eif> UdZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZddlmZmZmZmZejeZddlmZmZddlmZddlmZmZmZm Z de!d ed e!fd Z"e"d d e#dZ$e"dde%dZ&dZ'da(e!e)d<ddl Z e j*Z+dZ,dZ-dZ.dZ/ddl0m1Z2de!de!de3fdZ4ej5dZ6de!de!dzfd Z7d!e!de!de!fd"Z8dd$e#de!fd%Z9dded'e#de!fd(Z:d)e!de;fd*Zde!de=e!e;ffd-Z?de!de!fd.Z@de!dzde=e!dze!dzffd/ZAdd0lBmCZDdd1lmEZFdd2lGmHZIdd3lJmKZLdd4lMmNZOdd5lPmQZRdd6lSmTZTd7ZUiZVee!efe)d8<iZWee!e%fe)d9<e jXZYiZZee!e jXfe)d:<e jXZ[da\d;a]iZ^ee!ee!effe)d<<d=e!d>ee!effd?Z_d=e!fd@Z`d=ee!de!fdAZae#dfde!d e!d e!fdBZbdee!effdCZcdDeddzdee!effdEZe dde!dFe!dGe!dHe#dIe3dJe3dKe3d=e!dLe!fdMZfddOe#fdPZgdQZhdRZidSZjd=e!fdTZkd=e!de;fdUZldVZmd=e!fdWZndXZoe jpeode!dYe#de!dzfdZZqde!de;fd[Zrej5d\ejsZtej5d]Zuej5d^Zvej5d_ejsej5d`ejsej5daejsej5dbejsej5dcejsej5ddejsej5deejsej5dfejsfZwde!de;fdgZxde!de!dzfdhZydie;dje;de=fdkZz dde!dje;dHee#d=ee!dle;dee!dme;die;dneee!de!fdoZ{de;fdpZ|edqkr\e}dre}dsecZ~e}dte}due~de}dve~dwe}dxe~dye}dze~dGe}d{e~dHd|e}d}e~dOd|e|se}d~ede}de}de}de}de}de}de}de}de}de}ddZe}dejddde}dejdee}dejddee}dejdee}dejdee}dejdejddlmZe}dejdede}dejdde}dejddddlmZdeUddddddd;ddde$de$ddddddddd;dddd;ddddiddddgddZdZejpddeee|dddS)af Terminal Tool Module A terminal tool that executes commands in local, Docker, Modal, SSH, Singularity, and Daytona environments. Supports local execution, containerized backends, and Modal cloud sandboxes, including managed gateway mode. Environment Selection (via TERMINAL_ENV environment variable): - "local": Execute directly on the host machine (default, fastest) - "docker": Execute in Docker containers (isolated, requires Docker) - "modal": Execute in Modal cloud sandboxes (direct Modal or managed gateway) Features: - Multiple execution backends (local, docker, modal) - Background task support - VM/container lifecycle management - Automatic cleanup after inactivity Cloud sandbox note: - Persistent filesystems preserve working state across sandbox recreation - Persistent filesystems do NOT guarantee the same live sandbox or long-running processes survive cleanup, idle reaping, or Hermes exit Usage: from terminal_tool import terminal_tool # Execute a simple command result = terminal_tool("ls -la") # Execute in background result = terminal_tool("python server.py", background=True) N)Path)OptionalDictAnyList)is_interrupted_interrupt_event)_get_scratch_dir)coerce_modal_modehas_direct_modal_credentialsmanaged_nous_tools_enabledresolve_modal_backend_statenamedefault type_labelctj|}||dkr|S ||S#ttf$r#td|||||cYSwxYw)zParse module-level numeric env vars without breaking import. Terminal tool is imported by CLI, ACP, tests, and tool discovery. A single malformed env var must not make the whole module unloadable at import time. Nz;Invalid value for %s: %r (expected %s). Falling back to %r.)osgetenv TypeError ValueErrorloggerwarningrr converterrraws 5/home/div/.hermes/hermes-agent/tools/terminal_tool.py_safe_parse_import_envrKs )D//C {cRii y~~ z " I        s +1AATERMINAL_MAX_FOREGROUND_TIMEOUTiXintegerTERMINAL_DISK_WARNING_GBg@@numbercd t}d}ddl}|t|dz D]}t|dD]g}|rQ ||jz }4#t$r&}t d||Yd}~_d}~wwxYwh|dz }|tkr#t d|tdSd S#t$r(}t d |d Yd}~d Sd}~wwxYw) z4Check if total disk usage exceeds warning threshold.rNhermes-**zCould not stat file %s: %si@z\Disk usage (%.1fGB) exceeds threshold (%.0fGB). Consider running cleanup_all_environments().TFz#Disk usage warning check failed: %sexc_info)r globstrrrglobis_filestatst_sizeOSErrorrdebugDISK_USAGE_WARNING_THRESHOLD_GBr Exception) scratch_dir total_bytesr(pathfetotal_gbs r_check_disk_usage_warningr8ws}&((   IIc+ ":;;<< I ID$ZZ%%c** I I99;;II#qvvxx'77 "III %A1aHHHHHHHHII I), 5 5 5 NNy#%D F F F4u  :A MMMuuuuusBA3C=6BC= CB>9C=>C6C== D/D**D/r_cached_sudo_passwordc.ttddS)N sudo_passwordgetattr _callback_tlsr_get_sudo_password_callbackrAs =/4 8 88r@c.ttddS)Napprovalr<r?r@r_get_approval_callbackrDs =*d 3 33r@c|t_dS)uRegister a callback for sudo password prompts (used by CLI). Per-thread scope — ACP sessions that run concurrently in a ThreadPoolExecutor each have their own callback slot. N)r>r;cbs rset_sudo_password_callbackrHs #%Mr@c|t_dS)uRegister a callback for dangerous command approval prompts. Per-thread scope — ACP sessions that run concurrently in a ThreadPoolExecutor each have their own callback slot. See GHSA-qg5c-hvr5-hjgr. N)r>rCrFs rset_approval_callbackrJs Mr@)check_all_command_guardscommandenv_typereturnc>t||tS)zJDelegate to consolidated guard (tirith + dangerous cmd) with CLI callback.)approval_callback)_check_all_guards_implrD)rLrMs r_check_all_guardsrRs* !'84J4L4L N N NNr@z^[A-Za-z0-9/\\:_\-.