Pmj[dZddlmZddlZddlZddlZddlZddlZddlZ ddl m Z m Z ddl m Z mZddlmZmZmZmZmZmZejeZdZdZd Zd Zd Zd Zd ZdZ dZ!dZ"dZ#dZ$ddZ%ddZ&ddZ'ddZ(dZ)Gd d!e*Z+dd#Z,dd$Z-dd&Z.d'Z/dd)Z0hd*Z1hd+Z2dd/Z3dd3Z4dd4Z5dd5Z6dd6Z7dd8Z8dd:Z9dd<Z:dd=Z;Gd>d?ZddGddNZ?ddOZ@ddPZAddRZBGdSdTe*ZCGdUdVe*ZDGdWdXZEddYZFddZZGdd[ZHdd]ZId^d_ddcZJddeZKedfddiZLddjddmZMddnZNddpZOd^d_ddsZPd^d_ddvZQddwZRddyZS ddddzd{ddZTddZUddZVddZWddZX dddddZYddZZdzdddZ[ddZ\ddZ]ddZ^dZ_ddZ`ddZadZbddZcddZdddZe dddddZfddZgddZhddZiddZjddZkdddZlddZmddZn ddddddZoddZpddZqdS)u Skill Sync client -- the low-level sync layer. This is the LOW-LEVEL sync layer. It builds content-addressed objects (blob/tree/commit) from local skills, talks the sync wire contract to a sync plane (push objects + CAS a ref, pull the owner's HEAD, three-way merge on a 409), and is driven by: * a debounced push hook in ``skill_manage`` (after the write-gate passes), * a periodic pull hook (``maybe_pull_skills``) at the curator tick sites, * the ``hermes sync status|pull|push|now`` CLI. It lives beside ``tools/skills_sync.py`` (NOT under ``hermes_cli/``) so the low-level sync layer never imports the CLI -- same rule the bundled-skills sync module documents at ``skills_sync.py:43-50``. Contract: the Skill Sync wire contract (version 1, frozen for Milestone 1). Endpoint shapes, object model, canonicalization, and status codes below all trace to that document. --- ACCESS GATE (pre-launch) --------------------------------------------- Client sync is INERT (no push, no pull, no-op) unless the signed-in user is a **Nous admin**. We read that off the access token, which rides on the same bearer ``resolve_nous_runtime_credentials()`` returns; we decode the JWT payload (no signature verification -- the server re-verifies) and check the claim before doing any sync work. NAMING: the claim on the wire is ``tool_gateway_admin``, which is misleading -- it is NOT a tool-gateway-specific right. NAS populates it from ``Permissions.ADMIN_ACCESS`` (access-token-issuer.ts), the same global portal admin permission that guards ``/admin/*``; the claim is simply named for its first consumer. We keep the wire name (other services read it) but call it what it means everywhere on this side. This gate is pre-launch containment, not the shipping entitlement. Admin status conflates "may administer Nous" with "has Skill Sync enabled", and has no middle setting for a beta cohort -- opening it up would mean handing out portal admin. Replace it with a real entitlement (a ``sync:*`` scope, a tier check, or a per-cohort feature flag) before shipping to users. --- OPT-IN DEFAULT (M1-D, provisional) ----------------------------------- Nothing syncs unless the user marks a skill for sync. The user's local intent is toggled via ``hermes sync enable/disable`` (a ``sync`` flag on the skill's ``.usage.json`` sidecar, alongside ``pinned``/``created_by``), but the DURABLE, CROSS-DEVICE opt-in state is a committed ``sync-manifest`` object in the sync plane (design.md §2.8): a root-level blob in the tree at ``refs/user//HEAD`` recording per-skill ``{name, enabled}``. Push writes the manifest from local intent; pull reconciles local intent FROM it, so a skill opted in on one device becomes opted in on the others. The plane manifest is authoritative; the local flag is just the editable intent. Only agent-created + user-authored skills under ``~/.hermes/skills/`` are eligible; bundled and hub-installed skills are excluded. ) annotationsN)datetimetimezone)Path PurePosixPath)AnyCallableDictListOptionalTuple1iblobtreecommitfileexecdirskillz sync-manifestskillsDict[str, bool]returnbytescttdt|Dd}t |S)a5Serialize the per-skill opt-in map into canonical ``sync-manifest`` bytes. ``skills`` maps skill name -> enabled. Emits the shape gateway-gateway's ``parseSyncManifest`` validates: ``{type, version:1, skills:[{name,enabled}]}``. Skill entries are sorted by name for a stable content address. c8g|]\}}|t|dS))nameenabled)bool).0rrs >/home/thesage/.hermes/hermes-agent/tools/skills_sync_client.py z-build_sync_manifest_bytes..s:   gd7mm 4 4   )typeversionr)SYNC_MANIFEST_TYPESYNC_MANIFEST_VERSIONsorteditemscanonical_json_bytes)rmanifests r!build_sync_manifest_bytesr,vsR#(  !' !7!7   H  ) ))r#dataOptional[Dict[str, bool]]c tj|d}n#t$rYdSwxYwt |t sdS|dtkrdS|dtkrdS|d}t |tsdSi}|D]{}t |t sdS|d}|d}t |tr|sdSt |tsdS|||<||S)uParse ``sync-manifest`` bytes into ``{name: enabled}``, or ``None`` if the bytes are not a well-formed manifest. Strict (mirrors gateway-gateway ``parseSyncManifest``): an unknown ``type``, a missing/!