_MODAL_MODE=direct/auto to use direct Modal credentials.modez[Modal backend is configured for managed mode, but the managed tool gateway is unavailable. z_Modal backend is configured for direct mode, but no direct Modal credentials/config were found.zHModal backend selected but no direct Modal credentials/config was found.z`Modal backend selected but no direct Modal credentials/config or managed tool gateway was found.r)DaytonaEnvironmentr)VercelSandboxEnvironmentr8)r1rrrFrGrLrHrrr:r;z?SSH environment requires ssh_host and ssh_user to be configuredr<r9rr )r:r;r<key_pathrrzUnknown environment type: zV. Use 'local', 'docker', 'singularity', 'modal', 'daytona', 'vercel_sandbox', or 'ssh'rv)rB_LocalEnvironmentrrr_DockerEnvironment_session_scopedAttributeError_SingularityEnvironmentinspectr signatureSandboxcreate parametersrer7_ManagedModalEnvironmentr$rr_ModalEnvironmenttools.environments.daytonarYr!tools.environments.vercel_sandboxrZ_SSHEnvironment)rrBrrrCr|rDrrccrFrGrLr=rIrr#r&r%session_scopeddocker_env_objsandbox_kwargsrar modal_statemessage_DaytonaEnvironment_VercelSandboxEnvironments r_create_environmentrssl,  RB &&! $ $C VV& - -F 66"E * *D.55Jff%r**G 4b99 b))J2B77VV,d33N7 S':::: X   #2&&& . / / 69$ 6,W555  ,   %  S *1'  "F )- #-* 7>g G  X  66"A5III  +*    VV$=uEEE #N )( (EVV=tDD VV-t444! ,   15..!     ] " "&S'F",g    W   77$'N5 ! A::'-N8 $ !88 %%%%%%%%#w'8'89M'N'N'YYY7;N#34    /rvvl/C/CDD ) *i 7 7+g%3&0'  ) *h 6 612  <<1 a a6"i// q;1 6"h.. uaG)++ vW%% % S'!/",g    Y  XXXXXX""S'Cd",g    % % %      )(FF+,,4",     U   `!7!7 `z~~f?U?U `^__ _F#F#++^^E2..      M M M M   s$2F:: GG3I IIrr ctj} ddlm}ttD]!}||r |t|<"n#t$rYnwxYwg}t5tt D]]\}}||z |krOt |d}t |d|| ||f^t5|D] \}}t |d! dddn #1swxYwYdddn #1swxYwY|D]+\}} ddlm}||n#t$rYnwxYw t#|dr|nIt#|dr|n$t#|dr|t*d|#t.$rl} t1| } d | vsd | vrt*d |nt*d || Yd} ~ %d} ~ wwxYwdS) zOClean up environments that have been inactive for longer than lifetime_seconds.rprocess_registryNclear_file_ops_cachecleanupstop terminatez,Cleaned up inactive environment for task: %s404 not found*Environment for task %s already cleaned up-Error cleaning up environment for task %s: %s)rZtools.process_registryrvlistrzrhas_active_processesrritemsryrr_creation_locks_lockr{tools.file_toolsrxhasattrryrzr{r%rrerrr&) r  current_timervr envs_to_stop last_timerr^rxrl error_strs r_cleanup_inactive_envsrsq9;;L ;;;;;;N//1122 7 7G44W== 7*6w' 7      L  3 3"&~';';'='=">"> 8 8 GYi'*:::*..w==""7D111? ''#777" 3 3* 3 3 ##GT2222 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3%\\   = = = = = =  ) ) ) )    D  \sI&&  f%%  k**   KKF P P P P \ \ \AI !![IOO4E4E%E%E H'RRRRNPWYZ[[[  \'\\suAA$$ A10A1=B E $D:. E:D> >ED> EEE%E77 FFB H JA!JJc6tr t}t|dn4#t$r'}td|dYd}~nd}~wwxYwt dD]}tsntjd tdSdS)zKBackground thread worker that periodically cleans up inactive environments.r zError in cleanup thread: %sTrXNrr) _cleanup_runningr3rrer%r&rangerZr)r6rlr^s r_cleanup_thread_workerrs   L$&&F "6*<#= > > > > L L L NN8!dN K K K K K K K K Lr  A#  JqMMMM      s#- AAAct5tts6dat jt datddddS#1swxYwYdS)z;Start the background cleanup thread if not already running.NTr )r_cleanup_threadis_aliverrrrrrvrr_start_cleanup_threadrs $$  "/*B*B*D*D "# '.6LUYZZZO  ! ! # # # $$$$$$$$$$$$$$$$$$sAA,,A03A0cdat6 tddS#ttf$rYdSwxYwdS)z#Stop the background cleanup thread.FNr )rrrD SystemExitrrvrr_stop_cleanup_threadrsb"    + + + + +-.    DD #"s (==ct|}t5t|pt|cdddS#1swxYwYdS)z9Return the active BaseEnvironment for *task_id*, or None.N)rrryrB)rlookups rget_active_envrs ' 0 0F UU#''//T3G3K3KG3T3TUUUUUUUUUUUUUUUUUUs4AAAct}|d}|dkrdSt|}t|}|F%>O>O26:::UY #6662&999<@!)