JjUlUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZddlmZmZmZddlmZejdZgdZgd Zd d gZgd Zeeed <ehdZ eeed<ehdZ!eeed<dZ"de de#fdZ$de fdZ%ehdZ&ehdZ'ehdZ(ehdZ)de fdZ*de fdZ+de fdZ,de fdZ-d edefd!Z.d eddfd"Z/d eddfd#Z0d ede fd$Z1d ede#fd%Z2d edeefd&Z3de#fd'Z4dld ed(eedee fd)Z5d ede#fd*Z6de ddfd+Z7d,edeefd-Z8d.Z9de:eeffd/Z;e Gd0d1Zde de=fd3Z?de de#fd4Z@iZAe:ee=eBeBeCffed5<d6ZDd7e deBfd8ZEde deCfd9ZFde de fd:ZGde de:fd;ZHddd<de d=eed>ee#ddfd?ZIdee<fd@ZJdAe#deeee ffdBZK dmd edDeedEe#dFe#dGe#dHe#d=eede fdIZLdnde dJe#dee:fdKZMdndJe#deefdLZNdMede deeCfdNZOdMede ddfdOZPde ddfdPZQdnd edQe#de fdRZRd,eddfdSZSd,eddfdTZTd ede ddfdUZUde ddfdVZVdefdWZWd eddfdXZXdefdYZYdZe fd[ZZd ed\ede fd]Z[d^edeefd_Z\d`e dae ddfdbZ]d`e de^efdcZ_dldded eede fdeZ`dfedgedhe ddfdiZadfedgede fdjZbd,edefdkZcdS)ou_ Profile management for multiple isolated Hermes instances. Each profile is a fully independent HERMES_HOME directory with its own config.yaml, .env, memory, sessions, skills, gateway, cron, and logs. Profiles live under ``~/.hermes/profiles//`` by default. The "default" profile is ``~/.hermes`` itself — backward compatible, zero migration needed. Usage:: hermes profile create coder # fresh profile + bundled skills hermes profile create coder --clone # also copy config, .env, SOUL.md, skills hermes profile create coder --clone-all # full copy of source profile coder chat # use via wrapper alias hermes -p coder chat # or via flag hermes profile use coder # set as sticky default hermes profile delete coder # remove profile + alias + service N) dataclass)Path PurePosixPathPureWindowsPath)ListOptionalTuple)is_excluded_skill_pathz^[a-z0-9][a-z0-9_-]{0,63}$) memoriessessionsskillsskinslogsplans workspacecronhome) config.yaml.envSOUL.mdzmemories/MEMORY.mdzmemories/USER.md) gateway.pidgateway_state.jsonprocesses.json_CLONE_ALL_STRIP>binprofiles node_modules .worktrees hermes-agent_CLONE_ALL_DEFAULT_EXCLUDE_ROOT>state-snapshotsbackupsr checkpointsstate.db state.db-shm state.db-wal_CLONE_ALL_HISTORY_EXCLUDE_ROOTz.no-bundled-skills profile_dirreturnc^ |tz S#t$rYdSwxYw)z>Return True if the profile opted out of bundled-skill seeding.F)NO_BUNDLED_SKILLS_MARKERexistsOSErrorr(s 9/home/rurouni/.hermes/hermes-agent/hermes_cli/profiles.pyhas_bundled_skills_opt_outr0sA66>>@@@ uus  ,, source_dirc|tkdtdttdttffd }|S)uWExclude infrastructure artifacts when cloning a profile via --clone-all. Three categories: 1. Root-level entries in ``_CLONE_ALL_HISTORY_EXCLUDE_ROOT`` — session history, backups, and snapshots that belong to the SOURCE profile and should never carry into a fresh clone. Applies to any source. 2. Root-level entries in ``_CLONE_ALL_DEFAULT_EXCLUDE_ROOT`` — known Hermes infrastructure directories that only the default profile (``~/.hermes``) ever contains. Gated on ``source_dir`` actually being the default profile so a named-profile source never has its own data silently dropped. 3. Universal exclusions at any depth — Python bytecode caches that are stale or regenerable (``__pycache__``, ``*.pyc``, ``*.pyo``) and runtime sockets / temp files (``*.sock``, ``*.tmp``). The export-side ignore (``_default_export_ignore``) uses the same two-tier pattern with the broader ``_DEFAULT_EXPORT_EXCLUDE_ROOT`` set because the export archive is a portable snapshot rather than a live clone. directorynamesr)czg}|D]}|dks|dr||3 t|k}n#tt f$rd}YnwxYw|r?|t vr||r|tvr|||S)N __pycache__)z.pycz.pyo.sock.tmpF)endswithappendrresolver- ValueErrorr'r )r3r4ignoredentryat_rootis_default_sourcesource_resolveds r/_ignorez+_clone_all_copytree_ignore.._ignores * *E&&>>"CDD'u%%% y//1133FZ(       *;;;NN5)))$*2Q)Q)QNN5)))s%A  A65A6)r;_get_default_hermes_homestrr)r1rBr@rAs @@r/_clone_all_copytree_ignorerEs|*!((**O'+C+E+E+M+M+O+OO3tCyT#Y6 N> auth.lock errors.log .update_check.hermes_historyhermes_state.dbresponse_store.dbresponse_store.db-shmresponse_store.db-walrrr sandboxes audio_cacher# image_cacheractive_profiledocument_cachebrowser_screenshotsrr$ auth.jsonrrrr%r&rr>USER.md AGENTS.md CLAUDE.md MEMORY.md todo.json .cursorrulessystem_prompt.mdrr pluginsscriptsr r knowledge preferencesrr>tmprootsudotesthermesdefault>acpmcpchatrdumploginmodelsetuptoolsconfigdoctorhonchologoutr statusupdategatewaypairingr]profileversioninsightsr whatsapp uninstallc$tdz S)aReturn the directory where named profiles are stored. Anchored to the hermes root, NOT to the current HERMES_HOME (which may itself be a profile). This ensures ``coder profile list`` can see all profiles. In Docker/custom deployments where HERMES_HOME points outside ``~/.hermes``, profiles live under ``HERMES_HOME/profiles/`` so they persist on the mounted volume. rrCrFr/_get_profiles_rootrs $ % % 22rFc"ddlm}|S)zReturn the default (pre-profile) HERMES_HOME path. In standard deployments this is ``~/.hermes``. In Docker/custom deployments where HERMES_HOME is outside ``~/.hermes`` (e.g. ``/opt/data``), returns HERMES_HOME directly. rget_default_hermes_root)hermes_constantsrrs r/rCrCs%988888 " " $ $$rFc$tdz S)z2Return the