epj#P%UdZ ddlZn #e$rYnwxYwddlmZeddlZddlZejej ej e ej Z e ejvrejde ddlmZddlmZ ejn #e$rYnwxYwdeddfdZd add Zddddd d ed ededededdf dZdefdZddZddZdaded<defdZ dddde!fdZ"ddZ#e#de!fdZ$de%ede!fdZ&de%ede!fdZ'de!fdZ(d ede!fd!Z)de!fd"Z*dedzfd#Z+dd$Z,de!fd%Z-de!fd&Z.ee-r e/dddl0Z0ddl1Z1ddl2Z2ddl3Z3ddl4Z4ddl5Z5ddl6Z6ddl7Z7dd'l8m9Z9dd(l:m;Z;ddlm?Z?dd*l@mAZBdd+lCmDZDdd,lEmFZFdd-lGmHZHdd.lImJZJdd/lKmLZLdd0lMmNZNdd1lOmPZPdd2lQmRZRdd3lSmTZTdd4lUmVZVdd5lWmXZXdd6lYmZZZdd7l[m\Z\dd8l]m^Z^dd9l_m`Z`dd:lambZbdd;lcmdZdddlimjZjdd?lkmlZldd@lmmnZnddAlompZpddBlqmrZrddClsmtZtddDlumvZvddElwmxZxddFlymzZzddGl{m|Z|ddHl}m~Z~ddIlmZddJlmZddKlmZddLlmZddMlmZddNlmZddOlmZddPlmZddQlmZddRlmZddSlmZddTlmZdUeddfdVZe9eZeddWZeddXlmZddYlmZeedZz [d Z dd\lmZed]z ZerepiZ dd^lmZejeZn #e$rYnwxYwd_ejvr^ed`iZeeerddl?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZfmgZgmhZhmiZimjZjmkZkmlZlmmZmmnZnmoZompZpmqZqmrZrmsZsmtZtmuZumvZvmwZwmxZxmyZymzZzm{Z{m|Z|m}Z}m~Z~mZmZmZmZmZmZmZmZmZmZmZmZmZdZddZddZde9de!fdZde9de9defdZde9fdZde9de9ddfdZddddde%ede9ded edreeefdzde7jf d!Zdeeefdzfd"Zd#dddd$d%ede9d&eedfd'e!dreeefdzde7jf d(Zde%ede9dreeefd'e!de7jf d)Zd*ededzfd+Zd d,de9d-e!de!fd.Zd d,de9d-e!de!fd/Zd0e9de!fd1Zde9defd2Zde9fd3Zd0e9de9d4e!de!fd5Zde9d4e!ddfd6Zd0e9de;e9fd7Zd8Zd9Zd:Zed;ed<ed=iZed=ed>ed?iZdgZde;efd@Zde;efdAZdefdBZdefdCZde9defdDZde9de;efdEZde9de;efdFZdGe9de9fdHZdGe9de;e9fdIZd0e9dGe;e9defdJZde%e9fdKZd0e9de%e9fdLZdMZde9de9fdNZde9de9fdOZde9de!fdPZde9de!fdQZddRde9dredSe;ede!fdTZde9drede!fdUZd0e9de%efdVZdWe9de;efdXZde;efdYZdZe9de!fd[Zd\d]dZe9d0e9d^ede!fd_Zdd`d0e9dae;e!de!fdbZdred4e!de!fdcZde!fddZdGe9de!fdeZÐdGe9de!fdfZdee%eeffdgZŐdhe0jfdiZddjlȐmɐZɐmʐZʐmːZddkdleedzde%efdmZ̐dnedeeeefdzfdoZ͐dpedzdefdqZΐdrZϐefdsedtede!fduZАdvededzfdwZѐdxededzfdyZҐdvededzfdzZӐdd{ed|edzde!fd}ZԐdvede%edzfd~ZՐde%e%ede%e%efdZ֐eʐZאddede%efdZde9fdZde9fdZde9de!fdZde9deddfdZܐddZݐddZސddZߐddZddZde!fdZdee%eeeefdzffdZdddde%edreeefdzdeddfdZde!fdZde9dzfdZde9de%e9fdZddde9dede%ee9e9ffdZde9de9de!fdZde%ee9e9fddfdZdddde%edreeefdzde9dzddfdZdde9dzddfdZejZeeeefdfed<ejZeeefed<ddde%edreeefdzddfdZde%ede%efdZddde%edreeefdzde%edzfdZddde%ede%edreeefdzde!fdZddde%edreeefdzdefdZdddde%edreeefdzdeddfdZde%efdZddde%edreeefdzddfdZdddde%edreeefdzdeddfdZde%edreeefdzde9dzfdZddreeefdzde!fdZdede!fdZdedzfdZGddZdde!fdZdZdefdZdedefdZdZde%de%fdZd„ZddÄZdefdĄZdpedede!fdƄZ ddDŽZ dedefdȄZ dede!fdɄZ dʄZ d˄Zd̄Zdd̈́Zd΄ZdτZdЄZde%efdфZehdңZehdӣZdedzfdԄZde!fdՄZdUedzddfdքZhdףZdؐdِdhfdېdhfdܐdhfdޜZde!fd߄Zde!fdZde!fdZddZddZ ddZ!de!fdZ"de!fdZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.eԐdkr e.dSdS(u Hermes CLI - Main entry point. Usage: hermes # Interactive chat (default) hermes chat # Interactive chat hermes gateway # Run gateway in foreground hermes gateway start # Start gateway as service hermes gateway stop # Stop gateway service hermes gateway status # Show gateway status hermes gateway install # Install gateway service hermes gateway uninstall # Uninstall gateway service hermes setup # Interactive setup wizard hermes logout # Clear stored authentication hermes status # Show status of all components hermes cron # Manage cron jobs hermes cron list # List cron jobs hermes cron status # Check if cron scheduler is running hermes doctor # Check configuration and dependencies hermes honcho setup # Configure Honcho AI memory integration hermes honcho status # Show Honcho config and connection status hermes