~ +@=,]+$workdirc|sdSt|s6|D]1}t|sdt|dcS2dSdS)zReject workdir values that don't look like a filesystem path. Uses an allowlist of safe characters rather than a deny-list, so novel shell metacharacters can't slip through. Returns None if safe, or an error message string if dangerous. Nz/Blocked: workdir contains disallowed character z<. Use a simple filesystem path without shell metacharacters.z0Blocked: workdir contains disallowed characters.)_WORKDIR_SAFE_REmatchrepr)rSchs r_validate_workdirrYs t  ! !' * *B  B#))"-- Qd2hhQQQ  BA 4r@outputctjd}|s|Sgd}|D]}||vrddlm}|d|dzcS |S)z Check for sudo failure and add helpful message for messaging contexts. Returns enhanced output if sudo failed in messaging context, else original. HERMES_GATEWAY_SESSION)zsudo: a password is requiredzsudo: no tty presentzsudo: a terminal is requiredrdisplay_hermes_homeu@ 💡 Tip: To enable sudo over messaging, add SUDO_PASSWORD to z/.env on the agent machine.)rrhermes_constantsr^)rZrM is_gateway sudo_failuresfailure_dhhs r_handle_sudo_failurerds 344J  M !EE f   D D D D D DEaeaeagagEEEE E E E  Mr@-timeout_secondscFddl}t}| |pdS#t$rYdSwxYwdddfd} dtjd<t jd ttd td td td tdtd|ddzdztdttdddtj |d}| | |dr~dpd}t|rtdntdt|j |dtjvrtjd=SStdtdt|j  dtjvrtjd=dSdS#ttf$rettdt|j Ydtjvrtjd=dSdSt$rT}td |d!|j Yd}~dtjvrtjd=dSdSd}~wwxYw#dtjvr tjd=wxYw)"a Prompt user for sudo password with timeout. Returns the password if entered, or empty string if: - User presses Enter without input (skip) - Timeout expires (45s default) - Any error occurs Only works in interactive mode (HERMES_INTERACTIVE=1). If a _sudo_password_callback is registered (by the CLI), delegates to it so the prompt integrates with prompt_toolkit's UI. Otherwise reads directly from /dev/tty with echo disabled. rNrF)passworddonecd}d} tjdkr\ddl}g} |}|dvrn#|dkrt||.read_password_thread"s * "  I-- $ AL((F{{//LLOOO $&(WWU^^z""R[99#--f55 #--f55 (|w|m; ! !!&'*;YGGG$**A^ 3 3LLOOO $ &)XXe__%;%;GI%;%V%Vz"+W5 $ $ $!#F:    $ $ $!#F:    $!i&;Q....&&vx/A9MMMM QQQLL!LaPPPPPPPPQ!BHV$$$$ BBBLL!=qAAAAAAAAB!F6NNN!i&;Q....&&vx/A9MMMM QQQLL!LaPPPPPPPPQ!BHV$$$$ BBBLL!=qAAAAAAAAB!F6N ! ! ! !sEEH5F 6H58F H5F  H5 F22 G!<GG!'G<< H+H&&H+5K; IK J &JKJ  KJ&%K& K0K KK K1HERMES_SPINNER_PAUSEg?u┌──────────────────────────────────────────────────────────┐uA│ 🔐 SUDO PASSWORD REQUIRED │u├──────────────────────────────────────────────────────────┤u?│ Enter password below (input is hidden), or: │uA│ • Press Enter to skip (command fails gracefully) │u│ • Wait zs to auto-skipz u│u└──────────────────────────────────────────────────────────┘z Password (hidden): T)endflushtargetdaemontimeoutrirhu1 ✓ Password received (cached for this session)u' ⏭ Skipped - continuing without sudou( ⏱ Timeout - continuing without sudoz (Press Enter to dismiss)u) ⏭ Cancelled - continuing without sudoz [sudo prompt error: z] - continuing without sudo )sysrAr1renvirontimesleepprint threadingThreadstartr{stdoutrrry)rfr_sudo_cbrpassword_threadrhr6rs @r_prompt_for_sudo_passwordrsJJJ+,,H 8::# #   22  . .F."."."."."`03-0 )* 3  ())) CDDD ())) OPPP QRRR @@@@8KeSTTT ()))  %2T::::#*2FtTTT_555 &> j)/RH GGG AIJJJJ?@@@ GGG J     & "RZ / / 122 0# = > > > 0 1 1 1 GGG J      "RZ / / 1222 0 / ' (  9:::   "RZ / / 1222 0 /  IIIIJJJ rrr !RZ / / 1222 0 /  "RZ / / 12 2 2 2 2sJ # 11E-H. AH..ALL# L,,K;L;LLL limitc|dSt|tr |d|S t|d|S#t$rdt |jdcYSwxYw)z>Return a log-safe preview for possibly-invalid command values.Nz<>) isinstancer)rWr1type__name__)rLrs r_safe_command_previewrsx'3vv-G}}VeV$$ ---,4==),,,,,,-s<"A! A!tokencd|vs|drdS|dd\}}ttjd|S)zCReturn True when *token* is a leading shell environment assignment.=Frpz^[A-Za-z_][A-Za-z0-9_]*$) startswithsplitboolrerV)rr_values r_looks_like_env_assignmentrsW %5++C00u;;sA&&LD& 4d;; < <> " MM!M a a%%d 773<< r@cTt|}d}d}d}d}g}||krv||}|dkr|dkr|dkrd}|dz })|r|dz }C|dkr!|d|}|dkrn|}j|dkr|dz|kr|dz }|dvr't||\} } t | |dz}|d kr |dz }|dz }|d krt d|dz }|dz }|d krA|dz|kr8||dzs||dzdkr |dz }|dz }!|d kr|dkr|dz}d}|dz };|dks|dkr|dz }N|d |s|d|r |dz}|dz }|dkr d}|dz }|dkr d}|dz }|dkr|dz|kr||dzdkr|dz }|dz } | dkr?|| r%| dz} | dkr|| %| dkr|| dvr|dz }*|dkr|||fd}|dz }Pt||\} } t | |dz}||kv|s|S|} t|D]{\} }| }||kr?| |r%|dz }||kr| |%| d|}| ||}| |dzd}|dz|zdz|z} || S)uWrap `A && B &` (or `A || B &`) to `A && { B & }` at depth 0. Bash parses ``A && B &`` with `&&` tighter than `&`, so it forks a subshell for the whole `A && B` compound and backgrounds it. Inside the subshell, `B` runs foreground, so the subshell waits for `B` to finish. When `B` is a long-running process (`python3 -m http.server`, `yes > /dev/null`, anything that doesn't naturally exit), the subshell never exits. It leaks as a process stuck in ``wait4`` forever — and on the way, its open stdout pipe can prevent the terminal tool from returning promptly. Rewriting the tail to `A && { B & }` preserves `&&`'s error semantics (skip B if A fails) while replacing the subshell with a brace group. The brace group runs in the current shell (no fork), backgrounds B as a simple command (bash doesn't wait for it in non-interactive mode), and exits immediately. B runs as a normal backgrounded child, orphaned when the parent shell exits. Handles redirects (``&>``, ``2>&1``) and skips content inside quoted strings and parenthesised subshells. Leaves simple ``cmd &`` alone — that construct doesn't have the subshell-wait bug. rrrmrprrr)rr(r{}rr;|&rz<>Nz{ z& })rrrrmaxrrzreversed)rLrr paren_depth brace_depthlast_chain_op_endrewritesrXnl_rjr chain_endamp_pos insert_posprefixmiddlesuffixs r_rewrite_compound_backgroundrsg. G A AKK&(H a%% QZ ::+**{a/?