path to the sticky active_profile file.rRr}r~rFr/_get_active_profile_pathr!s # % %(8 88rFc4tjdz dz S)z)Return the directory for wrapper scripts.z.localr)rrr~rFr/_get_wrapper_dirr&s 9;; !E ))rFnamect|tst|}|}|std|dkrdS|S)uReturn the canonical profile id used on disk and in CLI ``-p`` argv. Named profiles are stored lowercase under ``profiles//``. The special alias ``default`` is matched case-insensitively (``Default`` → ``default``). Dashboards and tools may pass title-cased display labels; normalize before validation, assignment, and subprocess spawn (see issue #18498). zprofile name cannot be emptyrf) isinstancerDstripr<casefoldlower)rstrippeds r/normalize_profile_namer/sq dC 4yyzz||H 97888i''y >>  rFc|dkrdSt|std|d|tvrtd|ddS)uRaise ``ValueError`` if *name* is not a valid profile identifier. Validates the input as-given — strict lowercase match. Callers that accept mixed-case or title-cased input from users (dashboard UI, CLI args) should call :func:`normalize_profile_name` first. This separation keeps validate honest about what the on-disk directory name must look like, while ingress-point normalization handles UX flexibility (see #18498). Also rejects names in :data:`_RESERVED_NAMES` (``hermes``, ``test``, ``tmp``, ``root``, ``sudo``) that would create confusing on-disk collisions (a ``hermes`` profile inside ``~/.hermes/``) or get refused at alias-creation time anyway. ``default`` is a special pass-through — it's a valid alias for the built-in root profile. rfNzInvalid profile name %. Must match [a-z0-9][a-z0-9_-]{0,63}z Profile name uz is reserved — it collides with either the Hermes installation itself or a common system binary. Pick a different name.)_PROFILE_ID_REmatchr<_RESERVED_NAMESrs r/validate_profile_namerAs y    % %  *D * * *     &D & & &   rFc`t|std|ddS)uRaise ``ValueError`` if *name* is not a safe wrapper-alias identifier. The alias is used verbatim as a filename under :func:`_get_wrapper_dir` (``~/.local/bin``), so it must be a single safe command name with no path separators or traversal segments — otherwise a value like ``../../.bashrc`` would escape the wrapper directory and clobber arbitrary user files. We reuse the profile id regex, which already forbids ``/``, ``.``, and ``..``. zInvalid alias name rN)rrr<rs r/validate_alias_namer_sL    % %  *$ * * *     rFcjt|}|dkrtSt|z S)z4Resolve a profile name to its HERMES_HOME directory.rf)rrCrrcanons r/get_profile_dirros7 "4 ( (E ')))   % ''rFcrt|}|dkrdSt|S)z)Check whether a profile directory exists.rfT)rris_dirrs r/profile_existsrws9 "4 ( (E t 5 ! ! ( ( * **rFct|} t|n&#t$r}t|cYd}~Sd}~wwxYw|tvrd|dS|t vrd|dSt }tjdk} tj |rdnd|gddd }|j d kr|j d }||r|d n|z }|t|kr, |}d |vrdSn#t $rYnwxYwd|d|dSn#t"tjf$rYnwxYwdS)zReturn a human-readable collision message, or None if the name is safe. Checks: alias-name validity, reserved names, hermes subcommands, existing binaries in PATH. N'z' is a reserved namez$' conflicts with a hermes subcommandwin32wherewhichT)capture_outputtexttimeoutr.bat hermes -pz&' conflicts with an existing command ())rrr<rDr_HERMES_SUBCOMMANDSrsysplatform subprocessrun returncodestdoutr splitlines read_text ExceptionFileNotFoundErrorTimeoutExpired) rrexc wrapper_dir is_windowsresult existing_pathexpectedcontents r/check_alias_collisionrs #4 ( (EE"""" 3xx .5.... ###>5>>>>#$$K(J " /WW 7dA      ! !"M//11<<>>qAM" &MnnnnNHH --&0022G"g--#t. DTuTTMTTT T " z8 9      4sN! A?AAA9D3>DD3 D&#D3%D&& D33E  E ctt}|tjddtjvS)z!Check if ~/.local/bin is in PATH.PATH)rDrosenvirongetsplitpathsep)rs r/_is_wrapper_dir_in_pathrsA&(())K "*..44::2:FF FFrFtargetcjt|}|rt|n|}t|t} |ddn-#t$r }t d|d|Yd}~dSd}~wwxYwt jdk}|rQ||dz } |d|d |S#t$r }t d |d|Yd}~dSd}~wwxYw||z } tj d pd }|d tj |d |d| |jtjztjztjz|S#t$r }t d |d|Yd}~dSd}~wwxYw)uCreate a shell wrapper script at ~/.local/bin/. The wrapper file is named after ``name`` (the alias). The profile it activates is ``target`` if given, otherwise ``name`` — this lets a custom alias name point at a differently-named profile without a post-hoc rewrite. On Windows, creates a ``.bat`` file instead of a POSIX shell script. Returns the path to the created wrapper, or None if creation failed. Tparentsexist_oku⚠ Could not create : Nrrz@echo off hermes -p z %* u ⚠ Could not create wrapper at rez#!/bin/sh exec z -p z "$@" )rrrmkdirr-printrr write_textshutilrshlexquotechmodstatst_modeS_IEXECS_IXGRPS_IXOTH) rrrrwrer wrapper_path hermes_exes r/create_wrapper_scriptrs/ #4 ( (E06A$V,,,EG"$$K$6666  8k88Q88999ttttt(J"^^^3    # #$Ng$N$N$N O O O     H\HHQHH I I I44444 #U*  h//;8J  # #$du{:7N7N$d$dT[$d$d$d e e e   |0022:T\IDLX[_[gg h h h     H\HHQHH I I I44444 sIA B#A>>B!B<< C&C!!C&/BF F2F--F2ct}t|} t|n#t$rYdSwxYwtjdk}||z g}|r|d||dz |D]W}|rA |}d|vr| dSG#t$rYSwxYwXdS)zARemove the wrapper script for a profile. Returns True if removed.FrrrrT) rrrr<rrinsertr,runlinkr)rrrr candidatesrrs r/remove_wrapper_scriptrs&"$$K "4 ( (EE"""" uu(J%&J;![e>>>9:::"        &0022')) '')))44*      5s/ == ,B== C  C c(|dz }|sdS ddlm}m}ddlm}m}|t|} |\}}||kr |dd||dS#||wxYw#t$rYdSwxYw) uBring a copied profile config.yaml up to the current schema. Profile creation can clone a config file that predates schema tracking (no ``_config_version``) or that is simply older than the running Hermes. If we leave it untouched, the first desktop/doctor view of the new profile shows a scary ``v0 → latest`` warning even though we just created the profile. Scope the normal migration pipeline to the new profile and keep it non-interactive. rNr)reset_hermes_home_overrideset_hermes_home_override)check_config_versionmigrate_configFT) interactivequiet) r,rrrhermes_cli.configrrrDr) r( config_pathrrrrtoken current_ver latest_vers r/#_migrate_profile_config_if_outdatedrs -K      YYYYYYYYJJJJJJJJ(([)9)9:: .