=1 ``version``, a non-array ``skills``, or a malformed skill entry all reject rather than being coerced — a malformed manifest must not be mistaken for "no skills opted in." utf-8Nr$r%rrr) jsonloadsdecode Exception isinstancedictgetr&r'liststrr)r-value raw_skillsoutrawrrs r!parse_sync_manifestr>sU 4;;w//00 tt eT " "t yy...t yy444t8$$J j$ ' 'tC  #t$$ 44wwv'')$$$$$ D 44'4(( 44D Js '* 88r9cTdtj|zS)z;Return ``sha256:<64-hex>`` -- the wire address of ``data``.zsha256:)hashlibsha256 hexdigest)r-s r! wire_addressrCs# w~d++5577 77r#objDict[str, Any]cXtj|ddddS)aCanonical JSON serialization for tree/commit hashing (sync contract). UTF-8, keys sorted lexicographically, no insignificant whitespace (``separators=(",", ":")``), no trailing newline. Arrays must already be in the contract-specified order by the caller (tree entries by ``name``, commit ``parents`` in significance order). Both client and server MUST produce byte-identical output or a push fails ``422 hash_mismatch``. T),:F) sort_keys separators ensure_asciir0)r1dumpsencode)rDs r!r*r*s6 :       fWoo r#tool_gateway_adminceZdZdZdS)SyncInertErrorzRaised (and caught by the gate-and-swallow hooks) when sync must no-op: not logged in, no bearer, or the caller is not a Nous admin. N)__name__ __module__ __qualname____doc__r#r!rPrPsr#rPtokenc ddl}||dddpiS#t$r'}td|icYd}~Sd}~wwxYw)a9Decode a JWT payload WITHOUT signature verification. Safe here: we never trust these claims for authz -- the server re-verifies every call. We only read the dev-gate claim to decide whether to attempt sync at all. Mirrors the diagnostic decode in plugins/dashboard_auth/nous/__init__.py:463. rNF)verify_signature verify_exp)optionsz1skills_sync_client: JWT payload decode failed: %s)jwtr3r4loggerdebug)rVr[es r!_decode_jwt_payload_unverifiedr_s  zz ).eDD     H!LLL s" AAAAc ddlm}|}n%#t$r}td||d}~wwxYw|pid}|stdt |}|dp+|dp|d pd }|t d u}||pid t|||d S)usResolve the Nous bearer + owner + dev-gate flag. Returns a dict: ``{api_key, base_url, owner, nous_admin, claims}``. Raises :class:`SyncInertError` if not logged in / no bearer. ``owner`` is the token-verified subject; the server derives the real owner from the bearer regardless (contract §0.4), so this is advisory for local ref naming only. r) resolve_nous_runtime_credentialszno Nous credentials: Napi_keyzno bearer token availablesub privy_didtidunknownTbase_url)rbrgowner nous_adminclaims)hermes_cli.authrar4rPr7r_NOUS_ADMIN_CLAIMr9)racredsr^rbrjrhris r!resolve_identityrns8ADDDDDD0022 AAA8Q8899q@A{ **G :8999 +G 4 4F 5  ::k " "  ::e      ,--5J[b%%j11U    s 505rc ttdS#t$rYdSt$r&}t d|Yd}~dSd}~wwxYw)z3Whether the access gate permits sync. Never raises.riFz2skills_sync_client: dev_gate_open check failed: %sN)rrnr7rPr4r\r]r^s r! dev_gate_openrqs$&&**<88999 uu  I1MMMuuuuus-0 A, A,A''A,z(https://gateway-gateway.nousresearch.com Optional[str]c:tjd}|r;|r'|dS ddlm}|pi}|dpi}|d}t|tr;|r'|dSn2#t$r%}t d|Yd}~nd}~wwxYwtpdS) uResolve the sync-plane base URL. Order: HERMES_SYNC_BASE_URL env bridge -> config.yaml ``sync.base_url`` -> the production plane. Returns a base without a trailing slash (e.g. ``https://host``); the ``/v1/sync/`` prefix is appended by the client. The production default means a normal user never configures a URL — the env var and config key exist to point a dev/staging build at another plane. Returns None only if the default is somehow blanked out. HERMES_SYNC_BASE_URL/r load_configsyncrgz8skills_sync_client: config sync.base_url read failed: %sN) osgetenvstriprstriphermes_cli.configrwr7r5r9r4r\r]DEFAULT_SYNC_BASE_URL)envrwcfgsync_cfgbaser^s r!resolve_sync_base_urlr3s' )* + +C 'syy{{'yy{{!!#&&& T 211111kmm!r776??(b||J'' dC  ,TZZ\\ ,::<<&&s++ + TTT OQRSSSSSSSST (D(sB C"" D,D  D>ronyestrue>0noofffalser:rOptional[bool]ct|tr|S|dSt|}|t vrdS|t vrdSdS)zParse a config/env bool. Returns None if unrecognized (so callers can fall through to the next precedence layer). Accepts real bools + strings.NTF)r5rr9r{lower_TRUE_FALSE)r:ss r! _parse_boolrfsi%  }t E   ""AEzztF{{u 4r#env_var config_keydefaultcXttj|}||S ddlm}|pi}|dpi}t||}||Sn3#t $r&}td||Yd}~nd}~wwxYw|S)zMResolve a boolean sync knob: ``env_var`` -> ``sync.`` -> default.Nrrvrxz2skills_sync_client: config sync.%s read failed: %s) rryrzr}rwr7r4r\r]) rrrenv_valrwrrcfg_valr^s r!_sync_config_boolrus")G,,--G Z111111kmm!r776??(bhll:6677  N  ZZZ I:WXYYYYYYYYZ NsAA77 B'B""B'c&tdddS)uWhether the sync feature is turned on for this instance (env-first). ``HERMES_SYNC_ENABLED`` -> ``sync.enabled`` -> False. This is the master switch a Hermes Cloud deployment sets to opt its instances into sync by default. It is checked by the gate-and-swallow entrypoints IN ADDITION to the Nous-admin token gate and a configured base URL — all three must hold for background sync to run. HERMES_SYNC_ENABLEDrFrrrUr#r!sync_feature_enabledrs 2Iu M M MMr#c&tdddS)a~Whether an agent/user edit to an org skill is proposed automatically. ``HERMES_SYNC_ORG_AUTO_PROPOSE`` -> ``sync.org_auto_propose`` -> False. False (default): edits to an org-shared skill stay LOCAL until the user runs ``hermes sync propose ``. The skill keeps working with the edit applied; the organisation just doesn't see it yet. True: every local edit to an org skill is submitted to the org as a proposal right away (an admin still approves it, unless the editor is an admin). Suits a small, high-trust team that wants improvements to flow back without anyone remembering to push them. HERMES_SYNC_ORG_AUTO_PROPOSEorg_auto_proposeFrrrUr#r!sync_org_auto_proposers# &(:E   r#c&tdddS)uThe personal sync default opt-in policy (env-first). ``HERMES_SYNC_DEFAULT_OPT_IN`` -> ``sync.default_opt_in`` -> False. False (default): opt-IN — a skill syncs only after an explicit ``hermes sync enable`` (or a plane manifest that opted it in). True: opt-OUT — every sync-eligible skill is treated as opted in unless explicitly disabled, which is the "your skills follow you with no setup" default a Hermes Cloud deployment wants. Per the design notes, this default is provisional and expected to flip; exposing it as env config lets the operator choose per deployment without a protocol change. HERMES_SYNC_DEFAULT_OPT_INdefault_opt_inFrrrUr#r!sync_default_opt_inrs 9;KUZ [ [ [[r#rc(ddlm}|dz S)Nrget_hermes_homer)hermes_constantsrrs r! _skills_dirrs'000000 ?  