Jjo.UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZmZmZmZmZmZddlmZejeZeZee d<ded eefd Z!ded e"d dfd Z#ej$d kZ%ej&dZ'e(hdZ)e(e*e d<de*d dfdZ+iZ,ee*efe d<iZ-ee*ee.e.e.e.ee*efee*ee*fffe d<iZ/ee*ee.e.ee*efffe d<e j0Z1e(hdZ2ddl3Z3ddl4m5Z5m6Z6ddl7m8Z8m9Z9dZ:dddddZ;d ee*fdZdZ?d ee*fd Z@dLd!eed efd"ZAdLd!eed e*fd#ZBd e=fd$ZCdLd%e*d!eed dfd&ZDd e=fd'ZEd%e*d e*fd(ZFd e*fd)ZGd*ZHd e*fd+ZIdMd-e*d e*fd.ZJdNd-e*fd0ZKd eeLfd1ZMdd2lNmOZOdd3lPmQZQmRZRd efd4ZSd efd5ZTd efd6ZUd eVee.ee.ffd7ZWdOd8ZXd9ZYd e=fd:ZZd;Z[dZ]ddAid?dKdid@ddAddAddAdBdCddDdCgddEdCdFdWdGidHdIgdWdddddJddWdKdddLddWdWddLdMdNidOdAdPdWdAdAidQdRdWdAdAdWdddWdd?dWddd@dAdBddddWddCdDdEdFdddWddGdHdIddddWddJdKdLdMdWdddNdOdPddddWddQdRdSdTdUdgdWdVdWdXdYdZd[dUdgdWdVdWd\d]d^d_dUdgdWdVdWid`dadbdddVdWddcdddedddVdWddfdgdhdddVdWddidjdkdddVdWddldmdnddWdVdWdddodpdqdUdgdWdVdWdrdsdtdudUgddVdWdvdwdxdydUgdWdVdWdzd{d|d}d~dgdWdVdWdddd}d~dgddVdWddddd~dgdWdVdWdddd~dgddVdddddgdddVdWdddddd~dgddVdWddddd~dgdWdVdWdddddddgdWdVdWdddddgdWdVdWiddddddgdWdVdWddddddgdWdVdWdddddWdVddddddWdVddddddWddWddddddWddWddddddWddWddddddWddWddĐdŐdƐdǐdgdWdVdWdɐdʐdːdVd̜d͐dΐdϐdАdgdWdVdWdҐdӐdԐdVdWd՜d֐dאdؐdِdgdWdVdWdېdܐdݐdސdgdWdVdWdddddgdWdVdWddddVdWd՜dddddgdWdVdWiddddgdWdVdddddVdWd՜ddddddVddddddWdVdddddddVdWddddddWdddddddddddd ddd d d d ddWddddddddddddddddddddddWddddddddWdddd d!d"ddddd#d$d%d&dddd'd(d)ddWddd*d+d,ddddid-d.d/ddddd0d1d2ddddd3d4d5d6dddd7d8d9ddWddd:d;dd?ddddd@dAdBddddWddCdDdEddddWddFdGdHddddWddIdJdKddddWddLdMdNddddWddOdPdQddWddWddRdSdTdUddddVdWdXddWdddYdZd[ddddd\d]d^dd̜d_d`dadbddcidddedfdWdd dgdhdidd̜djdkdldd̜dmdndodd̜dpdqdrdd̜dsdtdudd̜dvdwdxdd̜dydzd{ddddd|d}d~ddddddddddddddddWddWddddddWddWddddddddWddddddddWddddddWddWddddddddWddddddddWdddddddWdddddddWdddddWddWdddddddddddddddddWddddddWddddddddddddddd ZbdPde=d eee*effdZcde*fdZddWdWdddee*efde=de=de=d ee*eff dZed eee*effdZfd eee*effdZgeZhee d<de*de*de*ded df dZidAddede*d eee*effdZjdAddede*d eee*effdZkded eee*effd„Zl dLdeee*efd eee*effdĄZmded ee=fdƄZn dQde*deeee*efdeee*efd ee*effdɄZo dQdee*efde*deeee*efdeee*efd df d˄Zpded ee*e*ffd̈́Zq dQde*deeee*efdeee*efd ee*e*ffd΄Zr dQdee*efde*deeee*efdeee*efd df dτZs dQd@e*de*deeee*efdeee*efd ee.f dЄZtded e.fdфZud ee.e.ffd҄ZvhdӣZwhdԣZxhdգZyeGdքdצZzdLdeee*efd edfd؄Z{dLdeee*efd dfdلZ|dLdeee*efd dfdڄZ}dee*efd dfdۄZ~dRde=de=d ee*effdބZd%eLdeLd eLfdZdeLded eeLeffdZdZdLdZdZdLdZdee*efd eee*dffdZe_dfdee*efdee*efdeeee*dfd ee*effdZdee*efd ee*effdZdee*efd ee*effdZdddeee*efde*ded efdZd ee*effdZdLdeed dfdZdededed dfdZd ee*effdZd ee*effdZddde*de*dede=d df dZidfddhddiddkddddrddtddvddxddyddd d d d d dddzdd|ddddddddddddddd Zded e*fd Zde*d ee*fd!Zdddd"d#eee*e*fdeee*efdee=d ee*e*ffd$Zd%e=d ee*effd&Zd'Zd(Zd)ZdWdd*dee*efd+e=deeee*dffd,Zd-e*d e*fd.Zd ee*e*ffd/Zdaeeee*eeee.fee*e*ffe d0<dOd1Zd2Zde*d e=fd3Zd4ed efd5Zd e.fd6Zde*de*d e*fd7Zde*d e*fd8Zde*de*fd9Zde*d e=fd:ZdLde*fd;ZdLd<ZdLde*fd=Zde*de*d ee*effd>Zd e.fd?Zde*d ee*fd@Zde*d ee*fdAZde*d e*fdBZe(hdCZdSdedDe.d efdEZdFZdGZde*de*fdHZdIZdadOdJZedadOdKZedS(Ta Configuration management for Hermes Agent. Config files are stored in ~/.hermes/ for easy access: - ~/.hermes/config.yaml - All settings (model, toolsets, terminal, etc.) - ~/.hermes/.env - API keys and secrets This module provides: - hermes config - Show current configuration - hermes config edit - Open config in editor - hermes config set - Set a specific value - hermes config wizard - Re-run setup wizard N) dataclass)Path)DictAnyOptionalListTupleSet)masked_secret_prompt_CONFIG_PARSE_WARNED config_pathreturnc* |rdS|}|jdkrdStjd}||jd|d}t|j |jd}|D]8} |j|jkrdS)#t$rY5wxYw| rdStj |||S#t$rYdSwxYw)uPreserve a corrupted ``config.yaml`` by copying it to a timestamped ``.bak``. When the YAML can't be parsed, ``load_config()`` silently falls back to ``DEFAULT_CONFIG`` and the user's broken file stays on disk untouched. That file is still the user's only copy of their intended overrides — if they re-run the setup wizard or ``hermes config set`` (which rewrites ``config.yaml``), the broken-but-recoverable content is gone for good. This snapshots the corrupted file to ``config.yaml.corrupt..bak`` so the user can diff/repair it. Unlike Gemini CLI's policy-file recovery (which resets the live file to a clean state), we deliberately leave ``config.yaml`` in place: hermes never silently mutates the user's config, and leaving it means a hand-fixed file is re-read on the next load. The backup is best-effort — any failure (permissions, symlink, disk full) is swallowed so config loading is never blocked by backup problems. Returns the backup path on success, else ``None``. Symlinks are not followed/copied (mirrors the Gemini #21541 lstat guard) to avoid clobbering whatever a malicious/misconfigured symlink points at. Nrz %Y%m%d-%H%M%Sz .corrupt.z.bakz.corrupt.*.bak) is_symlinkstatst_sizetimestrftime with_namenamelistparentglobOSErrorexistsshutilcopy2 Exception)r stts backup_path sibling_baksexistings 7/home/rurouni/.hermes/hermes-agent/hermes_cli/config.py_backup_corrupt_configr%*s[*  ! ! # # 4      :??4 ]? + +!++{/?,R,R",R,R,RSS    # #{'7$G$G$G H H  %  H ==??*bj88 449          4 [+... ttsLDDA'D!"CDD CDCD-D DDexcc |}t||j|jf}n"#t$rt|ddf}YnwxYw|t vrdSt |t|}d|d|d}| |d|dz }t | tj d|d tj dS#t$rYdSwxYw) aSurface a config.yaml parse failure to user, log, and stderr. A YAML parse error in ``~/.hermes/config.yaml`` causes ``load_config()`` to silently fall back to ``DEFAULT_CONFIG``, which means every user override (auxiliary providers, fallback chain, model overrides, etc.) is dropped. Before this helper that was a one-line ``print(...)`` that scrolled off-screen on the first invocation and was never seen again. Now: warn once per (path, mtime_ns, size) on stderr **and** in ``agent.log`` / ``errors.log`` at WARNING level so ``hermes logs`` surfaces it. Re-warns automatically if the file changes (different mtime/size), so users editing the config see the next failure. On the first warning for a given broken file we also snapshot it to a timestamped ``.bak`` (best-effort) so the user's recoverable content survives any later rewrite of ``config.yaml`` by the setup wizard or ``hermes config set``. rNzFailed to parse : u. Falling back to default config — every user override (auxiliary providers, fallback chain, model settings) is being IGNORED. Fix the YAML and restart.z+ A copy of the corrupted file was saved to .u⚠️ hermes config:  )rstr st_mtime_nsrrr addr%loggerwarningsysstderrwriteflushr)r r&rkeyr!msgs r$_warn_config_parse_failurer6`sQ$'     ;< ''';A&' """S!!!(55K %; % %# % % %  K[KKKK NN3  :3:::;;;       s"03AA8AC;; D D Windowsz^[A-Za-z_][A-Za-z0-9_]*$>PATHPAGERSHELLEDITORVISUALBROWSERLD_AUDITLD_DEBUG GIT_SHELL NODE_PATH HERMES_ENV LD_PRELOAD PYTHONHOME PYTHONPATH HERMES_HOME NODE_OPTIONS GIT_EXEC_PATH HERMES_CONFIG PYTHONSTARTUPHERMES_PROFILEPYTHONUSERBASEGIT_SSH_COMMANDLD_LIBRARY_PATHPYTHONEXECUTABLEPYTHONNOUSERSITEDYLD_LIBRARY_PATHDYLD_FRAMEWORK_PATHDYLD_INSERT_LIBRARIESDYLD_FALLBACK_LIBRARY_PATHDYLD_FALLBACK_FRAMEWORK_PATH_ENV_VAR_NAME_DENYLISTr4c>|tvrtd|ddS)zRaise if ``key`` is in :data:`_ENV_VAR_NAME_DENYLIST`. Centralised so both the regular and "secure" env writers share the same gate, and so the message is consistent for callers. zEnvironment variable a is on the writer denylist. Names that influence subprocess execution (LD_PRELOAD, PYTHONPATH, PATH, EDITOR, ...) or Hermes runtime location (HERMES_HOME, HERMES_PROFILE, ...) cannot be persisted via the env writer. If you really need this, edit ~/.hermes/.env directly.N)rV ValueError)r4s r$_reject_denylisted_env_varrYs@  $$$ 'C ' ' '   %$_LAST_EXPANDED_CONFIG_BY_PATH_LOAD_CONFIG_CACHE_RAW_CONFIG_CACHE>gIRC_PORT QQ_APP_ID IRC_SERVER IRC_CHANNEL IRC_USE_TLS IRC_NICKNAME QQ_STT_MODEL TERMINAL_ENV WECOM_BOT_ID WECOM_SECRET WEIXIN_TOKEN FEISHU_APP_ID WHATSAPP_MODEOPENAI_API_KEYQQ_STT_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENMATRIX_PASSWORDOPENAI_BASE_URLQQ_HOME_CHANNELQQ_STT_BASE_URLSIGNAL_HTTP_URLWEIXIN_BASE_URLMATRIX_DEVICE_IDMATRIX_HOME_ROOMQQ_ALLOWED_USERSQQ_CLIENT_SECRETSMS_HOME_CHANNELTERMINAL_SSH_KEYWEIXIN_DM_POLICYWHATSAPP_ENABLEDANTHROPIC_API_KEYFEISHU_APP_SECRETLANGFUSE_BASE_URLMATRIX_ENCRYPTIONTERMINAL_SSH_PORTWEIXIN_ACCOUNT_IDDINGTALK_CLIENT_IDFEISHU_ENCRYPT_KEYMATRIX_AUTO_THREADQQBOT_HOME_CHANNELQQ_ALLOW_ALL_USERSSLACK_HOME_CHANNELWECOM_HOME_CHANNELFEISHU_HOME_CHANNELHERMES_LANGFUSE_ENVIRC_SERVER_PASSWORDLANGFUSE_PUBLIC_KEYLANGFUSE_SECRET_KEYMATRIX_RECOVERY_KEYQQ_MARKDOWN_SUPPORTSIGNAL_HOME_CHANNELWECOM_CALLBACK_HOSTWECOM_CALLBACK_PORTWEIXIN_CDN_BASE_URLWEIXIN_GROUP_POLICYWEIXIN_HOME_CHANNELBLUEBUBBLES_PASSWORDDISCORD_HOME_CHANNELHERMES_TOOL_PROGRESSQQ_HOME_CHANNEL_NAMESIGNAL_ALLOWED_USERSWECOM_CALLBACK_TOKENWEIXIN_ALLOWED_USERSYUANBAO_HOME_CHANNELDINGTALK_HOME_CHANNELHERMES_LANGFUSE_DEBUGIRC_NICKSERV_PASSWORDMATRIX_DM_AUTO_THREADMATTERMOST_REPLY_MODESMS_HOME_CHANNEL_NAMETELEGRAM_HOME_CHANNELBLUEBUBBLES_SERVER_URLDINGTALK_CLIENT_SECRETMATRIX_REQUIRE_MENTIONQQ_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_IDWEIXIN_ALLOW_ALL_USERSHERMES_LANGFUSE_RELEASEMATTERMOST_HOME_CHANNELQQBOT_HOME_CHANNEL_NAMESLACK_HOME_CHANNEL_NAMEWECOM_CALLBACK_AGENT_IDWECOM_HOME_CHANNEL_NAMEBLUEBUBBLES_HOME_CHANNELFEISHU_HOME_CHANNEL_NAMESIGNAL_HOME_CHANNEL_NAMEWEIXIN_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNEL_NAMEFEISHU_VERIFICATION_TOKENHERMES_LANGFUSE_MAX_CHARSHERMES_TOOL_PROGRESS_MODEYUANBAO_HOME_CHANNEL_NAMEDINGTALK_HOME_CHANNEL_NAMEMATRIX_FREE_RESPONSE_ROOMSSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_HOME_CHANNEL_NAMEWECOM_CALLBACK_CORP_SECRETWEIXIN_GROUP_ALLOWED_USERSHERMES_LANGFUSE_SAMPLE_RATEMATTERMOST_HOME_CHANNEL_NAMEBLUEBUBBLES_HOME_CHANNEL_NAMEWECOM_CALLBACK_ENCODING_AES_KEY)Colorscolor)DEFAULT_SOUL_MDis_legacy_template_soul)true1yesHomebrewNixOS)brewhomebrewnixnixosctjdd}|r:|}|tvrdSt ||Stdz }|rdSdS)z7Return the package manager owning this install, if any.HERMES_MANAGEDrz.managedN) osgetenvstriplower_MANAGED_TRUE_VALUES_MANAGED_SYSTEM_NAMESgetget_hermes_homer)raw normalizedmanaged_markers r$get_managed_systemr@s )$b ) ) / / 1 1C :YY[[ - - -7$((S999$&&3Nw 4rZc"tduS)aCheck if Hermes is running in package-manager-managed mode. Two signals: the HERMES_MANAGED env var (set by the systemd service), or a .managed marker file in HERMES_HOME (set by the NixOS activation script, so interactive shells also see it). N)rrZr$ is_managedrOs   t ++rZzfUpdate your Nix flake input and rebuild (e.g. nix flake update, nixos-rebuild, or home-manager switch)cLt}|dkrdS|dkrtSdS)z;Return the preferred upgrade command for a managed install.rbrew upgrade hermes-agentrN)r_NIX_UPDATE_MSG)managed_systems r$get_managed_update_commandr\s4'))N##**   4rZ project_rootcj||SttjjS)uResolve the directory that holds the *running code* (the install tree). This is the parent of ``hermes_cli/`` — i.e. the git checkout for source installs, ``/opt/hermes`` inside the published image, the venv's site-packages root for pip installs. It is a property of the running interpreter, NOT of ``$HERMES_HOME``, which is why a code-scoped stamp here is immune to two installs sharing one data directory. r__file__rresolve)rs r$_install_method_project_rootrfs. >> ' / / 1 11rZcRt|} |dz d}|r|Sn#t$rYnwxYw t dz d}|r|dkrt r|Sn#t$rYnwxYwt}|r(|ddS|dz rdSd S) u Detect how Hermes was installed: 'docker', 'nixos', 'homebrew', 'git', or 'pip'. Resolution order: 1. Code-scoped stamp ``/.install_method`` (next to the running code) — the authoritative marker. 2. Legacy home-scoped stamp ``$HERMES_HOME/.install_method`` — read for backward compatibility, but a ``docker`` value is IGNORED when we are not actually running inside a container (see below). 