/@@   GG    NNA+BQB/   4441!!!!!!!!&  < <6= !2 304 N, - < < < < < < < < < < < < < < <  ; '+   C!!!!!!!!!!!!!!!!!!sA..A25A21-E**E.1E.7J6AG87J68 H=%H8'J68H== J6&I9- J69I= =J6I= (J66J:=J:ct|}|dSt|ddrdStt|ddS)u,Return True if the active environment for task_id is configured for cross-turn persistence (``persistent_filesystem=True``). Used by the agent loop to skip per-turn teardown for backends whose whole point is to survive between turns (docker with ``container_persistent``, daytona, modal, etc.). Non-persistent backends (e.g. Morph) still get torn down at end-of-turn to prevent leakage. The idle reaper (``_cleanup_inactive_envs``) handles persistent envs once they exceed ``terminal.lifetime_seconds``. Session-scoped docker containers (per-session isolation mode) also count as persistent HERE: their lifetime is the SESSION, not the turn — they are removed by ``AIAgent.close()`` → ``cleanup_vm`` at session teardown and by the idle reaper, not per-turn. NFr^T _persistent)rrtrJ)rrs ris_persistent_envrXsO  ! !C {us%u--t ]E22 3 33rcttt}d}|D]L} t||dz }#t$r(}t d||dYd}~Ed}~wwxYwt}ddl}|t|dz D]g} tj |dt d |5#t$r&}t d ||Yd}~`d}~wwxYw|dkrt d ||S) z3Clean up ALL active environments. Use with caution.rrzError cleaning %s: %sTrXNrV) ignore_errorszRemoved orphaned: %sz%Failed to remove orphaned path %s: %szCleaned %d environments)rryr cleanup_vmrer%rErr]rshutilrmtreerrbrc)task_idscleanedrrlrhr]rjs rcleanup_all_environmentsrrs(--//00HGMM M w    qLGG M M M LL0'1tL L L L L L L L L M#$$KKKK #kJ67788KK K M$d 3 3 3 3 KK. 5 5 5 5 K K K LL@$ J J J J J J J J K{{ -w777 Ns/A A5 A00A521C$$ D.DD force_removercd}t5t|d}t|ddddn #1swxYwYt5t |ddddn #1swxYwY ddlm}||n#t$rYnwxYw|dS t|drSddl }| |j }d|j vr| |n^| nIt|dr|n$t|dr|t d |dS#t$$rr}t'|}d |vsd |vrt d |n"t d ||Yd}~dSYd}~dSd}~wwxYw)u$Manually clean up a specific environment by task_id. *force_remove* (default False) is forwarded to backends that accept it — currently only ``DockerEnvironment``. The default of False matches session-lifecycle semantics: this function is called from ``AIAgent.close()`` (TUI session close, gateway session teardown) and the per-turn cleanup branch for non-persistent envs, both of which should honor the user's persist-mode preference. Stopping the container here would defeat the "ONE long-lived container shared across sessions" contract — exactly the bug Ben reported when the container was killed on every TUI session close. Pass ``force_remove=True`` for actual user-initiated teardown (e.g. ``/reset``-style flows that haven't been wired yet, or future "destroy my sandbox" commands). The idle reaper passes the env through ``env.cleanup()`` directly (not via this function), so persist-mode idle envs are similarly no-op'd — only the orphan reaper at next startup reclaims them. Nrrwryrrrzr{z,Manually cleaned up environment for task: %sr|r}r~r)rryrrzrr{rrxrrrarbryrerzr{r%rrerrr&)rrrrxrasigrlrs rrrs0 C **"&&w557D)))*************** ++GT***+++++++++++++++ 999999W%%%%       {X 3 " "  NNN##CK00C//  6666 S& ! !  HHJJJJ S+ & &  MMOOO BGLLLLL XXXFF I   0A0A!A!A KKDg N N N N NNJGUV W W W W W W W W W O N N N N NXsO7A  AABB B B%% B21B2:CF G? A!G::G?cttrtt}td|t t}t|D]W}t|dd}| |d$#t$r%}t d|Yd}~Nd}~wwxYwdSdS)zBStop cleanup thread and shut down all remaining sandboxes on exit.z)Shutting down %d remaining sandbox(es)...wait_for_cleanupNg.