x ''r# skill_namec ddlm}m}m}ddlm}n#t $rYdSwxYw||s ||rdS||}|dS||rdS |t}|j r|j dtkrdSn#ttf$rYnwxYwdS)uWhether *skill_name* is a candidate for sync (before the opt-in check). Eligible = present locally under ~/.hermes/skills/, NOT bundled, NOT hub-installed, NOT an external-dir skill, and NOT under the org mirror (``_org/`` — enterprise-managed content pulls from the org HEAD and must never ride a personal push; the sync contract / the design notes). Mirrors the exclusion logic used by the curator (tools/skill_usage.py). r) is_bundledis_hub_installed_find_skill_dir)is_external_skill_pathFNT)tools.skill_usagerrragent.skill_utilsrr4resolve relative_torparts ORG_DIR_NAMEOSError ValueError)rrrrr skill_dirrels r!is_sync_eligiblers6SSSSSSSSSS<<<<<<< uuz*!1!1*!=!=u ++Iui((u !!--kmm.C.C.E.EFF 9 1555 Z      4s !!A"B>>CC List[str]c ddlm}n#t$rgcYSwxYw|pi}trg}t D]h}||}t |tr|ddurDt|r| |itt|Sg}| D]U\}}t |tr;|ddur$t|r| |Vtt|S)u]Return the names of skills that should sync, honoring the opt-in policy. Two policies (``sync_default_opt_in()``, env-first — see that function): - **opt-in (default):** a skill syncs only when its usage record carries ``sync: true`` AND it is eligible. Nothing syncs by default. - **opt-out (Hermes Cloud "on by default"):** every *eligible* skill syncs UNLESS its usage record explicitly carries ``sync: false``. This is what a deployment sets (via ``HERMES_SYNC_DEFAULT_OPT_IN``) so a user's skills follow them with no per-skill setup. Sorted, deduped. r) load_usagerxFT) rrr4r_all_local_skill_namesr7r5r6rappendr(setr))rusagenamesrrecs r!list_synced_skill_namesrse0000000   JLL BE "*,, # #D))D//C#t$$ E)A)A%% # T"""c%jj!!! E[[]] c c4  SWWV__%<%>>>>>''(/2FGG , , ,+ , # T""" # RRR MqQQQQQQQQR #e**  s@B).B)A43B)4B  B) B  B)) C3CCc*eZdZdZd dZdd Zdd Zd S) ObjectSetzAccumulates objects to push: hash -> (kind, bytes). Deduped by content address, so identical blobs across skills upload once. rNoneci|_dSN)objectsselfs r!__init__zObjectSet.__init__4s 57 r#kindr9r-rc^t|}|j|||f|Sr)rCr setdefault)rrr-addrs r!addz ObjectSet.add7s0D!! tTl333 r#intc*t|jSr)lenrrs r!__len__zObjectSet.__len__<s4<   r#Nrr)rr9r-rrr9)rr)rQrRrSrTrrrrUr#r!rr.sZ 8888 !!!!!!r#rpathc |jtjtjztjzzrt Sn#t$rYnwxYwtS)uReturn the tree mode for a regular file: ``exec`` if +x else ``file`` (contract §2.3). No symlinks / other modes are emitted.) statst_mode_statS_IXUSRS_IXGRPS_IXOTH MODE_EXECr MODE_FILE)rs r! _file_moder@s` 99;; %-%-"?%-"O P         sAA AAdir_pathrmax_object_bytesrc Bg}t|dD]/}|rtd|3|r 413). c|jSr)r)ps r!zbuild_tree..Ts!&r#keyz'skills_sync_client: skipping symlink %srrrhashmodezfile  is z bytes > max_object_bytes c|dSNrrUrps r!rzbuild_tree..o qyr#r$entries)r(iterdirrr\r]is_dir build_treerr KIND_TREEMODE_DIRis_file read_bytesrrr KIND_BLOBrsortr*) rrrrchildsub_hashr- blob_hashtree_objs r!rrKs%'G((**0@0@AAA       LLBE J J J  <<>> !%CSTTTH NNYRZ[[    ]]__ ##%%D4yy+++ *E**s4yy**'** It44I NN!J%%&u--     LL((L)))!g66H ;;y"6x"@"@ A AAr#)ts tree_hashparentsrhdevicemessager ct|t|||d|p0tjtjd|td}|tt|S)aBuild a commit object (sync contract) and return its address. ``parents``: 0 for first commit, 1 for a normal edit, 2 for a merge commit (order significant: parents[0] = base fast-forwarded from, parents[1] = the other head being merged). )rhrz%Y-%m-%dT%H:%M:%SZ)r$rrauthorr r artifact_type) KIND_COMMITr8rnowrutcstrftimeARTIFACT_TYPE_SKILLrr*)rrrhrrrr  commit_objs r! build_commitrtsr"==!V44MHL..778LMM,J ;;{$8$D$D E EEr#cddl}ddl}|jdd} |pd}n#t $rd}YnwxYw|dd}dd|Dpd}|r|d|n|jS)zA human-friendly default device label: the short hostname plus a short random suffix for uniqueness (two machines can share a hostname). Falls back to a bare uuid if the hostname is unavailable/unusable.rNr.c3JK|]}|s|dv|VdS)z-_N)isalnum)r cs r! z(_default_device_label..s3AA! AqDyyAyyyyAAr#-) socketuuiduuid4hex gethostnamersplitr{join)r$r%suffixhostshorts r!_default_device_labelr.sMMMKKK ZZ\\ bqb !F!!##)r  JJsOOA  $ $ & &E GGAAuAAA A A GRE"' =e  f   TZZ\\-==sA AAc"tdz } |r,|d}|r|Sn#t$rYnwxYwddl}|jdpd}|r|n t} |j dd | |dn2#t$r%}t d |Yd}~nd}~wwxYw|S) uDReturn a stable per-device label for commit ``author.device`` (contract -- advisory, never an auth input). Persisted under ~/.hermes/skills/.sync_device_id. New devices are seeded with a HUMAN-FRIENDLY default (short hostname + a short random suffix, e.g. ``bens-macbook-a1b2c3``) so the sync console shows something recognizable instead of an opaque hash. Existing ``.sync_device_id`` files are honored verbatim (backward-compatible — a machine keeps its id). Use ``set_device_name()`` / ``hermes sync device --name`` to set an explicit label..sync_device_idr0encodingrNHERMES_SYNC_DEVICE_NAMErTrexist_okz3skills_sync_client: could not persist device id: %s)rr read_textr{rryenvironr7r.rmkdir write_textr\r])rvalryenv_namer^s r!stable_device_idr<s@ ==, ,D ;;== ..'