3. HERMES_MANAGED env / .managed marker (NixOS, Homebrew) 4. .git directory presence -> 'git' 5. Fallback -> 'pip' Why the stamp is code-scoped, not home-scoped (issue: shared ``~/.hermes``) -------------------------------------------------------------------------- The install method describes *the binary that is running*, but ``$HERMES_HOME`` is a shared DATA directory — the Docker docs deliberately bind-mount it (``~/.hermes:/opt/data``) so config/sessions/memory persist and can be shared with a host-side Desktop/CLI install. When a containerised gateway and a host install share one ``$HERMES_HOME``, a home-scoped stamp is a single slot describing two different installs: the container stamps ``docker`` on every boot, the host install then reads ``docker`` and ``hermes update`` refuses to run ("doesn't apply inside the Docker container") even though the host binary is a perfectly updatable git/pip install. Scoping the stamp to the install tree gives each install its own truthful marker. Self-healing for already-poisoned homes: a legacy ``docker`` value in the home-scoped stamp is only honoured when we are genuinely in a container. On a host install that read a contaminating ``docker`` stamp, we fall through to managed/.git/pip detection instead — so existing shared-home setups recover without the user touching anything. Note: running inside a container is NOT treated as "docker" on its own. The supported installs self-identify via the code-scoped stamp: - the curl installer (scripts/install.sh, the README/website install command) git-clones the repo and stamps ``git`` next to the code; - the published ``nousresearch/hermes-agent`` image bakes a ``docker`` stamp into ``/opt/hermes`` at build time. An unsupported manual install dropped into a container (no stamp) falls through to the ``.git``/pip checks and behaves like any off-path install. See issue #34397. .install_methodutf-8encodingdocker -z.gitgitpip) r read_textrrrr_running_in_containerrreplaceis_dir)rrootmethodmanageds r$detect_install_methodrtsRV ( 5 5D **55w5GGMMOOUUWW  M           !2 2 YY ( ( UWW UWW   6X--6K6M6M-M      !""G1}}&&sC000 v u 5s%AA A A $A C CCcF ddlm}|S#t$rYdSwxYw)zDThin wrapper around ``hermes_constants.is_container`` (import-safe).r is_containerF)hermes_constantsrrrs r$rrsG111111|~~ uu   rct|} |dd|dz |dzddS#t$rYdSwxYw)a<Write the install method next to the running code (code-scoped stamp). The stamp lives in the install tree (``/.install_method``), not in ``$HERMES_HOME``, so that two installs sharing one data directory do not overwrite each other's marker. See ``detect_install_method`` for the full rationale. Best-effort: if the install tree is read-only (e.g. the immutable ``/opt/hermes`` in the published image, which instead bakes the stamp at build time) the write silently no-ops and detection falls back to its other signals. Tparentsexist_okrr*rrN)rmkdir write_textr)rrrs r$stamp_install_methodr sw ( 5 5D  4$ /// ! !--ftmg-NNNNN      s4A AAcdtdtfd}|tjrdS|tjpdrdSdS)aReturn True when the *running* Hermes lives in a ``uv tool`` layout. ``uv tool install hermes-agent`` places the install at ``.../uv/tools/hermes-agent/...`` (default ``~/.local/share/uv/tools``, or ``$UV_TOOL_DIR/...``). Such installs live outside any virtualenv, so ``uv pip install`` fails with ``No virtual environment found`` and the update path must use ``uv tool upgrade`` instead. Detection is intentionally restricted to properties of the running interpreter (``sys.prefix`` / ``sys.executable``). We deliberately do NOT consult ``uv tool list``: it would also return True when ``hermes-agent`` happens to be uv-tool-installed on the machine while the *active* Hermes is a regular pip/venv install, causing ``hermes update`` to upgrade the wrong copy. It would also block on a subprocess call (~seconds) just to compute a recommendation string. pathrctj|tjd}d|dzvS)N/z/uv/tools/hermes-agent/)rrnormpathrsepr)rnorms r$_has_uv_tool_markerz/is_uv_tool_install.._has_uv_tool_markersDw%%--bfc::@@BB(D3J66rZTrF)r+boolr0prefix executable)rs r$is_uv_tool_installrsd"7#7$77773:&&t3>/R00t 5rZc|dkrtS|dkrdS|dkrdS|dkr(trdSdd l}|jd rd Sd Sd S)zAReturn the update command or guidance for a given install method.rrrrz,docker pull nousresearch/hermes-agent:latestrzuv tool upgrade hermes-agentrNuvz%uv pip install --upgrade hermes-agentz"pip install --upgrade hermes-agentz hermes update)rrrwhich)rrs r$%recommended_update_command_for_methodrs  ** ==     211 6<   ;::33 ?rZc`t}|r|St}t|S)z C C CrZmodify configurationcVtt|tjdS)z+Print user-friendly error for managed mode.fileN)printr'r0r1)r$s r$ managed_errorr-gs&  ( (sz::::::rZctjddkrdSddlm}|rdSt dz } i}t |dd 5}|D]q}|}d |vrW|d sB| d \}}}|||<r dddn #1swxYwYn#t$rYdSwxYw|d d }|dd} |dd} |dd} || | | dS)aRead container mode metadata from HERMES_HOME/.container-mode. Returns a dict with keys: backend, container_name, exec_user, hermes_bin or None if container mode is not active, we're already inside the container, or HERMES_DEV=1 is set. The .container-mode file is written by the NixOS activation script when container.enable = true. It tells the host CLI to exec into the container instead of running locally. HERMES_DEVrNrrz.container-moderrr=#backendrcontainer_namez hermes-agent exec_userhermes hermes_binz /data/current-package/bin/hermes)r3r4r5r7) renvironrrrropenr startswith partitionFileNotFoundError) rcontainer_mode_fileinfofliner4_valuer3r4r5r7s r$get_container_exec_inforCps z~~l##s**t------|~~t)++.??  %sW = = = 6 6 6zz||$;;ts';';;$(NN3$7$7MCE(- D%  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 tthhy(++GXX.??Nh//I,(JKKJ(   s7 C,A5C  C, C$$C,'C$(C,, C:9C:r)atomic_replacefast_safe_loadc$tdz S)zGet the main config file path. config.yamlrDrrZr$get_config_pathrIs   } ,,rZc$tdz S)z&Get the .env file path (for API keys)..envrDrrZr$ get_env_pathrLs   v %%rZcbttjjS)z'Get the project installation directory.rrrZr$get_project_rootrNs >> ' / / 1 11rZctjdkrdStjdd}tjdd} |rt |nd}n#t$rd}YnwxYw |rt |nd}n#t$rd}YnwxYw||fS)aRead the HERMES_UID / HERMES_GID env vars set by Docker deployments. Docker containers running Hermes commonly set these to map the in-container user to a host user so volume-mounted state files end up with the right ownership. The entrypoint chowns the top-level HERMES_HOME once, but subdirectories created at runtime by ``ensure_hermes_home()`` (especially for profile namespaces under ``profiles//``) need the same chown or they land as ``root:root`` and block subsequent uid-mapped workers with ``PermissionError [Errno 13]``. See #34107. Returns ``(uid, gid)`` parsed from the env vars, or ``(None, None)`` when either is missing/invalid. Returns ``(None, None)`` on Windows too (where chown is a no-op anyway). win32NN HERMES_UIDr HERMES_GIDN)r0platformrr8rrintrX)uid_strgid_struidgids r$_resolve_hermes_uid_gidrZs |wzjnn\2..4466Gjnn\2..4466G%/c'lll4 %/c'lll4  8Os$8B BBB33 CCct\}}||dS tj|||nd||nddS#ttt f$rYdSwxYw)uChown ``path`` to ``HERMES_UID:HERMES_GID`` if those env vars are set. No-op when: - Either env var is unset/invalid - The current process isn't root (chown will EPERM — silently ignored) - On Windows (chown semantics don't apply) Used by :func:`_secure_dir` to keep ownership consistent across all directories created by :func:`ensure_hermes_home` on Docker deployments. See #34107. N)rZrchownrAttributeErrorNotImplementedError)rrXrYs r$_chown_to_hermes_uidr`s'((HC {s{    ?CC?CC     ^%8 9      s9AAcTtrdS tjdd}|rt |dnd}n#t $rd}YnwxYw tj||n#ttf$rYnwxYwt|dS)uXSet directory to owner-only access (0700 by default). No-op on Windows. Skipped in managed mode — the NixOS module sets group-readable permissions (0750) so interactive users in the hermes group can share state with the gateway service. The mode can be overridden via the HERMES_HOME_MODE environment variable (e.g. HERMES_HOME_MODE=0701) for deployments where a web server (nginx, caddy, etc.) needs to traverse HERMES_HOME to reach a served subdirectory. The execute-only bit on a directory permits cd-through without exposing directory listings. Also applies ``HERMES_UID``/``HERMES_GID``-based ownership when those env vars are set (#34107 — Docker deployments need this so profile subdirs created at runtime by kanban workers don't land as root:root and block subsequent uid-mapped workers). NHERMES_HOME_MODEri) rrr8rrrUrXchmodrr_r`)rmode_strmodes r$ _secure_dirrgs$||:>>"4b99??AA#+6s8Q   t ( )     s$AA A('A(,BBBctjdstjdrdStjdrdS t ddd5}|}d d d n #1swxYwYd |vsd |vsd |vrdSn#ttf$rYnwxYwd S)a3Detect if we're running inside a Docker/Podman/LXC container. When Hermes runs in a container with volume-mounted config files, forcing 0o600 permissions breaks multi-process setups where the gateway and dashboard run as different UIDs or the volume mount requires broader permissions. HERMES_CONTAINERHERMES_SKIP_CHMODTz /.dockerenvz/proc/1/cgroupr0rrNrlxckubepodsF) rr8rrrr9readrIOError)r?cgroup_contents r$ _is_containerrp s! z~~())RZ^^>#d)) $ $ " HT5 ! ! ! ! ! " " ( )     sAA%%A:9A:homec|dz }|rA |d}n#ttf$rYdSwxYwt |sdS|t dt|dS)aSeed a default SOUL.md into HERMES_HOME, upgrading legacy empty templates. First run: write DEFAULT_SOUL_MD. Existing installs whose SOUL.md is still the old comment-only scaffold (seeded by older install.sh / install.ps1 / docker images, which shadowed the runtime default) get upgraded in place to DEFAULT_SOUL_MD. A SOUL.md the user actually customized is never touched. zSOUL.mdrrN)rrrUnicodeDecodeErrorrr rrr)rs soul_pathr#s r$_ensure_default_soul_mdrw7sy I  **G*<OpenRouter API key (for vision, web scraping helpers, and MoA)zOpenRouter API keyzhttps://openrouter.ai/keysvision_analyze)rrrArr6rrGOOGLE_API_KEYzAlibaba Cloud DashScope API key (Qwen + multi-provider models)zDashScope API Keyz-https://modelstudio.console.alibabacloud.com/DASHSCOPE_BASE_URLzGCustom DashScope base URL (default: coding-intl OpenAI-compat endpoint)zDashScope Base URLHERMES_QWEN_BASE_URLzBQwen Portal base URL override (default: https://portal.qwen.ai/v1)z.Qwen Portal base URL (leave empty for default)OPENCODE_ZEN_API_KEYz=OpenCode Zen API key (pay-as-you-go access to curated models)zOpenCode Zen API keyzhttps://opencode.ai/authOPENCODE_ZEN_BASE_URLzOpenCode Zen base URL overridez/OpenCode Zen base URL (leave empty for default)OPENCODE_GO_API_KEYzOllama Cloud API key (ollama.com — cloud-hosted open models)zOllama Cloud API keyzhttps://ollama.com/settingsOLLAMA_BASE_URLz?Ollama Cloud base URL override (default: https://ollama.com/v1)z)Ollama base URL (leave empty for default)XIAOMI_API_KEYzhXiaomi MiMo API key for MiMo models (mimo-v2.5-pro, mimo-v2.5, mimo-v2-pro, mimo-v2-omni, mimo-v2-flash)zXiaomi MiMo API Keyzhttps://platform.xiaomimimo.comXIAOMI_BASE_URLzFXiaomi MiMo base URL override (default: https://api.xiaomimimo.com/v1)z)Xiaomi base URL (leave empty for default) AWS_REGIONz?AWS region for Bedrock API calls (e.g. us-east-1, eu-central-1)z AWS RegionzIhttps://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html AWS_PROFILEzFAWS named profile for Bedrock authentication (from ~/.aws/credentials)z AWS ProfileAZURE_FOUNDRY_API_KEYz0Azure Foundry API key for custom Azure endpointszAzure Foundry API Keyzhttps://ai.azure.com/AZURE_FOUNDRY_BASE_URLzLAzure Foundry base URL (set via 'hermes model' for endpoint-specific config)zAzure Foundry base URL EXA_API_KEYz1Exa API key for AI-native web search and contentsz Exa API keyzhttps://exa.ai/ web_searchtool)rrrAr6rrPARALLEL_API_KEYz5Parallel API key for AI-native web search and extractzParallel API keyzhttps://parallel.ai/rz-Firecrawl API key for web search and scrapingzFirecrawl API keyzhttps://firecrawl.dev/FIRECRAWL_API_URLz6Firecrawl API URL for self-hosted instances (optional)z)Firecrawl API URL (leave empty for cloud)FIRECRAWL_GATEWAY_URLzQExact Firecrawl tool-gateway origin override for Nous Subscribers only (optional)z9Firecrawl gateway URL (leave empty to derive from domain)TOOL_GATEWAY_DOMAINzShared tool-gateway domain suffix for Nous Subscribers only, used to derive vendor hosts, e.g. nousresearch.com -> firecrawl-gateway.nousresearch.comzTool-gateway domain suffixTOOL_GATEWAY_SCHEMEzShared tool-gateway URL scheme for Nous Subscribers only, used to derive vendor hosts (`https` by default, set `http` for local gateway testing)zTool-gateway URL schemeTOOL_GATEWAY_USER_TOKENzuExplicit Nous Subscriber access token for tool-gateway requests (optional; otherwise read from the Hermes auth store)zTool-gateway user tokenz3Tavily API key for AI-native web search and extractzTavily API keyzhttps://app.tavily.com/home SEARXNG_URLz Bot User OAuth Token.zhttps://api.slack.com/apps)rrhelprArrruSlack app-level token (xapp-) for Socket Mode. Get from Basic Information → App-Level Tokens. Also ensure Event Subscriptions include: message.im, message.channels, message.groups, message.mpim, app_mentionzSlack App Token (xapp-...)zyIn your Slack app, enable Socket Mode, then create Basic Information > App-Level Tokens with the connections:write scope.rzComma-separated Slack member IDs allowed to use Hermes, e.g. U01ABC2DEF3. Without this, Slack may connect but deny messages by default.zAllowed Slack member IDszvIn Slack, open your profile, choose More or the three-dot menu, then Copy member ID. Add multiple IDs comma-separated.MATTERMOST_URLz3Mattermost server URL (e.g. https://mm.example.com)zMattermost server URLzhttps://mattermost.com/deploy/MATTERMOST_TOKENz-Mattermost bot token or personal access tokenzMattermost bot tokenMATTERMOST_ALLOWED_USERSz:Comma-separated Mattermost user IDs allowed to use the botz-Allowed Mattermost user IDs (comma-separated)MATTERMOST_REQUIRE_MENTIONzaRequire @mention in Mattermost channels (default: true). Set to false to respond to all messages.zRequire @mention in channels!MATTERMOST_FREE_RESPONSE_CHANNELSzJComma-separated Mattermost channel IDs where bot responds without @mentionz+Free-response channel IDs (comma-separated)MATRIX_HOMESERVERz7Matrix homeserver URL (e.g. https://matrix.example.org)zMatrix homeserver URLz%https://matrix.org/ecosystem/servers/MATRIX_ACCESS_TOKENz3Matrix access token (preferred over password login)zMatrix access tokenMATRIX_USER_IDz)Matrix user ID (e.g. @hermes:example.org)zMatrix user ID (@user:server)MATRIX_ALLOWED_USERSzLComma-separated Matrix user IDs allowed to use the bot (@user:server format)z)Allowed Matrix user IDs (comma-separated)rzZRequire @mention in Matrix rooms (default: true). Set to false to respond to all messages.z&Require @mention in rooms (true/false)rzCComma-separated Matrix room IDs where bot responds without @mentionz(Free-response room IDs (comma-separated)rz@Auto-create threads for messages in Matrix rooms (default: true)z)Auto-create threads in rooms (true/false)rz>Auto-create threads for DM messages in Matrix (default: false)z'Auto-create threads in DMs (true/false)ruzNStable Matrix device ID for E2EE persistence across restarts (e.g. HERMES_BOT)z)Matrix device ID (stable across restarts)ruMatrix recovery key for cross-signing verification after device key rotation (from Element: Settings → Security → Recovery Key)zMatrix recovery keyrzOBlueBubbles server URL for iMessage integration (e.g. http://192.168.1.10:1234)zBlueBubbles server URLzhttps://bluebubbles.app/ruJBlueBubbles server password (from BlueBubbles Server → Settings → API)zBlueBubbles server passwordBLUEBUBBLES_ALLOWED_USERSzJComma-separated iMessage addresses (email or phone) allowed to use the botz,Allowed iMessage addresses (comma-separated)BLUEBUBBLES_ALLOW_ALL_USERSz-Allow all BlueBubbles users without allowlistzAllow All BlueBubbles Usersr_z.QQ Bot App ID from QQ Open Platform (q.qq.com)z QQ App IDzhttps://q.qq.com)rrrArrxz*QQ Bot Client Secret from QQ Open PlatformzQQ Client Secretrwz2Comma-separated QQ user IDs allowed to use the botzQQ Allowed Usersrz=Comma-separated QQ group IDs allowed to interact with the botzQQ Group Allowed Usersrz4Allow all QQ users without an allowlist (true/false)zAllow All QQ Usersrzs r$get_missing_env_varsr,s G,1133LL$X&& L NNFHJJmTJJ K K K Q/5577 Q QNHd ** QODO-OOPPP NrZ dotted_keyc j|d}|}|ddD]}t|trE t|}n+#tt f$rt d|d|dwxYw||}\t|t rC||}||vst|t tfsi||<||}t dt|j d||d}t|tr||t|<dS|||<dS) uSet a value at an arbitrarily nested dotted key path. Supports both dict and list navigation: _set_nested(c, "a.b.c", 1) → c["a"]["b"]["c"] = 1 _set_nested(c, "a.0.b", 1) → c["a"][0]["b"] = 1 _set_nested(c, "providers.1", "x") → c["providers"][1] = "x" Intermediate dicts are created on demand. List indices are parsed from numeric path segments; the referenced index must already exist (we do not grow lists — the user is navigating into structure they wrote themselves). If a segment targets a non-container leaf (scalar), the leaf is replaced with a fresh dict so the write can proceed — this preserves the pre-existing behavior for bare scalar overrides (e.g. setting ``a.b.c`` where ``a.b`` was previously a string). Guards against #17876: before this fix the code unconditionally replaced any non-dict value (including lists) with ``{}``, silently destroying list-typed config like ``custom_providers`` whenever a caller used an indexed path. r)Nr\z!Cannot navigate into list at key z : segment z is not a numeric indexzCannot navigate into z at key ) split isinstancerrU TypeErrorrXdictrtype__name__) configr-rBpartscurrentpartidxr#lasts r$ _set_nestedr;s|,   S ! !EGcrc  gt $ $  $iiz*   ? ??#???  clGG  & & {{4((H7""*Xd|*L*L" " dmGGVW (>VV VV  9D'4  "D  s A  (A2) clear_api_keyclear_api_modeclear_base_url model_cfgr<r=r>ct|ts|S|r,|dd|dd|r|dd|r|dd|S)aRemove stale inline endpoint credentials from a model config. ``model.api_key`` is valid only for explicit custom endpoint assignments. Built-in providers resolve credentials from env vars, auth.json, or the credential pool. When switching away from a custom endpoint, leaving these fields behind keeps secrets in config.yaml and can contaminate later custom resolution paths. r)Napirr()r0r2pop)r?r<r=r>s r$ clear_model_endpoint_credentialsrC8s i & &# i&&& eT"""( j$'''( j$''' rZct}gddtdtdtffd t|S)z Check which config fields are missing or outdated (recursive). Walks the DEFAULT_CONFIG tree at arbitrary depth and reports any keys present in defaults but absent from the user's loaded config. rdefaultsr7rc`|D]\}}|dr|s|n|d|}||vr||d|dGt|tr;t||tr||||dS)NrAr)zNew config option: )r4r^r)r&r:r(r0r2r)rEr7rr4 default_valuefull_key_checkr*s r$rIz)get_missing_config_fields.._check]s"*.."2"2 > > C~~c"" "(?ss.?.?#.?.?H'!!#,#C#C#C   M400 >Z C@P@PRV5W5W >}gclH=== > >rZ)r) load_configr2r+DEFAULT_CONFIG)r5rIr*s @@r$get_missing_config_fieldsrLSsj]]FG > > > >c > > > > > > > F>6""" NrZc6 ddlm}m}n#t$rgcYSwxYw |}nF#t$r9}ddl}|jt d|gcYd}~Sd}~wwxYw|sgSt}g}|D]}|d|d}| d} |} d} | D](} t| tr| | vr | | } | } &d} | )t| tr)| s|||S)a3Return skill-declared config vars that are missing or empty in config.yaml. Scans all enabled skills for ``metadata.hermes.config`` entries, then checks which ones are absent or empty under ``skills.config.`` in the user's config.yaml. Returns a list of dicts suitable for prompting. r)discover_all_skill_config_varsSKILL_CONFIG_PREFIXNz)discover_all_skill_config_vars failed: %sr)r4)agent.skill_utilsrNrOrr; getLoggerr4debugrJr/r0r2r+rr() rNrOall_varser;r5r*var storage_keyr6r7rBr8s r$get_missing_skill_config_varsrWosYYYYYYYYY   1133  (##)) 7      ]]F$&G  ,;;s5z;; !!#&&  D'4(( TW__!$- =Zs33=EKKMM= NN3    Ns&  ) A,.A'!A,'A,_PROVIDER_NORMALIZE_WARNED provider_key signaturer5argsc|pd|f}|tvrdSt|tj|g|RdS)zKEmit ``logger.warning(msg, *args)`` at most once per (provider, signature).?N)rXr-r.r/)rYrZr5r[ dedup_keys r$_warn_once_per_providerr_sV$i0I...""9--- N3rZrYentryc Pt|tsdSddddddddd }d |vrd|vr |d |d<hd }|D]1\}}||vr(||vr$t|d |d |pd||||||<2t ||z t |z }|rXt|ddt|zd|pddt|ddlm }d}dD]} | | } t| tr}| ri| } tjd| r| }n=|| } | jr | jr| }n t"d|pd| | |sdSd} | d}t|tr)| r| } n(| r| } | sdS| |d}| }|r||d<| d}t|tr+| r| |d<| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| d}t|tr |r||d<n2t|t&r|ri}|D] }t|tr,| ri|| <Dt|tsZ| d}t|tr| s| d}t|tr| sd |D}||| <|r||d<| d}t|t(r |dkr||d<| d}t|t(t*fr |dkr||d<| d!}t|t,r||d!<| d"}t|trt||d"<t/| d#}|r||d#<| d$}t|tr+| r| |d$<| d%}t|t,r||d%<n@t|tr+| r| |d%<|S)&z>Return a runtime-compatible custom provider entry or ``None``.Nr)r(rkey_env default_modelcontext_lengthrate_limit_delay)apiKeybaseUrlapiModekeyEnv apiKeyEnv defaultModel contextLengthrateLimitDelay api_key_env>rArArrmodelsr)rcrr(r'rTr* ssl_verifyro ssl_ca_certrd extra_headersrediscover_modelsrfstale_timeout_secondsrequest_timeout_secondszcamel:z[providers.%s: camelCase key '%s' auto-mapped to '%s' (use snake_case to avoid this warning)r]zunknown:,z-providers.%s: unknown config keys ignored: %s, rurlparser)r(rArAz \{[^}]+\}uPproviders.%s: '%s' value '%s' is not a valid URL (no scheme or host) — skippedr)rr(rYrTrrpidc"i|] \}}|dv || S)>r{rr.0kvs r$ z4_normalize_custom_provider_entry..<s/A.1H1H11H1H1HrZrtr*rsrrrq)r0r2r&r_setkeysjoinsorted urllib.parserzrr+rresearchschemenetlocr.r/rrUfloatrnormalize_extra_headers) rarY_CAMEL_ALIASES _KNOWN_KEYScamelsnakeunknownrzr(url_keyraw_url candidateparsedrraw_namerr)rcr model_namerpnormalized_modelsitemr model_metarerfrtr*normalized_headersrrrqs r$ _normalize_custom_provider_entryrs eT " "t'), & &N)5"8"8 /i   K',,..(( u E>>e500 #.u..9#UE     !"ii ""G'30GMMOO0 '  9ii ""G'30GMMOO0 '  9yy$$> +(>(>H(C  2X^^%5%52!)!1!1 :7##Auyy'A'AJ*c""1z'7'7'9'91(..00 7 YYx F&$5F5% 8 FD ! !5f5 -/ = =D$$$  24!$**,,/dD)) xx~~Hh,, ,HNN4D4D ,88F++h,, HNN4D4D !%J3= hnn.. / /  5#4Jx YY/00N.#&&6>A+=+='5 #$yy!344"S%L11:6F!6K6K)9 %&ii 122O/4((8(7 $%<((J*d##4#' #3#3 < 1?1K1KLL9&8 ?#))M**K+s##8 (9(9(;(;8$/$5$5$7$7 =!<((J*d##6#- <  J $ $6)9)9););6#-#3#3#5#5 < rZctt|trt|n||}|dSd|di}dD]}||vr ||||<d|vr |d|d<d|vr |d|d <|S) zDTranslate a legacy custom provider entry to the v12 providers shape.r`NrAr() rr)rcrprerfrtr*rsrrrqrrdrrT)rr0r2)rarYrprovider_entryfields r$)_custom_provider_entry_to_provider_configrgs 2!%..9U E!Jt&+Z -C%DN 66 J  $.u$5N5 !**4W*='Z&0&<{# rZproviders_dictct|tsgSg}|D]:\}}t|t |}|||;|S)zMNormalize ``providers`` config entries into the legacy custom-provider shape.r`)r0r2r&rr+r()rcustom_providersr4rars r$"providers_dict_to_custom_providersrsw nd + + -/$**,,00 U5e#c((SSS  !  # #J / / / rZr5c|t}gttdtttt fddffd }|d}|4t|tsgS|D]}|t|t|dD] }||S)ayReturn a deduplicated custom-provider view across legacy and v12+ config. ``custom_providers`` remains the on-disk legacy format, while ``providers`` is the newer keyed schema. Runtime and picker flows still need a single list-shaped view, but we should not materialise that compatibility layer back into config.yaml because it duplicates entries in UIs. Nrarc>|dSt|ddpd}t|ddpd}t|ddpdd}t|ddpd}|||f}|r|vrdS|r|r|vrdS||r||r|r|dSdSdS)NrYrrr(rr)r+rrrrstripr(r-) rarYrr(rpair compatibleseen_name_url_pairsseen_provider_keyss r$_append_if_newz7get_compatible_custom_providers.._append_if_news = F599^R88>B??EEGGMMOO 599VR((.B//5577==??uyyR006B77==??FFsKKQQSSEIIgr**0b117799??AAh&  L,>>> F  H )0norfalseF>rrQrrT)r0rr+rr)rBlowereds r$_coerce_ssl_verifyrsu }t% %++--%%'' 1 1 15 0 0 04 4rZr(rc|# t|}n#t$rg}YnwxYw|rt|tsiS|pdd}|D]}t|t s|dpdd}|r||kr]i}|d}t|tr+| r| |d<t|d}|||d<|cSiS)zOReturn TLS settings from a matching ``custom_providers`` / ``providers`` entry.Nrrr(rrrq) rrr0rrrr2rr+rr) r(rr5 target_urlra entry_urloutcaverifys r$ get_custom_provider_tls_settingsrst  ">vFF   " " "!    " :&6== .b((--3355J!  %&&  YYz**0b88==CCEE  I33   YY} % % b#   ,288:: ,!#C #EIIl$;$;<<   &C  I  ## client_kwargsct|||}|dr |d|d<d|vr |d|d<dSdS)zCAttach per-provider TLS knobs to OpenAI client kwargs when matched.rrrqN)rr)rr(rr5tlss r$*apply_custom_provider_tls_to_client_kwargsrsa +85Ev N NC ww}:'*='9 m$s&),&7 l###rZrscpt|tr|siSd|DS)a.Normalize a raw ``extra_headers`` value into a ``dict[str, str]``. Stringifies keys and values and drops entries whose value is ``None``. Returns ``{}`` for non-dict or empty inputs. This is the single shared normalizer for per-provider ``extra_headers`` across config normalization, runtime resolution, client construction, and live ``/models`` discovery. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Callers must never log the returned values. cRi|]$\}}|t|t|%SN)r+r}s r$rz+normalize_extra_headers..s+ N N Ntq! CFFCFF rZ)r0r2r&)rss r$rrsB mT * *- N N}':':'<'< N N NNrZc|# t|}n#t$rg}YnwxYw|rt|tsiS|pdd}|D]}t|t s|dpdd}|r||kr]t|dcSiS)aReturn ``extra_headers`` from a matching ``providers`` / ``custom_providers`` entry. Matches the entry whose ``base_url`` equals *base_url* (trailing-slash and case insensitive, mirroring :func:`get_custom_provider_tls_settings`) and returns its ``extra_headers`` dict, or ``{}`` when no entry matches or the entry declares none. SECURITY: header values routinely carry credentials (Cloudflare Access service tokens, proxy auth, custom bearer schemes). Callers must never log the returned values. Nrrr(rs) rrr0rrrr2rr)r(rr5rrars r$!get_custom_provider_extra_headersr s  ">vFF   " " "!    " :&6== .b((--3355J!CC%&&  YYz**0b88==CCEE  I33 &uyy'A'ABBBBB Irct|||}|sdSt|dpi}||||d<dS)uMerge per-provider ``extra_headers`` onto OpenAI client ``default_headers``. Provider-specific headers win over provider/SDK defaults already present in ``client_kwargs`` — they are the most specific configuration level. No-op when the base_url matches no ``providers`` / ``custom_providers`` entry or the entry declares no headers. SECURITY: values may carry credentials — never log them. Ndefault_headers)rr2rupdate)rr(rr5rsmergeds r$4apply_custom_provider_extra_headers_to_client_kwargsrCsh6h@PRXYYM  -##$566<" = =F MM-   '-M#$$$rZc|r|sdS|T t|}nC#t$r6|YdS|d}t|tr|ng}YnwxYwt|tsdS|pdd}|sdS|D]}t|t s|dpdd}|r||krK|d}t|t sv||} t| t s| d} |  t| } n#ttf$rYwxYw| dkr| cSdS) aLook up a per-model ``context_length`` override from ``custom_providers``. Matches any entry whose ``base_url`` equals ``base_url`` (trailing-slash insensitive) and returns ``custom_providers[i].models..context_length`` if present and valid. Returns ``None`` when no override applies. This is the single source of truth for custom-provider context overrides, used by: * ``AIAgent.__init__`` (startup resolution) * ``AIAgent.switch_model`` (mid-session ``/model`` switch) * ``hermes_cli.model_switch.resolve_display_context_length`` (``/model`` confirmation display) * ``gateway.run._format_session_info`` (``/info`` display) * ``agent.model_metadata.get_model_context_length`` (when custom_providers is threaded through) Before this helper existed, the lookup was duplicated in ``run_agent.py``'s startup path only; every other path (notably ``/model`` switch) fell back to the 128K default. See #15779. Nrrrr(rprer) rrrr0rrr2rUr1rX) rr(rr5rrrarrpr?raw_ctxctxs r$"get_custom_provider_context_lengthrZs0 t D>vFF   D D D~tt**/00C&0d&;&;Css     D & - -t.b((--J t!%&&  YYz**0b88==  I33 8$$&$''  JJu%% )T**  -- 011 ?  g,,CC:&    H  77JJJ  4s& A.AA EE/.E/ct|trdS t|}n#ttf$rYdSwxYwt |dS)zHReturn a safe integer config version, treating invalid values as legacy.r)r0rrUr1rXmax)rBversions r$_coerce_config_versionrs`%qe** z "qq w??s )>>cttddpd}t}|s||fS t |d5}t |pi}dddn #1swxYwYn+#t$r}t||||fcYd}~Sd}~wwxYwt|tsi}t|d}||fS)a Check the raw on-disk config schema version. ``load_config()`` deliberately starts from ``DEFAULT_CONFIG`` and deep-merges the user's file, which is correct for runtime reads but wrong for deciding whether the user's persisted schema has been migrated. A config file with no raw ``_config_version`` must remain visible as legacy instead of inheriting the latest default version in memory. Returns (current_version, latest_version). rrrrN) rrKrrIrr9rFrr6r0r2)latestr r?r5rTr7s r$check_config_versionrsU$N$6$67H!$L$L M M RQRF!##K     v~ + 0 0 0 -A#A&&,"F - - - - - - - - - - - - - - -  #;222v~  fd # #$VZZ0A%B%BCCG F?sBB #B5 B BB B B B5B0*B50B5>rrrrrr;rEr_r|rrr$rrRrr mcp_serversfallback_modelrrrr> rrrpr)rcrr(r*rqrrrerf>r)rr(rfc2eZdZUdZeed<eed<eed<dS) ConfigIssuez$A detected config structure problem.severitymessagehintN)r4 __module__ __qualname____doc__r+__annotations__rrZr$rrs1..MMM LLL IIIIIrZrc d |2 t}n"#t$rtdddgcYSwxYwg}|d}|t |t r|tdddt |t r!t|n t}|tz}|r5|tdd t|d d nt |trt|D]\}}t |t s>|tdd |d t|jddX|ds(|tdd |dd|ds(|tdd |dd|d}|t |trt|D]\}}t |t s=|tdd|dt|jdW|ds(|tdd|dd|ds(|tdd|ddnt |t s:|tdd t|jd!nt|rr|ds$|tdd"d|ds$|tdd#d$t |t r.d|vr*d|pivr$|tdd%d&|d}|r&|s$|tdd'd(|D]V} | d)r| t vr5| tvr,|tdd*| d+d,| d-W|S).a"Validate config.yaml structure and return a list of detected issues. Catches common YAML formatting mistakes that produce confusing runtime errors (like "Unknown provider") instead of clear diagnostics. Can be called with a pre-loaded config dict, or will load from disk. NerrorzCould not load config.yamlz+Run 'hermes setup' to create a valid configruOcustom_providers is a dict — it must be a YAML list (items prefixed with '-')zeChange to: custom_providers: - name: my-provider base_url: https://... api_key: ...r/zRoot-level keys z( look like custom_providers entry fieldszLThese should be indented under a '- name: ...' list entry, not at root levelzcustom_providers[z] is not a dict (got )z1Each entry should have at minimum: name, base_urlrz] is missing 'name' fieldz#Add a name, e.g.: name: my-providerr(z] is missing 'base_url' fieldzDAdd the API endpoint URL, e.g.: base_url: https://api.example.com/v1rzfallback_model[z] should be a dict, got z!Each entry needs provider + modelr'z] is missing 'provider' fieldz/Add: provider: openrouter (or another provider)rz] is missing 'model' fieldzAdd: model: zAfallback_model should be a dict with 'provider' and 'model', got zZChange to: fallback_model: provider: openrouter model: anthropic/claude-sonnet-4uHfallback_model is missing 'provider' field — fallback will be disableduEfallback_model is missing 'model' field — fallback will be disabledz8Add: model: anthropic/claude-sonnet-4 (or another model)zGfallback_model appears inside custom_providers instead of at root levelzDMove fallback_model to the top level of config.yaml (no indentation)u[custom_providers defined but no 'model' section — Hermes won't know which provider to useziAdd a model section: model: provider: custom default: your-model-name base_url: https://...rAzRoot-level key 'uW' looks misplaced — should it be under 'model:' or inside a 'custom_providers' entry?zMove 'z' under the appropriate section)rJrrrr0r2r(rr_CUSTOM_PROVIDER_LIKE_FIELDSrr enumerater3r4r:_KNOWN_ROOT_KEYS) r5issuescpcp_keys suspiciousirafbr?r4s r$validate_config_structurers~ w ]]FF w w w)EGtuuv v v v w!#F & ' 'B ~ b$  (  MM+a%   )32t(<(<Gc"''))nnn#%%G #??J  kcvj'9'9cccb D ! ! %bMM  5!%..MM+![A[[DKKDX[[[K## yy((MM+!HAHHH=## yy,,MM+!LALLL^## $ % %B ~ b$  + %bMM  5!%..MM+[![[T%[[EY[[;## !99Z00 k%NaNNNM'' !99W-- k%KaKKK6'' (B%%  MM+gTXY[T\T\Tegg7     66*%%  k^E 66'??  k[N"d 0 > >CSXZX`^`CaCa k  U R      7##I  )   k  i (      >>#     & & &32N+N+N MM+3====    Ms 22cT t|}n#t$rYdSwxYw|sdSdg}|D]1}|jdkrdnd}|d|d|j2|dt jd |d zdS) zPrint config structure warnings to stderr at startup. Called early in CLI and gateway init so users see problems before they hit cryptic "Unknown provider" errors. Prints nothing if config is healthy. Nu3⚠ Config issues detected in config.yaml:ru ✗u ⚠ rz2 Run 'hermes doctor' for fix suggestions.r* ) rrrr(rr0r1r2r)r5rlinescimarkers r$print_config_warningsrzs*622   H IE11)+)?)?%%EY /&//2://0000 LLKLLLJTYYu%%./////rctjd}tjd}|! t}n#t$rYdSwxYw|di}t |t r|ddnd}|dv}g}|r|d|d |r|s|d |d |rtjd d }|d d|d|d|dtj d |dzdSdS)uWarn if MESSAGING_CWD or TERMINAL_CWD is set in .env instead of config.yaml. These env vars are deprecated — the canonical setting is terminal.cwd in config.yaml. Prints a migration hint to stderr. MESSAGING_CWD TERMINAL_CWDNrrr)>rrrr)u ⚠ MESSAGING_CWD=u& found in .env — this is deprecated.u ⚠ TERMINAL_CWD=rFz ~/.hermesru/⚠ Deprecated .env settings detected:zN Move to config.yaml instead: terminal:\n cwd: /your/project/pathz' Then remove the old entries from z /.envr*r) rr8rrJrr0r2r(insertr0r1r2r)r5 messaging_cwdterminal_cwd_env terminal_cfg config_cwdconfig_has_explicit_cwdr hint_paths r$warn_deprecated_cwd_env_varsrs JNN?33Mz~~n55 ~  ]]FF    FF ::j"--L1;L$1O1OX!!%---UXJ(0HHE   #- # # #    7   #1A # # #    4JNN=+>>  QOPPP  =     P P P P    5))F233333 4 4sA AAc$t|dS)ubPersist a migrated config under the migration write invariant. THE INVARIANT (single source of truth for the whole migration pipeline): a migration may only persist values that DIFFER from the current schema default, plus explicit removals/renames of user data. Pure schema defaults are never materialised to disk — ``load_config()``'s deep-merge supplies them at read time, so writing them adds nothing and actively shadows future default changes (see ``save_config``'s docstring). Materialising defaults on every version bump is what rewrote hand-curated configs into full DEFAULT_CONFIG dumps (the "hermes update / hermes -p blows up my config" reports). Every migration step MUST route its write through this helper instead of calling ``save_config`` directly. It is a thin wrapper over ``save_config(config)`` (default-stripping ON); centralising the call makes the invariant impossible to regress one migration at a time. Correctness across seeds, non-default values, behaviour flips, and data transforms is verified by the migration parity tests. N) save_config)r5s r$_persist_migrationrs(rZ interactivequietc &;ogggd} t}|r|std|dn#t$rYnwxYwt\}}|dkrFt }|di}t |tsi}d|vrtd}td} |r7| d vr!d |d<|d  d n| r_| d vrI| |d<|d  d| dn d|d<|d  d||d<t||std|d|dkrt }d|vrtj dd} | r]| rI| |d<|d  d| dn d|d<|d  dt||s|dpd} td| |dkrD td} | r!tdd|stdn#t$rYnwxYw|dkrt }|d } t | t r| r|d!i}t |tsi}d"}| D]}t |ts|d#d}|d$dp-|d%dp|d&dpd}|sv| d'd(d)dd*d}d+|vr|d+d(}d+|v|d(}|sE d"d,lm}||}|jpd-d.d(}n#t$rd/|}YnwxYw|}|}||vr|d(|}|d0z }||vt+||1}||s|d#d2|d3d4vr|d3d2|||<|d0z }|d"kr||d!<|d d2t||sqtd5|d6t!|| d2D]3}||}td7|d8|d&d4|d9krLd:D]I} t|}|r%t|d|std;|d<:#t$rYFwxYw|d=kr]t }|d>i}t |tr#d?|vr|d?}|d@dA}t }|d>i} | d?d2|dBvrShdC}!||!vrJ|dAi}"t |"trd?|"vr| dAi}#||#d?<nJ||i}$t |$trd?|$vr| |i}%||%d?<| |d><t||stdD|dEkrt }|di}t |tsi}dF|vrEdG|dF<||d<|d  dHt||stdI|dJkrEt }|di}t |tsi}|dK}&t |&tr|&r|dLi}'t |'tsi}'|&D]#\}(})|(|'vri|'|(<d|'|(vr |)|'|(d<$|'|dL<||d<t||sCdMdN|&D}*tdO|*|d  dP|dQkrt }|dRi}+t |+tr|+dSd2},|+dTd2}-|+dUd2}.g}/|,rt7|,r}|dVi}0|0dRi}1|1d?stNdmi}?|dm}@t |@tsi}@g}A|?D]5\}B}C|B|@vr,tQj)|C|@|B<|A |B6|Ar|@|dm<dG}>tNdVidmi}D|dV}Et |Etsi}E|Edm}Ft |Ftsi}Fg}G|DD]5\}B}C|B|Fvr,tQj)|C|F|B<|G |B6|Gr |F|Edm<|E|dV<dG}>|>rt||ArT|d  drtK|Ads|s&tdtdM|Adu|GrT|d  dvtK|Gds|s&tdwdM|Gdu|dxkrt }|dy}Ht |Htr^|Hdzd{krEd0|Hdz<|H|dy<t||d  d||std}|d~krt }dq}>dD]}I||I}Jt |Jtrd|Jvr1|Jd}Kt |Kt6r&|K n|K}L|Ldk|Jd<|J||I<dG}>|d  |Id|Jd|>r t||std|dkrt }|d}Mt |Mtsi}M|Md}Nt |Nt6o)|N dYk}O|N|OrEdq|Md<|M|d<t||d  d|std|dkrt }|d}Mt |Mtr\|MddGurEdq|Md<|M|d<t||d  d|std|dkrt }|d}Pt |Ptrd|Pvr|Pd}Q tU|Q}Rn#tVtXf$rd2}RYnwxYw|Rn|Rdkrh tU|Pdd}Sn#tVtXf$rd}SYnwxYw|R|Skr$|R|Pd<|d  d|Rd|P|d<t||stdt }|d}Tt |Ttr d"dl-m.}Un#t$rd2}UYnwxYw|Urdq}V|TD]|\}W}t |ts|U|W|}X|Xs*dq|d`<dG}V|do d|Wd|s*|XD]}Ytd|Ytd|Wd}|Vr|T|d<t| d"dl/m0}Zd"dl1m2}[|[t d|Z}\|\D]1}]|do |]|std|]2n2#t$r%}^tf4d|^Yd2}^~^nd2}^~^wwxYw||kr|std|d|tkdG}_|_r7|s5td|_D]#}`td|`d#d8|`d$|r%|_r"td|_D]}`|`d%rtd|`d%|`drtmd|`dd8}an+tod|`dd8}a|arPt|`d#|a|d |`d#td|`d#n%|do d|`d#dttkdq}b|_r d|_Dn t9oofd|bD}bt9}ctq|d0z|d0zD]0}d|c9tt|dg1|cr9|r6|s3dt?|cD}e|ertdtK|ed|eD].\};}ftd|;d|fdd/t tod }gn#tvtxf$rd}gYnwxYw|gdvrVt|eD]C\};}f|fd%r?td|fd|;td|fd%n&td|fd|;|fdr(tmd|fd|;d}an9tod|fd|;d}a|ar=t|;|a|d |;td|;tEntdt{}h|hr%|d >d|hD||kr"t }||d<t|t}i|ir*|r'|s$tdtK|id|iD]=}`|`dd}jtd|`dd|`dd|jd*>t tod }gn#tvtxf$rd}gYnwxYw|gdvrTtt } d"dl@mA}kn#t$rd}kYnwxYw|iD] }`|`dd}l|lrd|ld*nd}mtod|`d|md8}a|as|lrt7|l}a|ar[|kd.|`d}nt||n|a|d  |`dtd|`dd|an<|do d|`dd|`ddȦdɝt t|ntd|S)a< Migrate config to latest version, prompting for new required fields. Args: interactive: If True, prompt user for missing values quiet: If True, suppress output Returns: Dict with migration results: {"env_added": [...], "config_added": [...], "warnings": [...]