honcho sessions # List directory → session name mappings hermes honcho map # Map current directory to a session name hermes honcho peer # Show peer names and dialectic settings hermes honcho peer --user NAME # Set user peer name hermes honcho peer --ai NAME # Set AI peer name hermes honcho peer --reasoning LEVEL # Set dialectic reasoning level hermes honcho mode # Show current memory mode hermes honcho mode [hybrid|honcho|local] # Set memory mode hermes honcho tokens # Show token budget settings hermes honcho tokens --context N # Set session.context() token cap hermes honcho tokens --dialectic N # Set dialectic result char cap hermes honcho identity # Show AI peer identity representation hermes honcho identity # Seed AI peer identity from a file (SOUL.md etc.) hermes honcho migrate # Step-by-step migration guide: OpenClaw native → Hermes + Honcho hermes version Show version hermes update Update to latest version hermes uninstall Uninstall Hermes Agent hermes acp Run as an ACP server for editor integration hermes sessions browse Interactive session picker with search hermes claw migrate --dry-run # Preview migration without changes N)suppress_platform_ver_console) _startup_fast)_early_recoveryrcreturnc6tjtjfD]'} |#t$rY$wxYw t jn#t$rYnwxYw|d}nt|tr|}nd}tj |dS)u Exit one-shot mode without letting late native finalizers change rc. The SIGABRT this guards against (#30387, #43055) fires in a native-extension finalizer during CPython's ``Py_FinalizeEx``, *after* the response has printed. Flush streams, shut down file logging, then ``os._exit`` past interpreter finalization. The ``atexit`` chain is deliberately skipped — several handlers re-enter native code that may be the abort source. Stateful cleanup is handled in ``_run_agent`` and ``_cleanup_oneshot_runtime``. Nr) sysstdoutstderrflush Exceptionloggingshutdown isinstanceintos_exit)rstream exit_codes 5/home/thesage/.hermes/hermes-agent/hermes_cli/main.py_exit_after_oneshotris:sz*  LLNNNN    D         z B    HYs1 >>A A#"A#FcttrdSda ddlm}|n#t$rYnwxYw ddlm}|dn#t$rYnwxYw ddlm}|n#t$rYnwxYw dd lm }|n#t$rYnwxYw dd l m }|dS#t$rYdSwxYw) uSBest-effort process-global cleanup before one-shot hard exit. ``run_oneshot`` owns the agent-local cleanup (memory provider, agent.close, session_db.close — all in ``_run_agent``'s finally block). This mirrors the process-global pieces from ``cli.py:_run_cleanup()`` that would otherwise be skipped by ``os._exit``. NTr)cleanup_all_environments) interrupt_allzoneshot shutdownreason)_emergency_cleanup_all_sessions)shutdown_mcp_servers)shutdown_cached_clients) _oneshot_cleanup_donetools.terminal_toolrrtools.async_delegationrtools.browser_toolrtools.mcp_toolr BaseExceptionagent.auxiliary_clientr )rrrrr s r_cleanup_oneshot_runtimer(s  @@@@@@  """"       888888 /00000       FFFFFF''))))       777777       BBBBBB!!!!!      sS ++A AAA$$ A10A15B BBB)) B76B7modelprovidertoolsets usage_filepromptr*r+r,r-c ddlm}||||||}n#t$rd}Ynt$rU}|j=t |jt s#t|jtj d}n|j}Yd}~n?d}~wt$r/ddl } | n#t$rYnwxYwd}YnwxYw tt|dS#t|wxYw)Nr) run_oneshotr)filer )hermes_cli.oneshotr0KeyboardInterrupt SystemExitcoderrprintr r r& traceback print_excrr(r) r.r*r+r,r-r0rexcr9s r_run_and_exit_oneshotr<s^222222 [ !        8  38S(A(A  #( , , , ,BBB          ! ! ! !    D     """ BBsP B< B<A BB<B'&B<' B41B<3B44B<;B<CC0c(tjSN)rproject_root_strr_project_root_str_fastrBs  ) + ++rAc,tjdSr>)rensure_project_root_on_pathr@rAr!