.2288::C       III 899?RFFHHH ;(($9$;$;CO $666 g.... OOO JANNNNNNNNO Js)?A A! A!)3C D 'DD rc|pd}|stdtdz }|jdd||d|S)uoSet the human-friendly device label used for commit ``author.device``. Writes the (trimmed) name to ~/.hermes/skills/.sync_device_id, overwriting any previous value. The label is advisory metadata only — never an auth input (contract §2.4) — so any non-empty string is accepted. Returns the stored value. Raises ValueError on an empty name. rz&device name must be a non-empty stringr0Tr4r0r1)r{rrrr8r9)rcleanedrs r!set_device_namer?svzr  ""G CABBB ==, ,DKdT222OOGgO... Nr#c*eZdZdZddd fdZxZS) SyncErrorz?A non-recoverable wire error (4xx that the client can't retry).Nstatusrr9rC Optional[int]cXt|||_dSr)superrrC)rrrC __class__s r!rzSyncError.__init__s& !!! r#)rr9rCrDrQrRrSrTr __classcell__rGs@r!rArAsPII@Dr#rAc$eZdZdZdfd ZxZS) SyncConflicta[CAS lost (409). NOT a rejection -- pushed objects are already durable. ``actual`` is the current head to merge against, or **None** when the ref does not exist server-side (the server reports that as an empty string). None means "there is nothing to merge against, retry as a create" -- it must never be fetched as an object. actualrrc~|pd|_t|jr d|jnddS)NzCAS conflict; actual head z(CAS conflict; the ref does not exist yet)rMrFr)rrMrGs r!rzSyncConflict.__init__sS&,^t  { < 6 6 6 6;     r#)rMrrrHrJs@r!rLrLsG           r#rLc~eZdZdZddd&d Zd'd Zd(dZddd)dZddd*dZddd+dZ ddd,dZ ddd-dZ d.d$Z d%S)/ SyncClientzJSync client bound to a base URL + bearer (routes under ``/v1/sync/``).g>@timeoutrgr9rbrRfloatc|d|_||_||_ddl}||_d||jjd<dS)NrurzBearer Authorization)r|rrbrRrequestsSession_sessionheaders)rrgrbrRrVs r!rzSyncClient.__init__s\OOC((    ((** 1D71D1D o...r#rrc@|jd|dS)Nz /v1/sync/ru)rlstrip)rrs r!_urlzSyncClient._url s$)88dkk#&6&6888r#rEc|j|d|j}|jdkrt d|j|j|S)z/`` silently returns the caller's personal refs instead of an error. Callers reading an org ref MUST pass ``org_scope=True``. zorg/refsrefsNre)paramsrRr_zget_refs failed: rBcg|]:}t|dd8|;S)rr)r9r7 startswith)r r_res r!r"z'SyncClient.get_refs..*sBTTT2RVVFB-?-?)@)@)K)KF)S)STBTTTr#r`)rrerdrrirbrhs ` r!get_refszSyncClient.get_refss'2zzF":6(: M  diioofdl  S S =C  ? ?? VVV VB##FB//  UUTTTTTTD r#obj_hashTuple[str, bytes]c|rd|nd|}|j|||j}|jdkrt d|dd|jdkrt d|d d|jd krt d |j|j|jd pt}||jfS) aGET /v1/sync/objects/:hash (or the org route when ``org_scope``). Kind comes from the object-type response header for tree/commit; a blob (application/octet-stream) is returned as ``blob``. Org objects are stored under the ``org:`` scope key and are NOT readable through the personal route (it scopes to the token's owner), so walking an org commit requires ``org_scope=True`` on every hop. z org/objects/zobjects/rQizobject z not foundrBz not readabler_zget_object failed: zX-HSP-Object-Type) rXr7r\rRrarArYrcontent)rrnrdrrbrs r! get_objectzSyncClient.get_object-s-6P(h(((;Ph;P;P M  diioot|  D D =C  :h:::3GGG G =C  =h===cJJJ J =C  A!-AA!-XXX Xy}}011>YQYr# commit_hashc|||\}}|tkrt|d|dtj|dS)z3Fetch a commit object and parse its canonical JSON.rcrz, expected commitr0)rsrrAr1r2r3)rrtrdrr-s r!get_commit_jsonzSyncClient.get_commit_jsonBsc__[I_FF d ;  {GGGGGHH Hz$++g..///r#rc|||\}}|tkrt|d|dtj|dS)z1Fetch a tree object and parse its canonical JSON.rcrz, expected treer0)rsrrAr1r2r3)rrrdrr-s r! get_tree_jsonzSyncClient.get_tree_jsonKsc__Y)_DD d 9  yCCdCCCDD Dz$++g..///r#rDict[str, Tuple[str, bytes]]cd|D}|j|d||rddind|j}|jdkrt dd |jd krt d |jd |jd vrt d |j|j |jr| niS)uPOST /v1/sync/objects (sync contract). Batch multi-object upload. Contract §1 requires raw object bytes on the wire (NOT base64-in-JSON), and specifies "a length-prefixed or multipart stream of {hash, type, bytes}". We use multipart/form-data: one part per object, the part's field name = the claimed ``sha256:`` hash, its ``filename`` carries the object ``type`` (blob|tree|commit), and the part body is the raw object bytes. The server recomputes each hash from the received bytes and rejects the whole batch with 422 on mismatch. Idempotent: a known hash is a no-op ``already_present``. M2 (contract §11.5): ``org_scope=True`` adds ``?scope=org`` so the objects land in the ORG scope (org-readable; required before an org CAS/propose). Gated server-side on the token's org_role claim. NOTE (framing choice within contract latitude): §4.2 says "length- prefixed OR multipart"; this picks multipart/form-data with (field=hash, filename=type, body=raw-bytes). The server strand must parse the same framing -- flagged for cross-strand alignment. c(g|]\}\}}|||dffS)zapplication/octet-streamrU)r hrr-s r!r"z*SyncClient.put_objects..qs=   q}>>q}UUU U9,qvvxxx",r#N)rgr9rbr9rRrS)rr9rr9rrE)rer9rdrrrf)rnr9rdrrro)rtr9rdrrrE)rr9rdrrrE)rryrdrrrE)rr9rrrrr9rrE) rQrRrSrTrr\r^rmrsrvrxrrrUr#r!rPrPs6IMEEEEEE9999 :?