&:&:&<&< #KZ''5==== & &u - - - - - & &u - - - -       s)(B A3& B3 BB BB profile_namec^tt|S)uReturn the alias name of the wrapper that activates *profile_name*, or None. A wrapper created by :func:`create_wrapper_script` is a file named after the alias whose body invokes ``hermes -p ``. When the alias name equals the profile name this is trivial, but a custom alias (``hermes profile alias --name ``) produces a differently-named file — so the display side cannot assume ``wrapper == profile`` and must reverse-look-up. A custom alias (name != profile) is preferred over the profile-named wrapper so ``profile list``/``show`` surface the command the user actually typed. Results are sorted for deterministic output when several aliases match. For listing ALL profiles at once, prefer :func:`build_alias_map` — calling this per-profile re-reads every wrapper file N times (O(N*M)); on a wrapper dir like ``~/.local/bin`` that also holds large unrelated binaries (ffmpeg etc.) that meant multi-second ``list_profiles`` latency and desktop timeouts. )build_alias_maprr)rs r/find_alias_for_profilers'$    !7 !E!E F FFrFi cXt}i}|s|Stjdk}d}t |D]N}|s|r |jdkr&|s|jr0 t|ddd5}| t}dddn #1swxYwYn#ttf$rYwxYw| |}|d kr||t|zd}|r.|dd d nd } | s t#| } |r|jn|j} | | kr|| | I| || <P|S) aSingle-pass reverse map ``{canonical_profile -> alias_name}``. Scans the wrapper dir ONCE (vs. :func:`find_alias_for_profile` per profile) and reads only a small head slice of each candidate wrapper, skipping binaries. A custom alias (file name != profile) wins over the profile-named wrapper, matching ``find_alias_for_profile``'s preference; deterministic via sorted iteration. rz hermes -p rrutf-8strict)encodingerrorsNrr)rrrrsortediterdiris_filesuffixopenread_WRAPPER_READ_LIMITr-UnicodeDecodeErrorfindlenrrrstemr setdefault) rrrprefixr>fridxrestraliass r/rr9s#$$KF      (J F ++--..""}}    %,&00  el   eS78DDD 6&&!455 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6+,    H ll6"" "99 sS[[())*26**,,F 4##A&,,...B  &u--(8 ej E>>   eU + + + +!F5MM Ms6 CC9 CC C C CC%$C%c*eZdZUdZeed<eed<eed<eed<dZe eed<dZ e eed<d Z eed <d Z e ed <dZe eed <dZe eed<dZe eed<dZe eed<dZe eed<dZeed<d Zeed<dS) ProfileInfoz$Summary information about a profile.rpath is_defaultgateway_runningNrlproviderFhas_envr skill_count alias_path alias_namedistribution_namedistribution_versiondistribution_sourcer descriptiondescription_auto)__name__ __module__ __qualname____doc__rD__annotations__rboolrlrrrrintrrrrrrrr~rFr/rrns.. III JJJE8C="Hhsm"""GTK!%J%%%!%J $$$'+x}+++*.(3-...)-#--- K #d"""""rFrc|dz }|sdS ddl}t|dd5}||pi}dddn #1swxYwYt |t sdS|d|d |d fS#t$rYdSwxYw) uReturn ``(name, version, source)`` from the profile's ``distribution.yaml`` if present; ``(None, None, None)`` otherwise. Failures (missing file, bad YAML) are swallowed — a bad manifest should never break ``hermes profile list`` for an unrelated profile. zdistribution.yaml)NNNrNrrrrrxsource)ryamlr safe_loadrdictrr)r(mf_pathr'r datas r/_read_distribution_metar,s'//G ??      '3 1 1 1 +Q>>!$$*D + + + + + + + + + + + + + + +$%% $## HHV   HHY   HHX        s:B7A B7AB7AB79=B77 CCc|dz }|sdS ddl}t|dd5}||pi}dddn #1swxYwY|di}t |t r|dfSt |tr?|d p|d|d fSdS#t$rYdSwxYw) zLRead model/provider from a profile's config.yaml. Returns (model, provider).r)NNrNrrr%rlrfr) r,r'rr(rrrDr)r)r(rr'r cfg model_cfgs r/_read_config_modelr0sN -K     z  +sW 5 5 5 *..##)rC * * * * * * * * * * * * * * *GGGR(( i % % #d? " i & & a==++Ey}}W/E/Ey}}U_G`G`` `z zzs;C'A C'AC'A1C'AC'' C54C5c ddlm}||dz d dSn#t$rYnwxYw ddlm}m}||d z }||| duS#t$rYdSwxYw) uCheck if a gateway is running for a given profile directory. Primary signal is the profile's ``gateway.pid`` (verified against the runtime lock). That check fails closed whenever the lock isn't held by *this* reader — which is exactly the case for a dashboard process that is a separate s6 service from the gateway it's reporting on (Docker), or any launch-service-managed gateway that left a fresh ``gateway_state.json`` but no live PID file. In those cases fall back to validating the PID recorded in the profile's own ``gateway_state.json`` against the live process table, mirroring the ``/api/status`` sidebar's liveness logic so the two surfaces agree. Parameterized by ``profile_dir`` so it never mutates ``HERMES_HOME``. r)get_running_pidrF) cleanup_staleNT)get_runtime_status_running_pidread_runtime_statusr) expected_home)gateway.statusr2rr4r5)r(r2r4r5runtimes r/_check_gateway_runningr9s 222222 OK-7u M M M 4               &%k4H&HII--g[QQQY]]] uus ))$A A A _SKILL_COUNT_CACHEg>@ skills_dircz |j}n#t$rYdSwxYw tj|5}|D]L} |dr#|dj}||kr|}=#t$rYIwxYw dddn #1swxYwYn#t$rYnwxYw|S)a\Cheap change-signature for a skills tree. Max mtime of ``skills_dir`` and its immediate children (category dirs). Adding/removing a category bumps ``skills_dir``'s mtime; adding/removing a skill inside a category bumps that category dir's mtime. One ``scandir`` (not a recursive walk) keeps this O(#categories), not O(#files). gF)follow_symlinksN)rst_mtimer-rscandirr)r;sigitr>ms r/_skills_dir_signaturerCs@oo( ss  Z # # r  ||E|::$!JJuJ==Fs77"#CH                       Jse **B+B9BB B BBB B+B##B+&B#'B++ B87B8c|dz }|sdSt|}t|}tj}t|}|(|d|kr||dz t kr|dSd}|dD]}t|r|dz }|||ft|<|S)zECount installed skills in a profile (cached by skills-dir signature).r rNrzSKILL.md) rrDrCtimer:r_SKILL_COUNT_TTL_SECONDSrglobr )r(r;key signaturenowcachedcountmds r/ _count_skillsrOsx'J     q j//C%j11I )++C  # #C ( (F 1I " " 6!9_ 8 8 8ay Ez** !" % %    (#u5s LrFc |dz S)Nz profile.yamlr~r.s r/_profile_yaml_pathrQ+s  ''rFct|}|sdddS ddl}t|dd5}||pi}dddn #1swxYwYn#t $rdddcYSwxYwt |tsdddSt| d pd t| d ddS) uRead ``/profile.yaml`` and return a dict. Returns ``{"description": "", "description_auto": False}`` when the file is missing or unreadable. Never raises — a corrupt profile.yaml on an unrelated profile must not break ``hermes profile list``. rFrrrNrrr%rr) rQrr'rr(rrr)rDrrr")r(rr'r r+s r/read_profile_metarT/s[ k * *D <<>>>!u===> $g . . . +!>>!$$*D + + + + + + + + + + + + + + + >>>!u=====> dD ! !>!u===488M228b99??AA */profile.yaml`` in place. Only the explicitly passed fields are overwritten; unspecified fields preserve existing values. Creates the file if missing. Profile directory itself must exist. z"profile directory does not exist: rNrrr%rrwF) sort_keysdefault_flow_style) rrr'rQrrr(rr)rrr" safe_dump)r(rrr'rexistingr loadeds r/write_profile_metar\Hs     T R[ R RSSSKKK k * *DH ||~~ dC'222 1a**0b 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1&$'' "!   HHH "-"3"3"5"5#'+,<'='=#$ dC' * * *Oa xeNNNOOOOOOOOOOOOOOOOOOsHB*#B; B*B  B*B B** B98B9;D""D&)D&c6g}t}t}|rt|\}}t |\}}}t |}|td|dt||||dz t||||| dd| dd t} | rt} t| D]X} | s| j} | dkr&t"| sAt| \}}| t'| } | rt(jd k}||r| d n| z }nd }t | \}}}t | }|t| | dt| ||| dz t| |r| r|nd | |||| dd| dd Z|S) z4Return info for all profiles, including the default.rfTrrrrF) rrrrrlrrrrrrrrrrN)rrrrrlrrrrrrrrrr)rrCrr0r,rTr:rr9r,rOrrrrrrrrrrr)rr default_homerlr dist_name dist_version dist_sourcemeta profiles_root alias_mapr>rrrrs r/ list_profilesremsH"$$K,--L ,\::x/F|/T/T, < .. 2<@@!F*2244%l33'!- +33!XX&8%@@      "'((M&$%% M113344! ! E<<>> :Dy  !''-- 077OE8"'=d'C'CDDJ " \W4 (:,]z,?,?,?,?S]^ ! 3J53Q3Q 0I|[$U++D OOK 6u = =!//11)%00*4W9J9J9L9LW::SW%"+%1$/ HH]B77!%*rs r/profiles_to_serverks(% & & 3)F 300122&/1I1K1K%L$ME&((M (M113344 ( (E<<>> :Dy  !''--  LL$ ' ' ' ' LrFF clone_from clone_all clone_configno_alias no_skillsc|r||s|rtdt|}t||dkrtdt|}|rt d|d|d} ||s|rk|ddlm} | } n-t|}t|t|} | std |pd d | |rL| rJtj | |d t|  tD]} || z d nB|d d t D]} || z d d | t"D]o} | | z }|rT|| z }tj||| dkr4 t'jt+|d_#t,$rYkwxYwp| dz }|rtj ||dz d d t.D]Q}| |z }|r6||z }|jd d tj||R|dz }|sK |ddt'jt+|dn#t,$rYnwxYw|dz }|s/ ddlm}||dn#t8$rYnwxYw|r1 |t:z ddn#t,$rYnwxYw|st=||rJ|r6 tA||dn#t8$rYnwxYwtC||S)aCreate a new profile directory. Parameters ---------- name: Profile identifier (lowercase, alphanumeric, hyphens, underscores). clone_from: Source profile to clone from. If ``None`` and clone_config/clone_all is True, defaults to the currently active profile. clone_all: If True, do a full copytree of the source (all state). clone_config: If True, copy config files (config.yaml, .env, SOUL.md), installed skills, and selected profile identity files from the source profile. no_alias: If True, skip wrapper script creation. no_skills: If True, create an empty profile with no bundled skills, and write a marker file so ``hermes update`` skips re-seeding this profile's skills. Mutually exclusive with ``clone_config``/``clone_all`` (those explicitly copy skills from the source). Returns ------- Path The newly created profile directory. Nz--no-skills is mutually exclusive with --clone / --clone-from / --clone-all (cloning explicitly copies skills from the source profile).rfuSCannot create a profile named 'default' — it is the built-in profile (~/.hermes). Profile '' already exists at rget_hermes_homezSource profile 'riz' does not exist at Tsymlinksignore missing_okrrr )rw dirs_exist_ok# Per-profile secrets for this Hermes profile. # API keys and tokens set here override the shell environment. # Behavioral settings belong in config.yaml, not here. rr%r)DEFAULT_SOUL_MDzThis profile opted out of bundled-skill seeding (`hermes profile create --no-skills`). Delete this file to re-enable sync on the next `hermes update`. FrS)"r<rrrr,FileExistsErrorrrurrrcopytreerErrr _PROFILE_DIRS_CLONE_CONFIG_FILEScopy2rrrDr-_CLONE_SUBDIR_FILESparentrhermes_cli.default_soulr~rr+rrr\_maybe_register_gateway_service)rrlrmrnrorprrr(r1rustalesubdirfilenamesrcdst source_skillsrelpathenv_path soul_pathr~s r/create_profilersZH j, , , J    #4 ( (E%     a   "%((KTR%RR[RRSSSJl   8 8 8 8 8 8(**JJ/ ;;J !