/? "  FA  ::<<  FA  99dA&&BRxxA  ::!a%!)) FA    )'155IAvFAE""A  99 1 K FA  99aq11K FA  99QA(>(>(@(@GAPQENVZDZDZ 1 K FA  99q 1 K "  FA  ??kAoo FA    dA & & '*<* > > > >: > > >    s "0Ac  d}tjdd}tjdddv}|dkrtj}n |dkrd}nd }tjd | d }d }|d kr|rtjd ptj}tjtj| t fd|DsStj r8tj r ds }d nj|dvrf rdt fd|D}tj  }|s|r% |krt d ||| id|dttjdddtjd|dtddtjddtjdd |d!tjd"|d#tjd$|d% d&|d'|d(td)d*d+td,d-d.tjd/d0d1tjd2d0d3td4d5d6tjd7d0d8tjd9tjd:d;dvtjdt"d?td@dAtdBdCtjdDd;dvtdEdtjddFS)GzBGet terminal environment configuration from environment variables.*nikolaik/python-nodejs:python3.11-nodejs20 TERMINAL_ENVlocal&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACEfalse)trueryesssh~/root TERMINAL_CWDN)z/Users/z/home/zC:\zC:/dockerc3BK|]}|VdSNr).0p candidates r z"_get_env_config..ns1??A $$Q''??????r@) /workspacerr)modalr singularitydaytonac3BK|]}|VdSrr)rrcwds rrz"_get_env_config..us/DD3>>!,,DDDDDDr@zeIgnoring TERMINAL_CWD=%r for %s backend (host/relative path won't work in sandbox). Using %r instead.rM modal_modeTERMINAL_MODAL_MODEauto docker_imageTERMINAL_DOCKER_IMAGEdocker_forward_envTERMINAL_DOCKER_FORWARD_ENVz[]z valid JSONsingularity_imageTERMINAL_SINGULARITY_IMAGE docker:// modal_imageTERMINAL_MODAL_IMAGE daytona_imageTERMINAL_DAYTONA_IMAGEr#host_cwddocker_mount_cwd_to_workspacerTERMINAL_TIMEOUT180lifetime_secondsTERMINAL_LIFETIME_SECONDS300ssh_hostTERMINAL_SSH_HOSTrssh_userTERMINAL_SSH_USERssh_portTERMINAL_SSH_PORT22ssh_keyTERMINAL_SSH_KEYssh_persistentTERMINAL_SSH_PERSISTENTTERMINAL_PERSISTENT_SHELLrTERMINAL_LOCAL_PERSISTENTTERMINAL_CONTAINER_CPUrr"TERMINAL_CONTAINER_MEMORY5120TERMINAL_CONTAINER_DISK51200TERMINAL_CONTAINER_PERSISTENTTERMINAL_DOCKER_VOLUMES)local_persistent container_cpucontainer_memorycontainer_diskcontainer_persistentdocker_volumes)rrlowergetcwdr4abspath expanduseranyisabsisdirrrinfor r rloadsfloat) default_imagerMmount_docker_cwd default_cwdr2 host_prefixesdocker_cwd_source is_host_path is_relativerr#s @@r_get_env_configrdQs.AMy11Hy!I7SSYY[[_ss 7ikk U    )NK 0 0CH8M8 0In55DGOOBG$6$67H$I$IJJ ??????? ? ?  i(( -/W]]9-E-E NWNbNbczN{N{ !HC B B Bs BDDDDmDDDDD '--,,,  K SK-?-? KKXX{ 4 4 4C H ' 2G(P(PQQ   "9=II  n-JDRVR\^jkk  RY'CE`Q^E`E`aa  ry!7GG  #;]KK  s  H  ()9  >"4e<<  N+FNN  BI1266  BI1266  N#6==! " 29/44# * ") % I16 : :   %'')*+ 2I&A7KKQQSSWkk'(@#uhWW*+FOO()BGLL " *I6 R R X X Z Z^r r()BD$*Vbcc?    r@r$cXt|ttdS)z2Resolve direct vs managed Modal backend selection.r) has_direct managed_ready)rr r)r$s r_get_modal_backend_staterhs0 &/113G<<   r@imager#r ssh_configcontainer_config local_configr2c |pi} | dd} | dd} | dd} | dd} | d g}| d g}| d i}|d krt|| S|dkr0t|||| | | | |||| dd|| S|dkrt|||| | | | |S|dkr5i}| dkr| |d<| dkr| |d<| dkrE ddl}ddl}d||jjj vr| |d<n#t$rYnwxYwt| d}|ddkrt||||| |S|ddkrn|drtd |d!dkrtd"|d!dkrtd#d$}trd%}t|t||||| |S|d&kr&dd'lm}||||t%| | | | |S|d(kr|r*|d)r|d*std+t'|d)|d*|d,d-|d.d/||0Std1|d2)3a Create an execution environment for sandboxed command execution. Args: env_type: One of "local", "docker", "singularity", "modal", "daytona", "ssh" image: Docker/Singularity/Modal image name (ignored for local/ssh) cwd: Working directory timeout: Default command timeout ssh_config: SSH connection config (for env_type="ssh") container_config: Resource config for container backends (cpu, memory, disk, persistent) task_id: Task identifier for environment reuse and snapshot keying host_cwd: Optional host working directory to bind into Docker when explicitly enabled Returns: Environment instance with execute() method rNrprOrPrQTrRr) docker_envr )r#rrr3F) rir#rcpumemorydiskpersistent_filesystemrvolumesr2auto_mount_cwd forward_envenvr )rir#rrqrrrsrtrrrrqrrNephemeral_diskr$selected_backendmanaged)rir#rmodal_sandbox_kwargsrtrdirectmanaged_mode_blockedzModal backend is configured for managed mode, but a paid Nous subscription is required for the Tool Gateway and no direct Modal credentials/config were found. Log in with `hermes model` or choose TERMINAL_MODAL_MODE=direct/auto.modezZModal backend is configured for managed mode, but the managed tool gateway is unavailable.z_Modal backend is configured for direct mode, but no direct Modal credentials/config were found.zHModal backend