} ) env_added config_addedwarningsu ✓ Repaired .env file (z corrupted entries fixed)rr; tool_progressrr>rrrrrz;display.tool_progress=off (from HERMES_TOOL_PROGRESS=false)>allnewverbosezdisplay.tool_progress=z! (from HERMES_TOOL_PROGRESS_MODE)r z#display.tool_progress=all (default)u- ✓ Migrated tool progress to config.yaml: rrHERMES_TIMEZONErz timezone=z (from HERMES_TIMEZONE)z$timezone= (empty, uses server-local)(server-local)u% ✓ Added timezone to config.yaml: rnu8 ✓ Cleared ANTHROPIC_TOKEN from .env (no longer used) rrrrr(rArArr(rz--ryendpointr)z endpoint-rr`Nr)>no-keyno-key-requiredru ✓ Migrated z) custom provider(s) to providers: sectionu → r( ) LLM_MODEL OPENAI_MODELu ✓ Cleared u> from .env (no longer used — config.yaml is source of truth)rrr'r>r local_command>base.entiny.enlarge-v1large-v2large-v3small.en medium.enlarge-v3-turbodistil-large-v2distil-large-v3distil-small.endistil-medium.endistil-large-v3.5rtinylargesmallturbomediumu; ✓ Migrated legacy stt.model to provider-specific configrfTz1display.interim_assistant_messages=true (default)u3 ✓ Added display.interim_assistant_messages=truerrrryrxc3*K|]\}}|d|VdS)r1Nr)r~pms r$ z!migrate_config..s0$R$RDAqZZAZZ$R$R$R$R$R$RrZu> ✓ Migrated tool_progress_overrides → display.platforms: z9display.platforms (migrated from tool_progress_overrides)r summary_modelsummary_providersummary_base_urlr$model=>rrr provider=z base_url=u@ ✓ Migrated compression.summary_* → auxiliary.compression: u/ ✓ Removed unused compression.summary_* keyspluginsrr plugin.yaml plugin.ymlrrz$plugins.enabled (opt-in allow-list, z grandfathered)u( ✓ Plugins now opt-in: grandfathered z( existing plugin(s) into plugins.enabledum ✓ Plugins now opt-in: no existing plugins to grandfather. Use `hermes plugins enable ` to activate.r}rrrzCould not create Fz curator (z default key(s))u& ✓ Curator settings now available (u") — edit via `hermes config set`zauxiliary.curator (u0 ✓ auxiliary.curator settings now available (r@rBrumodel_catalog.ttl_hours 24→1uB ✓ Lowered model_catalog.ttl_hours to 1 (hourly picker refresh))rr write_modeapproveru.write_mode → write_approval=u: ✓ Renamed write_mode → write_approval (boolean gate)rrzagent.verify_on_stop=falseu ✓ Turned off verify-on-stop (agent.verify_on_stop: false). Set it to true to re-enable, or "auto" for the legacy surface-aware behavior. u ✓ Turned off verify-on-stop (agent.verify_on_stop: false) — the old default was written into your config as a literal true. Set it to true again to re-enable, or "auto" for the legacy surface-aware behavior.rzrmax_async_childrenrrz#delegation.max_concurrent_children=z, (folded from deprecated max_async_children)u ✓ Removed deprecated delegation.max_async_children — delegation.max_concurrent_children now caps background delegations too.r)validate_mcp_server_entryz Disabled suspicious MCP server ''u ⚠ u ⚠ Disabled MCP server 'z' pending review)validate_toolset)validate_platform_toolsetsplatform_toolsetsz(platform_toolsets validation skipped: %szConfig version:  → r"u0 ⚠️ Missing required environment variables:u • rz Let's configure them now: z Get your key at: rrrru ✓ Saved zSkipped z - some features may not workch|] }|d S)rrr~rs r$ z!migrate_config..gs555Aai555rZcRg|]#}|dv |d!|$S)rrr)r~rrequired_namess r$ z"migrate_config..hsC V9N * *1553D3D * * * *rZc\g|])}t|s|tv|t|f*Sr)r'r))r~rs r$rOz"migrate_config..ssK    && ,03D+D+D$T* ++D+D+DrZ z$ new optional key(s) in this update:u • u — z Configure new keys? [y/N]: n>yrz (Enter to skip): z1 Set later with: hermes config set c3&K|] }|dV dS)r4Nr)r~rs r$r/z!migrate_config..s&&P&PuU|&P&P&P&P&P&PrZrz! skill setting(s) not configured:rrr4z (from skill: z# Configure skill settings? [y/N]: )rOz skills.configr^z (default:  = u — skill 'r]z' may ask for it later)Csanitize_env_filer,rrread_raw_configrr0r2r'rr(rrrrsave_env_valuerrrrzhostnamerrBr setdefaultr&rr+rrrriterdirrr9rFrlenr rKcopydeepcopyrUr1rXhermes_cli.mcp_securityrBrrDhermes_cli.toolset_validationrEr.rRr,r inputrangerrEOFErrorKeyboardInterruptrLextendrWrPrOr;)prrresultsfixes current_ver latest_verr5r; old_enabledold_modeold_tz tz_display old_token custom_listrmigrated_countraold_nameold_urlr4rzrbase_keysuffix new_entryepdead_varold_valrraw_stt legacy_modelr'r _local_models raw_local local_cfg raw_provider provider_cfg old_overridesryplatrfmigratedcomps_model s_provider s_base_url migrated_keysauxaux_comp plugins_cfgr disabled_set grandfathereduser_plugins_dirchild manifest_file_mfmanifestr curator_dirrTtouched_curator_defaults raw_curator added_curatorrr_aux_curator_defaultsraw_auxraw_aux_curator added_auxraw_mc subsystemsuboldold_norm raw_agentcuris_auto_sentinel raw_deleg old_async old_async_i cur_childrenraw_mcp_servers_validate_mcp_server_entry mcp_touched server_namerissuerDrE ts_warningsw _ts_val_err missing_envrUrBmissing_optional new_var_namesver new_and_unsetr>answermissing_configmissing_skill_config skill_namerOr^ default_hintrVrNsp @r$migrate_configrs#CCG !##  Q Q OuOOO P P P      344KQ ""**Y++'4(( G ' ) )'(>??K$%@AAH V{00226JJJ+0('../lmmmm Vhnn..2KKK+3>>+;+;('../{HXHX/{/{/{||||+0('../TUUU 'F9  v & & & b`goF^``aaaQ "" V # #Y0"55F W&,,.. W%+\\^^z"'../b6<<>>/b/b/bcccc%'z"'../UVVV v & & & L#J/C3C JjJJKKKQ %&788I V0"555VTUUU    D R ""jj!344 k4 ( (: E[: E#ZZ R88Nnd33 $!#N$* $* $!%.. 99VR00))J33iuyy7K7KiuyyY^`bOcOciginn&&,,..66sC@@HHbQQYYZ]_abbckk++dC00Cckkiinn;;999999!)'!2!2%<*EEc3OO$;;;:.::;'^++%0000CaKF^++F!$ $0MM&$///==++/PPPMM)T222&/s#!#!!&4{# -t444"6***EeNeeefff#N$7$7$9$9::N?;K;KLEE+C0CCCub0A0ACCDDDD R5  H '11y"8R000 ywxwwwxxx    R''%$$ gt $ $% UG););"7+L{{:w77H$&&F**UB''C GGGT " " "555!!!  =00!( GR 8 8I%i66:':R:R$'NN7B$?$? -9 '* '{{8R88 !,559 9T9T#&>>(B#?#?L,8L)F5M v & & & USTTTR ""**Y++'4(( G 'w 6 648G0 1 'F9  N # * *+^ _ _ _ v & & & MKLLLR ""**Y++'4(( G $=>> mT * * h} h K44Ii..  +1133 < < dy((&(IdO")D/997;IdOO4#,GK 'F9  v & & & c99$R$RM>-<<||G,,=(+G (:(:(<(>-<<||J//C8<< 3K3Kv3U3U+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Cc*oo3355 C'' R88>>-<<||J//C+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Q 3z7MQ[Qg(,}%"6***Q$Q{aeajajkxayay{{||||OPPPR ""jj++ +t,, K K ' '"z266<"Hh-- x==L(*M ##2#4#4y#@ #**,,3!'(8(@(@(B(B!C!C33$||~~%$(- (= ,3355A,1L,@M,3355%$*!%mg!F!F!FE#+9#+>+>+D"EEEEEEEEEEEEEEE(***')HHH*'||F33Auz<//$%,,T2222 # # # "  #&3K " +F9  v & & & N # * *Zs=7I7IZZZ     X}--XXX J0R O)++f4y@K   dT  : : : : O O O J  & &'M;'M'M!'M'M N N N N N N N N O!""+..y"==jj++ +t,, K#% %++-- ( (DAq ##!%q!1!1 A$$Q'''   +F9 G   {B / / 3 3Ir B B **[))'4(( G!++i00/400 ! O! )//11 $ $DAq''%)]1%5%5"  ###  !0GI ")F; G   v & & & '..DM 2 2DDDY IIm44YYY '..J#i..JJJU IIi00UUUR ""O,, fd # # \ ;(?(?2(E(E"#F; &,F? # v & & & N # * *+K L L L \Z[[[R ""-  I**Y''Cc4(( L,C,C'',''C.8c.B.BKsyy{{((***H%-%:C ! #F9 G N # * *TTSAQ=RTT      T v & & & TRSSS&R ""JJw'' )T** Imm,-- sC BSYY[[%6%6%8%8F%B  ;*;*/I& ''F7O v & & & N # * *+G H H H .$R ""JJw'' i & & 9==9I+J+Jd+R+R*/I& ''F7O v & & & N # * *+G H H H 5R ""JJ|,, i & & +?9+L+L! &:;;I #!)nn z* # # #"  #&;??%#&y}}5NPQ'R'R#S#SLL!:.%%%#$LLL%--;FI78N+22GkGGG$-F< v & & & '  Fjj//O/4((+ . g g g g g g g . . .)- & & & . % +K&5&;&;&=&= W W" U!%..33KGG#(i "  #**E{EEEW!'00.u..////U UUUVVV +(7}%"6*** N------LLLLLL00    ! !"5 6 68H   $ $A J  & &q ) ) ) $lqll### $ NNN ?MMMMMMMMNZ ???:??@@@'T:::KA5A ABBB A AC ?CK??3}+=?? @ @ @ @{ -...  Cwwu~~ :8CJ88999wwz"" >,-C#h--C-C-CDD43x=44455;;== bs6{E222 $++CK8882S[223333 #**+`c&k+`+`+`aaa GGGG,%@@@9DO555555#%%N# EEM[1_j1n55??044S"==>>>>$K$KU$K  }--    K Q]++QQQ R R R+ K K dIIIDHH]B,G,GIIJJJJ GGG >??EEGGMMOO/0    %%"/JD$xxDB488M4#@#@BBCCCADKAABBBBB488M4#@#@BBCCCxx ++a 4M(D!9!9MMM!!!&&W488Hd+C+C&W&W&W X X ^ ^ ` `5&tU333 ,33D9993T33444GGGG!$IJJJ/00NQ&&&P&P&P&P&PPPPZ ""$. !6""" 9::$G $GE$G QS-..QQQRRR' _ _C)44J ]SZ]]c-.@]]PZ]]] ^ ^ ^ ^  @AAGGIIOOQQFF+,   FFF  \ ! ! GGG$&&F 6AAAAAAA 6 6 6&5### 6+  '')R00;BJ7W7777 B3x=B,BBBCCIIKK))LLE%8"G"G3u:"G"GK U;;;N+223u:>>>?U????@@@@J'..h3u:hh3777C;P;Phhh v & & & & E F F F Nsf%/ <<=2J00 J=<J=.Q11RR26W)) W65W6Bv% u1u uu uu uv% u*'v%)u**:v%% v43v48+y$$ z.!zzQAQQAQ,Q+AQ,Q8#ARRAR2R1AR2T=AUU AUUAUXA+AY.Y. AZY8AZZAZe3Ae6e6Af f Af o3AppAp&p%Ap&q Aqq Aq!q Aq!overridec|}|D]X\}}||vrJt||tr/t|trt |||||<S|||<Y|S)aRecursively merge *override* into *base*, preserving nested defaults. Keys in *override* take precedence. If both values are dicts the merge recurses, so a user who overrides only ``tts.elevenlabs.voice_id`` will keep the default ``tts.elevenlabs.model_id`` intact. )r]r&r0r2 _deep_merge)rrresultr4rBs r$rrsYY[[Fnn&&  U 6MM6#;-- 5$'' &fSk599F3KKF3KK MrZcfg dotted_keysc<t}|D]}|d}|}|ddD]'}t|tr||vrd}n ||}(t|tr(|d|vr||d=||||fS)a}Remove the given dotted leaf keys from a nested config dict. Returns ``(pruned_cfg, set_of_stripped_keys_that_were_present)``. Used by ``save_config`` to drop managed-scope leaves before persisting, so a bulk write never writes a user value that would lose to the managed layer on the next load. Only keys actually present in ``cfg`` are reported as stripped. r)Nr\)rr/r0r2r-)rrstrippeddottedr6noder-s r$_strip_dotted_keysrsEEH ! ! S!!ss  AdD)) Qd]]7DD dD ! ! !eBi4&7&7U2Y LL =rZct|trtjdd|St|trd|DSt|t r d|DS|S)aRecursively expand ``${VAR}`` references in config values. Only string values are processed; dict keys, numbers, booleans, and None are left untouched. Unresolved references (variable not in ``os.environ``) are kept verbatim so callers can detect them. \${([^}]+)}ctj|d|dS)Nrr)rr8rgroup)r.s r$z"_expand_env_vars.. s*bjnnQWWQZZ<<rZc4i|]\}}|t|Sr_expand_env_varsr}s r$rz$_expand_env_vars..s'???41a#A&&???rZc,g|]}t|Srr)r~rs r$rOz$_expand_env_vars..s!7774 &&777rZ)r0r+rrr2r&r)objs r$rrs#s v  < <    #t@??399;;????#t87737777 JrZc||i}t|tr;tjd|D]$}tj|||<%ngt|tr(|D]}t||n*t|tr|D]}t|||S)uMap every ``${VAR}`` name referenced in config values to its current ``os.environ`` value (``None`` when unset). Stored alongside cached ``load_config()`` results so a cache hit can detect that the cached expansion was made against a *different* environment — e.g. a ``load_config()`` that ran before ``load_hermes_dotenv()`` populated the process env, or an env var rotated in-process after the first load. File mtime/size alone cannot see either case (#58514). Nr) r0r+rfindallrr8rr2values_env_ref_snapshotr)rsnapshotrrBrs r$rrs#s.J~s33 2 2DZ^^D11HTNN 2 C  .ZZ\\ / /E eX . . . . / C  . . .D dH - - - - OrZct|tsdSi}|D]V}t|tr(t|dtsdS|d}||vrdS|||<W|S)zHReturn a name-indexed dict only when all items have unique string names.Nr)r0rr2rr+)r&indexedrrs r$_items_by_unique_namer.s eT " "tG$%% Z8H8H#-N-N 44F| 7??44 NrZct|trfttrQtjdr<|krSttr|krSt |krS|St|t r6tt r!fd|DSt|trqttr\t|}tt|fd|DSfdt|DS|S)aRestore raw ``${VAR}`` templates when a value is otherwise unchanged. ``load_config()`` expands env refs for runtime use. When a caller later persists that config after modifying some unrelated setting, keep the original on-disk template instead of writing the expanded plaintext secret back to ``config.yaml``. Prefer preserving the raw template when ``current`` still matches either the value previously returned by ``load_config()`` for this config path or the current environment expansion of ``raw``. This handles env-var rotation between load and save while still treating mixed literal/template string edits as caller-owned once their rendered value diverges. z \${[^}]+}c i|]T\}}|t||ttr|ndUSr)_preserve_env_ref_templatesrr0r2)r~r4rBloaded_expandedrs r$rz/_preserve_env_ref_templates..Usr   U , ,6,M,MW##C(((SW   rZNc g|]c}t||d(|dnddS)rN)rr)r~rloaded_by_name raw_by_names r$rOz/_preserve_env_ref_templates..gs{  ,OODHHV$4$455.os    t (#c#hh..E Dot449>_AUAU9U9U &&       rZ) r0r+rrrr2r&rrr)r7rrcurrent_by_namerrs `` @@r$rr=s'3JsC$8$8RY|UX=Y=Y c>>J os + + ?0J0JJ C G + +J'4   ZT%:%:      &mmoo     '4   ZT%:%: 088+C00 .??  &;+B $         )11     NrZ.ctdtdttdfddffd |dS)aReturn leaf paths explicitly present in a raw config dict. Computed on the **raw** (un-normalized, un-expanded) config so that values injected by normalisation (e.g. ``agent.max_turns`` from ``DEFAULT_CONFIG``) are not mistakenly treated as user-set. Used by ``save_config`` to build the *preserve* set passed to ``_strip_default_values`` so only user-authored keys survive the defaults-strip pass. rBr.rNct|tr,|D]\}}|||fzdS|r|dSdSr)r0r2r&r-)rBrr4r_walkpathss r$rz%_explicit_config_paths.._walksu eT " " #kkmm , , UeTSF]++++ F   IIdOOOOO  rZr)rrr r+)r5rrs @@r$_explicit_config_pathsr}sh#&%%ESc3hD E&" LrZrE preserve_keyscdhtpdzdtdtdttdfdtffd i}|D]-\}}||||f}||||<.|S) aReturn *config* without keys whose values match *defaults*. Keys in *preserve_keys* (explicitly present in the user's raw config, before any normalisation) are always kept even when they equal the default, so user-set values such as ``memory.user_char_limit: 2200`` survive a ``save_config`` round-trip. Nested dicts whose every child is stripped are removed entirely so default-only subtrees (e.g. ``gateway``) never bloat ``config.yaml`` when the user has nothing to say about them. rrrBr^r.rcj| vrtj|St|trj|rht|tr|ni}i}|D]2\}}||} ||||fz}||||<3|r|SdS||krdStj|Sr)r]r^r0r2r&r) rBr^r default_dictrr4r child_defaultstripped_child_striprs r$rz%_strip_default_values.._strips = ='' ' eT " " u &0$&?&?G77RL')H#kkmm 3 3 U , 0 0 5 5 !'}dcVm!L!L!