_ensure_project_root_on_path_fastrEs-/////rAc ddl}|ddS#t$rYnwxYwddl}ddl} |}|dkr2|dd}|dd ddddS|d kr.|d d}|d dSdS#t$rYdSwxYw) udSet the process title to 'hermes' so tools like 'ps', 'top', and 'htop' show the app name instead of 'python3.xx'. Purely cosmetic — non-fatal on any platform. Strategy (try in order): 1. ``setproctitle`` (opt-in dep — installed via ``hermes tools`` or ``pip install setproctitle``, or bundled in a future release). 2. ctypes ``prctl(PR_SET_NAME)`` (Linux only, 15-char limit). 3. ctypes ``pthread_setname_np`` (macOS only, kernel thread name — changes lldb/top but not ``ps aux``). 4. No-op on Windows (the .exe name is already ``hermes.exe``). rNhermesLinuxz libc.so.6T) use_errnoshermesDarwinz libc.dylib) setproctitle ImportErrorctypesplatformsystemCDLLprctlpthread_setname_npr)rLrNrOrPlibcs r_set_process_titlerUs !!(+++      MMMOOO  "" W  ;;{d;;;D JJr9aA . . . . . x  ;;|t;<tjtjddd}tj|rddl}t|d 5}| |t|d dp|j pi}dddn #1swxYwY|d i}t|trV|d }t|tr,|dkrd}n#t$$rd}YnwxYw|ga|S)zReturn the configured default interface ("cli"/"tui") via a minimal YAML read. Best-effort: any error falls back to "cli" (legacy behavior).Nrcli HERMES_HOME config.yaml~.hermesutf-8encoding CSafeLoader)Loaderdisplay interfacetui)rVrenvirongetpathjoin expanduserexistsyamlopenloadgetattr SafeLoaderrdictstrstriplowerr)valuehomecfg_path _yaml_iface_frawdispifaces r_config_default_interface_earlyr|s)%a(( Ez~~m,,  Ww||D-88HHw||BG$6$6s$;$;Y VVH 7>>( # # " & & & &h111 R!&&w{M4HHbKLb'               779b))D$%% "--eS))"ekkmm.A.A.C.Cu.L.L!E #W Ls7B4F 0D< FD  FD BF F$#F$argvzlist[str] | NonecR|tjdd}d|vrdStjddksd|vrdS tjrtjsdSn#t$rYdSwxYwtd kS) u1Earliest TUI decision, usable before argparse/config imports. Precedence: explicit ``--cli`` wins (forces classic REPL), then explicit ``--tui``/``HERMES_TUI=1``, then a real-TTY gate (a non-interactive stdio can't host the Ink UI, so ambient config never boots it there), then ``display.interface`` in config. The TTY gate is load-bearing for headless spawners — kanban workers, cron jobs, pipes run ``hermes … chat -q`` with stdio on a pipe. This is the earliest launch decision (it runs before ``cmd_chat`` / ``_resolve_use_tui``), so a ``display.interface: tui`` default used to boot the TUI here — whose no-TTY bail-out exits 0 without doing the task → "protocol violation" on every attempt. An explicit ``--tui`` still reaches the informative bail-out. Nr z--cliF HERMES_TUI1z--tuiTrd) r r}rrerfstdinisattyr rr|r}s r_wants_tui_earlyr7s  |x|$u z~~l##s**goot   "" sz'8'8':': 5  uu * , , 55s)ris_termux_fast_version_argvrs r_is_termux_fast_version_argvr{  4T : ::rAc*tj|Sr>)ris_global_fast_version_argvrs r_is_global_fast_version_argvrrrAc(tjSr>)r is_container_startup_environmentr@rAr&_is_container_startup_environment_fastrs  9 ; ;;rA hermes_rootc*tj|Sr>)r active_profile_may_override_home)rs r&_active_profile_may_override_home_fastrs  9+ F FFrAc(tjSr>)rcontainer_mode_may_be_activer@rAr"_container_mode_may_be_active_fastrs  5 7 77rAc(tjS)zARead OpenAI SDK version without importing ``importlib.metadata``.)rread_openai_versionr@rAr_read_openai_version_fastrs  , . ..rAc,tjdSr>)rprint_fast_version_infor@rAr_print_fast_version_infors)+++++rAc(tjS)z:Handle ``hermes --version`` before config/logging imports.)rtry_fast_versionr@rAr_try_ultrafast_versionrs  ) + ++rAc>tsdStS)z?Backward-compatible test hook for the Termux startup fast path.F)rrr@rAr_try_termux_ultrafast_versionrs! . 