selected but no direct Modal credentials/config was found.z`Modal backend selected but no direct Modal credentials/config or managed tool gateway was found.r!)DaytonaEnvironmentrhostuserz?SSH environment requires ssh_host and ssh_user to be configuredportkeyr)rrrkey_pathr#rzUnknown environment type: zD. Use 'local', 'docker', 'singularity', 'modal', 'daytona', or 'ssh')r_LocalEnvironment_DockerEnvironment_SingularityEnvironmentinspectr signatureSandboxcreate parametersr1rh_ManagedModalEnvironmentrr _ModalEnvironmenttools.environments.daytonarint_SSHEnvironment)rMrir#rrjrkrlrr2ccrqrrrs persistentrur)rpsandbox_kwargsrr modal_statemessage_DaytonaEnvironments r_create_environmentrs7*  RB &&! $ $C VV& - -F 66"E * *D.55Jff%r**G 4b99 b))J7 S':::: X  !S'F",g66"A5II*     ] " "&S'F",g    W   77$'N5 ! A::'-N8 $ !88 %%%%%%%%#w'8'89M'N'N'YYY7;N#34    /rvvl/C/CDD ) *i 7 7+g%3&0'  ) *h 6 612  > 6"i// p6"h.. uaG)++ vW%% % S'!/",g    Y  XXXXXX""S'Cd",g    U   `!7!7 `z~~f?U?U `^__ _F#F#++^^E2..     EhEEEFF Fs/3E## E0/E0,r6ctj} ddlm}ttD]!}||r |t|<"n#t$rYnwxYwg}t5tt D]]\}}||z |krOt |d}t |d|| ||f^t5|D] \}}t |d! dddn #1swxYwYdddn #1swxYwY|D]+\}} ddlm}||n#t$rYnwxYw t#|dr|nIt#|dr|n$t#|dr|t*d|#t.$rl} t1| } d | vsd | vrt*d |nt*d || Yd} ~ %d} ~ wwxYwdS) zOClean up environments that have been inactive for longer than lifetime_seconds.rprocess_registryNclear_file_ops_cachecleanupstop terminatez,Cleaned up inactive environment for task: %s404 not found*Environment for task %s already cleaned up-Error cleaning up environment for task %s: %s)rtools.process_registryrlistrkeyshas_active_processes ImportError _env_lockitemsrrrz_creation_locks_lockrtools.file_toolsrhasattrrrrrrZr1r)rSr) r6 current_timerr envs_to_stop last_timerxrrr6 error_strs r_cleanup_inactive_envsr*sq9;;L ;;;;;;N//1122 7 7G44W== 7*6w' 7      L  3 3"&~';';'='=">"> 8 8 GYi'*:::*..w==""7D111? ''#777" 3 3* 3 3 ##GT2222 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3%\\   = = = = = =  ) ) ) )    D  \sI&&  f%%  k**   KKF P P P P \ \ \AI !![IOO4E4E%E%E H'RRRRNPWYZ[[[  \'\\suAA$$ A10A1=B E $D:. E:D> >ED> EEE%E77 FFB H JA!JJc6tr t}t|dn4#t$r'}td|dYd}~nd}~wwxYwt dD]}tsntjd tdSdS)zKBackground thread worker that periodically cleans up inactive environments.r6zError in cleanup thread: %sTr&N<rp) _cleanup_runningrdrr1rrrangerr)configr6rs r_cleanup_thread_workerrhs   L$&&F "6*<#= > > > > L L L NN8!dN K K K K K K K K Lr  A#  JqMMMM      s#- AAAct5tts6dat jt datddddS#1swxYwYdS)z;Start the background cleanup thread if not already running.NTr)r_cleanup_threadis_aliverrrrrr?r@r_start_cleanup_threadrws $$  "/*B*B*D*D "# '.6LUYZZZO  ! ! # # # $$$$$$$$$$$$$$$$$$sAA,,A03A0cdat6 tddS#ttf$rYdSwxYwdS)z#Stop the background cleanup thread.FNr)rrr{ SystemExitryr?r@r_stop_cleanup_threadrsb"    + + + + +-.    DD #"s (==ct|}t5t|pt|cdddS#1swxYwYdS)z9Return the active BaseEnvironment for *task_id*, or None.N)rrrr)rlookups rget_active_envrs ' 0 0F UU#''//T3G3K3KG3T3TUUUUUUUUUUUUUUUUUUs4AAAcdt|}|dStt|ddS)aReturn True if the active environment for task_id is configured for cross-turn persistence (``persistent_filesystem=True``). Used by the agent loop to skip per-turn teardown for backends whose whole point is to survive between turns (docker with ``container_persistent``, daytona, modal, etc.). Non-persistent backends (e.g. Morph) still get torn down at end-of-turn to prevent leakage. The idle reaper (``_cleanup_inactive_envs``) handles persistent envs once they exceed ``terminal.lifetime_seconds``. NF _persistent)rrr=)rrxs ris_persistent_envrs5  ! !C {u ]E22 3 33r@cttt}d}|D]L} t||dz }#t$r(}t d||dYd}~Ed}~wwxYwt}ddl}|t|dz D]g} tj |dt d |5#t$r&}t d ||Yd}~`d}~wwxYw|dkrt d ||S) z3Clean up ALL active environments. Use with caution.rrpzError cleaning %s: %sTr&Nr$) ignore_errorszRemoved orphaned: %sz%Failed to remove orphaned path %s: %szCleaned %d environments)rrr cleanup_vmr1rerrorr r(r)shutilrmtreerZr.r/)task_idscleanedrr6r2r(r4s rcleanup_all_environmentsrs(--//00HGMM M w    qLGG M M M LL0'1tL L L L L L L L L M#$$KKKK #kJ67788KK K M$d 3 3 3 3 KK. 5 5 5 5 K K K LL@$ J J J J J J J J K{{ -w777 Ns/A A5 A00A521C$$ D.DDcd}t5t|d}t|ddddn #1swxYwYt5t |ddddn #1swxYwY ddlm}||n#t$rYnwxYw|dS t|dr| nIt|dr| n$t|dr| td|dS#t$rr}t!|}d|vsd |vrtd |n"td ||Yd}~dSYd}~dSd}~wwxYw) z4Manually clean up a specific environment by task_id.Nrrrrrz,Manually cleaned up environment for task: %srrrr)rrrrrrrrrrrrrrrZr1r)rSr)rrxrr6rs rrrs C **"&&w557D)))*************** ++GT***+++++++++++++++ 999999W%%%%       {X 3 " "  KKMMMM S& ! !  