-$2HSM 4 G  4}U###rZ)rrr r+r&r)r5rErrr4rBrrs ` @r$_strip_default_valuesrs **S1D"-E-EEM$c$C$uS#X$3$$$$$$$, Fllnn## U6%c!2!2SF;;  "F3K MrZcd}t|to|d}t|to)|dp|d}tfddD}|s|s|sStd}t|ts |rd|ini}nt|}|d<dD]I}|}|r||s|||<|dJd|dfD]}|r|d s||d <dd|dd|ds2 |dp|d} | r| |d<|dr,|dd|ddS) uMove stale root-level provider/base_url/context_length into model section. Some users (or older code) placed ``provider:``, ``base_url:``, or ``context_length:`` at the config root instead of inside ``model:``. These root-level keys are only used as a fallback when the corresponding ``model.*`` key is empty — they never override an existing value. After migration the root-level keys are removed so they can't cause confusion on subsequent loads. Also aliases ``api_base`` → ``base_url`` (issue #8919). ``api_base`` is the intuitive name OpenAI-SDK / LiteLLM users reach for, and ``hermes config set`` blindly accepts any dotted key — so ``model.api_base`` got written, confirmed, and then silently ignored by the runtime resolver (which reads only ``model.base_url``), causing requests to fall back to OpenRouter. We migrate the alias to the canonical key (fallback-only — never override an explicit ``base_url``) and drop the alias so it can't confuse later loads. Finally, canonicalizes the model-id key to ``model.default`` (issue #34500). The runtime resolver and ~14 other readers select the chat model via ``model.default``; ``model.model`` was already aliased inline at some sites but ``model.name`` was not, so a custom-provider config like ``model: {name: , provider: }`` resolved to an empty model and the API request went out with ``model=`` (HTTP 400 from OpenAI-compatible backends) — while display paths (``hermes status``/``dump``) read ``name`` and *showed* the model, making the failure silent. Normalizing here (the single load/save chokepoint) means every reader, present and future, sees a populated ``default`` and the stale alias is migrated out of config.yaml on the next save. Precedence: ``default`` > ``model`` > ``name`` (never overrides an explicit ``default``, so existing configs are unaffected). rapi_baserc3BK|]}|VdSrrM)r~rr5s r$r/z-_normalize_root_model_keys..s> 1 rZ)r'r(rerr^)r'r(reNr()rr0r2anyrB) r5model_inmodel_has_aliasmodel_needs_canonhas_rootrr4root_val alias_valaliass ` r$_normalize_root_model_keysrsBzz'""H 400MX\\*5M5MO #8T22 W5f!5!5UH O4E &\\F JJw  E eT " "&+3E""U F7O9::c??  "EIIcNN "!E#J 3jj,,eii .C.CD**  *UYYz22 * )E*  JJz4    IIj$ IIi %% '""7eii&7&7  %$E)  yy  '4    &$ MrZct|}t|dpi}d|v}d|v}|r |s |d|d<|s|snd|vrtdd|d<||d<|dd|S)uNormalize legacy root-level max_turns into agent.max_turns. Only injects the schema default when the user actually set max_turns somewhere (root level or under ``agent``). A bare ``load_config()`` call that passes the result straight to ``save_config()`` should not materialise ``agent.max_turns`` in config.yaml when the user never set it — that makes the default sticky and blocks future schema changes. rrN)r2rrKrB)r5 agent_confighad_root had_agents r$_normalize_max_turns_configrs&\\F 7++1r22Lf$H|+I8 8$*;$7 [! III L ( ($27$;K$H [!"F7O JJ{D!!! MrZ)r^rct|ts|S|}|D]+}t|ts|cS||vr|cS||},|S)u%Traverse nested dict keys safely, returning ``default`` on any miss. Canonical helper for the ``cfg.get("X", {}).get("Y", default)`` pattern that appears 50+ times across the codebase. Handles three common gotchas in one place: 1. Missing intermediate keys (returns ``default``, no KeyError). 2. An intermediate value that's not a dict (e.g. a user wrote a string where a section was expected). Returns ``default`` instead of AttributeError on ``.get()``. 3. ``cfg is None`` (callers sometimes pass ``load_config() or None``). Named ``cfg_get`` rather than ``cfg_path`` to avoid shadowing the ubiquitous ``cfg_path = _hermes_home / "config.yaml"`` local variable that appears in gateway/run.py, cron/scheduler.py, main.py, etc. Explicit ``None`` values are returned as-is (matches ``dict.get(key, default)`` semantics — ``default`` is only returned when the key is *absent*, not when it's present but set to ``None``). Examples: >>> cfg_get({"agent": {"reasoning_effort": "high"}}, "agent", "reasoning_effort") 'high' >>> cfg_get({}, "agent", "reasoning_effort", default="medium") 'medium' >>> cfg_get({"agent": "oops_a_string"}, "agent", "reasoning_effort", default="low") 'low' >>> cfg_get(None, "anything", default=42) 42 >>> cfg_get({"a": {"b": None}}, "a", "b", default="def") # explicit None preserved >>> cfg_get({"a": {"b": False}}, "a", "b", default=True) # falsy values preserved False )r0r2)rr^rrr4s r$cfg_getr9smD c4 D$%% NNN d??NNNCy KrZct5 t}|}|j|jf}n%#t t f$ricYcdddSwxYwt|}t |}|4|dd|kr&tj |dcdddS t|d5}t|pi}dddn #1swxYwYn5#t$r(}t||icYd}~cdddSd}~wwxYwt!|t"si}|d|dtj |ft|<|cdddS#1swxYwYdS)uRead ~/.hermes/config.yaml as-is, without merging defaults or migrating. Returns the raw YAML dict, or ``{}`` if the file doesn't exist or can't be parsed. Use this for lightweight config reads where you just need a single value and don't want the overhead of ``load_config()``'s deep-merge + migration pipeline. Cached on the config file's (mtime_ns, size) — same strategy as ``load_config()``. Returns a deepcopy on every call since some callers mutate the result before passing to ``save_config()``. Nrrrrr) _CONFIG_LOCKrIrr,rr<rr+r]rr]r^r9rFrr6r0r2)r r cache_keypath_keycachedr?datarTs r$rWrWhs  )++K!!##B4II!7+   II   {##"&&x00  &!* "9"9=++ kG444 /%a((.B / / / / / / / / / / / / / / /    &{A 6 6 6IIIII%  $%% D'0|Yq\4=QUCVCV&W(#/sF0;FAFAAFC;C/# C;/C3 3C;6C3 7C;:F; D-D(D-F(D--AFFFc|t} |n5#t$rYdSt$r}t d|d|d|d}~wwxYw t |d5}|dddddS#1swxYwYdS#t$r}t d|d|d|d}~wwxYw)z>Refuse to replace an existing config.yaml that cannot be read.NzRefusing to overwrite z+: existing config.yaml cannot be accessed (z3). Fix the file permissions or move it aside first.rbrz': existing config.yaml cannot be read ()rIrr<rrr9rm)r r&r?s r$$require_readable_config_before_writer s%''    I[ I I I I I     +t $ $  FF1III                    I[ I I I I I   sU' A AAAB-B BBBBB C'B>>Crkwargsc Dddlm}t||||fi|dS)a*Fail-closed atomic write for ``config.yaml``. The single chokepoint every config-update path should use instead of calling :func:`utils.atomic_yaml_write` directly. It runs :func:`require_readable_config_before_write` first, so a full-file replacement can never silently clobber an existing ``config.yaml`` that degraded to an empty dict on read (permission error, broken mount, transient I/O). New-file creation still works when the path is absent. Root cause this guards: ``read_raw_config()`` returns ``{}`` for BOTH an absent file and an unreadable-but-present file. Callers that read then overwrite can't tell the two apart, so an unreadable config would be replaced with only defaults or the single edited section. Routing every write through this helper enforces the invariant in one place rather than relying on each of ~15 independent write sites to remember the guard. ``kwargs`` are forwarded verbatim to ``atomic_yaml_write`` (``sort_keys``, ``default_flow_style``, ``extra_content``, ...). ratomic_yaml_writeN)utilsrr )r rr rs r$atomic_config_writersE(('''''(555k422622222rZc"tdS)uLoad configuration from ~/.hermes/config.yaml. Cached on the config file's (mtime_ns, size). Returns a deepcopy of the cached value when unchanged, since most call sites mutate the result (e.g. ``cfg["model"]["default"] = ...`` before ``save_config``). The cache is keyed on ``str(config_path)`` so profile switches (which change ``HERMES_HOME`` and therefore ``get_config_path()``) don't collide. Read-only callers should use ``load_config_readonly()`` to skip the defensive deepcopy — that path matters in agent-loop hot spots like ``get_provider_request_timeout`` which is called once per API turn. T want_deepcopy_load_config_implrrZr$rJrJs 4 0 0 00rZc"tdS)uFast-path variant of ``load_config()`` for callers that ONLY READ. Returns the cached config dict directly without the defensive deepcopy that ``load_config()`` applies. **Mutating the returned dict (or any nested structure) corrupts the in-process cache for every subsequent caller** — only use this when you are absolutely sure your code path will not write to the result. If you need to mutate or pass to ``save_config``, call ``load_config()`` instead. Why this exists: ``load_config()`` cache-hit cost is ~265us per call, half of which (~135us) is the defensive deepcopy. The agent loop calls into config reads (timeouts, thresholds, feature flags) ~20-50x per conversation; skipping deepcopy here removes a measurable allocation source and the GC pressure that comes with it. Note: this returns a plain ``dict`` (not ``MappingProxyType``) so existing ``isinstance(x, dict)`` guards downstream keep working. The safety guarantee is purely documented, not enforced — be careful. FrrrrZr$load_config_readonlyrs( 5 1 1 11rZ)r platform_key field_keyrc2|rtn t}|di}t|tsi}||d<||i}t|tsi}|||<|||<t |dS)a)Persist one scalar field under ``platforms.``. ``raw=True`` preserves CLI setup flows that intentionally edit only the user's raw config file. Dashboard routes use the default loaded-config path so they retain their existing profile-scoped ``load_config`` behavior. ryN)rWrJrZr0r2r)rrrBrr5ryplatform_configs r$write_platform_config_fieldrs#& 8_   ;==F!!+r22I i & &( '{**<<>& ! !t " & &s3v;;<<'8 9 99rZ)envr5rrDc| tjn|}t}t|dt }||n|}||n t }t|t r|dini}t|t s|StD]\} } | |vr || } | dkr\t| pd } | dvr@t| trtj | } |s| |vrt| || <|S)a`Bridge ``terminal.*`` config into the env vars terminal tools read. ``tools.terminal_tool`` is intentionally environment-driven because it also runs in child processes (TUI, dashboard PTY, gateway workers). This helper gives those child-process launch paths the same config bridge as classic CLI without importing ``cli.py`` and paying for its startup side effects. When the user config contains a ``terminal`` section, config.yaml is authoritative and overrides existing env values. Otherwise defaults only backfill missing env vars so exported/.env values keep working. Nrrr>rrr))rr8rWr0rr2rrBr&r+rr expanduserr@) rDr5rtarget raw_configfile_has_terminal_configshould_overriderrcfg_keyenv_varrBraw_cwds r$apply_terminal_config_to_envrN2s\";RZZCF ""J)*..*D*DdKK2:2B..O&&&,@,B,BC.8d.C.CK377:r***L lD ) ) 399;; 9 9 , & & W% e  %+2&&,,..G...%%% 2**511  9gV331%88F7O MrZrcNt5tt}t|} |}|j|jf}n#t$rd}YnwxYwddlm }| }|r|dz nd} |r|nd}|r|j|jfnd} n#t$rd} YnwxYw||d|d| d| df} n| dkrdd| d| df} nd} t |} | | | dd| krxt| dkr| dni} td| Dr0|rt#j| dn| dcdddSt#jt&} | t)|d 5}t+|pi}dddn #1swxYwYd |vr_t-| d pi}| d  |d |d <||d <|d dt1| |} n'#t2$r}t5||Yd}~nd}~wwxYwt7t9| }t;|}|}|rt;|}t1||}t#j|t>|<| Wt#j|}tA|} |rtA|| g| || Rt|<|s|cdddSnt|d|cdddS#1swxYwYdS) Nr managed_scoperH)rrrrrc3bK|]*\}}tj||kV+dSr)rr8rr}s r$r/z$_load_config_impl..s9KKda2:>>!$$)KKKKKKrZrrrr)!rrrIr+rr,rr< hermes_clirQget_managed_dirrr\rr\r r&r]r^rKr9rFr2rBrrr6rrrload_managed_configr[r)rr rruser_sigrQ managed_dirmanaged_cfg_pathmst managed_sig cache_sigr env_snapshotr5r? user_configagent_user_configrTrexpandedmanaged_configmanaged_expanded cached_copys r$rr]s' ii%'' {## !!##B35>2:2NHH    HHH  -,,,,,#3355 II F " "A{1~{1~>III#''11  )"7F2A2J)>H26-2I2I%h/  -11K,Z88L @!.,???