* - - -(44J  "" #[:#9[[z[[ 0+Z0+  -j99     & : :E 5 ( (D ( 9 9 9 9 : $666# F FF 6 ! ( ( ( E E E E  !/ ! ! 8+::<< !%0CLc***  6))!HSXXu5555&!!! D!'1M##%% j {X/EPTdhiiii/ + + 7*::<<+%/CJ$$TD$AAALc***V#H ??       K!     HS]]E * * * *    D  i'I       ? ? ? ? ? ?  7 C C C C    D     3 3 ? ?T! @         D  9+K888 {((**  '--//!&          D $E*** sZ"G(( G54G5 9K K'&K'L"" L/.L/5M M"!M" $N22 N?>N?rc6t|rgggddSttjj} t jtjddgitj dt|it|ddd}|j dkrD|j r+tj|j S|sat#d |j |jr1t#d |jd d d S#t j$r|st#d Yd St($r}|st#d|Yd }~d Sd }~wwxYw)uSeed bundled skills into a profile via subprocess. Uses subprocess because sync_skills() caches HERMES_HOME at module level. Returns the sync result dict, or None on failure. Profiles that opted out of bundled skills (via ``hermes profile create --no-skills`` — which writes ``.no-bundled-skills`` to the profile root) are skipped and get an empty-result dict so callers can report "opted out" instead of "failed". T)copiedupdated user_modifiedskipped_opt_outz-cziimport json; from tools.skills_sync import sync_skills; r = sync_skills(quiet=True); print(json.dumps(r)) HERMES_HOME<)envcwdrrrru%⚠ Skill seeding returned exit code z Nu!⚠ Skill seeding timed out (60s)u⚠ Skill seeding failed: )r0r__file__rr;rrr executablerrrDrrrjsonloadsrstderrrr)r(r project_rootrrs r/seed_profile_skillsrs"+.. #    >>(/7799L ^TA B@2:?}c+.>.>??L!!dB       ! !fm&9&9&;&; !:fm113344 4 : M&:KMM N N N}""$$ :86=..00#688999t  $ 7 5 6 6 6tt  4 2q22 3 3 3ttttts&BE (A#E F0 F9FFcg}t}|s|Stdz }t|D]}|rt |js7|jdkrC|dz }|r] | rtj ||n| ddtjt|d||j#t"$r'}|st%d|jd|Yd }~d }~wwxYw|S) uGive every named profile that predates per-profile ``.env`` files one. Profiles created before the dashboard/CLI started seeding a ``.env`` (PR #44792) have none, so once the Channels/Keys endpoints became profile-scoped those profiles stopped inheriting the root install's credentials and showed everything as unconfigured. To avoid breaking anyone on update, copy the DEFAULT install's ``.env`` into each named profile that lacks one — that preserves the effective credentials those profiles were already running with (they previously read the root ``.env`` via the process environment). Users can then diverge per profile from there. Falls back to the placeholder header when the default install has no ``.env`` itself. Never overwrites an existing profile ``.env``. Returns the list of profile names that received a backfilled ``.env``. rrfr}rr%r{u%⚠ Could not seed .env for profile 'z': N)rrrCrrrrrr,rrrrrrrDr:r-r)r backfilledrc default_envr>rrs r/backfill_profile_envsrs$J&((M    ! !*,,v5K --//00RR||~~ ^%9%9%*%E%E   : " " 6> ??     R""$$  [(3333##O% $ HS]]E * * *   ej ) ) ) ) R R R RPejPPQPPQQQ R s7A=D55 E&?E!!E&rc ddl}n#t$rgcYSwxYw |}n#t$r|}YnwxYwt jh} |t j}|0||j |}|0n#t$rYnwxYw |t j }n#t$rd}YnwxYwhd}d}g} | gdD]4} | j } | d} | | |vr'|| d|krC| dpg} | s]d | tj| d}t%fd |Dp|d kp|d }|sd | D}||zsd }t)| D]\}}|dvr7|dzt+| kr!t-| |dz|krd}nH@|dr1t-|ddd|krd}n|se | pi dd}|r't3||krd}n#t$rYnwxYw|r| |  #|j|j|jf$rY&t$rY2wxYw| S)uPIDs of running Hermes *backends* bound to this profile. The ``gateway.pid`` file only tracks the messaging gateway. A Desktop app spawns a headless ``serve`` (or legacy ``dashboard --no-open``) backend per profile that holds the profile's SQLite connection open and keeps writing sessions/WAL/sandbox files — the writer that makes ``rmtree`` hit ``ENOTEMPTY`` (and, pre-fix, resurrected the tree). ``gateway.pid`` never names it, so find it by inspection: a Hermes backend subcommand (``serve``/``dashboard``/``gateway``) that is bound to *this* profile either by a ``--profile `` / ``-p `` selector or by a ``HERMES_HOME`` that resolves to ``profile_dir``. Best-effort and tightly scoped: current-user processes only, backend subcommands only (never an interactive ``chat``/``tui``), and never this process or its ancestors. Returns an empty list if ``psutil`` can't inspect anything. rN>rjru dashboard)zhermes_cli.mainzhermes-gateway tui_gateway)pidrusernamecmdlinerrr c3 K|]}|vV dSNr~).0markerjoineds r/ z._profile_bound_backend_pids..Bs(BBFf$BBBBBBrFrec6h|]}|Sr~)r)rtoks r/ z._profile_bound_backend_pids..Ks 222cciikk222rFF>-p --profilerTz --profile==rr)psutilrr;r-rgetpidProcessraddrr process_iterinforjoinrbasenamerany startswith enumeraterrrrrr: NoSuchProcess AccessDenied ZombieProcess)rr(r resolved_dirskipr current_userbackend_tokenshermes_markerspidsprocrrargvexe_name is_hermestokensboundirenv_homers @r/_profile_bound_backend_pidsrs:$  #"**,, ###" # ikk]D  ,,3355 HHVZ ]]__F       ~~bikk22;;==  766NIND##$J$J$JKK;;: 9D((5//C{cTkk'DHHZ,@,@L,P,P88I&&,"D XXd^^Fw''Q006688HBBBB>BBBBB1x'1&&x00   