HHJJJJ S+ & &  MMOOO BGLLLLL XXXFF I   0A0A!A!A KKDg N N N N NNJGUV W W W W W W W W W O N N N N NXsO7A  AABB B B%% B21B2:B E GA!F<<Gcttr?tt}td|t dSdS)zBStop cleanup thread and shut down all remaining sandboxes on exit.z)Shutting down %d remaining sandbox(es)...N)rrrrrZr)counts r_atexit_cleanuprsU#()) ?GGG """""##r@ exit_codec|dkrdStjd|}|r|dn|}|}d}|D]7}d|vr|ds|dd}|sdSd d id d id d id d id d id d id d id d id d id d id d idddddd did }||}|r ||vr||SdS)a Return a human-readable note when a non-zero exit code is non-erroneous. Returns None when the exit code is 0 or genuinely signals an error. The note is appended to the tool result so the model doesn't waste turns investigating expected exit codes. rNz\s*(?:\|\||&&|[|;])\s*rrr-/rpzNo matches found (not an error)z%Files differ (expected, not an error)zGSome directories were inaccessible (partial results may still be valid)z5Condition evaluated to false (expected, not an error)zCould not resolve hostzFailed to connect to hostz2HTTP response code indicated error (e.g. 404, 500)zOperation timed out)ruLNon-zero exit (often normal — e.g. 'git diff' returns 1 when files differ)) grepegrepfgreprgagackdiff colordiffrtest[curlgit)rrstriprr) rLrsegments last_segmentwordsbase_cmdw semantics cmd_semanticss r_interpret_exit_coderstA~~t x17;;H$,9HRLL'@@BBL    EH  !88ALL--8 773<<# t 676767676767<=@A^_LMLM(*D%   cd1,,I6MM(++M(m33Y'' 4r@cd|}|dod|vS)auReturn True when PTY mode would break stdin-driven commands. Some CLIs change behavior when stdin is a TTY. In particular, `gh auth login --with-token` expects the token to arrive via piped stdin and waits for EOF; when we launch it under a PTY, `process.submit()` only sends a newline, so the command appears to hang forever with no visible progress.  z gh auth loginz --with-token)r{rSrrrL normalizeds r_command_requires_pipe_stdinr?sL'--////1122Jo.. ) j (r@z\b(?:nohup|disown|setsid)\bz\s&\sz\s&\s*(?:#.*)?$z@\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:dev|start|serve|watch)\bz\bdocker\s+compose\s+up\bz\bnext\s+dev\bz\bvite(?:\s|$)z \bnodemon\bz \buvicorn\bz \bgunicorn\bz$\bpython(?:3)?\s+-m\s+http\.server\bcd|}d|vp-|dpd|vp|dS)zGReturn True for informational invocations that should never be blocked.rz --helpz -hz --versionz -v)r{rSrendswithrs r#_looks_like_help_or_version_commandr]so'--////1122JZ &   u % % & : % &   u % % r@ct|rdSt|r dSt|st|r dSt D]}||r dSdS)zSuggest background mode when a foreground command looks long-lived. Prevents workflows that start a server/watch process and then stall before follow-up checks or test commands run. NzForeground command uses shell-level background wrappers (nohup/disown/setsid). Use terminal(background=true) so Hermes can track the process, then run readiness checks and tests in separate commands.zForeground command uses '&' backgrounding. Use terminal(background=true) for long-lived processes, then run health checks and tests in follow-up terminal calls.zThis foreground command appears to start a long-lived server/watch process. Run it with background=true, verify readiness (health endpoint/log signal), then execute tests in a separate command.)r_SHELL_LEVEL_BACKGROUND_REsearch_INLINE_BACKGROUND_AMP_RE_TRAILING_BACKGROUND_AMP_RE_LONG_LIVED_FOREGROUND_PATTERNS)rLpatterns r_foreground_background_guidancerhs +733t!((11  ?  !''00 4O4V4VW^4_4_  W  3 >>' " " <     4r@notify_on_complete backgroundc"|r |r|rd}d|fS|dfS)uKDecide what to do when both notify_on_complete and watch_patterns are set. These flags produce duplicate, delayed notifications when combined — one notification per watch-pattern match AND one on process exit, with async delivery that can spam the user long after the process ends. When both are set, we drop watch_patterns in favor of notify_on_complete (the more useful "let me know when it's done" signal) and return a human-readable note. Returns: (watch_patterns_to_use, conflict_note). conflict_note is "" when there is no conflict. zuwatch_patterns ignored because notify_on_complete=True; these two flags produce duplicate notifications when combinedNrr?)rwatch_patternsrnotes r#_resolve_notification_flag_conflictr s=$(^ L Tz 2 r@forceptyrc n t|ts]tdt |jt jdddt |jdddSt} | d } t|} t | i} | d kr| d p| d } nn| d kr| d p| d } nJ| dkr| dp| d} n&| dkr| dp| d} nd} | dp| d}| d}|p|}|s1|r/|tkr$t jdd|dtdidS|s,t|}|rt jdd|dddStt5| t vr+t#jt$| <t | }d}nd}dddn #1swxYwY|r*t&5| t(vrt+jt(| <t(| }dddn #1swxYwY|5t5| t vr*t#jt$| <t | }d}dddn #1swxYwY|rk| d krt/td| | dd d}| dkrl| dd| dd| dd| d d| d!dd"}d}| d#vr| d$d%| d&d'| d(d)| d*d| d+d,| d-g| d.d| d/g| d0id1 }d}| d2krd3| d4di}t3| | |||||| | d56 }nB#t4$r5}t jddd7|d8d9ddcYd}~cdddSd}~wwxYwt5|t | <t#jt$| <|}dddn #1swxYwYtd:| | dddddn #1swxYwYd}|sMt7|| }|d;s| d<d=krnt jdd| d>d?d=| d@|| dAdB| dCddDdS| dAdB}dE|dF}t jdd| d>|dGddS| dHr| dAdI}dJ|dK}n1| dLr| dAdI}dM|dN}|r]t9|}|rLtdO|ddPt;|t jdd|dGddSd}|} |rt=|rd} dQ}|r-dRdSlm }!dRdTl!m"}"|!dU}#|p|}$ | d2kr3|"#||$| |#tI|dVr|j%nd| W}%n|"&|||$| |#X}%dY|%j'|%j(dRddZ}&|r||&d[<|r||&d\<|rk|s|rgdRd]l)m*}'|'d^d}(|(rS|'d_d})|'d`d}*|'dad}+|'dbd},|(|%_+|)|%_,|+|%_-|,|%_.