@r z#wait_for_cleanup raised on exit: %s) rryrr%rrvaluesrrtrerc)rA envs_to_waitrwait_fnrls r_atexit_cleanuprs G()) ?GGG07799::  """   G GCc#5t<>( # # <     4rnotify_on_complete backgroundc"|r |r|rd}d|fS|dfS)uKDecide what to do when both notify_on_complete and watch_patterns are set. These flags produce duplicate, delayed notifications when combined — one notification per watch-pattern match AND one on process exit, with async delivery that can spam the user long after the process ends. When both are set, we drop watch_patterns in favor of notify_on_complete (the more useful "let me know when it's done" signal) and return a human-readable note. Returns: (watch_patterns_to_use, conflict_note). conflict_note is "" when there is no conflict. zuwatch_patterns ignored because notify_on_complete=True; these two flags produce duplicate notifications when combinedNr rv)rwatch_patternsrnotes r#_resolve_notification_flag_conflictr s=$(^ L Tz 2 r)rrr1c|r|St|}|r7|tvr.t|rtd||||S|p|S)uReturn the cwd for a command. Explicit ``workdir=`` overrides everything. Otherwise the session's own cwd RECORD (``get_session_cwd``) wins — it is written after every completed command for this session, so it IS the session's ``cd`` state, with no shared-env ambiguity: another session's ``cd`` lands in another record and can't affect us. A session with no record yet (first command) runs in ``default_cwd`` (config/override cwd), which is also what seeds a fresh environment. ``env_type`` makes the record container-aware: on container backends a recorded HOST path (a desktop/TUI surface registering its host workspace via ``register_task_env_overrides`` → ``record_session_cwd``) is unusable inside the sandbox — the shell prefixes every command with ``cd `` and fails with exit 126. Same guard class as the env-creation sanitizers (#50636, #54447); this is the per-command sibling site. zmIgnoring recorded session cwd %r for %s backend (host/relative path won't work in sandbox). Using %r instead.)rr,rr%r)rr1rrrecordeds r_resolve_command_cwdr sz.{++H  + + + &x 0 0 ,   L h      "{"r session_idrptyrc %fgh t|ts]tdt |jt jdddt |jdddSt} | d } t|} t|} | d kr| d p| d }nn| d kr| d p| d }nJ| dkr| dp| d}n&| dkr| dp| d}nd}| dpt|p| d}t| |}| tvr@t|r1|rdn| d}||krtd|| ||}| d}||dkrt#d|dS|p|}|s(|r&|t$krt#d|dt$dS|s,t'|}|rt jdd|dddSt)dgt*5| t,vr| n|r |t,vr|nd}|+t/jt0|<t,|gd}nd}dddn #1swxYwY|r.t25| t4vrt7jt4| <t4| }dddn #1swxYwY|5t*5| t,vr| n|r |t,vr|nd}|*t/jt0|<t,|gd}dddn #1swxYwY|r\| d krt;td| | dd | d krt=| nd}| tvrt?| nd}d}| d!krd"| d#di}tA| ||||||| |$ }nO#tB$rB}t jddtEd%|d&d'ddcYd}~cdddSd}~wwxYwt*5|t,| <t/jt0| <|gdddn #1swxYwYtd(| | dddddn #1swxYwYgJdd)l#m$}|d*p|pd}tJj& d+d,krdd-l'm(fm)}m*} | |rt jdd.d/dddSt|}!|!tWgddp|}!tY||!|| 0hd1td2tZtffghfd3 }"||h|"4rt jdd.d5dddS|r]t]|}#|#rLtd6|dd7t_|t jdd|#d8ddS| d!krldd9l0m1}$tY|||:h|$|h\}%}&|%rCtd;t_|t jdd.|&d8ddSd}'te|}(|sutg|| ti| <})|)d=s|) d>d?krt jdddd?d|) d@||) dAdB|) dCd|) dDd|) dEddF dS|) dAdB}*dG|*dH}+t jdd|) dI|+d8ddS|) dJr|) dAdK}*dL|*dM}'d}(n1|) dNr|) dAdK}*dO|*dP}'d},|}-|rtk|rd}-dQ},|rddRl6m7}.tY|||| 0}/ | d!kr3|.8||/| |tsgdSrgj:nd|-T}0n|.;g||/| |U}0dV|0j<|0j=dddW}1|'r|'|1dX<|,r|,|1dY<|r |s| sdZ|1d[<|rG|rEd\|vpd]|v}2d^|vpd_|vpd`|v}3da|vp|2o|3}4|4r'|1 d[d}5db}6|5r|5dcz|6zn|6|1d[<|r|s| rdddl>m?}7m@}8|7s/d}d} d|1de<df|1dg<tdh|0j<nt|8did}9|9rf|8djd}:|8dkd};|8dld}<|8dmd}=|8dnd}>|9|0_A|:|0_B|<|0_C|=|0_D|;|0_E|>|0_Ftte|| te|o\} }?|?r&tdp|0j<|?|?