+RY+R +R\+R+R x (! #"Ciiiiiiii@ #  " "8T 2 2 2 Siiiiiiiiiiiiiiiiiis,N"AN A'$N&A''&N*B98N9 CNCCN+NI5G6* I56G: :I5=G: >A6I54N5 J?JNJC N0NN!Nu- # ── Security ────────────────────────────────────────────────────────── # Secret redaction is ON by default — strings that look like API keys, # tokens, and passwords are masked in tool output, logs, and chat # responses before the model or user ever sees them. Set redact_secrets # to false to disable (e.g. when developing the redactor itself). # tirith pre-exec scanning is enabled by default when the tirith binary # is available. Configure via security.tirith_* keys or env vars # (TIRITH_ENABLED, TIRITH_BIN, TIRITH_TIMEOUT, TIRITH_FAIL_OPEN). # # security: # redact_secrets: true # tirith_enabled: true # tirith_path: "tirith" # tirith_timeout: 5 # tirith_fail_open: true u@ # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # bedrock (AWS IAM / boto3) — AWS Bedrock (Converse API) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 u # ── Security ────────────────────────────────────────────────────────── # Secret redaction is ON by default. Set to false to pass tool output, # logs, and chat responses through unmodified (e.g. for redactor dev). # # security: # redact_secrets: true # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # bedrock (AWS IAM / boto3) — AWS Bedrock (Converse API) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 )strip_defaultsrrcc t5trtd ddddSddlm}|}|rut tj||\}}|rNtdt|dd t|tjdd lm}t#t%}t'|t)}|rt+|nd} t-t/|} | } t-t/t)} | r6t1| | t2t7|} d h} | r| | |r| ||rB| r@dd lm}|t>t6t@f| } tC| tD| } g}| d i}|r|d|#tH| di}d}tK|tLrtOd|D}nLtK|tPr7tS|do|d}|s|#tT||| |rd |ndtW|tj| t2t7|<ddddS#1swxYwYdS)a{Save configuration to ~/.hermes/config.yaml. Default values from ``DEFAULT_CONFIG`` are not written to disk unless the user explicitly set them (i.e. the path exists in the raw config before any normalisation). This prevents config.yaml from being contaminated with schema defaults on every save, which makes future default changes invisible to users. zsave configurationNrrPzNote: zD managed setting(s) were not saved (managed by your administrator): rxr*r r)cast)rrrrFc3K|]C}t|to)|do|dVDdS)r'rN)r0r2r)r~rTs r$r/zsave_config..lsNgg_`jD11ZaeeJ6G6GZAEERYNNggggggrZr'rr) extra_content),rrr-rSrQmanaged_config_keysrr]r^r,r\rrr0r1rrrrIr rWrrrrr[rr+rtypingrerrrrKr(_SECURITY_COMMENTr0rrr2r_FALLBACK_COMMENTrr)r5rcrrQ managed_keys _strippedrr _raw_for_pathsexplicit_raw_pathscurrent_normalizedr raw_existingeffective_preserve_keys_castr6secr fb_is_valids r$rrsT U\U\ <<  . / / / U\U\U\U\U\U\U\U\ -,,,,,$88::   24=3H3H, W W FI WS^^WW8< &BSBS8T8TWW ,+++++%'' ,[999 )**6D N "> 2 2 2$  88STZ8[8[\\' 12MoN_N_2`2`aa  4-11#k2B2BCCJ:N8N  ? # * *+= > > >  : # * *= 9 9 9  5  , , , , , ,tCH~z::J.5JnnZ,, ,cgg.//7 LL* + + + ^^,b 1 1 b$   GggdfgggggKK D ! ! Grvvj11EbffWooFFK , LL* + + +  ,1;"''%...t    [!!!:>-HZ:[:[%c+&6&67kU\U\U\U\U\U\U\U\U\U\U\U\U\U\U\U\U\U\sM,L+M,,M03M0 raw_valuec`|}t|dkr|d|dcxkrdkrnn|dd}g}d}|t|kr{||}|dkr@|dzt|kr*||dz}|dvr|||dz }a|||dz }|t|k{d|St|dkr&|d|dcxkrd kr nn |ddS|S) z7Parse the small .env value subset Hermes writes itself.rrr\"r\>rxryrrC)rr\r(r)rvrBquotedrrchnext_chs r$_parse_env_valuer}{sT OO  E 5zzQ58uRy7777C77777qt #f++ooBTzza!ec&kk11 Q-k))MM'***FA MM"    FA#f++oowwv 5zzQ58uRy7777C77777QrT{ LrZcht} |j}|j}t |||f}n/#t $rt |ddf}Ynt $rd}YnwxYw|&tt\}}||krt|Si}| rddd}t|fi|5}| } dddn #1swxYwYt| } | D]} | } | ru| ds`d| vr\| dr | dd} | d\} } }t!||| <||t|fa|S) uLoad environment variables from ~/.hermes/.env. Sanitizes lines before parsing so that corrupted files (e.g. concatenated KEY=VALUE pairs on a single line) are handled gracefully instead of producing mangled values such as duplicated bot tokens. See #8908. The parsed dict is memoised keyed on the .env file mtime, because ``get_env_value()`` is called dozens-to-hundreds of times per interactive menu render (`hermes tools`, `hermes setup`, status panels). Sanitisation is O(lines × known-keys), so re-parsing the same file on every call was burning ~300ms of CPU per `hermes tools` menu paint on top of the OAuth-refresh slowness. The mtime check invalidates the cache when the user edits .env mid-process. N utf-8-sigrrerrorsr2r1zexport rz)rLrst_mtimerr+r<r _env_cacher2rr9 readlines_sanitize_env_linesrr:r;r})env_pathmtimesizer cached_key cached_varsenv_varsopen_kwr? raw_linesrr@r4rArBs r$load_envrs "~~H (}}&]]E40 000]]D$/  !7", K  " " $$ $!H@ +i@@ ( & &g & & &! I & & & & & & & & & & & & & & &$I.. @ @D::<.s' C Cv6U? C C C C C CrZTc3>K|]}|VdSr)isspace)r~r{s r$r/z/_looks_like_structured_value..s*,,rzz||,,,,,,rZ)r_STRUCTURED_VALUE_MARKERSr?s`r$_looks_like_structured_valuersM C C C C)B C C CCCt ,,e,,, , ,,rZrc  tttz}g}|D]}|d}|rdr||dz\g |D]u}|dz}|}|dkrS ||t|zf||t|z}|dkSvt fd D d}g} t dkrI ddkr= fd t D} td | d d D}|r5| D]0} | } | r|| dz1|dz|S) aFix corrupted .env lines before reading or writing. Handles two known corruption patterns: 1. Concatenated KEY=VALUE pairs on a single line (missing newline between entries, e.g. ``ANTHROPIC_API_KEY=sk-...OPENAI_BASE_URL=https://...``). 2. Stale ``KEY=***`` placeholder entries left by incomplete setup runs. Uses a known-keys set (OPTIONAL_ENV_VARS + _EXTRA_ENV_KEYS) so we only split on real Hermes env var names, avoiding false positives from values that happen to contain uppercase text with ``=``. z r2r*r1rcVh|]#\tfdD!$S)c3JK|]\}}|ko|ko ||ffkVdSrr)r~s2e2rTss r$r/z0_sanitize_env_lines...sZBa:B!G:RQF(:rZ)r)r~rTr match_rangess @@r$rKz&_sanitize_env_lines..sj" " " !Q*" " " " rZFrcg|]=\}}||dztkr |dznt>Sr)r\)r~rpossplit_positionsrs r$rOz'_sanitize_env_lines..,slAs./!ec/6J6J.J.JOAE**PST\P]P]rZc3jK|].}t|ddd V/dS)r1rN)rr/)r~segs r$r/z&_sanitize_env_lines..7sT%%131B1B11EFFF%%%%%%rZNr\) rr)r_EXTRA_ENV_KEYSrrr:r(findr\rrr )r known_keys sanitizedr@rkey_nameneedler9split_into_entriessegmentsrr8rrrs @@@r$rrs[&++--..@JI<.<.kk&!!99;; 8..s33    S4Z ( ( ( /1 " ? ?H^F--''C((##S#F *;$<===mmFC#f++,=>>((!" " " " &" " "   #    ! # #(:a(?(?(88 H"%%%#CRC=%%%""   . 2 2yy{{2$$TD[111 2   X_ - - - - rZc$t}|sdSddd}ddi}t|fi|5}|}dddn #1swxYwYt |}||krdSt t |t |z }|dkrVtdt||D}|t t |t |z z }tj t|j d d \}} tj|d fi|5}|||tj|dddn #1swxYwYt'||n5#t($r( tj|n#t,$rYnwxYwwxYwt/|t1|S) zRead, sanitize, and rewrite ~/.hermes/.env in place. Returns the number of lines that were fixed (concatenation splits + placeholder removals). Returns 0 when no changes are needed. rrrrrrNc3,K|]\}}||k dVdS)rNr)r~abs r$r/z$sanitize_env_file..`s*KK$!QAFFAFFFFKKrZ.tmp.env_dirrtrr)rLrr9rrabsr\sumziptempfilemkstempr+rrfdopen writelinesr3fsyncfilenorE BaseExceptionunlinkrrrr) rread_kwwrite_kwr?original_linesrrgfdtmp_paths r$rVrVGs ~~H ??  q&)<AF" F>"F&&F>)F&*F>> G0 GG0 G+(G0*G++G0c  |d|S#t$rYnwxYwg}t|D]E\}}t|dkr-|d|d|dt|ddF|dd d}t d |d d d |ddDzt|dkrdndzdztj |S)u1Warn and strip non-ASCII characters from credential values. API keys and tokens must be pure ASCII — they are sent as HTTP header values which httpx/httpcore encode as ASCII. Non-ASCII characters (commonly introduced by copy-pasting from rich-text editors or PDFs that substitute lookalike Unicode glyphs for ASCII letters) cause ``UnicodeEncodeError: 'ascii' codec can't encode character`` at request time. Returns the sanitized (ASCII-only) value. Prints a warning if any non-ASCII characters were found and removed. asciiz position r(z (U+04Xrignore)rz Warning: z contains non-ASCII characters that will break API requests. This usually happens when copy-pasting from a PDF, rich-text editor, or web page that substitutes lookalike Unicode glyphs for ASCII letters. r*c3 K|] }d|V dS)rNr)r~r@s r$r/z._check_non_ascii_credential..s(::DKKK::::::rZNrz ... and morerz The non-ASCII characters have been stripped automatically. If authentication fails, re-copy the key from the provider's dashboard. r*) encodeUnicodeEncodeErrorrordr(decoder,rr\r0r1)r4rB bad_charsrr{rs r$_check_non_ascii_credentialrusc  W      I5!!JJ2 r77S==   H1HHHH#b''HHHH I I I WX 66==gFFI      ))::IbqbM::: : :  ; "%Y!!3!3    =  V  VZ     s  &&c|dkr|Sd|vpd|vpd|vp||k}|s|S|dddd}d|dS)zDQuote .env values containing characters with special dotenv meaning.rr2rxrCryz\\z\")rr)rB needs_quotingescapeds r$_quote_env_valuers {{  u  " %< " %< " EKKMM !   mmD&))11#u==G w>>>rZcntrtd|dSddlm}||rA|}|r|dz nd}t d|d|d tj dSt |std |t|| d d  dd }t||}tt!}ddd}ddi}g}|rHt%|fi|5} | }dddn #1swxYwYt)|}t+|} d} t-|D]>\} } | |dr|d| d || <d} n?| sH|r+|dd s|dxxd z cc<||d| d t7jt;|jdd\}}d}|r= t?j |j!}n#tD$rYnwxYw tGj$|dfi|5} | %|| &tGj'| (dddn #1swxYwYtS|||' tGj*||n#tD$rYnwxYwtW|n5#tX$r( tGj-|n#tD$rYnwxYwwxYw|tFj.|<t_dS)z)Save or update a value in ~/.hermes/.env.zset NrrPrKthe managed scopez Cannot set ': it is managed by your administrator () and cannot be changed.r*#Invalid environment variable name: r*r rrrrrFr1Tr\rrrr)0rr-rSrQis_env_managedrTr,r0r1_ENV_VAR_NAME_REmatchrXrYrrrrLrr9rrrrrr:endswithr(rrr+rrS_IMODEst_moderrrrr3rrrErdrrrrr8r)r4rBrQrWsrcrrrrr?serialized_valuefoundrr@rr original_modes r$rXrXs||lSll###)(((((##C((#3355 (3L{V##9L  &# & &c & & &      ! !# & &HFsFFGGGs### MM$ # # + +D" 5 5E 'U 3 3E~~H')<.(s:RRR$tzz||/F/F#yyy/Q/QRRRRrZrrrr)(rr-rSrQrrTr,r0r1rrrXrLrrr8rBr9rrr\rrr+rrrrrrrr3rrrErdrrrrr)r4rQrWrrrrr?r new_linesrrrrs` r$remove_env_valuers ||ooo&&&u((((((##C((#3355 (3L{V##9L  &S & & & & &    u  ! !# & &HFsFFGGG~~H ??   sD!!!u&)<>#  % ' '#BJsO QJE h  3"*#4#4 3 QJE LrZc|tjvrtj|St}||S)z/Get a value from ~/.hermes/.env or environment.)rr8rr)r4rs r$r'r's: bjz#zzH <<  rZct}||}|r|S ddlm}||S#t$r"t j|cYSwxYw)uResolve a credential env value, preferring ``~/.hermes/.env`` over ``os.environ``. Used for Hermes-managed credentials where a deliberate edit to ``.env`` must take precedence over a stale value inherited from the parent shell (Codex CLI, test scripts, login profile exports). Without this, rotating a key in ``.env`` mid-session leaves callers serving the stale shell value and produces persistent 401s. The ``os.environ`` fallback routes through ``secret_scope.get_secret`` so that, under an active profile scope (multiplexed gateway turn), this read is scope-checked rather than leaking another profile's raw ``os.environ`` value — matching the credential-pool seeding path's behaviour. r) get_secret)rragent.secret_scoperrrr8)r4rval _get_secrets r$get_env_value_prefer_dotenvrszzH ,,s  C  #@@@@@@{3 ###z~~c"""""#s:)A&%A&cXddlm}||tdtjS)uRedact an API key for display. Thin wrapper over :func:`agent.redact.mask_secret` — preserves the "(not set)" placeholder in dim color for the empty case. r mask_secret (not set))empty) agent.redactrrrDIM)r4rs r$ redact_keyr s7 )((((( ;s% VZ"@"@ A A AArZ>jwtr4authtokenapikeybearerpasswdrr)id_tokenr private_key access_token authorization client_secret refresh_token_depthcddlm}dkr|St|tri}|D]q\}}t|t rA|tvr&t|t r|r||||<[t|dz||<r|St|trfd|DS|S)ufReturn a copy of ``value`` with credential-shaped keys masked for display. Recursively walks dicts/lists and replaces the value of any key in ``_SECRET_CONFIG_KEYS`` (case-insensitive) with a masked form via :func:`agent.redact.mask_secret`. Non-secret keys and scalar values pass through unchanged. Use this before ``print``-ing any config sub-tree that might carry a custom-provider ``api_key`` — ``print`` bypasses the logging redactor, and opaque tokens (e.g. Cloudflare ``cfut_...``) don't match the vendor-prefix regexes either, so structural key-name masking is required. rrrrc6g|]}t|dzSr)redact_config_value)r~rrs r$rOz'redact_config_value..s(BBBq#Avz22BBBrZ) rrr0r2r&r+r_SECRET_CONFIG_KEYSrr)rBrrrrrs ` r$rrs)((((({{ %KKMM < d?|d7d@kr(tdA|dBdCnj|d7dDkr(tdE|dFdGn)|d7dHkrLtdI|dJdCt#dK}tdL|rdMndNn|d7dOkrLtdP|dQdCt#dR}tdS|rdMndNn_|d7dTkrFt#dU}t#dV}tdW|pdNtdX|pdNtttdYtjtj |dZd[}|rtd\|n*td\td]tjtttd^tjtj |d_i}|d`da}tdb|rdcndd|r(tde|dfdgdhzdidjtdk|dldmdhzdidntdo|dpdqdrtds|dtdudv|dwid_i}|dd[pdx}td||dydz}|r|dzkrtd{||dwi}|d|i|d}id~}t?d| D}|rtttdtjtj |!D]\}} | dydz}!| dd[}"|!dzks|"rId|!g}#|"r|#"d|"td|ddd |#tttdtjtj t#d}$t#d}%td|$rdMntdtjtd|%rdMntdtj ddl#m$}&m%}'|&}(|(r|'|(})tttdtjtj |(D]}*|*d}+|)|+d[}|*dd[},|rt3|ntdNtj}-td|+dd|-dtd|,dtjn#t6$rYnwxYwtttdtjttdtjttdtjttdtjtdS)zDisplay current configuration.u┌─────────────────────────────────────────────────────────┐u@│ ⚕ Hermes Configuration │u└─────────────────────────────────────────────────────────┘rrPu7 ⚷ Some settings are managed by your administrator (z) and cannot be changedz Managed config keys: rxz Managed env keys: u ◆ Pathsz Config: z Secrets: z Install: u ◆ API Keys) )r OpenRouter)rzOpenAI (STT/TTS))rExa)rParallel)r Firecrawl)rTavily)r Browserbase)rz Browser Use)rFALrz<14r)get_anthropic_key Anthropicu ◆ Modelz Model: rznot setrrz Max turns: HERMES_MAX_ITERATIONSNu9 ⚠ .env has stale HERMES_MAX_ITERATIONS=z& (run 'hermes doctor --fix' to remove)u ◆ Displayr;z Personality: r=nonez Reasoning: rNFrQrz Bell: rMrcrdrrez User preview: first z line(s), last z line(s)u ◆ Terminalrz Backend: r3rz Working dir: rr)z Timeout: rr6rrz Docker image: rr singularityz Image: rrmodalz Modal image: rMODAL_TOKEN_IDz Modal token: configuredrdaytonaz Daytona image: rDAYTONA_API_KEYz API key: sshr&r(z SSH host: z SSH user: u ◆ Timezonerrz Timezone: r u◆ Context CompressionrrTz Enabled: rrz Threshold: rrdz.0f%z Target ratio: rrz% of threshold preservedz Protect last: rrz messagesz Protect first: r rz non-system head messagesr$z(auto)r'rz Provider: r&r,)Visionz Web extractc3vK|]4}|dddkp|ddV5dS)r'rrrNrM)r~ts r$r/zshow_config..s\  j&!!V+AquuWb/A/ArZu ◆ Auxiliary Models (overrides)r5r412su◆ Messaging Platformsrrz Telegram: znot configuredz Discord: )rNresolve_skill_config_valuesu◆ Skill Settingsr4rz<20s[]u────────────────────────────────────────────────────────────z+ hermes config edit # Edit config filez! hermes config set z+ hermes setup # Run setup wizard)&rJr,rrCYANrSrQrhload_managed_envrTYELLOWBOLDrrrIrLrNr'r hermes_cli.authr#rrrKrr+rrr0r2rrrr&r(rPrNr4).r5rQ _managed_keys _managed_env _managed_dirrenv_keyrrBr#anthropic_value_cfg_max_turns _env_ghostr;ump ump_firstump_lastr modal_token daytona_keyr%r'tzrr _aux_comp_sm comp_providerr$ aux_tasks has_overrideslabeltask_cfgprovmdlr6telegram_token discord_tokenrNr4 skill_varsresolvedrUr4r display_vals. r$ show_configrWs ]]F GGG %DFLFQ R RSSS %RTZT_ ` `aaa %DFLFQ R RSSS)(((((!5577M 1133L $4466   e %l % % % M K        %NDIIf]6K6K,L,LNN       %J6,3G3G)H)HJJ      GGG % V[&+ 6 6777 0_.. 