|*|%_/tatc||tc|c\}}-|-r&tdd|%j'|-|-|&de<|r^|r\d|%_2d|&df<|%j+rIdg|%_3|"j45|%j'dg|#|%j+|%j,|%j-|%j.|%j/ddh |r |rtm||%_7|%j7|&di<t j|&dS#tp$r4}t jdddjt|dkdcYd}~Sd}~wwxYwdl}.dR}/d}0|/|.kre d|i}1|r||1d<|j9|fi|1}0nH#tp$r:}t|:}2d|2vr#t jddmdn|dodkdcYd}~S|/|.krd|/d%z }/dp|/z}3tdq|3|/|.t;|t |j|| | t#j;|3Yd}~t<dr|.t;|t |j|| | t jdddst |jdtt|dkdcYd}~Sd}~wwxYw |0 dud}4|0 dvdR}5t{|4| }4 dRdwl>m?}6|6dx||4|5| pd| y}7|7D]}8t|8tr|8}4nn#tp$rYnwxYwdRdzl@mA}9|9}:t|4|:kr[t|:d{z};|:|;z }|4d|;|>z|4|< dz}4dRdlDmE}?|?|4}4dRdlFmG}@|4r|@|4Hnd}4t||5}A|4|5ddk}B|r||Bd[<|Ar|A|Bd<t j|BdS#tp$ri}dRdlJ}C|CK}Dt<d|Dt jdddt||DdddcYd}~Sd}~wwxYw)u. Execute a command in the configured terminal environment. Args: command: The command to execute background: Whether to run in background (default: False) timeout: Command timeout in seconds (default: from config) task_id: Unique identifier for environment isolation (optional) force: If True, skip dangerous command check (use after user confirms) workdir: Working directory for this command (optional, uses session cwd if not set) pty: If True, use pseudo-terminal for interactive CLI tools (local backend only) notify_on_complete: If True and background=True, you'll be notified exactly once when the process exits. The right choice for almost every long task. MUTUALLY EXCLUSIVE with watch_patterns. watch_patterns: List of strings to watch for in background output. HARD rate limit: 1 notification per 15s per process. After 3 strike windows in a row, watch_patterns is disabled and the session is auto-promoted to notify_on_complete. Use ONLY for rare, one-shot mid-process signals on long-lived processes (server readiness, migration-done markers). NEVER use in loops/batch jobs — error patterns there will hit the strike limit and get disabled. MUTUALLY EXCLUSIVE with notify_on_complete — set one, not both. Returns: str: JSON string with output, exit_code, and error fields Examples: # Execute a simple command >>> result = terminal_tool(command="ls -la /tmp") # Run a background task >>> result = terminal_tool(command="python server.py", background=True) # With custom timeout >>> result = terminal_tool(command="long_task.sh", timeout=300) # Force run after user confirmation # Note: force parameter is internal only, not exposed to model API z+Rejected invalid terminal command value: %srrz&Invalid command: expected string, got r)rZrrstatusF) ensure_asciirMrr'r r+rr.r!r0r#rzForeground timeout zs exceeds the maximum of zNs. Use background=true with notify_on_complete=true for long-running commands.TNz*Creating new %s environment for task %s...rr9r;r=rr@rB)rrrrr)rr rr!rNrprOrnrProrQr$r&rRr3r)rp) rNrOrPrQr$rRr3r)rpr rrMr2) rMrir#rrjrkrlrr2z5Terminal tool disabled: environment creation failed (rdisabledz %s environment ready for task %sapprovedr approval_requiredrzWaiting for user approvalrL descriptionzcommand flagged pattern_key)rZrrr rLrrzCommand denied: z?. Use the approval prompt to allow it, or rephrase the command.blocked user_approvedzflagged as dangerouszCommand required approval (z) and was approved by the user.smart_approvedzCommand was flagged (z&) and auto-approved by smart approval.z+Blocked dangerous workdir: %s (command: %s)rzPTY disabled for this command because it expects piped stdin/EOF (for example gh auth login --with-token). For local background processes, call process(action='close') after writing so it receives EOF.r)get_current_session_keyr)rrx)rLr#r session_keyenv_varsuse_pty)rxrLr#rrzBackground process started)rZ session_idpidrrrCpty_note)get_session_envHERMES_SESSION_PLATFORMHERMES_SESSION_CHAT_IDHERMES_SESSION_THREAD_IDHERMES_SESSION_USER_IDHERMES_SESSION_USER_NAME)rrrzbackground proc %s: %swatch_patterns_ignoredrr) rcheck_intervalrruchat_iduser_id user_name thread_idrrz$Failed to start background process: )rZrrro|zCommand timed out after z secondsrzfExecution error, retrying in %ds (attempt %d/%d) - Command: %s - Error: %s: %s - Task: %s, Backend: %szWExecution failed after %d retries - Command: %s - Error: %s: %s - Task: %s, Backend: %szCommand execution failed: rrZ returncode) invoke_hooktransform_terminal_output)rLrZr,rrM) get_max_bytesg?z ... [OUTPUT TRUNCATED - z chars omitted out of z total] ... ) strip_ansi)redact_sensitive_textexit_code_meaningzterminal_tool exception: %szFailed to execute command: )rZrr tracebackr )Lrr)rrrrrdumpsrdrrrFOREGROUND_MAX_TIMEOUTrrrrrrrrrLockr8rZrrrRrYrrtools.approvalrrr spawn_localrrx spawn_via_envidrgateway.session_contextrwatcher_platformwatcher_chat_idwatcher_user_idwatcher_user_namewatcher_thread_idr rrwatcher_intervalpending_watchersrzrrr1executerSrrrdhermes_cli.pluginsr-tools.tool_output_limitsr/rrtools.ansi_stripr0 agent.redactr1rrr3 format_exc)ErLrrrr rSr rrrrMeffective_task_idrrir#default_timeouteffective_timeoutguidancerxneeds_creation task_lockrjrkrlnew_envr6 approval_noterCdesc fallback_msg workdir_errorpty_disabled_reason effective_ptyrrr effective_cwd proc_session result_data_gse _gw_platform _gw_chat_id _gw_thread_id _gw_user_id _gw_user_name conflict_note max_retries retry_countrexecute_kwargsr wait_timerZr,r- hook_results hook_resultr/MAX_OUTPUT_CHARS head_chars tail_charsomittedtruncated_noticer0r1 exit_note result_dictr3tb_strsE r terminal_toolrnsRz'3'' # NN=W &   :Z$w--BXZZ!  " ### #!""*% 7w??(++,=rBB  x  MM.11KVN5KEE  & &MM"566U&AT:UEE  MM-00IF=4IEE  " "MM/22Mf_6MEEEmmE""3fUm +#6 #g #'4J*J*J:J'JJ-JJJ " ### # '6w??H 'z !#%% ## !& ''''   & & $88848IKK01*+<=!&!%  & & & & & & & & & & & & & & & I e% ? ?$O;;9B9I9IO$56+,=>  ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? B eB e//(,@@@<@IKK'8923DE). /////////////// ":e=001333KK LhXijlkljlXmnnn0/%) #u,,(. :r(B(B(. :r(B(B(. :r(B(B'-zz)R'@'@.4jj9I5.Q.Q **J,0(#'TTT17OQ1O1O4:JJ?QSW4X4X28**=Mu2U2U8> CY[_8`8`.4jjv.N.N28**=Mr2R2RAGLkmrAsAs6?<@IKK'89%&&&&&&&&&&&&&&&KK BHN_`bab`bNcdddEB eB eB eB eB eB eB eB eB eB eB eB eB eB eB eL  e((;;HJ' '<<))-@@@:"$%'!)i9T!U!U"5#+<< 7#C#C'/||MCT'U'U'/||M2'F'F''%*++++ ||M3DEETtTTTz !#%\\)\BB' ## !& ''''||O,, e||M3IJJ cd c c c .// e||M3IJJ d d d d   '-g66M 'L&tt}.CG.L.LNNNz !#*' ## !& ''''#  /88 !M  T ? ? > > > > > ? ? ? ? ? ?11"===K#NsMa 'w&#?#? ') 1$/,3C,?,?!IT - $@$$LL$4#A#A ') 1$/ $B$$L;"./'+!"!  !<.;K +&B.AK +  G#5 G GOOOOOO#'4(A2#F#FL# G&*d+CR&H&H (,-G(L(L &*d+CR&H&H (,-G(L(L 8D 57B 47B 49F 69F 61T'+,>'?'?#1#J//111- !JNN#;\_m\\\N!Z!ZRUVWRXRX!Z!Z''%* +++++++++)+6ZZ"--FL!44J*&(;;F  ::::::*{/#!)-3%     $0K!+s33!,     ? > > > > >,} 6{{--- !1C!788 - : f++ 2Z?;7;;!&kk;;;!  ,/??&*BVV 4 3 3 3 3 3Z''F ; : : : : :>DL**6<<>>:::"F-WjAAI!'K  8*7 J' =3< /0:k>>> >    %%'' 3V<<<z;3q66;;           sA1q4D-q"-qq%7H( q(H,,q/H,0 q=2I;/ q;I??qI?qU4K UK UK >UFRU S'SSU qS U&(T UT U!T "'U qUqUB&qA qCq8q Gd e#)e e qeq(fq kAkkqA%k;qA=k=k>qkAq 7mq m q mC2q r4 Ar/)r4/r4ct}|d} |dkrdS|dkrRddlm}|}|stddSt j|d gdd }|jdkS|d krPtj d ptj d }|r$t j|dgdd }|jdkSdS|dkrH| dr| dstddSdS|dkr[t| d}|ddkrdS|ddkr|drtddS|ddkrtddS|ddkrEtrtdntddStrtdntddStjdtd!dSdS|d"krdd#lm}t%jd$d uStd%|dS#t($r(}td&|d'Yd }~dSd }~wwxYw)(z8Check if all requirements for the terminal tool are met.rMr Trr) find_dockerz?Docker executable not found in PATH or common install locationsFversionr)capture_outputrr  apptainerz --versionrr9r;zSSH backend selected but TERMINAL_SSH_HOST and TERMINAL_SSH_USER are not both set. Configure both or switch TERMINAL_ENV to 'local'.rr$rzr{r}r~zModal backend selected with TERMINAL_MODAL_MODE=managed, but a paid Nous subscription is required for the Tool Gateway and no direct Modal credentials/config were found. Log in with `hermes model` or choose TERMINAL_MODAL_MODE=direct/auto.rzModal backend selected with TERMINAL_MODAL_MODE=managed, but the managed tool gateway is unavailable. Configure the managed gateway or choose TERMINAL_MODAL_MODE=direct/auto.zModal backend selected with TERMINAL_MODAL_MODE=direct, but no direct Modal credentials/config were found. Configure Modal or choose TERMINAL_MODAL_MODE=managed/auto.zModal backend selected with TERMINAL_MODAL_MODE=direct, but no direct Modal credentials/config were found. Configure Modal or choose TERMINAL_MODAL_MODE=auto.zModal backend selected but no direct Modal credentials/config or managed tool gateway was found. Configure Modal, set up the managed gateway, or choose a different TERMINAL_ENV.z|Modal backend selected but no direct Modal credentials/config was found. Configure Modal or choose a different TERMINAL_ENV.NzFmodal is required for direct modal terminal backend: pip install modalr!)DaytonaDAYTONA_API_KEYzWUnknown TERMINAL_ENV '%s'. Use one of: local, docker, singularity, modal, daytona, ssh.z&Terminal requirements check failed: %sr&)rdtools.environments.dockerrprr subprocessrunr,rwhichrrhr importlibutil find_specr!rtrrr1) rrMrprr executablerrtr6s rcheck_terminal_requirementsr~s   Fj!Ha w  4  ! ! = = = = = = []]F  ^___u^VY$7VWXXXF$) )  & &k22Qfl=6Q6QJ .#[(ARV`abbb(A--5   ::j)) J1G1G  Zu4  26::l3K3KLLK-.);;t-.(::56!LLE !5v&)33LL; !5 (H44133  @  8 !5133  B  R!5~''008 efffu4  " " ' ' ' ' ' '9.