0 0u ! # ##rAPath)Optional) cmd_sessions)add_accept_hooks_flag)build_cron_parser)build_sync_parser)build_gateway_parser)build_profile_parser)build_model_parser)build_setup_parser)build_whatsapp_parser)build_slack_parser)build_login_parser)build_logout_parser)build_auth_parser)build_status_parser)build_webhook_parser)build_hooks_parser)build_doctor_parser)build_security_parser)build_approvals_parser)build_dump_parser)build_debug_parser)build_backup_parser)build_import_cmd_parser)build_import_agent_parser)build_config_parser)build_skin_parser)build_console_parser)build_version_parser)build_update_parser)build_uninstall_parser)build_dashboard_parser)build_gui_parser)build_logs_parser)build_prompt_size_parser)build_memory_parser)build_acp_parser)build_tools_parser)build_insights_parser)build_monitoring_parser)build_skills_parser)build_pairing_parser)build_plugins_parser)build_mcp_parser)build_claw_parser command_namectjs5td|dtjtjddSdS)aExit with a clear error if stdin is not a terminal. Interactive TUI commands (hermes tools, hermes setup, hermes model) use curses or input() prompts that spin at 100% CPU when stdin is a pipe. This guard prevents accidental non-interactive invocation. zError: 'hermes z' requires an interactive terminal. It cannot be run through a pipe or non-interactive subprocess. Run it directly in your terminal instead.r2r N)r rrr8r exit)rs r _require_ttyrsk 9      9l 9 9 9      rAc:tjddd}d}d}dtdtffd }dtdtdzfd}hd }d d h}d}|t kr|}|d krn|d kr ||rn|dvr&|dzt kr|dz}d}|}n|dr!|ddd}d}|}n~d|vr ||vr|dzt kr|dz }nGd|vr>||vr:|dzt kr$|dzds|dz }n|dz }|t k|&|dkr ddl} | d|sd}d}d}tj dd} |!| rt| jjdkrdS|tj dst ddlm} | dz } | r4| d} | r | dkr| }d}n#t*t,f$rYnwxYw|3 ddlm}||}n#t2$rI}||}|s2t5d|tjtjdYd}~n~d}~wt:$r<}t5d|tjtjdYd}~n:d}~wt<$r*}t5d |d!tjYd}~dSd}~wwxYw|tj d<|dkrA|A|dz}tjd|tj||zdzt_dSdSdSdS)"z:Pre-parse --profile/-p and set HERMES_HOME before imports.r Nrindexrc dd|}d|dz|n#t$rYdSwxYwdS)a"True once argv reaches `hermes mcp add ... --args `. ``mcp add --args`` is command-argv passthrough. Flags after that point belong to the child MCP command (for example Docker MCP Toolkit's ``--profile``), not to Hermes' own profile selector. mcpraddr FT)r ValueError)r mcp_indexr}s r_inside_mcp_add_argsz5_apply_profile_override.._inside_mcp_add_args sa  5!U33I JJui!mU 3 3 3 3   55 ts15 AAnamec|dkrdSttdrtjdkrdStjdd}|r|dkrdS ddl}t||j }n#t$rYdSwxYw|dz d z |z } | rt|Sn#t$rYdSwxYwdS) aResolve `sudo hermes -p ` against the invoking user's home. `_apply_profile_override()` runs before argparse, so `--run-as-user` is not available yet. For sudo invocations, the best available signal is SUDO_USER: root is only doing the privileged install/start action, while the profile store normally belongs to the user who invoked sudo. defaultNgeteuidr SUDO_USERrootr\profiles)hasattrrrrerfrrpwdrgetpwnampw_dirris_dirrqr)r sudo_userrru candidates r_resolve_sudo_user_profile_envz?_apply_profile_override.._resolve_sudo_user_profile_envs( 9  4r9%% ):):4JNN;3399;;  I//4  JJJ Y//677DD   44 9$z1D8  !! &9~~% &   44 ts$4+B B.-B.