0 0111 -\^^ - -... 1-// 1 1222 GGG % V[ 9 9:::   D33 g&& 14111j//112222111111''))O >{ > > >O! >??? GGG % V[&+ 6 6777 R0GY1O1OPP R RSSSZZ,,00nW>UVa>bccN -^ - -...  ZZ^^$;<<  !c*oo&;&;&=&=^ATATAZAZA\A\&\&\ %9J999           GGG % v{FK 8 8999jjB''G CW[[77A6 C CDDD VW[[1A5%I%ITTTu V VWWW XW[[1CU%K%KVTTQV X XYYY5? Lbdf@g@gim5n5n v'++,b 1 1 1tvC q))Iww|Q''H O9 O OX O O OPPP GGG % V[ 9 9:::zz*b))H ?X\\)W== ? ?@@@ 7X\\%55 7 7888 ;X\\)R88 ; ; ;<<<||I(** mn>j!k!kmmnnnn i M 1 1 {.ACx!y!y{{|||| i G + + lm=i!j!jllmmm#$455  O!M+OOPPPP i I - - o(,,@l"m"mooppp#$566  O!M+OOPPPP i E ) ) !455 !455 :!8[::;;; :!8[::;;; GGG % V[ 9 9::: J # #B H %%%&&&& F'7!D!DFFGGG GGG %)6; D DEEE**]B//Kooi..G 9g7UU4 9 9::: 6 Pd!C!Cc!IPPPPQQQ j!F!F!Ljjjjkkk Q1A2!F!FQQQRRR b+//2CQ"G"GbbbcccJJ{B//33M2FF mmGR((4H &&&'''! j&99  6]f44 4]44 5 5 5 ;++I }}Xr22 }}]B77I!!##M <  e6 V[QQRRR(00 < >H GGG %,fk6;GG H H H! ] ]%j S"-- WWWb11 ,1Uc%jjju[&*7U7U [3[[[k[[U;Lz;L;L;Lfj5Y5Y[[\\\\       GGG % FJ ' '((( %=vz J JKKK %3VZ @ @AAA %=vz J JKKK GGGGGs&BQ Q Q /C8u(( u54u5cRtrtddSt}|s(t t dt d|tjdptjd}|s5ddl }ddl }|j d krgd }ngd }|D]}|j |r|}n|s#t d t d |dSt d|d|dtj|t|gdS)z"Open config file in user's editor.zedit configurationNF)rczCreated r;r<rrP)notepadrhvimvinano)r\rZr[rhrYz#No editor found. Config file is at:rzOpening  in z...)rr-rIrrrKr,rrrr0rTr subprocessrunr+)r editorr_sys candidatescmds r$ edit_configrds}||*+++!##K     (N59999 &&&'''Yx 7BIh$7$7F    =G # #AAAJJAAAJ  Cv|C      3444  ;  !!! 1[ 1 1f 1 1 1222NFC ,,-.....rZctrtddSddlm}||rS|}|r|dz nd}t d|d|d tj tj d gd }| |vsN| d s'| drEt| |t d|dtdSt}t!|i}|rN t%|d5}t'|pi}dddn #1swxYwYn#t($ri}YnwxYw|dvrd}nu|dvrd}n\|rt/|}n8|ddd rt3|}t5||||} | dvr t9|}d}t dt;ddlm} | ||dtA|} | r#|dkrt| tC||"dd d} | tFvr)tI|tJr|rdd l&m'} | |}n|}t d|d!|d|dS)"zSet a configuration value.zset configuration valuesNrrPrHrz Cannot set 'z(': it is managed by your administrator (zA) and cannot be changed. Contact your administrator to modify it.r*r)rrkr}rrrrrrrrrrrrrrrrr&r(rzrrrrr)_API_KEY_TOKEN TERMINAL_SSHu✓ Set r]rr>rQrrT>rrrFr)r)zmodel.api_baserzmodel.base_urlu< (note: 'api_base' is an alias — saved as model.base_url)r ) sort_keysz terminal.cwdr\rrU)(rr-rSrQis_key_managedrTr,r0r1exitupperrr:rXrLrIr rr9rFrrisdigitrUrrr;rrrrrrCr@rsplitrr0r+rr)r4rBrQrWrapi_keysr r]r? _alias_normrrL _leaf_keyr_display_values r$set_config_valuerss&||0111 )(((((##C((#3355 /:S{]**@S  O3 O O O O O        H yy{{h#))++"6"67M"N"NRUR[R[R]R]RhRhiwRxRxsyy{{E*** 222,..22333 "##K(555K kG444 6,Q//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6   KKK  {{}}--- 0 0 0 E  sB " " * * , ,e  S%((( ))++##%%K4440==  LMMM''''''k;%@@@@.c22G<3.((w 3E : :;;;  3""2&,,..I'''Juc,B,B'u',,,,,,$U++ >S > >^ > > > >?????s6/F*F F*F""F*%F"&F** F98F9c  t|dd}||dkrtdS|dkrtdS|dkrt|dd}t|dd}|r|mtdttd td td td t jd t ||dS|dkrttdS|dkrttdS|dkrtttdtj tj ttd}t}t\}}|s?|s=||kr7ttdtjtdS||krtd|d||r tdt#|dd|D}d|D} |r=tdt#|d|D]} td| d| rztdt#| d | D]W} | d!g} | r!d"d#| dd$d%nd&} td| d| Xtt)d'd(} t| d)s| d*r'ttd+tj| d,rCt| d,D],}ttd-|tj-tdS|d.krtttd/tj tj tt\}}||krtd|d0n.ttd|d|d1tjtttd2tj t,D]O}t/|rtd3|$ttd4|d5tjPtttd6tj t2D]\}}t/|rtd3|'|d!g} | r dd#| dd$nd&} ttd7|| tjt}|rUtttd8t#|d9tjtd:tdStd;|ttd<td=td>td?td@tdAtdBtdCt jd dS)DzHandle config subcommands.config_commandNshoweditrr4rBz&Usage: hermes config set z Examples:z3 hermes config set model anthropic/claude-sonnet-4z+ hermes config set terminal.backend dockerz0 hermes config set OPENROUTER_API_KEY sk-or-...rrzenv-pathmigrateu*🔄 Checking configuration for updates...FrHu ✓ Configuration is up to date!z Config version: rGrQz1 new config option(s) will be added with defaultsc<g|]}|d|S)r$rMrJs r$rOz"config_command..s)KKK!aeeM6J6JKAKKKrZcfg|].}|d|d,|/S)r$rrMrJs r$rOz"config_command..sN   55'' 01j0A0A    rZu ⚠️ z required API key(s) missing:u • ru ℹ️ z$ optional API key(s) not configured:r6z (enables: rxrrrT)rrrru✓ Configuration updated!ru ⚠️ checku📋 Configuration Statusu ✓z (update available)z Required:u ✓ u ✗ z (missing)z Optional:u ○ rz new config option(s) availablez+ Run 'hermes config migrate' to add themzUnknown config command: zAvailable commands:z4 hermes config Show current configurationz/ hermes config edit Open config in editorz6 hermes config set Set a config valuez; hermes config check Check for missing/outdated configz8 hermes config migrate Update config with new optionsz/ hermes config path Show config file pathz- hermes config env-path Show .env file path)getattrrWrdr,r0rkrsrIrLrrr7r:r,rLrGREENr\rrrr9r%r'REDr)r&r)r[subcmdr4rBrrrhrirequired_missingoptional_missingrUr6 tools_strrfr/r+r>s r$ruruMsA T+T 2 2F ~6)) 6   5dE4((gt,, em : ; ; ; GGG +    G H H H ? @ @ @ D E E E HQKKKe$$$$$ 6   o     :   lnn 9    e@&+v{[[\\\ +??? 244"6"8"8 Z > kZ6O6O %:FLII J J J GGG F  # # E{EEEE F F F  a _^,,___ ` ` `KK{KKK  "     1 U%5!6!6UUU V V V' 1 1/#f+//0000  < \%5!6!6\\\ ] ] ]' < <,,EJRA$))E"1"I*>*>AAAAPR :#f+:y::;;;; !T???  ;  E7>#: E %4flCC D D D :  D GGG":. D De222FMBBCCCC  7    e/fkJJKKK "6"8"8 Z * $ $ 8{888 9 9 9 9 %^[^^z^^^`f`mnn o o o  eM6;//000) J JHX&& J+++,,,,e;x;;;VZHHIIII  eM6;//000/5577 K KNHdX&& K+++,,,,"-->CK:DIIeBQBi$8$8::: e>>  rZc ~trdSda ddlm}|D]}|jdvr |jD]z}|t vr |d o|d }|jp|jd|rd nd |jp|jd|rd nd |j pd|d dd t |<{dS#t$rYdSwxYw)uPopulate OPTIONAL_ENV_VARS from provider profiles not already listed. Called once at module load time. Idempotent — repeated calls are no-ops. NTr)list_providers>r) _BASE_URL_URLrzAPI keyzbase URL overridez"base URL (leave empty for default)r'r) _profile_env_vars_injectedrr auth_typerr)r display_namer signup_urlr)r_pp_var_is_keys r$_inject_profile_env_varsrsO "!% ,,,,,,!>##  C}L00  ,,,"mmK888VvAVAV=V&)&6&B#(#t#tRYErYY_r#t#t!$!1!=SXAAW@~ Z~AA>1T ' * $ ++!$''         sBB.. B<;B<c  trdSda ddl}ttjd}|dz dz }|sdS|D]^}|s|dz }|s|dz }|sK t|d d 5}t|pi}dddn #1swxYwYn#t$rYwxYw| d p| d p|j }t| dpg}|| dpg|D]C} t!| t"r| } i} n6t!| t$r | d r | d } | } nS| t&vr]|  t+| dp| d} | s2| ddurt- fddD} | dp|d| dp| | dpd| | dpddt&| <E`dS#t$rYdSwxYw)uPopulate OPTIONAL_ENV_VARS from bundled platform plugin manifests. Called once at module load time. Idempotent — repeated calls are no-ops. Failures are swallowed so a malformed plugin.yaml can't break CLI import. NTrrr7ryr8r9r0rrrNr requires_env optional_envrrFc3BK|]}|VdSr)r)r~suf name_uppers r$r/z3_inject_platform_plugin_env_vars..K sE$$#++C00$$$$$$rZ)rg_SECRET_KEY _PASSWORD_JSONrz configurationrrArrr)"_platform_plugin_env_vars_injectedyamlrrrrrr[rr9rFrrrrrer0r+r2r)rlrr)r repo_root platforms_dirr manifest_pathr?rrNentriesrarmeta is_secretrs @r$ _inject_platform_plugin_env_varsr s*)-&9  NN**,,4Q7 !I- ; ##%%  F"**,,. . E<<>> !M1M '')) 5 % 4  ''))  -w???71-a006BH777777777777777    LL))OX\\&-A-AOUZE8<<77=2>>G NN8<<77=2 > > >   eS)) D!#DDt,,61B1B =D DD,,,"ZZ\\  *!5!5!K(9K9KLL  *)=)=)F)F #$$$$#V$$$!!I //4#333"hhx008D88E??2d ) $ 4 4 C  + +!$'') #. . ^      sbAK!AKC=C1% C=1C5 5C=8C5 9C=<K= D K D  G K K%$K%r)r#)r()rN)FrQ)TF)r)rr]r=r;rrTrrrr^r0r threadingr dataclassesrpathlibrrirrrrr r hermes_cli.secret_promptr rQr4r.rr rr%rr6system _IS_WINDOWScompiler frozensetrVr+rYr[r\rUr]RLockrrrhermes_cli.colorsrrhermes_cli.default_soulrrrrrrrrrrrrr rrrr!r"r'r-r2rCrrrrErFrIrLrNtuplerZr`rgrprrrwrrrKrr%r)r,r;rCrLrWrXr_rrrrrrrrrrrrrr_VALID_CUSTOM_PROVIDER_FIELDSrrrrrrrrrrrrrrrrrrrWr rrJrrrBr@rCrNrrjrk_COMMENTED_SECTIONSrr}rrrrrrrrrVrrrXrrrrrrr'rr rrrWrdrsrurrrrrrZr$rs7A        !!!!!!8888888888888888999999  8 $ $  CEEc!!!33$3333l* D* y* T* * * * Xho9, 2:9::P*3444** #* C D    13tCH~222fhDeCc3S#XSRZ[^R_M_H`$`aabgggAC4U3T#s(^#;<<=BBBy  )66666n ++++++++LLLLLLLL,     HSM    ,D,,,,{HSM 2 2x~ 2 2 2 2 2JJJ#JJJJZt   HTN d    *D8##$9C99990K6"c""""3s8;;#;;;;*$****d-,,,,,00000000-----&d&&&&2$2222x}hsm'C!D<    :@t2   $$4*!&!&!&H"d""""4W# RW#W#"W#!" W#  W#tW#W# kRk 4 k* +k< 1=k> ?kJ Kk^ "6_kj #Dkk| &t}kL TMkZ B[kx &ykF rGkP 4QkV QWkj &kkr "3skJ $',0#UkkkW#v_7_f_ s_ 3 _ $S_ 2_* V+_D BE_^ d__` Da_b bc_n bo_p Rq_r Cs_t Eu_x y_z D{_| $*/$) !}___wW#x #   yW#F ! #'+!& ( $)"'&+#9  +&&G W#j  ! 5k W#p dq W#z 7{ W#X SY W#x y W#J  "!"&'  !"&'    K W#W#h &* %*"&)-K55i W#^  #D _W#xTyW#^! _W#n! $  %'!#&-  oW#Fr Qr  "  r"    #r2    3rJ    KrZ    [rj    krz   {rL    Mrf    gr@    ArX    Yrr    srN    Ort    urD    ErT    UrGW#nF5FrF &F BF F %cF %aF !F" ;#F* !$+F6 U7F@ !%AFJ DKFL EMFN %OFV %WFb cFFd UeFf egFh "7iFp TqFr &ssFz 4{F| }FL !$MFV 4WFd $TeFf UgFh  iFr DsFx  yFH IFJ ! ! KFR %dSFFT"'#% !% #/ "!"&%d+#U+  555   " %  eFFFoW#@!&  4#$   ( "  0EccAW#L!eM!W#^!  ' /0  '  4 $&       ->  3    *  Y9 9 _!W#T# !  [  * $ %   #  U#W#F$ !$  G$W#X$Y$W#p$,q$W#z$  $ ! -{$W#t%!% #!" #$ $"'u;;u%W#t'Ru'W#W#W#H( R I(W#^( # !/)DD!-8RSS%,8B]^^"    _(W#T)   " % M''U)W#z* !   E&&{*W#P, bQ,W#X,Y,W#^, "$ _,W#n,"$"'', "$ ! !& !)#   U::o,W#h.i.W#x."   y.W#N/"$ O/W#^/ !_/W#z/#&*={/W#~00W#B1bC1W#b1bc1W#t1 Ru1W#W#W#@2A2W#H2RI2W#N2#    $5O2W#H3 <!#   *! "y= = I3W#R5 $&($3#$ !#(, $% +0i55S5W#B7   C7W#r7  %& "!  s7W#`8a8W#v8Rw8W#X9 e Y9W#j9%' #A "    u $- &(#'* "2 Mook9W#Z= &);[=W#d> #!!&;e>W#j? k?W#@@#  *1 #K&&A@W#fA   #C" " gAW#xB'  yBW#W#^C !3!$ "&!;   f!")*%) "8mFW#W#W#@GYXX "67EEE   --T#tCy.)p6B pW&+"#p&U,7 'p6L"7 7pF;= GpVf oE  Wpn$& op~.: pNT&* Op^cA _pnN4 op~4@ pN[& Op^=  _pn=  op~5A pN0 . Opp^:; _pn6(. op~2-. pN<H Op^)$' _pn3< op~*%) pN4@ Op^8#( _pn2> op~9+* pN:F Op^D$7 _pl@% mpzW%> {pH`& IpX[B YppphV() ipx7C ypH U') I pX 6B Y ph o&7 i pv K9 w pF W(, G pV X= W pf B'0 g pt _= u pD XZ E pT _ U pd I)& e pr e* s pF J  . G pV N$% . W pf F%' . g pppv O= w pF jM G pV o. W pf j+ g pv O+   w pFL", . GpVU<3 WpfZ3. gpvn')$o6 wpF\*)$o6 GpVn')$o6 WpfY1$o6 gptz;=\\\upFr&:$o6 GpVt#:$o6WphC "$45 ipxR 8"# ypppHX:5'6 IpXf&'"$9: YphP#, ipv\ 3 wpPN"6 Qp`M"= appV$3 qp@V!F ApTG"'"# UpdV@eprL%/$% spBe% CpRV''&' SpfM $ gpz?$%#$ {pJh% KpZ`%* [pppnL&!" op|O' }pL!@'+ ##MpZ!@'+ ##[phRL !!ip|;&' }pJl?) KpXz1 Ypd@%< eprP> sp@a6 ApNu/Z+  OpbU/L+  cpva,I+ wpFL)/ GpTF( UpbSA !!cpppp!z0 ##qp~(c? **pLP)6 MpZL' [phB1 ipve= wpDs: EpT!\< ##UpdY= eptW; upDg= EpT]' Updh*) eprc/ sp@ c@ ""ApN"F/$$OpXG! YpppdC$ eppK$qpzV*{pDM&EpNU#OpX=(  YpbT#cplC mpz; {pHB  IpV:' WpfB% gpvf0   wpF L2 G pV V' W pf A# g pv M# w ppH!u) yQ [. l0 K  u" S! `. %%i+ ''S#pppl#d38n9M,0C0000l CH~     #s(^ 64S#X#78,tDcN';,,,,j#&#%%C'''"%,/8; rrr rrd38n rrrrp$$$ $$d38n $$$$N s tDcN?S    (,// T#s(^ $/ $sCx.////d c htn     8<'+"""tDcN34" T#s(^ $" #s(^ """"P8<'+ 8 8S> 8 8tDcN34 8 T#s(^ $ 8  8 8 8 8O3O4S>OOOO&8<'+   tDcN34  T#s(^ $  #s(^    L8<'+ ..S>..tDcN34. T#s(^ $ .  ....48<'+ >> >>tDcN34> T#s(^ $ > c] >>>>B##eCHoJ!!! WVV  MMhtCH~&>M$}J]MMMM`00(4S>":0d0000,*4*4$sCx.)A*4T*4*4*4*4ZtCH~$.   D T#s(^    Dddt(DsuT3Y7G.(2   ====@4S>c%S/6J6 .48-- cN-38n-Cc3h01- #s(^ ----`QtCH~Q$sCx.QQQQhS#X4S>>GK+++$sCx.)+#++s++++^#c3h####LhtnPT03T333333341T#s(^1111"2d38n22228      8 ~' >!  3  + 75)-###!- 3!"/#$</'%M/5A'Q;)39@ss ::#::::%)'+# ((( $sCx. !( T#s(^ $(tn (  #s(^ ((((Vjjc3hjjjjZ$2F 48 c\c\c\ cNc\c\Cc3h01 c\c\c\c\L.;$sCx.;;;;F[_ HU5huox}!DEtCQTH~UV W^^^    . - - - - - -OtOOOOOd+3++++\%S%%%%%%P C C     VVCVVVVrF#F$FFFFR$$c$$$$$$$$""#""""s34S>C,sx}#S#Xc]####<BCBCBBBB i!!!(sC:L L L ^%/%/%/Pb@#b@cb@b@b@b@RFFF\#    >.&+"C C C C N! """""rZ