|1dq<|rd|rbd|0_Hd|1de<|0jArOdr|0_I|.jJK|0j<dr||0jA|0jB|0jC|0jD|0jE|0jFdds | r |rt| |0_M|0jM|1dt<t j|1dS#t$r4}t jddtEdu|dvdcYd}~Sd}~wwxYwdw}@d}Ad}Bd}C|(rddxlOmP}D|D|A|@krs tY|||| 0}C||Cddy}EgjQ|fi|E}BnH#t$r:}t|R}Fd|Fvr#t jddzd{|d|dvdcYd}~S|A|@krd|Ad.z }Ad}|Az}Gtd~|G|A|@t_|t |j|| | t/jS|GYd}~tTd|@t_|t |j|| | t jddtEdt |jd|dvdcYd}~Sd}~wwxYw |st|tWgdd|B dd}H|B dd}I|B d}J|B d}Kt|H| }Ht|H}Lt||H}M|Mr&tdu}N|Nstdr|Hdz }H ddl[m\}O|Od||H|I| pd| }P|PD]}Qt|Qtr|Q}Hnn#t$rYnwxYwddl]m^}R|R}St|H|Skr[t|Sdz}T|S|Tz }Ut|H|Tz |Uz }Vd|Vdt|Hd}W|Hd|T|Wz|H|U dz}Hddlamb}X|X|H}Hddlcmd}Y|Hr|Y|He|nd}Ht||I}Zd}[|Idkr)|Zs' ddlgmh}\|\||I|H}[n#t$rd}[YnwxYw|H|Iddv}] tWgdd}^|^rn|CrltJjijt|^tJjijt|Ckrt|^|]d<n#t$rYnwxYw|Kr t|K}_|_ldd}`|_m|Y|X|`|dd|J|]d<|K|]d<d|Jdd|Kd|]d<n_#t$rRtndd t|Kon#t$rYnwxYwYnwxYw ddlqmr}a|a||C|p|p| pd|I|H}b|brV|b d>|b d|b d|b dd|]d<n,#t$rtnddYnwxYw|'r+|Idkr d|Hvr|'sddz|]dX<n|'|]dX<|Zr|Z|]d<|[r|[|]d[<|Lrd|]d<|Mrd|]d<t j|]dS#t$rF}tKjuddeR}c|cdkrqddlv}d|dw}etTd|et jddtEd|tE|edddcYd}~Std|jx t|n,#t$rtnddYnwxYwt jddd|jx|jzd|jxddcYd}~Sd}~wt$rv}ddlv}d|dw}etTd|et jddtEd|tE|edddcYd}~Sd}~wwxYw)u| Execute a command in the configured terminal environment. Args: command: The command to execute background: Whether to run in background (default: False) timeout: Command timeout in seconds (default: from config) task_id: Unique identifier for environment isolation (optional) session_id: Conversation/session identifier for durable observability force: If True, skip dangerous command check (use after user confirms) workdir: Working directory for this command (optional, uses session cwd if not set) pty: If True, use pseudo-terminal for interactive CLI tools (local backend only) notify_on_complete: If True and background=True, you'll be notified exactly once when the process exits. The right choice for almost every long task. MUTUALLY EXCLUSIVE with watch_patterns. watch_patterns: List of strings to watch for in background output. HARD rate limit: 1 notification per 15s per process. After 3 strike windows in a row, watch_patterns is disabled and the session is auto-promoted to notify_on_complete. Use ONLY for rare, one-shot mid-process signals on long-lived processes (server readiness, migration-done markers). NEVER use in loops/batch jobs — error patterns there will hit the strike limit and get disabled. MUTUALLY EXCLUSIVE with notify_on_complete — set one, not both. Returns: str: JSON string with output, exit_code, and error fields Examples: # Execute a simple command >>> result = terminal_tool(command="ls -la /tmp") # Run a background task >>> result = terminal_tool(command="python server.py", background=True) # With custom timeout >>> result = terminal_tool(command="long_task.sh", timeout=300) # Force run after user confirmation # Note: force parameter is internal only, not exposed to model API z+Rejected invalid terminal command value: %sr r2z&Invalid command: expected string, got rE)rrrEstatusF) ensure_asciirrrrrrrrrrrzbRemapping host/relative cwd override %r for %s backend (won't exist in sandbox). Using %r instead.rNrz2timeout must be a positive number of seconds (got z).zForeground timeout zs exceeds the maximum of zNs. Use background=true with notify_on_complete=true for long-running commands.Tz*Creating new %s environment for task %s...rrrDr=rrz5Terminal tool disabled: environment creation failed (r7disabledz %s environment ready for task %s)get_current_session_key)r_HERMES_GATEWAYr)_MAX_REFERENCED_SCRIPT_BYTES7contains_gateway_lifecycle_command_or_referenced_script!contains_launchctl_submit_commandrzBlocked: launchctl submit/bootstrap registers a persistent KeepAlive job and is