="C!! C/.C/> -m-r-s-t-z--model--resume--skills --oneshot --provider --toolsets --usage-file-c --continue--z--args> --profile-pz --profile==-z^[a-z0-9][a-z0-9_-]{0,63}$rYrrHERMES_S6_SUPERVISED_CHILDget_default_hermes_rootactive_profiler]r^r)resolve_profile_envError: r2z"Warning: profile override failed (z), using default)r r}rboolrqlen startswithsplitrematchrrerfrparentrhermes_constantsr rj read_textrrUnicodeDecodeErrorrhermes_cli.profilesr FileNotFoundErrorr8r rrr) profile_nameconsume profile_indexrr value_flagsoptional_value_flagsiarg_rehermes_home_envr  active_pathrr  hermes_homer;startr}s @r_apply_profile_overrider&s 8ABB>, ' ' 99S!,,Q/LGM  c>>c[00QUSYY5F5F FAA sNN+++AD !!QK**3//" FAA FA5 c$ii--@GqLLyy6 EE !LG Mjnn]B77O  ' , : : FBJNN3O$P$P  @ @ @ @ @ @11336FFK!!## ",,g,>>DDFF DI--#'LG"G,    D   ? ? ? ? ? ?--l;;KK    88FFK oooCJ7777     /C// 3 3 3 3 HQKKKKKKKK    JSJJJZ     FFFFF  %0 =! Q;;=4!A%Ex'#(57?3D3D*EECHHH1 , ;44sC.AI II%I77 M?K M2L  ML;;Mget_hermes_home)load_hermes_dotenv.env) project_envread_raw_configrZ) managed_scopeHERMES_REDACT_SECRETSsecurityredact_secretsnetwork force_ipv4T setup_loggingc#DK|]}|d|VdSrNr.0r s r r;s3LLSs8K8KLSLLLLLLrAr r>guiservedesktop dashboardr<rXmode)apply_ipv4_preferenceforce)datetime) __version____release_date__)_prompt_auth_credentials_choice_model_flow_openrouter_model_flow_nous_model_flow_openai_codex_model_flow_xai_oauth_model_flow_qwen_oauth_model_flow_minimax_oauth_model_flow_custom_model_flow_azure_foundry_model_flow_named_custom_model_flow_copilot_model_flow_copilot_acp_model_flow_kimi_model_flow_stepfun_model_flow_bedrock_api_key_model_flow_bedrock_model_flow_vertex_model_flow_api_key_provider_model_flow_anthropic_model_flow_moa_model_flow_ai_gatewayenvc|p tj}t|dd}t |dpd|vp|dS)z `` with optional ``^`` peel lines and ``#``-prefixed comments / ``# pack-refs with:`` header. z packed-refsr]replacer_errorsN#^ r rr)rr splitlinesrrrrr)rdretextlinepartss r_read_packed_refrq3s ]*55wy5YY tt!!$$ ts++ ts/C/C   3"" u::??uQx~~//3668>>## # # # 4s  ++ repo_rootc<|dz } |r|ddD]r}|d\}}}|dkr?|r+||z }ns|}|dz }|rT |dd}|r||z }n#t$rYnwxYw|dz } | dd} | d r| dd d } ||fD]L} | | z } | r1d | d| ddcSMt|| }|rd | d|Sd | d Sd | S#t$rYdSwxYw)z9Return a cheap checkout fingerprint without spawning git..gitr]rgrh:gitdir commondirHEADzref:r zgit:z :unresolvedz git:HEAD:N) is_filerrm partitionrrresolverjrrrrq)rrgit_dirrokey_rtrdcommondir_filerel head_fileheadrerref_file packed_shas r_read_git_revision_fingerprintrFs& G' ??   ))79)MMXXZZ   $s 3 3 Q99;;(**u{{}}*(5;;==8AACCGE  ;.  " "  $.. .RRXXZZ;")C-!8!8!:!:J    f$ ""GI"FFLLNN ??6 " " +**S!$$Q'--//C&z2 i i $s???$$ih#hh(:(:GT](:(^(^(d(d(f(fhhhhhi)*c::J 10c00J000+#*** *!4!!! ttsJC H ADH  D# H "D##CH 'H H H HHctt}|r|Stdz } |}dtdtd|jd|jS#t$rdtdtdcYSwxYw)z=Cheap invalidation key for Termux bundled-skill startup sync.skillszskills:ruz:missing)r PROJECT_ROOTstatrFrG st_mtime_nsst_sizer)git_fp skills_dirrs r"_termux_bundled_skills_fingerprintrss +L 9 9F  (JB  [[['7[[$:J[[T\[[[ BBBAAA'7AAAAAABs5AA:9A:c*tdz dz S)Nrz.termux_bundled_sync_stampr'r@rAr!