*>C,6;00000049000000 +-+-+-+-+-+-Z------r#rPc$tdz S)Nz .sync_staterrUr#r!_sync_state_pathrs === ((r#c$tdz S)Nz.sync_manifestrrUr#r!_legacy_sync_state_pathrs ==+ ++r#ct}|st}|r tj|d}t |trc|dd|dit| | n#t$rYnwxYw|Sn>#ttj f$r%}td|Yd}~nd}~wwxYwdidS tj|d}t |tr.|dd|di|Sn>#ttj f$r%}td|Yd}~nd}~wwxYwdidS) aRead the local sync state. Returns a default on missing/corrupt. Shape: ``{"head": "sha256:...|null", "skills": {name: {tree, commit}}}``. ``head`` is the last profile-root HEAD commit we reconciled with. Migrates a legacy ``.sync_manifest`` file (pre-rename) transparently: if the new ``.sync_state`` is absent but the legacy file exists, it is read and rewritten to the new path so an existing device keeps its head record. r0r1headNrz8skills_sync_client: legacy sync state migrate failed: %s)rrz.skills_sync_client: sync state read failed: %s)rrrr1r2r6r5r6rwrite_sync_stateunlinkrJSONDecodeErrorr\r])rlegacyr-r^s r!read_sync_staters    D ;;==,(** ==?? \ \z&"2"2G"2"D"DEEdD)) OOFD111OOHb111$T*** "K T12 \ \ \ WYZ[[[[[[[[ \+++Jz$..'.::;; dD ! !  OOFD ) ) ) OOHb ) ) )K  T) *JJJ EqIIIIIIIIJB ' ''sVA8C(CC( C"C(!C""C((D#>DD#,A*FG.GGrcddl}t} |jdd|t |jdd\}} t j|dd 5}tj ||d dd | t j | dddn #1swxYwYt j ||dS#t$r( t j|n#t $rYnwxYwwxYw#t"$r&}t$d|Yd}~dSd}~wwxYw)z3Write the local sync state atomically. Best-effort.rNTr4z .sync_state_z.tmp)rrer+wr0r1F)indentrIrKz/skills_sync_client: sync state write failed: %s)tempfilerrr8mkstempr9ryfdopenr1dumpflushfsyncfilenoreplace BaseExceptionrrr4r\r])r-rrfdtmpfr^s r!rrsOOO   DK $666""s4;'7'7W]"^^C 2sW555 % $!t%PPPP $$$ % % % % % % % % % % % % % % % JsD ! ! ! ! !     #        KKK FJJJJJJJJJKssA D,C75AC C7CC7CC77 D)DD) D$!D)#D$$D))D,, E6EEFrcclientdestrdc|dd|||}|dgD]E}|dd}|rd|vs|dvrtd |?||z }|d }|t krt ||d ||~|tkr||d |\} } | | |d tkri | j } | | tjztjztjz4#t$$rYAwxYwGd S)a)Write the tree at *tree_hash* into *dest* (created if needed). Blobs become files (with +x restored for ``exec`` mode), nested trees become subdirectories. Does NOT delete files absent from the tree -- the caller decides removal semantics. Refuses path traversal via entry names. Tr4rcrrrru)rz..z1skills_sync_client: skipping unsafe tree entry %rrrrN)r8rxr7r\warningrmaterialize_treerrs write_bytesrrrchmodrrrrr) rrrrdrentryrtargetr_r-sts r!rrs JJtdJ+++    Y  ? ?D)R((yy$$ sd{{dk&9&9 NNNPT U U U yy   9   VU6]Fi P P P P P Y  ''f 'KKGAt   t $ $ $yy  I--.BLLem!3em!Cem!STTTTD!s"AE99 FFOptional[PurePosixPath]cR ddlm}n#t$rYdSwxYw||}|dS |t }n#t tf$rYdSwxYwt| S)zGReturn the skill's path relative to ~/.hermes/skills/ (posix), or None.rrN) rrr4rrrrrras_posix)rrrrs r!_skill_rel_pathr%s5555555 tt ++It!!--kmm.C.C.E.EFF Z tt  ( ((s AA00BBr skill_names%Tuple[ObjectSet, str, Dict[str, str]]chddlm}t}i}i}tt |D]}t |}||}||! t |||} n3#t$r&} t d|| Yd} ~ `d} ~ wwxYw| ||<t|j } |} | ddD]} | | i} d| i| | d<d|D}| tt|}t!||| }|||fS) u?Build all objects for *skill_names* + the profile-root tree. Returns ``(objects, root_tree_hash, skill_tree_map)`` where ``skill_tree_map`` is ``{skill_name: tree_hash}``. Skills whose blobs exceed *max_object_bytes* are skipped (surfaced via logger). The root tree nests category directories: a skill at ``devops/foo`` yields a root entry ``devops`` (tree) containing ``foo`` (tree). Flat skills yield a direct root entry. The root tree also carries a ``sync-manifest`` BLOB (design.md §2.8) recording the per-skill opt-in state, so opt-in is durable + cross-device rather than a device-local ``.usage.json`` flag. Every skill in ``skill_names`` is recorded ``enabled: true`` (they ARE the opted-in set); the manifest is the authoritative record the plane + other devices read. rrNrz#skills_sync_client: skipping %s: %s__tree__ci|]}|dS)TrU)r rs r! z$snapshot_profile..es:::4D$:::r# manifest_hash)rrrr(rrrrr\rr8rrrrr,_build_root_tree)rrrrskill_tree_maprrrrrr^rnodepart manifest_mapr root_hashs r!snapshot_profiler5s&211111kkG%'NDs;''((22d###OD)) ;)+  "9gHXYYYII    NN@$ J J J HHHH  )tSY#2#J - -D??4,,DD%y1U2Y ;:>:::LKK,\::M!wmLLLI I~ --sA** B4BBrrrc8g}|D]\}}t|trBd|vr>t|dkr+||t |dt d\t||}||t |t d|)|tt|td| dt |d}| t t|S)u.Recursively canonicalize the nested root structure into trees. ``manifest_hash`` (only passed at the top level) adds a root-level ``sync-manifest`` BLOB entry (design.md §2.8) alongside the skill subtrees. It cannot collide with a skill dir (skill entries are trees; this is a blob). rrrNc|dSrrUrps r!rz"_build_root_tree..rr#rr)r)r5r6rrrrrSYNC_MANIFEST_ENTRY_NAMErrrrr*)rrrrrr r r s r!rrns1%'Gzz||   e eT " " zU':':s5zzQ NNy% :KU]^^    (w77H NNy(HUU     0!%!       LL((L)))!g66H ;;y"6x"@"@ A AAr#cd|dS)N refs/user//HEADrU)rhs r! user_head_refrs $ $ $ $$r#ncd|d|S)Nr /conflict/rU)rhrs r!user_conflict_refrs , , , , ,,r# 'SyncClient'rtc<|||dS)z,Return the tree hash referenced by a commit.rcr)rv)rrtrds r!_root_tree_of_commitrs"  ! !