unsafe from inside the gateway process. Use Hermes cron for one-shot delayed work, or install an explicit LaunchAgent from a separate shell.)rr1rr script_pathr cdS t|}|st|z }|r||}t j|jrO|jkrD|}t|krd|vrdS| ddSn#t$rYnwxYw  ddzdtj|}|d d d kr |d d }|rd|vrdS|Sn#t$rYnwxYwdS)aTBest-effort script read; uses env.execute only when local read fails. For local backends the script path is on the host filesystem. For SSH/Modal/Daytona the same path is remote; the local read misses, so we fall back to a bounded ``env.execute('head -c ... < path')`` read. Nrrrzhead -c rz < rLr2rrr )rr is_absoluter_r`S_ISREGst_modera read_bytesrrreexecuteshlexquoterB) r local_pathmetadatadatarSrrr guard_cwds r_read_script_in_envz*terminal_tool.._read_script_in_env s;4!%k!2!2!=!=!?!?J%1133B%))__z%A !))++ N#-??#4#4<(899 Nh>NRn>n>n#-#8#8#:#:D"4yy,HHH#*d??,04'+{{79{'M'M M D  [[8#?!#C88"[5588Fzz,33q88!'Hb!9!9!(f&6&6$(4% 9!Dts1B>CC C,+C,0A&EE E('E()rread_remote_scriptaBlocked: command or referenced script cannot restart or stop the gateway from inside the gateway process. The gateway would kill this command before it could complete (SIGTERM propagates to child processes). Run `hermes gateway restart` from a separate shell outside the running gateway.z+Blocked dangerous workdir: %s (command: %s)rblocked)detect_self_repo_git_mutation)rr1rz,Blocked self-repo git mutation (command: %s))rapprovedrpending_approvalr descriptionzcommand flagged pattern_key smart_deniedallow_permanent) rrrErapproval_pendingrrrrrzCommand denied: z?. Use the approval prompt to allow it, or rephrase the command.rp user_approvedzflagged as dangerouszCommand required approval (z) and was approved by the user.smart_approvedzCommand was flagged (z&) and auto-approved by smart approval.zPTY disabled for this command because it expects piped stdin/EOF (for example gh auth login --with-token). For local background processes, call process(action='close') after writing so it receives EOF.rur)rrrrenv_varsuse_pty)rrrrrzBackground process started)rrpidrrErypty_noteubackground=true without notify_on_complete=true means this process runs SILENTLY — you will not be told when it exits. If this is a bounded task (test suite, build, CI poller, deploy, anything with a defined end), you almost certainly wanted notify_on_complete=true so the system pings you on exit. Re-launch with notify_on_complete=true, or call process(action='poll') / process(action='wait') yourself to learn the outcome. Only ignore this hint for genuine long-lived processes that never exit (servers, watchers, daemons).hintz gh pr viewz gh pr checksz jq z| jqz$(jqstatusCheckRollupuRThis looks like a homebrewed CI poller built from `gh pr view --json statusCheckRollup` and/or `gh pr checks | jq`. That shape has burned us repeatedly in hermes-agent dev work (PRs #31329, #31448, #31695, #31709, #31745, #32264, #33131) — stdout buffering kills output capture, jq null-key edge cases silently exit the loop, conclusion-vs-status field confusion exits early with bogus all-green verdicts, TTY-only summary banners never appear when piped. Use the canonical snippets in the green-ci-policy skill instead: the exit-code-driven `gh pr checks $PR >/dev/null` (rc 0 = green, 8 = pending, else fail) for exit-on-first-fail behavior, or the column-2 awk-on-tabs poller (`awk -F"\t" "$2==\"pending\""`) for sharded matrices. Load skill_view(name='github/hermes-agent-dev', file_path='references/green-ci-policy.md') for the verbatim snippets. If you must