_termux_bundled_skills_stamp_pathrs   x '*F FFrActsdStjddkrdS t }|dtkS#t$rYdSwxYw)NTHERMES_TERMUX_FORCE_SKILLS_SYNCrr]r^) rcrrerfrrrrrrstamps r"_termux_bundled_skills_sync_neededrs ) + +t z~~788C??t133006688<^<`<``` ttsAA== B  B ctsdS t}|jdd|t dzddS#t $rYdSwxYw)NTparentsexist_ok r]r^)rcrrmkdir write_textrrrs r"_mark_termux_bundled_skills_syncedrs ) + + 133 4$777 ;==DwWWWWW      sAA$$ A21A2ctrtsdSddlm}|dt dS)aSync bundled skills, but skip unchanged Termux checkouts cheaply. Hashing every bundled skill is safe but expensive on older Android storage. The git/ref stamp keeps post-update correctness: a changed checkout revision forces one real sync, then later starts skip it. Fr sync_skillsTquiet)rcrtools.skills_syncrrrs r _sync_bundled_skills_for_startuprs[&''0R0T0Tu------Kd&((( 4rAchtsdStjddkS)NTHERMES_TERMUX_PREFETCH_UPDATESr)rcrrerfr@rAr$_termux_should_prefetch_update_checkrs/ ) + +t :>>: ; ;s BBrAc$ddlm}||S)zFormat a timestamp as relative time (e.g., '2h ago', 'yesterday'). Thin wrapper kept for backward compatibility; the implementation lives in :mod:`hermes_cli.timefmt` so lightweight consumers don't have to import the whole CLI surface. r) relative_time)hermes_cli.timefmtr)tsrs r_relative_timers&100000 =  rAcddlm}m}m}ddlm}ddlm}|dd}|}|d}t|tr*|dpd }n,t|tr| }nd}|o||k} ddlm } hd } | D]'} | jd kr| | j(t#d | Drd S|} | r | d D]}| }|dsd|vr0|dr |dd}|d\}}}| d}| | vr|rd Sn#t.$rYnwxYw | D]4\}} | jd kr||}|drd S5n#t.$rYnwxYw|dz }|rs ddl}|j|d }|d}|r"||}|drd Sn#t.$rYnwxYwt|tr|dpd }|dpd }|d pd }|s|s|rd S| rH ddlm}m}|}|r"||s|drd Sn#t.$rYnwxYwdS)z3Check if at least one inference provider is usable.r) get_env_pathr( load_config)get_auth_status)DEFAULT_CONFIGr*rr)PROVIDER_REGISTRY>OPENAI_API_KEYANTHROPIC_TOKENOPENAI_BASE_URLANTHROPIC_API_KEYOPENROUTER_API_KEYapi_keyc3>K|]}tj|VdSr>)rgetenv)r:vs rr;z/_has_any_provider_configured..s* 3 3A29Q<< 3 3 3 3 3 3rATr]r^rjrzexport Nz'" logged_inz auth.jsonactive_providerr+base_url)read_claude_code_credentialsis_claude_code_token_valid refreshTokenF)hermes_cli.configrr(rhermes_cli.authrrrfrrprrrqrvalues auth_typeupdateapi_key_env_varsanyrjrrmrrzritemsjsonloadsagent.anthropic_adapterrr)rr(rrr_DEFAULT_MODELcfg model_cfg _model_name_has_hermes_configrprovider_env_varspconfigenv_fileror}r~val provider_idstatus auth_filerauthactive cfg_provider cfg_base_url cfg_api_keyrrcredss r_has_any_provider_configuredrs LLLLLLLLLL////// 100000#''44N +--C  I)T"" }}Y//52<<>> Is # #oo''  $F)F 211111%++--??   ) )  $ $W%= > > > 3 3!2 3 3 333t|~~H   **G*<<GGII zz||??3''3d????9--$8D"nnS11 Qiikk''..99;;"333344     D  $5$;$;$=$=   K I--$_[11Fzz+&& tt          !!K/I   KKK4:i1171CCDDDXX/00F (00::k** 4    D )T""! j117R>>@@ ! j117R>>@@  }}Y//52<<>>  < ; 4            1022E **511 5:YY~5N5N t    D  5sW?CHH H H $AI.,I.. I;:I; AL LL-4O$$ O10O1sessionsc  stddS ddl dgd d fd} |dS#t$rYnwxYwtdt D]\}}|dpd }|d pd }|p |p|d }t|d kr |dd dz}t|d}|dd dd}td|dzdd|dd|dd| tdtd} | r| dvrdSt| dz } d| cxkrtkrnn| d Stdtdn@#t$rtdYn%ttf$rtYdSwxYw)aInteractive curses-based session browser with live search filtering. Returns the selected session ID, or None if cancelled. Uses curses (not simple_term_menu) to avoid the ghost-duplication rendering bug in tmux/iTerm when arrow keys are used. zNo sessions found.Nrc|dpd}|dpd}|dddd}t|d}|ddd }d }td ||z }|r |d|} n|r |d|} n|} | d |d |dd |dd|S)z!Format a session row for display.titlerpreviewsourceN last_activeid-< <10<5rl)rfrrrmax) smax_xrrrrsid fixed_cols name_widthrs r _format_rowz+_session_browse_picker.._format_rowCsUU7^^)r0022EuuY''-24466GUU8R((!,F(})=)=>>KD'#2#,C-JR!344J [j[) { {+PZPPPPKPPPvPPP3PP PrAc|}||dpdvp||dpdvpT||ddvp*||dpdvS)z?Check if a session matches the search query (case-insensitive).rrrrr)rsrf)rqueryqs r_matchz&_session_browse_picker.._matchYs