32T222F^+ E#D//  3---!a%#d))2C2C-d1q5k::eCC $D^^L11-ciiQ.?.?.BCCuLL $  $  4"99-LLH%DNN$:$:$<$< $L$L $ D  ! C   $f&96;OP    H    H  Ks 0 ??A*C CC8D DD"M $M M BM M 1BM  AL M  L-*M ,L--M  M0# M0/M0cbt||}|sdS ddlmm}n#t$rYdSwxYw|D]+} ||#t t tf$rY(wxYwtjdz}tj|krGtfd|Dsn+tj dtj|kG|D]9}|r, ||d#t t tf$rY5wxYw:td t|d dS) aTerminate any Desktop-spawned / stray backends bound to this profile. Complements ``_stop_gateway_process`` (which only knows ``gateway.pid``): without this, a live ``serve``/``dashboard`` backend keeps creating files under the profile dir while ``rmtree`` walks it, so the final ``rmdir`` fails with ``ENOTEMPTY`` and the delete doesn't converge. Best-effort: any failure is reported and swallowed so it never makes delete worse. Nr) _pid_exists terminate_pidg$@c3.K|]}|VdSrr~)rrrs r/rz)_stop_profile_backends..s-44;;s##444444rF?Tforceu ✓ Stopped z profile backend process(es)) rr7rrrProcessLookupErrorPermissionErrorr-rFrsleeprr)rr(r_terminate_pidrdeadliners @r/_stop_profile_backendsrps 'uk : :D OOOOOOOOO   N3    "OW=    H y{{T!H )++ 4444t44444   3 )++  ;s    s$/////&A       @T @ @ @AAAAAs/ .. AAA# C11D  D cjd}d}t|D]} tj||n&#t$rtj||YnwxYwdS#t$rJ}|}|sYd}~dS||dz krt jd|dzzYd}~d}~wwxYw||dS)a``shutil.rmtree`` with a short retry loop for transient races. Even after stopping the gateway and profile backends, a just-terminated process can leave in-flight writes (SQLite ``-wal``/``-shm`` checkpoints, sandbox temp files) that land after ``rmtree`` has walked past a directory, surfacing as ``ENOTEMPTY`` (POSIX) or a transient ``PermissionError`` (Windows file lock still releasing). A few spaced retries let those settle instead of failing the whole delete on a race the next attempt would win. N)onexc)onerrorrg333333?)rangerrmtree TypeErrorr-r,rFr)r( onexc_handlerattemptslast_excattemptrs r/_rmtree_with_retryrsH#H?? 0 0 0 B k????? B B B k=AAAAAA B FF 0 0 0H%%'' A%% 3'A+.///  0 s8/A AAAA B,"B'?#B''B,yesct|}t||dkrtdt|}|st d|dt |\}}t|}t|}t|\}} } td|td||rtd||rd|d nd z|rtd ||r+td |d | pd| rtd| dg} t|z } | } | r| d| d td| D]}td||rtd|stt td|d}n(#t t"f$rtd|cYSwxYw||krtd|St%||t'||rt)|t+||| r!t-|rtd| d} d}t/||td|n.#t0$r!}td|d||}Yd}~nd}~wwxYw t3}||krt5dtdn#t0$rYnwxYw|t7d|d||td |d!|S)"zDelete a profile, its wrapper script, and its gateway service. Stops the gateway if running. Disables systemd/launchd service first to prevent auto-restart. Returns the path that was removed. rfzZCannot delete the default profile (~/.hermes). To remove everything, use: hermes uninstallrr' does not exist.z Profile: z Path: z Model: z (rrz Skills: zDistribution: @?zInstalled from: z;All config, API keys, memories, sessions, skills, cron jobszCommand alias (z This will permanently delete:u • u0 ⚠ Gateway is running — it will be stopped.zType 'z' to confirm: z Cancelled.z Cancelled.u ✓ Removed Ncddl}t|tr|d}t|tr t j|t j|j|jzn#t$rYnwxYwtj |}|rF t j|t j|j|jzn#t$rYnwxYw||dS)aonexc/onerror handler: add +w on PermissionError so rmtree can proceed. Handles two cases on NixOS (and other systems with read-only copies from immutable stores): 1. The path itself isn't writable (e.g. a file with mode 0444) 2. The *parent* directory isn't writable (e.g. mode 0555) Compatible with both the ``onexc`` API (3.12+, receives an exception instance) and the ``onerror`` API (3.11-, receives ``sys.exc_info()`` tuple). rNr) rrtuplerrrrS_IWUSRr-rdirname)funcrr_statrs r/_make_writablez&delete_profile.._make_writables ! #u%% !f#// HT274==#85=#HIIIID..)@5=)PQQQQ"T s#4A-- A:9A:4C C! C!u⚠ Could not remove ru#✓ Active profile reset to defaultz#Could not remove profile directory z Profile 'z ' deleted.)rrr<rrrr0r9rOr,rrr,r:inputrKeyboardInterruptEOFError_cleanup_gateway_service!_maybe_unregister_gateway_service_stop_gateway_processrrrrget_active_profileset_active_profile RuntimeError)rrrr(rlr gw_runningrr_r`raitemsr has_wrapperitemconfirm remove_errorrrris r/delete_profiler s #4 ( (E%     :   "%((K     F DE D D DEEE)55OE8' 44J ,,K+B;+O+O(I|[       #k # #$$$ L !%!!%I%5(%5%5%5%5rJKKK) '+''(((4 @y@@<+>3@@AAA  4 2[22 3 3 3 F E $%%-L%%''K8 6|666777 +,,, otooB @AAA    :U:::;;AACCGG!8,    . ! ! !     e   ,    UK000&e,,,+k***5+...1  ' ' 1 /// 0 0 0&*L*# # # J ;777 *[**++++  8k88Q88999   #%% U?? y ) ) ) 7 8 8 8      ^^^P\^^__eqq ) ) ) )*** s<<%G"""HH%J-- K7KK2L LLcX ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||ddS#t$rYdSt$r}td|Yd}~dSd}~wwxYw) uRegister a profile's gateway with s6 inside the container. No-op on host (systemd/launchd/windows) — those backends raise ``NotImplementedError`` on ``register_profile_gateway`` and the existing per-profile unit-generation paths handle lifecycle. Best-effort: any error (no backend detected, s6 not yet ready, etc.) is logged and swallowed so profile creation doesn't fail because the s6 supervision tree is in a weird state. The user can re-register manually later via the gateway start command, which goes through the same dispatch path. Port selection: each supervised profile gateway loads its own ``HERMES_HOME`` and binds the