+ ! C CF KKr#root_tree_hashDict[str, str]c<idfd |dS) aFlatten a profile-root tree into ``{posix_rel_path: skill_tree_hash}``. A skill tree is any tree containing a ``SKILL.md`` blob entry. We walk the root tree; a subtree with a SKILL.md is treated as a skill leaf keyed by its path, so category nesting is preserved. rr9rerrcB| }|dg}td|D}|r |r| |<dS|D]I}|dtkr)|r |d|dn|d}|d|JdS)Nrcrc3K|];}|ddko|dtkV._walk..sV  KLAEE&MMZ ' FAEE&MMY,F      r#rrurr)rxr7anyr) rrerr has_skill_mdr^ child_prefix_walkrrdresults r!rz#_skill_trees_of_root.._walks##I#CC((9b))  PW       F &F6N F / /AuuV}} )):@O&661V9666ai ai... / /r#r)rr9rer9rrrU)rrrdrrs` `@@r!_skill_trees_of_rootrsS F / / / / / / / / / E." Mr#c ||}n3#t$r&}td|Yd}~dSd}~wwxYw|dgD]}|dt kr|dt kre ||d\}}n4#t$r'}td|Yd}~dSd}~wwxYwt|cSdS)uwRead the ``sync-manifest`` blob at the root of *root_tree_hash* into ``{name: enabled}`` (design.md §2.8), or ``None`` if there is no manifest entry / it is malformed. The manifest is a root-level BLOB entry named ``sync-manifest`` (never a skill subtree). This is how a device learns the cross-device opt-in state written by another device's push. z1skills_sync_client: manifest root read failed: %sNrrrrz2skills_sync_client: manifest blob fetch failed: %s) rxr4r\r]r7rrrsr>)rrrr^_kindr-exs r!read_manifest_of_rootrs(##N33  H!LLLtttttXXi $ $-- 55==4 4 4v)9S9S $//& :: tt    QSUVVVtttttt 't,, , , , 4s, AAA B?? C0 C++C0capsct|dpd}|ddd}|tkrt d|dtdd S) z|t}|d}|,t}|sddddSt||d}|t}|sddddS|}t |t |d pt}t|| \}} } t} | d } | r | d | krd| d ddSt} | r| gng}t| ||| ||}| |jt|} ||| ||| d <| | d <t#| d|t%|dS#t&$rv}|jsI||d||| d <| | d <t#| d|t%|ddcYd}~St+|||j| ||||| cYd}~Sd}~wwxYw)u#Push opted-in skills to the owner's HEAD (sync contract). Uploads all new objects, then CAS-es ``refs/user//HEAD``. On a 409, fetches the actual head, three-way merges, and retries once (§4.4 / M1-C). Returns a result dict; never raises for the inert / no-op cases. NrhFno sync base url configuredTokreasonnooprbzno skills opted into syncrrrr unchanged)rrrrrhrrr)rrpushed_objects)rrrrecovered_stale_head)rnrrPrr^rrr7DEFAULT_MAX_OBJECT_BYTESrrr<rrrrrrrrLrM_resolve_push_conflict)rrrrrhrr max_bytesrrrr+ base_headrrrtrefconflicts r! push_skillsrs#%% W E ~$&& X+HRVWW WD(9"566-// Q&A4PPP    D4DHH/00L4LMMI,[9UUUGY  H V$$I TX\\&))Y66IdSSS   F&.ykkBG7%QXK w'''   C sI{333&$"""K3w<<PPP      NN3k 2 2 2*HV (HV  X & & &#"%g,,(,        & Hhoy+ ['9         s,AF H&A H0H6HHH actual_headour_root our_commit 'ObjectSet'rc r|d} t} t||} |rt||nd} t||} t|| }| rt|| ni}i}g}t| t|zt|z}|D]}| |}||}||}t |||}|dkr||||||<u|dkr||||<|dkr||||<|dkr ||n|||<|rrt|| }t| |} | |d|n#t$rYnwxYwdd|t||t|d|d d St}|jD]\}\}}||f|j|<t!|||}t#|||g| | d || }||j | t'| ||n,#t$r} ddd | jd| jdcYd} ~ Sd} ~ wwxYwt+}!||!d<||!d<t-|!d|ddS)NrhoverlapourstheirseitherFTz' skill(s) changed on both sides; wrote z-. Resolve out-of-band (hermes sync / NAS UI).)rr conflict_refoverlapping_skillsrrzmerge: rzmerge CAS lost again (head now z); retry sync.)rrrrrr)rrmerged)r<rrrr7 _merge_skillr_next_conflict_indexrrrLr(rrrr)_assemble_root_from_skill_treesrrrrMrr)"rrrrrrrrrrhr theirs_root base_root ours_trees theirs_trees base_treesroverlaps all_pathsrotbdecisionrr  merge_objectsr|rr- merged_root merge_commitc2r+s" r!rrLs W E   F&v{;;K;DN$VY777$I%fh77J' <J J rr r cN||kr|dndS||k}||k}|r|sdS|r|sdSdS)aaThree-way decision for one skill's tree hash. Returns one of: ``ours``, ``theirs``, ``either``, ``overlap``, ``none``. Mirrors the origin/user/incoming decision block of skills_sync.py:619-643: a side "modified" the skill when its hash differs from the common base (analogous to ``_is_tracked_user_modification(origin, current)``). Nr noner r r rU)rr r  ours_changedtheirs_changeds r!rrs[ v~~+xx74> qq D ##uuVR  {{3""2& <<>> # KKD " " "" )CIIMM)s  **rc|t}|d}|,t}|sddddSt||d}|}t ||t |}d}|D]?}|dt |kr|d }n@|sdd ddSt}||d krdd |dd St||} t|| } g} t|| } | r ddl m } m}m}| D]@\}}|s||s||s!| |d| |An2#t$$r%}t&d|Yd}~nd}~wwxYwt+t-}g}| D]C\}}|r||vr t/|z }t1|||||D||d <t3|d|t5|t5| dS)aPull the owner's HEAD and materialize opted-in skills to disk. Fetches ``refs/user//HEAD``; if it advanced past our recorded head, walks the profile-root tree and writes each skill tree into ~/.hermes/skills/. Only paths the user has opted into (``sync: true``) are materialized, so a pull never resurrects a skill the user hasn't chosen. Best-effort; returns a result dict. NrhFrTrrbrrzno remote HEAD yetrzalready up to date)rrrrr)set_syncis_curation_eligibleis_sync_enabledz8skills_sync_client: manifest opt-in reconcile failed: %s)rrupdatedopt_in_adopted)rnrrPr^rrmrr7rrrrrr0r1r2r)rr4r\r]r_opted_in_rel_pathsrrrr()rrrhrrrhrrbr+ root_tree remote_treesreconciled_from_manifestremote_manifestr0r1r2snamerr^opted_inr3rrrs r! pull_skillsr<s$#%% W E ~$&& X+HRVWW WD(9"566    D4 ??