AaeeGnn*113338y))/R668888dB--///8x.B55777  rAc * drdjddjddjddjdkrdnj dd}d}dt} | | \}}|d ks|d krS | ddd n#j$rYnwxYw||dSr:d d}j}r|dz}n5d}j}r|dz} |dd||dz |n#j$rYnwxYwd}t)d||z } ddd| dddddddd} rdnj} |dd| |dz | n#j$rYnwxYw|dz } t)| d} |s7 d} |dd| |dz jnB#j$rYn5wxYw|t-|krt-|dz }t)|d}||kr|}n||| zkr|| z dz}t/t1|t3t-||| zD]\}}|dz}||dz krn||}||krdnd}|||dz z}j}||kr3j}r|dz} ||d||dz |#j$rYwxYw|dz }|rPd|dzdt-|d}t-|t-kr|d t-d!z }nd"t-d} ||d||dz rdnjn#j$rYnwxYw||}|jhvr|r|dz t-|z}n|jhvr|r|dzt-|z}n|jd#d$hvr|r||d%d<dS|d&krrdt}d}d}ndS|jd'dhvr2r/ddrfd(D}nt}d}d}nL|t?d)krsdSd*|cxkrd+kr(nn%tA|z fd,D}d}d}.)-Nrr rrT(zTerminal too smallu Browse sessions — filter: u█uM Browse sessions — ↑↓ navigate Enter select Type to filter Esc quitrrz zTitle / PreviewrrActiverSrcrrlIDz No sessions match the filter. → /z sessionsz (filtered from )z 0/ rc,g|]}||Sr@r@r:rr search_texts r zB_session_browse_picker.._curses_browse..s*'V'V'Vavva?U?U'V'V'V'VrAr ~c,g|]}||Sr@r@rs rrzB_session_browse_picker.._curses_browse..s*NNNavva7M7MNNNNrA)!curs_set has_colors start_coloruse_default_colors init_pair COLOR_GREEN COLOR_YELLOW COLOR_CYANCOLORS COLOR_WHITElistcleargetmaxyxaddstrerrorrefreshgetchA_BOLD color_pairaddnstrrA_DIMr enumeraterangeminA_NORMALKEY_UPKEY_DOWN KEY_ENTER KEY_BACKSPACEordchr)stdscrcursor scroll_offsetfilteredmax_yrheader header_attrrr col_headerdim_attr visible_rowsmsgdraw_iryrarrowrowattrfooter_yfooterr}rrrcurses result_holderrs @r_curses_browsez._session_browse_picker.._curses_browsecs OOA     "" X""$$$))+++  F$6;;;  F$7<<<  F$5r:::  ):):AA@RTVWWWFMKH~~HM & %00 u199  a,@AAAA!<NN$$$LLNNNF <NkNNNF"(-K((**<#v'8'8';';; lF"(-K((**<#v'8'8';';; NN1aKHHHH|D1  UZ%788 g#4gzgggghgggV[gggaegg 060A0A0C0CU))!,,,NN1aUQYIIII|D %qy "<33  #!?q!S%!)V\JJJJ!<X..!$X!2 ^^F --(. =<#???(.(=(A %.)H }|/KLL&&!!  #QJ >>!E$QK+,;;E#kk!UQY&?&??%;;#)=D%0022= $(9(9!(<(< <!"NN1aeaiFFFF%|!!! D!!19=G&1*GGs8}}GGGF8}}s8}}44"ES]]"E"E"EE"(1*H !=V_...>"(1*H !=V-r2666B+3F+;D+A a(FBYY"&( #'>>!"() V13:::"*&1#2#&6 &6'V'V'V'V'V8'V'V'VHH'+H~~H!"() CHH__[_F3%%%%#%%%%%3s88+KNNNNN8NNNHF$%M[M &snD77 EE#H H  H :A J JJ/#K K"!K")P PPA S SSz: Browse sessions (enter number to resume, q to cancel) rrrr2/...rrrrr z>3. z<50rTz Select [1-]: >rrquitz Invalid selection. Enter 1-z or q to cancel.z/ Invalid input. Enter a number or q to cancel.)r8rEwrapperrr)rfrrrrinputrsrrr5EOFError)rrGrrrrlabelrsrcridxrrrErFs` @@@@r_session_browse_pickerrT2s  "###tG    Q Q Q,   \ &\ &\ &\ &\ &\ &\ &\ &\ &| ~&&&Q       HIII(##FF1w%2,,..55##)r0022++AdG u::??#2#J&E$QUU=%9%9:: eeHb!!"1"% D1q5DDDuDDDKDDDsDDEEEE  ;X;;;<<BBDDC #))++)>>>tc((Q,CC''''#h--'''''}T** Q#h--QQQ R R R R E E E C D D D D D!8,    GGG44  s62A AA"A H .#t $rYn2wxYwn-#|& |w#t $rYwwxYwwxYwdS)ahLook up the most recently-used session ID for a source. Scoped to the current workspace first (git repo root, else cwd) so ``hermes -c`` from repo A continues repo A's last session rather than the global MRU. Falls back to the unscoped MRU when no session matches the current workspace, preserving the old behaviour for fresh directories. Nr SessionDBr )rlimit workspace_keyr)rrd) hermes_statercr`search_sessionscloser)rdbrcws_keyrs r_resolve_last_sessionrk;s B****** Y[['))  )))qPV)WWH ){4( >        %%V1%==$,6x{4  $6 >              >       2>        4sACA## A0/A04(C B55 CC CDCDC// C<;C<D*DD* D&#D*%D&&D*cmdbackendvia_sudoc tj|dddddS#tj$rC|rd|n|}td|d|d tj t jd Yd SwxYw) zRun a container inspect probe, returning the CompletedProcess. Catches TimeoutExpired specifically for a human-readable message; all other exceptions propagate naturally. Tr]rgrJrWzsudo zError: timed out waiting for z to respond. The z+ daemon may be unresponsive or starting up.r2r N)rZr[TimeoutExpiredr8r r r)rlrmrnrQs r_probe_containerrq[s ~c$TG\eoqrrrr  $%-:!!!!7  HE H H H H H     sAA.