port resolved by ``gateway/config.py`` from that profile's environment — ``API_SERVER_PORT`` (or ``platforms.api_server.extra.port`` in the profile's ``config.yaml``), defaulting to 8642. There is no ``[gateway] port`` key and no Python-side allocator (PR #30136 review item I5 retired the SHA-256-derived range [9200, 9800) as dead code), so two profiles that both leave the port at its default will both try to bind 8642 — give each profile a distinct ``API_SERVER_PORT`` in its ``.env``. Host short-circuit: check ``detect_service_manager()`` first and return immediately if it isn't ``"s6"``. This keeps host (systemd/launchd/windows) profile creation completely silent — no ``get_service_manager()`` call, no exception path, no chance of the ``⚠ Could not register s6 gateway service`` warning ever rendering on a non-container machine. The earlier ``supports_runtime_registration()`` check still catches the case where detection somehow returns ``"s6"`` but the backend isn't actually the S6 one. rdetect_service_managers6Nget_service_managerF) start_nowu+⚠ Could not register s6 gateway service: ) hermes_cli.service_managerrrrrsupports_runtime_registrationregister_profile_gatewayr<rrrrmgrrs r/rrNs9D EEEEEE ! ! # #t + + FBBBBBB!!##      , , . .C $$\U$CCCCC      CCC ACAABBBBBBBBBCs6)) A AAA66 B) B) B$$B)c< ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||dS#t$r}td|Yd}~dSd}~wwxYw)uTear down a profile's s6 gateway service inside the container. No-op on host. Idempotent: absent services are silently skipped by ``unregister_profile_gateway``. Same host short-circuit as :func:`_maybe_register_gateway_service` — see that docstring. rr rNru-⚠ Could not unregister s6 gateway service: )rrrrrrunregister_profile_gatewayrrs r/rrs EEEEEE ! ! # #t + + FBBBBBB!!##    , , . .E &&|44444 EEE CcCCDDDDDDDDDEs0)) A AAA44 B>BBc\ddl}tjd} t |tjd<ddlm}m}|dkr|}tj dz dz dz |d z }| r{tj d d d |gd ddtj d d d|gd dd|d tj gdd ddtd|dn|dkrk|}| rMtj ddt |gd dd|d tdn)#t $r} td| Yd} ~ nd} ~ wwxYw||tjd<dSdtjvrtjd=dSdS#||tjd<ndtjvr tjd=wxYw)z9Disable and remove systemd/launchd service for a profile.rNr)get_service_nameget_launchd_plist_pathLinuxz.configsystemduserz.service systemctl--userdisableTF )rcheckrstopry)r r!z daemon-reloadu ✓ Service z removedDarwin launchctlunloadu✓ Launchd service removedu⚠ Service cleanup: )rrrrrDhermes_cli.gatewayrrsystemrrr,rrrrr) rr( _platformold_homerrsvc_namesvc_file plist_pathrs r/rrs    z~~m,,H&*$' $4$4 =!OOOOOOOO      ( (''))Hy{{Y.:VCF[F[F[[H   9 (Ix@#'ub (FH=#'ub4000<<<#'ub7X777888     8 + +//11J  "" 5 (C OO<#'ub!!T!2223444 +++ )a))********+  (0BJ} % % % bj ( ( =)))) (  (0BJ} % % bj ( ( =) ) ) ) )s0E;F! G<! G+G=G<GG<``. Returns ``"custom"`` if HERMES_HOME is set to an unrecognized path. rrtrfrcustom) rrur;rCr relative_topartsrrrr<)ru hermes_homeresolveddefault_resolvedrcrelr@s r/rhrh(s100000!/##K""$$H/1199;;###y&((0022M ""=11  u::??~33E!H==?8O       8s.AC CCroot_dirc>dtdtdtffd }|S)uReturn an *ignore* callable for :func:`shutil.copytree`. Two-tier filtering: * **Root-level allow-list** — only entries whose name appears in ``_DEFAULT_EXPORT_INCLUDE_ROOT`` survive. Everything else (such as an unrelated ``x11-dev/`` directory in a Docker deployment where HERMES_HOME equals the cwd) is excluded. Blacklisting was tried first and proved unable to anticipate every non-Hermes file the user may have lying alongside HERMES_HOME (#58394). * **Universal exclusions at any depth** — ``__pycache__``, sockets, temp files; plus npm lockfiles, which may appear at the root. All other profile artifacts are copied through untouched. r3contentsr)c&t}|D]L}|dks|dr||3|dvr||Mt|kr|d|D|S)Nr6)r7r8> package.jsonpackage-lock.jsonc3,K|]}|tv |VdSr)_DEFAULT_EXPORT_INCLUDE_ROOT)rr>s r/rz:_default_export_ignore.._ignore..ds6urEs r/rBz'_default_export_ignore.._ignoreXsuu # #E %%8I)J)J% E""""??? E"""  ??h & & NN#+   rF)rDlistrM)rErBs` r/_default_export_ignorerOGs="3$3" NrF output_pathc d ddl}t|}t|t|}|st d|dt |}t|dd}|dkr| 5}t |dz }tj ||dt| tj |d |d} t | cdddS#1swxYwY| 5}t ||z }d d h tj ||d fd  tj |d ||} t | cdddS#1swxYwYdS)zMExport a profile to a tar.gz archive. Returns the output file path. rNrrrz.tar.gzz.tgzrfTrvgztarrUrc(t|zSr)rM)drG_CREDENTIAL_FILESs r/z export_profile..s'83x=='HrF)tempfilerrrrrrrD removesuffixTemporaryDirectoryrrrO make_archive) rrPrWrr(outputbasetmpdirstagedrrUs @r/export_profiler_lsL OOO "4 ( (E%   !%((K     F DE D D DEEE +  F v;; # #I . . ; ;F C CD  ( ( * * f&\\I-F O-k::      (w JJF<<   $ $ & & &f%(&1  HHHH     $T7FEBBF||                  s&8AD""D&)D&AF%%F),F) member_namecp|dd}t|}t|}|r/|s|s|jrt d|d|jD}|rtd|Drt d||S)z4Return safe path parts for a profile archive member.\/zUnsafe archive member path: cg|]}|dv| S)>r.r~rparts r/ z4_normalize_profile_archive_parts..s" H H Hd$i2G2GT2G2G2GrFc3"K|] }|dkV dS)z..Nr~rfs r/rz3_normalize_profile_archive_parts..s&77 777777rF)r<rr is_absolutedriver<r@r)r`normalized_name posix_path windows_pathr@s r/ _normalize_profile_archive_partsros!))