//t; ; LL'    5  =q4 PPPuuuuusbJ=2J=#J=8AJ=A J=5J=.J=&J=+AJ=!J= J== K/K**K/__main__zTerminal Tool Modulez2==================================================z Current Configuration:z Environment type: z Docker image: r'z Modal image: r.z Working directory: z Default timeout: sz Lifetime: u; ❌ Requirements not met. Please check the messages above.rpu ✅ All requirements met!z Available Tool:z= - terminal_tool: Execute commands in sandboxed environmentsz Usage Examples:z # Execute a commandz* result = terminal_tool(command='ls -la')z z # Run a background taskzE result = terminal_tool(command='python server.py', background=True)z Environment Variables:r z TERMINAL_ENV: r r z- (local/docker/singularity/modal/daytona/ssh)z TERMINAL_DOCKER_IMAGE: r(z TERMINAL_SINGULARITY_IMAGE: r,r-z TERMINAL_MODAL_IMAGE: r/z TERMINAL_DAYTONA_IMAGE: r1z TERMINAL_CWD: rr]z TERMINAL_SANDBOX_DIR: TERMINAL_SANDBOX_DIRz /sandboxesz TERMINAL_TIMEOUT: r460z TERMINAL_LIFETIME_SECONDS: r7r8)registryterminalobjectstringz The command to execute on the VM)rrbooleanu2Run the command in the background. Two patterns: (1) Long-lived processes that never exit (servers, watchers). (2) Long-running tasks paired with notify_on_complete=true — you can keep working and get notified when the task finishes. For short commands, prefer foreground with a generous timeout instead.)rrrz3Max seconds to wait (default: 180, foreground max: u). Returns INSTANTLY when command finishes — set high for long tasks, you won't wait unnecessarily. Foreground timeout above z7s is rejected; use background=true for longer commands.)rrminimumz^Working directory for this command (absolute path). Defaults to the session working directory.zRun in pseudo-terminal (PTY) mode for interactive CLI tools like Codex, Claude Code, or Python REPL. Only works with local and SSH backends. Default: false.uWhen true (and background=true), you'll be automatically notified exactly once when the process finishes. **This is the right choice for almost every long-running task** — tests, builds, deployments, multi-item batch jobs, anything that takes over a minute and has a defined end. Use this and keep working on other things; the system notifies you on exit. MUTUALLY EXCLUSIVE with watch_patterns — when both are set, watch_patterns is dropped.arrayru Strings to watch for in background process output. HARD RATE LIMIT: at most 1 notification per 15 seconds per process — matches arriving inside the cooldown are dropped. After 3 consecutive 15-second windows with dropped matches, watch_patterns is automatically disabled for that process and promoted to notify_on_complete behavior (one notification on exit, no more mid-process spam). USE ONLY for truly rare, one-shot mid-process signals on LONG-LIVED processes that will never exit on their own — e.g. ['Application startup complete'] on a server so you know when to hit its endpoint, or ['migration done'] on a daemon. DO NOT use for: (1) end-of-run markers like 'DONE'/'PASS' — use notify_on_complete instead; (2) error patterns like 'ERROR'/'Traceback' in loops or multi-item batch jobs — they fire on every iteration and you'll hit the strike limit fast; (3) anything you'd ever combine with notify_on_complete. When in doubt, choose notify_on_complete. MUTUALLY EXCLUSIVE with notify_on_complete — set one, not both.)rrr)rLrrrSr rr)r propertiesrequired)rrrc ft|d|dd|d|d|d|dd|dd|d  S) NrLrFrrrSr rr)rLrrrrSr rr)rnr)argskws r_handle_terminalrPs ##88L%00##y!!## HHUE " "88$8%@@xx 011    r@u💻i)rtoolsetschemahandlercheck_fnemojimax_result_size_chars)re)r)NNNrN)r)FNNFNFFN)__doc__importlib.utilrzrloggingrrurrratexitrrwpathlibrtypingrrrr getLoggerrrtools.interruptrr tools.environments.singularityr tools.tool_backend_helpersr r r rr)rrr5r\r0r8r9__annotations__r r>rArDrHrJr7rKrQdictrRcompilerUrYrdrrrrtuplerrrrtools.environments.localrrrrtools.environments.sshrrrvrrtools.environments.modalrr tools.environments.managed_modalrrtools.managed_tool_gatewayrTERMINAL_TOOL_DESCRIPTIONrrr6rrrrrrrrrr rdrrhrrrrrrrrrrregisterrr IGNORECASErrrrrrr rnr~rrexit default_imgrrTr_r^rctools.registryrTERMINAL_SCHEMArr?r@rrs>    ,,,,,,,,,,,,  8 $ $=<<<<<<<<;;;;;   80/% #9"8   ##< s !! 999444%%%    NsNcNdNNNN2:=>>ssTz,4z3z3sz3Cz3z3z3z3x - -3 -s -S - - - -=c=d====!s!3!5c?!!!!H:C:E#t)4D::::zb#b#bbbbJ6S4Z6E#*cDj:P4Q6666tKJJJJJ\\\\\\DDDDDDMMMMMMJJJJJJ``````DDDDDD.(*d38n)))#%S%Z %%% IN   -/c9>)*///%y~''24T#tCH~-.333--c3h----&+c++++ #47:Y     s  s     Lc3hLLLL^$4S>KO-1'0(, ~F~F#~Fc~F~Fc~F$(~FCG~F&*~F"%~F#& ~F~F~F~FB;\;\S;\;\;\;\|   $$$UCUUUU4s4t4444&6'X'X'X'X'XT### =#=#=#*====@ # $    (RZ(F VV&BJx00(bj);<<BJRTVTabbBJ+R];;BJ "-00BJ "-00BJ~r}--BJ~r}--BJ ..BJ6 FF #SS4ZB   :!!!$*.cc ccc]cc] c  c c] c ccT#Y'c ccccLfTffffR z E !!! E(OOO _  F E $%%% E 5 !3 5 5666 E 5VN3 5 5666 E 3F=1 3 3444 E 1&- 1 1222 E 4y 1 4 4 4555 E 6 23 6 6 6777 & & ( ( LMMM Q E '((( E  E IJJJ E  E !""" E 6777 E$KKK E %&&& E QRRR E $%%%>K E nYRY~w?? n n nooo E Wibi0G&U&U W WXXX E o9295QSl_jSlSl+m+m o oppp E UYRY/E{%S%S U UVVV E Yyry1I;'W'W Y YZZZ E EYRY~yry{{CC E EFFF<<<<<< E _YRY/E$$&&G\G\G\%]%] _ _``` E F+=t!D!D F FGGG E Y)")4OQV*W*W Y YZZZ $##### ,!A " T  " |Uk | |mC | | | ! " ~  " ` ##   (+ l;" " FKK&&**Z        ( !r@