=// 0 0D D  55==M%00 0 055==D E 1 J&:DIII  H x||F####&:DRVWWW$VT22I' ::L+-+FI>>O X X Y Y Y Y Y Y Y Y Y Y"1"7"7"9"9 ; ;w++E22&u--;HUD))),33E::: ; X X X LLSUV W W W W W W W W X&(())HG'--//i  H,, }}t#D111tHVX'?? !9::   s;AF G %GG cg}tD]:}t|}|'||;|S)z>>>  GUY ZZZttttts-#A(A(A(A(A(( B2BBc t}|dsdStsdStsdSt |S#t $r(}t d|dYd}~dSd}~wwxYw)zBest-effort pull if all gates pass. Returns a result dict or None. Never raises. Invoked at the curator tick sites (gateway housekeeping loop + CLI startup).riNr.z0skills_sync_client: maybe_pull_skills failed: %sTrA)rnr7rrr<r4r\r])rr^s r!maybe_pull_skillsrE`s #%%||L)) 4#%% 4$&& 4H----  GUY ZZZttttts'#AAAA B !BB cpddtttgdddddggd } t}d|d<|d|d<t |d|d<n=#t $rYn1t$r%}t d|Yd}~nd}~wwxYw t|d <td |d <n#t$rYnwxYw t}d|d <|d |d <|d|d<t|d<t|d |d<n=#t $rYn1t$r%}t d|Yd}~nd}~wwxYw|S)zBReturn a status snapshot for ``hermes sync status``. Never raises.FN) ri logged_infeature_enabledrrgopted_in_skills local_headrh org_availableorg_idorg_role org_skillsorg_skills_modifiedTrGrhriz3skills_sync_client: sync_status identity failed: %srIrrJrKrLrMrNrOz5skills_sync_client: sync_status org lookup failed: %s)rrrrnr7rrPr4r\r]rrresolve_org_identitylist_org_skill_names list_locally_modified_org_skills)rCrr^ org_identitys r! sync_statusrTrs1/11-//)++!#F&O#%%"{",,w//w#HLL$>$>??|      OOO JANNNNNNNNO $;$=$= !.0044V<<|       Q+-- "&'++H55x)--j99z355|(H 8 ) ) $%%      QQQ LaPPPPPPPPQ MsOAB C CB<<C5C;; DD A,E99 F3 F3F..F3cg} ddlm}|t}|s|St|z }|s|S|dD]Y}|j|}|jr6| t| ddZn2#t$r%}td|Yd}~nd}~wwxYwt|S)zESkill names present in the local org mirror (empty when none pulled).rread_active_org_idr\ruz0skills_sync_client: org skill listing failed: %sN)rrWr_org_dirrrrrrrr9rr4r\r]r()rrWrLrrrr^s r!rQrQs EL888888##KMM22 LzzF"{{}} L :.. : :H/--d33Cy : SXX--dC88999 : LLL GKKKKKKKKL %==s# B<&B< A/B<< C+C&&C+_orgc@t}|dpi}|d}|d}|stdt|tr|stdt ||d<||d<|S)u^Resolve identity + org context for org-skill operations. Returns ``resolve_identity()``'s dict extended with ``org_id`` and ``org_role``. Raises :class:`SyncInertError` when the token carries no ``org_role`` claim (personal org / issuer predates org support) — the caller should treat org sync as unavailable, NOT as an error. rjrLrMz,no organisation associated with this accountz4this account isn't a member of a shared organisation)rnr7rPr5r9)rrjrLrMs r!rPrPs !!H \\( # # )rF ZZ ! !Fzz*%%H MKLLL h $ $ H  B   VHX#HZ Or#cF tdS#t$rYdSwxYw)zETrue iff this token can see the org-skill surface (multi-member org).TF)rPr4rUr#r!org_sync_availabler]s:t uus   rLcr|ddd}tfd|DdS)ayCurrent ``refs/org//HEAD``, or None if the org has no content. Reads through the ORG endpoint. The personal refs route is scoped to the caller's own owner and answers an ``refs/org/...`` prefix with the caller's PERSONAL refs, so a personal-route read here silently reports "no org head" and every subsequent CAS races against a head it never saw. refs/org/ruTrcc3tK|]2}|dtk(|dV3dS)rrN)r7 org_head_ref)r rbrLs r!r"z!_read_org_head..sCJJqAEE&MM\&5I5I$I$I6$I$I$I$IJJr#N)rmnext)rrLrhs ` r!_read_org_headrdsQ ??0v000D? A AD JJJJDJJJD  r#cd|dS)Nr`rrUrLs r!rbrbs $v $ $ $$r#c.ttz S)z/``. Fast-forward only (design.md §2.6: no client merge on the org path): the mirror is replaced with the org HEAD's content. Local edits under _org/ are NOT merged — they are overwritten on pull; a member's change of record is `propose_skill` (the fork lives in their personal skills, not _org/). Returns {ok, org_id, head, updated} (updated = skill rel-paths written). rLz!no organisation context availableNno sync base URL configuredrbr~features.this server does not support org-shared skillsT)rrLrr3rcrrr4) fingerprintrz;skills_sync_client: org skill materialize failed for %s: %srrhrrr )rLrauthor_user_id author_devicer rz]skills_sync_client: %d org skill(s) have local edits AND upstream changes; left untouched: %sz, )rrLrr3 conflicted)rPrPrrPr^rr7rd_write_active_org_markerrvrrY_read_org_baseliner(r)rrorg_skill_is_locally_modifiedrshutilrmtreer8r_skill_dir_fingerprintr4r\r_write_org_provenance_write_org_baselinerr*)rrrLrgrr head_commitr6r& dest_rootr3robaselinerel_pathrrprevrsr^s r!pull_org_skillsr} s1/11Hx@AAA h F ~(** @ !>?? ?Hhy&9::    D4 TXXj))/R00MNNN && ) )D V$$$ KfdrJJJ(((>>KF#I&vyDIIIK V#IGJ!&))H%k&7&7&9&9::)=222 {{}} $ 16BB#<<117RDxx''944"))(333  d### JJtdJ 3 3 3 VY E E E E5d;;!""HX  NN8 $ $ $ $    NNM         *x88>BCCGRPP)ooh77=2BB8RPP//$++      )))  *  OO IIj ! !       s %A)H=A-H== I.I))I.cttj} td|dDD]}|t ||ddd|d|| |dn4#t$r'}t d||Yd}~d Sd}~wwxYw| S) aStable content hash of a materialized skill directory. Used to tell "the user/agent edited this org skill" from "this is exactly what upstream shipped". Hashes every file's relative path + bytes, sorted, so it is independent of filesystem ordering and mtimes. c3BK|]}||VdSr)r)r rs r!r"z)_skill_dir_fingerprint..s/BBaaiikkBBBBBBBr#*rXrur0z1skills_sync_client: fingerprint failed for %s: %sNr)r@rAr(rupdater9rrrMrrr\r]rB)rr|rr^s r!ruru{s ABB4::c??BBBBB  A HHSt,,--55dC@@GGPP Q Q Q HHUOOO HHQ\\^^ $ $ $ HHUOOOO    H$PQRRRrrrrr ;;==sCC22 D#<DD#c6ddlm}t|z |z S)zBSidecar recording the upstream fingerprint of each mirrored skill.r)ORG_BASELINE_FILE)rrrY)rLrs r!_org_baseline_pathrs)333333 :: !2 22r#c tjt|dS#t$ricYSwxYw)Nr0r1)r1r2rr6r4rfs r!rqrqsUz,V44>>>PPQQQ  s47 AArzc t|}|jdd|t j|ddddS#t $r&}td|Yd}~dSd}~wwxYw)NTr4r)rrIr0r1z-skills_sync_client: baseline write failed: %s) rrr8r9r1rLr4r\r])rLrzrr^s r!rwrwsI v & & td333 TZdCCCg VVVVV III DaHHHHHHHHHIsAA B %BB skill_rel_pathc>t|z t|z }|sdSt||pi}t |t r|dn|}|sdSt||kS)zITrue when the local copy of an org skill differs from what upstream sent.Frl)rYrrrqr7r5r6ru)rrLrrrecordeds r!rrrrs :: ~!>!