$44O//J";//L G  ! ! # #G  # # % %G   G E EEFFF H Hj. H H HE GC7777777GE EEFFF LrFarchive destinationc *ddl}||d5}|D]H}t|j}|j|}|r|ddM|std|j|j dd| |}|td|j|5t|d5}tj ||dddn #1swxYwYdddn #1swxYwY tj||jd z9#t"$rYFwxYw ddddS#1swxYwYdS) zAExtract a profile archive without allowing path escapes or links.rNr:gzTrz!Unsupported archive member type: zCannot read archive member: wbi)tarfiler getmembersrorjoinpathisdirrisfiler<r extractfiler copyfileobjrrmoder-) rprqrutfmemberr@r extractedrs r/_safe_extract_profile_archiversoNNN gv & &"mmoo  F4V[AAE)[)51F||~~  TD 999==??  E EE M  t  < < <v..I  !M !M!MNNN 3 3D.. 3#"9c222 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 u!45555    / s~CF4D>D'  D>'D+ +D>.D+ /D>2 F>E FE F E)'F) E73F6E77FF F cddl}||d5}d|D}|sd|D}dddn #1swxYwY|S)aReturn the archive's top-level directory names. Profile imports expect exactly one root directory. Inspecting the archive before extraction lets us stage the import safely instead of mutating a live profile tree first and reconciling names later. rNrsch|]E}t|j}t|dks|=|dFS)rr)rorrrx)rr~r@s r/rz1_inspect_profile_archive_roots..sP   :6;GG5zzA~~~ !H~~rFcjh|]0}|t|jd1S)r)rxror)rr~s r/rz1_inspect_profile_archive_roots..sE<<>>0==a@rF)rurrv)rprur}top_dirss r/_inspect_profile_archive_rootsrsNNN gv & & "  --//      mmooH                Os?A&&A*-A* archive_pathcddl}t|}|std|t |}t |dkr|nd}|p|}|std|tdt|}t||dkrtdt|}|rtd |d |t} | d d |d 5} t| } t|| | |z } | std|| } ||kr| |z } | | t%jt)| t)|dddn #1swxYwY|S)zImport a profile from a tar.gz archive. If *name* is not given, infers it from the archive's top-level directory. Returns the imported profile directory. rNzArchive not found: rzpCannot determine profile name from archive. Specify it explicitly: hermes profile import --name z=Profile archive must contain exactly one top-level directory.rfuCannot import as 'default' — that is the built-in root profile (~/.hermes). Specify a different name: hermes profile import --name rrrsTrhermes_profile_import_)r z,Profile archive root is missing or invalid: )rWrr,rrrpopr<rrrrrrrYrrrenamermoverD)rrrWrpr archive_root inferred_namerr(rcr] staging_rootr final_sources r/import_profilersz OOO<  G >>  A ?g ? ?@@@-g66H%(]]a%7%78<<>>>TL(LM   S    K    #= 1 1E%     V   "%((KTR%RR[RRSSS&((Mt444  $ $,D $ E E9F|| %g|<<< </ !! M|MM ! 5 '%/L   \ * * * C %%s;'7'7888999999999999999" s>BG&&G*-G*old_namenew_namenew_dirc d|}d|}d|}|dz tdz tjdz dz g}t}|D]4} |} n#t $r|} YnwxYw| |vs|sD||  tj | d} n#t tj f$rYwxYw| d} t| ts|| vr|n|} | | vr|| vrtd |d || | } t| tr]d | vrY| dr| d d d }n"d| vr| dd d n| }|| d <| | | |<||jdz} |tj| dddzd||n9#t $r, |dn#t $rYnwxYwYwxYwtd| d|6dS)zGRename Honcho host blocks for a renamed profile without changing peers.hermes_zhermes.z honcho.jsonz.honchoz config.jsonrr%hostsu$⚠ Honcho host block not migrated: z already exists in aiPeerr6rrer8rEF)indent ensure_asciir:Tryu✓ Honcho host updated:  → N)rCrrrMr;r-rrrrrJSONDecodeErrorrrr)rrrrr;rrdumpsr<r)rrrold_hostlegacy_old_hostnew_hostrseenrrBr5r source_hostblockbareras r/_migrate_honcho_profile_hostr*s-###H***O###H - ""]2 i-/J eeD,H,H ||~~HH   HHH  t  4<<>>    *T^^W^==>>CC-.    H   %&&  "*e"3"3hh e # #  u   \\\VZ\\ ] ] ] k" eT " " #xu'<'<%%i00 ["((a0037:k7I7I{((a0033{"E(O))K00ht{V344  NN4:c!%HHH4OZaN b b b KK         d ++++     H   F+FFHFFGGGGY,H,Hs[A'' A65A6((CC*)C*/AH44 I*?II* I# I*"I##I*)I*ct|}t|}t|t||dkrtd|dkrtdt|}t|}|st d|d|rtd|dt|rt||t|| |td|j d|j t|||t|t!|}|s"t#|td |ntd |d | t%|kr!t'|td |n#t($rYnwxYw|S) zrRename a profile: directory, wrapper script, service, active_profile. Returns the new profile directory. rfz"Cannot rename the default profile.u.Cannot rename to 'default' — it is reserved.rrrz' already exists.u ✓ Renamed ru✓ Alias updated: u⚠ Cannot create alias 'u' — u✓ Active profile updated: )rrr<rrrr,rr9rrrrrrrrrrrr)rr old_canon new_canonold_dirr collisions r/rename_profilerfs- 'x00I&x00I)$$$)$$$I=>>>IIJJJi((Gi((G >>  J HI H H HIII~~HF)FFFGGGg&&' G444g&&& NN7 : : :GL : :;;;!Iw???)$$$%i00I Hi((( /I//0000 F)FF9FFGGG   9 , , y ) ) ) <<< = = =       Ns3G GGct|}t|t|}|dkr)|st d|d|t |S)zResolve a profile name to a HERMES_HOME path string. Called early in the CLI entry point, before any hermes modules are imported, to set the HERMES_HOME environment variable. rfrrr9)rrrrrrD)rrr(s r/resolve_profile_envrs #< 0 0E%   !%((K +"4"4"6"6 = = =5: = =   {  rFr)NFFFFN)F)dr rrrerrrrrrF dataclassesrpathlibrrrtypingrrr agent.skill_utilsr compilerrrrrrNrDr! frozensetr r'r+r"r0rE_DEFAULT_EXPORT_EXCLUDE_ROOTrLrrrrCrrrrrrrrrrrrrrr)rrrr,r0r9r:floatr#rGrCrOrQrTr\rerkrrrrrrr rrrrrrrhrOr_rorrMrrrrrr~rFr/rs *  !!!!!!8888888888((((((((((4444449:: "$s),3<)===333,3<)===333 0DT343333t )y***  B )y***  )  i!!! 3D 3 3 3 3%$%%%%9$9999 *$****$      <  c  d     (#($((((++++++'' ''''TGGGGG (((Xc](htn((((V< T d    >GG#GGGG6.c3h....j ####### #@  %    2DU&R;=DeE5#$5667<<<du6tP(D(T((((4D8"&'+ OOOO#Otn O  OOOOJEtK(EEEEP&&$uS$Y/?*@&&&&V!%!%~~ ~ ~~ ~  ~  ~#~ ~~~~B**T*$*8D>****Z111$s)1111hmsmm$s)mmmm`&B#&BD&BT&B&B&B&BRDD"T""""J++3+4++++\#$s)(4dt@DSX2<<<HSM<T<<<<F9H39H#9H9HQU9H9H9H9Hx4S4C4D4444vccrF