roll a custom loop with rich structured output, write each tick to a known file (`tee -a /tmp/ci.log`) and rely on `process(action='log')` to read THAT file — do not rely on background-process stdout capture for line-buffered shell loops.z )async_delivery_supportedrru\notify_on_complete / watch_patterns are not available in this session — it cannot receive an async completion after the turn ends (a one-shot runner such as `hermes -z`, a cron job, a Kanban worker, or a stateless HTTP endpoint). The process is running in the background; retrieve its result with process(action='poll') or process(action='wait').notify_unsupportedzjbackground proc %s: async delivery unsupported on this session; notify_on_complete/watch_patterns disabledHERMES_SESSION_PLATFORMHERMES_SESSION_CHAT_IDHERMES_SESSION_THREAD_IDHERMES_SESSION_USER_IDHERMES_SESSION_USER_NAMEHERMES_SESSION_MESSAGE_ID)rrrzbackground proc %s: %swatch_patterns_ignoredr) rcheck_intervalrrchat_iduser_id user_name thread_id message_idrrz$Failed to start background process: )rrrEr)clear_current_thread_interrupt)rrbounded_capture|zCommand timed out after z secondsrzfExecution error, retrying in %ds (attempt %d/%d) - Command: %s - Error: %s: %s - Task: %s, Backend: %szWExecution failed after %d retries - Command: %s - Error: %s: %s - Task: %s, Backend: %szCommand execution failed: rrrLoutput_total_charsfull_output_pathriuu ⚠️ Sudo authentication failed — cached password cleared. You will be prompted again on the next sudo command.) invoke_hooktransform_terminal_output)rrrLrr) get_max_bytesg?z ... [OUTPUT TRUNCATED - z chars omitted out of z total] ... ) strip_ansi)redact_terminal_output)annotate_failurerr)encodingrzCOutput exceeded the capture window (head+tail shown). Full output (,z chars) saved to u] — search it with search_files or page it with read_file instead of re-running the command.truncation_notez-spill redaction failed; dropping spill handlerX)record_terminal_resultr)rrrrrkindrcanonical_command)rr=rr>verification_evidencez&verification evidence recording failedz[Command interrupted].z, then interrupted.exit_code_meaningsudo_auth_failedsudo_cache_clearedTERMINAL_DEGRADED_MODEwarnfailzterminal_tool exception: %szFailed to execute command: )rrrE tracebackrzterminal backend degraded: %szdegraded-env eviction faileddegradedzTerminal backend degraded: )rrrreason retry_hintrE){rrr%r&rrrdumpsr3rrrBrrr,rrrFOREGROUND_MAX_TIMEOUTrrrryrZrzrr{rrror?rArsrrtools.approvalrr!rcron.lifecycle_guardrrrrtrrrrtools.self_repo_guardrrJrrrrrv spawn_localrr spawn_via_envrrrrrwatcher_platformwatcher_chat_idwatcher_user_idwatcher_user_namewatcher_thread_idwatcher_message_idrrwatcher_intervalpending_watchersrrrretools.interruptr.rrrrErrrrrwrhermes_cli.lifecycler3tools.tool_output_limitsr5rrtools.ansi_stripr6rr7rCrtools.terminal_hintsr8rjrealpathr read_text write_textrcunlinkrbagent.verification_evidencer<rstriprqr"rH format_excrJ_evict_environment_for_taskrK)irrrrrrrrrrr6rrrrBrrremappeddefault_timeouteffective_timeoutguidance _existing_keyneeds_creationrrCr|rDrrlrrrrguard_cwd_baser  workdir_errorr_self_repo_hit_self_repo_msg approval_note _approved_runrydesc fallback_msgpty_disabled_reason effective_ptyrv effective_cwd proc_session result_data_gh_has_jq _bad_shapercanonical_hint _async_ok_gse _gw_platform _gw_chat_id _gw_thread_id _gw_user_id _gw_user_name_gw_message_id conflict_note max_retries retry_countrS command_cwdr.execute_kwargsr wait_timerrLspill_total_charsspill_file_pathrCrDrmr3 hook_results hook_resultr5MAX_OUTPUT_CHARS head_chars tail_charsomittedtruncated_noticer6r7 exit_note failure_hintr8 result_dictpost_cwd_sp raw_spillr<evidence degraded_moderHtb_strrrr si @@@r terminal_toolr sBVN'3'' # NN=W &   :Z$w--BXZZ!  " ### #!""*% 7w??+733  x  MM.11KVN5KEE  & &MM"566U&AT:UEE  MM-00IF=4IEE  " "MM/22Mf_6MEEEmmE""Oog&>&>O&-*&':: * * */I#/N/N *'/B||VE]Hh B8 C +  7a<<PWPPP $6 g '4J*J*JFgFF)FFF  '6w??H 'z !#%% ## !& ''''    & &&7:N%N%N!!!(VW8L-L-LggRV (04 }-*=9!&!% & & & & & & & & & & & & & & &" = e% ? ?$O;;9B9I9IO$56+,=>  ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 6 e6 e//->BV-V-V)))0^W@T5T5TggZ^"%08< }52=A).///////////////"*e=001333KK LhXijlkljlXmnnn /HPTYHYHY%>>:&AAADH) (, #w.. ,fjj9KU.S.S,L#6%-"' #$5'1-=)5$5%- # # #'///#z&()+%@ \XY \ \ \&&'1 ++). / / //////S6 e6 e6 e6 e6 e6 e6 e6 eP/#&&BI,->?<@IKK'89%&&&&&&&&&&&&&&&KK BHN_`bab`bNcdddm6 e6 e6 e6 e6 e6 e6 e6 e6 e6 e6 e6 e6 e6 e6 ep ;:::::--b999Lgm  :>>+ , , 3 3           1099 'z !"F & # #!& ' ' ' '-[99N%!(eT!:!:!Ac,*'! I5 5 #5 5 5 5 5 5 5 5 nGF#6 ' z !"F & # #!& ' ' ' '  '-g66M 'L&tt}.CG.L.LNNNz !#*' ## !& '''' w   K K K K K K,'I .K-J.. *NN 'B)'22z !"+' ## !& '''' U ' e( 7 ? ?HJ' '<<))-???:"$%'!#"4,0#+<< 7#C#C'/||MCT'U'U'/||M2'F'F(0 ^U(K(K+3<<8I4+P+P ' '%* + + + + ||M3DEETtTTTz !#%\\)\BB' ## !& ''''||O,, e||M3IJJ cd c c c $ .// e||M3IJJ d d d d #  /88 !M   ? @ ? ? ? ? ?0'! M m 'w&#?#? ') 1$/,3C,?,?!IT - $@$$LL$4#A#A ') 1$/ $B$$L;"./'+!"!  !<.;K +&B.AK + &8   H 'T0'0'72On6OC')SVw->S&GBS,w6-  OG" #.??62#>#>='8CK0Hv->>!/$F+)M#5)M)M%9;;M-2*)-LL;1T'+,>'?'?#1#J//111- !JNN#;\_m\\\ > > > >,} 6{{--- !1C!788 - : f++ 2Z?;7;;!&kk;;;!  ,/??&*BVV 4 3 3 3 3 3Z''F < ; ; ; ; ;HNV++FLLNNGDDDTVF-WjAAI LQy(EEEEEE#3#3GZ#P#PLL (((#'LLL(!'K "3t447 70@0@X0O0OSUSZScScdghsdtdtSuSu0u0u),XK&     //C # wy Q QINN..zz)/D/DgNN!(#9JK 456EK 23L(9NLL*LLL 122 !LL!P[_L```_--446666"   VNNNNNN11##)VWV8IVY(! "*,,x"8"8 ( V 4 4!)g!6!6-5\\:M-N-N <<K 78  V V V EPT UUUUU V < $$)@F)J)J /<.B.B3.G.GJ_._K ++.;K + =3< /0 3&2 F# 726 ./! 948 01:k>>> > %%%% ":FCCIIKKQQSS F " "    ))++F LL7 @ @ @:45VST5V5VWW8@@!  " ### # # # # # # 6AAA H ' 0 0 0 0 H H H LL7$L G G G G G Hz h,=18==             %%'' 3V<<<z01Rq1R1RSS4V<<           sOA1AD(7E-AD(%-AD(-AD(AD(A J." AD(.J22AD(5J26 AD(2L5 AD(LAD(L AD(SAM) S)M- -S0M- 1>S0A)PS Q&$+Q!Q&S AD(!Q&& S0(R$ S$R( (S+R( ,'S AD(S##AD(&S#'A/AD(BAD(AAD(7A1AD()CAD(A AD( BAD((I6k l))llAD(l$AD('m+)AD(+ r06Ar+8r09AD(>A%r+#AD((A=r+%r0&AD(+r00CAD(7v;:AD(; wAD(wCAD(z10AD(1 {=AD(?{ AD( B} AD( }AD(}AD(A(AD(&A@$/!A@@A@$@ A@@A@$@A@@A@$@!AD(@#A@$@$AD(@(A4ABBAD(B&ACCAD(CACCA!AD(D( AK7D3B*AI4GAK7G# AI4HAHHAI4H&AH=H:AI4H<AH=H=1AI4I.AK7I4 AK7JA+AK2K,AK7K2AK7ct|h}|r||g}t5|D]O}t|d}t |d|||P dddn #1swxYwY|D]C} |#t$rt ddY@wxYwdS)aDrop any cached environment for *task_id* (and its collapsed key). Used when a backend reports an infrastructure failure: keeping the dead env cached would make every subsequent call fail against a stale connection, defeating automatic recovery. Nz&cleanup of degraded environment failedTrX) rrrryrrzrryrer%rc)rrevictedrrs rrgrg sU 'w / / 0D G $$ $ $C&**355C   sD ) ) )s###  $$$$$$$$$$$$$$$$ RR R KKMMMM R R R LLADL Q Q Q Q Q RRRs$ABBB!B66&CCcl t}|d}|dkrdS|dkr]ddlm}|}|stddSt j|d gdd t j }|jdkS|d kr[tj d ptj d }|r/t j|dgdd t j }|jdkSdS|dkrH| dr| dstddSdS|dkrwt| d}|ddkrdS|ddkr|dr*tdtddS|ddkr*tdtddS|ddkrEtrtdntddStrtdntd dStjdtd"dSdS|d#krt%|S|d$krdd%lm}dd&lm}|d'd!uStd(|dS#t.$r(} td)| d*Yd!} ~ dSd!