> >D ;;==u v & & * *> : : @bE+5eT+B+BMuyy'''H u !$ ' '8 33r#c ddlm}p|tsgSt}t fd|DS#t $r'}t d|gcYd}~Sd}~wwxYw)z7Org skills with local edits that upstream has not seen.rrVc3<K|]}t||VdSr)rr)r rrLs r!r"z3list_locally_modified_org_skills..sG  'DS&'Q'Q       r#z,skills_sync_client: modified-scan failed: %sN)rrWrrqr(r4r\r])rLrWrzr^s` r!rRrRs 888888<--kmm<< I%f--    #        CQGGG s""A)A BA<6B<Bc ddlm}t}|dd||z |ddS#t $r&}t d|Yd}~dSd}~wwxYw) zBRecord which org's mirror may resolve (best-effort, never raises).rORG_ACTIVE_MARKERTr4r0r1z6skills_sync_client: active-org marker write failed: %sN)rrrYr8r9r4r\r])rLrrr^s r!rprpsR777777zz 4$ /// ! !--fw-GGGGG RRR MqQQQQQQQQQRsAA A9A44A9c& ddlm}t|z }|dd||z t j|ddd S#t$r&}t d |Yd }~d Sd }~wwxYw) zDPersist the org HEAD provenance sidecar (best-effort, never raises).r)ORG_PROVENANCE_FILETr4r)rr0r1z3skills_sync_client: org provenance write failed: %sN) rrrYr8r9r1rLr4r\r])rLr-rrr^s r!rvrvs O999999zzF" 4$ /// # #// JtA & & & 0      OOO JANNNNNNNNNOsAA B*B  Br@c|p t}|d}|5t}|stdt||d}|}t |d|dpgvrtdt|dpt}t|}|td |d t|z } | d z std |d t} t| | | } d} | dz } t||} | r%t!|| d}t#||d}ni}| |t%|<t'||| }t)|| r| gng|dt+|pd|| }|| jd |t3|| |}nZ#t4$rM}| t6krtd| dd|t8d|j| Yd}~'d}~wwxYw|dr/dd|d|d||dSdd|d|||dS) uPropose a local skill's current content to the org canonical set. Snapshots the LOCAL (personal) skill directory as an org-scoped commit layered on the current org HEAD tree (splice/replace that one skill subtree), uploads the objects with ``?scope=org``, then CAS-es the org HEAD (contract §11.5): - ADMIN/OWNER token → the server merges directly → ``{ok, merged: True}``. - MEMBER token → the server converts to a proposal (202) → ``{ok, proposal_pending: True, proposal_id, ref}``. NEVER presented as live/merged. Non-interactive by design — an automated submitter (curator hook) drives this exact function later (Ben's automation trajectory). rLNrirbr~rjrkrzskill 'z ' not found under the skills dirrz' has no SKILL.mdrrTrrcrhzpropose rzEthe organisation's skills changed while this was being proposed, and uA attempts to catch up all lost the race — run the command againrrBzCpropose_skill: org HEAD moved (actual=%r), re-splicing (attempt %d)r proposal_idr)rrrrrrLr)rrrrrL)rPrrPrPr^rr7rrrrArrrrrdrrr9rrr<rrrrbrL_ORG_CAS_MAX_ATTEMPTSr\r]rM)rrrrrLrgrrrrr skill_treeattemptsrr skill_maprrtrrs r! propose_skillrsm,1/11H h F ~(** @ !>?? ?Hhy&9::    D4 TXXj))/R00MNNNDHH/00L4LMMI * % %C {N*NNNOOO #I  " * * , ,A?*???@@@kkGIwKKKJH%A "6622  ,VY$OOOI,VY$OOOIII( #c((3FIwOO " $ ,YKK"7##%%66*66     7?d;;; ^^L$8$8)[QQF    0009%-999    LLU    HHHH zz$%%  $!::m44::e$$!     6;//   s5$H I1$AI,,I1c t}n#t$r^ t}|dpi}|dst n#t $rYnwxYwYdSt $r&}t d|Yd}~dSd}~wwxYw tsdStsdSt|S#t $r&}t d|Yd}~dSd}~wwxYw)uBest-effort org pull if all gates pass. Never raises; None when inert. Gates (all must hold): logged in, org_role claim present (multi-member org), feature enabled, base URL configured. Personal orgs are inert here by construction — resolve_org_identity raises SyncInertError without the claim. Marker hygiene: when the token VERIFIABLY lacks the org claim (logged in, personal org / left the org), the active-org marker is cleared so previously-mirrored org skills stop resolving. When we simply cannot resolve identity (offline, logged out), the marker is left alone — offline grace keeps already-pulled org skills working. rjrMNz:skills_sync_client: maybe_pull_org_skills inert/failed: %sr.) rPrPrnr7_clear_active_org_markerr4r\r]rrr})r base_identityrjr^s r!maybe_pull_org_skillsrRsd'))     ,..M"&&x006BF::j)) +(***    D tt  H!   ttttt  #%% 4$&& 41111  H!   ttttt sc B'AA%$B'% A2/B'1A22B'8 B'B""B'+C;C C D %DD c$ ddlm}t|z }|r0|t ddSdS#t$r&}t d|Yd}~dSd}~wwxYw)z9Remove the active-org marker (org skills stop resolving).rrzgskills_sync_client: cleared active-org marker (token has no org workflow); org skills no longer resolvez+skills_sync_client: marker clear failed: %sN) rrrYrrr\infor4r])rmarkerr^s r!rr~s G777777// ==??  MMOOO KKL        GGG BAFFFFFFFFFGsAA B)B  B)rrrr)r-rrr.)r-rrr9)rDrErr)rVr9rrEr)rr)rrr)r:rrr)rr9rr9rrrr)rr)rr9rr)rr)rrrr9)rrrrrrrr9)rr9rrrhr9rr9rr9rrr rrrr9)rr9)rr9rr9)r-rErr) rrPrr9rrrdrrr)rr9rr)rrrrrr)rrErrrrrrr9)rhr9rr9)rhr9rrrr9)rrrtr9rdrrr9)rrrr9rdrrr)rrrr9rr.)rrErrr) rrrrrrrr9rrE)rrrrErr9rr9rr9rrrrrr9rrrrrE)rrrr rrr rrrr9)rrr&rrrrr9)rrrhr9rr)rrrrrrE)rr9rr)rr)rrrLr9rrr)rLr9rr9)rLr9rr)rLr9rrE)rLr9rzrErr)rr9rLr9rr)rLrrrr)rLr9rr)rLr9r-rErr) rr9rrrrrrrrrEr)rrT __future__rr@r1loggingrytimerrrrpathlibrrtypingrr r r r r getLoggerrQr\rrrrrrrrrrr&r'r,r>rCr*rl RuntimeErrorrPr_rnrqr~rrrrrrrrrrrrrrrrr.r<r?rArLrPrrrrrrrrrrrrrrrrrrrr<r5rCrErTrQrrPr]rrdrbrYr}rurrqrwrrrRrprvrrrrUr#r!rs44l#"""""  ''''''''''''''''================  8 $ $ #       2+$****$!!!!Z8888 <(\(####L*C))))^ #"" ( ( (    $ N N N N& \ \ \ \0(((( <$$$$NJ!!!!!!!!$&B&B&B&BbFFFFFF8>>>>&####L2      <   *a-a-a-a-a-a-a-a-f)))),,,,$($($($(NKKKK:JOP ) ) ) )"8P6.6.6.6.6.6.tQUBBBBBBL%%%%---- BGLLLLLLEJ:6    &*K (,)-& K K K K K K D\>\>\>\>~(++++& * * * *(&*R*.RRRRRRj&)<&$0000fP .    %%%%(((( &*k*.kkkkkk\(3333IIII 4 4 4 4" R R R R O O O O &*p*.! ppppppf))))X G G G G G Gr#