} ~ wwxYw)+z8Check if all requirements for the terminal tool are met.rrDTrr) find_dockerz?Docker executable not found in PATH or common install locationsFversionr)capture_outputrrFr apptainerz --versionrrrzSSH backend selected but TERMINAL_SSH_HOST and TERMINAL_SSH_USER are not both set. Configure both or switch TERMINAL_ENV to 'local'.rrrRrSrUrVzModal backend selected with TERMINAL_MODAL_MODE=managed, but Nous Tool Gateway access is not currently available and no direct Modal credentials/config were found. %s Choose TERMINAL_MODAL_MODE=direct/auto to use direct Modal credentials.rWrXzhModal backend selected with TERMINAL_MODAL_MODE=managed, but the managed tool gateway is unavailable. %szModal backend selected with TERMINAL_MODAL_MODE=direct, but no direct Modal credentials/config were found. Configure Modal or choose TERMINAL_MODAL_MODE=managed/auto.zModal backend selected with TERMINAL_MODAL_MODE=direct, but no direct Modal credentials/config were found. Configure Modal or choose TERMINAL_MODAL_MODE=auto.zModal backend selected but no direct Modal credentials/config or managed tool gateway was found. Configure Modal, set up the managed gateway, or choose a different TERMINAL_ENV.z|Modal backend selected but no direct Modal credentials/config was found. Configure Modal or choose a different TERMINAL_ENV.NzFmodal is required for direct modal terminal backend: pip install modalrr)Daytonar<DAYTONA_API_KEYzgUnknown TERMINAL_ENV '%s'. Use one of: local, docker, singularity, modal, daytona, vercel_sandbox, ssh.z&Terminal requirements check failed: %srX)r3rrr%rErIrJrKrLrwhichrBr7rrrFrGrHrQrrrIr=re) r6rrrrS executablerorr=rls rcheck_terminal_requirementsr sm ""*% w  4  ! ! = = = = = = []]F  ^___u^VY$7VW_i_qrrrF$) )  & &k22Qfl=6Q6QJ .#[(ARV`aisi{|||(A--5   ::j)) J1G1G  Zu4  26::l3K3KLLK-.);;t-.(::56 !LL[>5 !5v&)33LL:=5!5 (H44133  @  8 !5133  B  R!5~''008 efffu4 ) ) )5f== =  " " ' ' ' ' ' ' 5 5 5 5 5 5:/00< < LL7    5  =q4 PPPuuuuushL2L.LAL$A L25L)rs   D    ,,,,,,,,,,,,!!!!!!  8 $ $RsRsRRRR=<<<<<<<%%%%%%<;;;;;   80/% #9"8   ## 0?@#@$@@@@7tCH~7$7777x),u==4===&&&^(*d38n)))*IN,, !! 999444%%%   -----,333333222222%%%% s t    _DcN_t____/4CCsCcC'+C8<CCCC &Io66;c;d;;;;ssTz&6 MMMMMM 4Z!$ (z3z3sz3Cz3z3z3z3x - -3 -s -S - - - -=c=d====!s!3!5c?!!!!H=$C=$E#s(O=$=$=$=$@5#5#5555pd4b#b#bbbbJUS4ZUE#*cDj:P4QUUUUr?>>>>>JJJJJJ\\\\\\DDDDDDMMMMMMJJJJJJ``````DDDDDD  (*d38n)))#%S%Z %%% IN   -/c9>)*///%y~'' "+Y^-->;c3h>;D>;>;>;>;R24T#tCH~-.333 " d38n!!!"IN$$$HSM$ $$$$$$" %# %8C= % % % %,3,4,,,, %%c3h%%%%P .c . . . .$&(DcN'''& (( MC M# MSW M M M Mcc b4 b b b b %9&&& Uhsm U U U U U# ######LHSMd38n()4S>)HSM)hWZm))))\>AT]     s  s  c     Dc D D D D$:i _ _ _``CD2%*!,V,V,V,V^Bc3hBBBBJ$4S> DcN t     $sCx.T6KO-1'026 } } #} c} } c} $(} CG} &*} "%} #+3- } } } } @;\;\S;\;\;\;\|   $$$UCUUUUQQXc]QQQQh4s4t4444466;AXAXAXAXdAXAXAXAXHGGG0 =#=#=#*====@ # $    (RZDbmVXVbFb'BJx00(bj);<< 3 3    "BJRTVTabbBJ+R];;BJ "-00BJ "-00BJ~r}--BJ~r}--BJ ..BJ6 FF #$S$S4Z$$$$N   >"&" %#%#%# c]%#%## %# sm %#  %#%#%#%#T!! $!$*.yy yyc]yc] y  y  yc]y yyT#Y'y yyyyxR#R4RRRR0oTooood z E !!! E(OOO _  F E $%%% E 5 !3 5 5666 E 5VN3 5 5666 E 3F=1 3 3444 E 1&- 1 1222 E 4y 1 4 4 4555 E 6 23 6 6 6777 & & ( ( LMMM  E '((( E  E IJJJ E  E !""" E 6777 E$KKK E %&&& E QRRR E $%%%>K E F 29^W - - F F F  E Wibi0G&U&U W WXXX E o9295QSl_jSlSl+m+m o oppp E UYRY/E{%S%S U UVVV E Yyry1I;'W'W Y YZZZ E HYRY~||~~FF H HIII<<<<<< E _YRY/E$$&&G\G\G\%]%] _ _``` E F+=t!D!D F FGGG E Y)")4OQV*W*W Y YZZZ $##### ,!A " R  " |Uk | |mC | | | ! " ~  " S ##   (+ y;" " FKK&&**Z        ( !r