-A.container_infocli_argscL|d}|d}|d}|d}tj|}|s3td|dtjtjdd }t |d d d |g|}|jd krtjd}|rt |d|d d d |g|d} | jd krjtd|d|d|d|dtj ddd|dd |tjtjdnKtd|d|dd |tjtjdtj } | rdgndg} g} dD]?} tj | }|r| d | d!|g@|r|d|gn|g}|d"gz| zd#|gz| z||gz|z}tj|d |d S)$aReplace the current process with a command inside the managed container. Probes whether sudo is needed (rootful containers), then os.execvp into the container. On success the Python process is replaced entirely and the container's exit code becomes the process exit code (OS semantics). On failure, OSError propagates naturally. Args: container_info: dict with backend, container_name, exec_user, hermes_bin cli_args: the original CLI arguments (everything after 'hermes') rmcontainer_name exec_user hermes_binr z. not found on PATH. Cannot route to container.r2r Ninspect--formatokrsudo-nT)rnzError: container 'z' not found via zL. The container is likely running as root. Your user cannot see it because z7 uses per-user namespaces. Grant passwordless sudo for u — the -n (non-interactive) flag is required because a password prompt would hang or break piped commands. On NixOS: security.sudo.extraRules = [{ users = [ "USERz your-userz"" ]; commands = [{ command = "z<"; options = [ "NOPASSWD" ]; }]; }]; Or run: sudo hermes rlz<. The container may be running under root. Try: sudo hermes z-itz-i)TERM COLORTERMLANGLC_ALL-erexecz-u)shutilwhichr8r r rrqr\rrrhrrrerfextendexecvp)rrrsrmrurvrwruntime sudo_pathprobeprobe2is_tty tty_flags env_flagsvarr cmd_prefixexec_cmds r_exec_in_containerrms'Y'G#$45N{+I -Jl7##G  Mg M M M      I  )Z~>  E 1L((  %D'9j$WF  A%%@@@@@ '@@!( @@')i &D&D@@6=@@,/88H+=+=@@!$ b^bbWbbMPXXV^M_M_bbZ     HQKKK Y    F!-vII655jnnS!!  5   dsNNSNN3 4 4 4/8G)T7++wiJ (          : &  '    Ihqk8$$$$$rA name_or_idc8 ddlm}|}||}d}|r |d}n||}|r) ||p|}n#t $rYnwxYw||S#t $rYnwxYwdS)aXResolve a session name (title) or ID to a session ID. - If it looks like a session ID (contains underscore + hex), try direct lookup first. - Otherwise, treat it as a title and use resolve_session_by_title (auto-latest). - Falls back to the other method if the first doesn't match. - If the resolved session is a compression root, follow the chain forward to the latest continuation. Users who remember the old root ID (e.g. from an exit summary printed before the bug fix, or from notes) get resumed at the live tip instead of a stale parent with no messages. rrbNr)rfrc get_sessionresolve_session_by_titleget_compression_tiprrh)rrcrisession resolved_ids r_resolve_session_by_name_or_idrs ****** Y[[..,,%)  B!$-KK55jAAK    44[AAP[             4s6A B A$#B $ A1.B 0A11B BBrgc |sdS tjt|d}t |dpd}|pdS#t$rYdSwxYw)Nr]r^ session_idr)rrrrrqrfrrr)rgdatars r_read_tui_active_session_filers tz$t**...@@AA$((<((.B//5577{d ttsA.A55 BBractive_session_filec &t|p|ptd}|sdSd} ddlm}|}||}|s ||dSdS||}t|dpd}|dkr ||dSdSt|dpd}t|dpd} t|d pd} t|d pd} t|d pd} || z| z| z| z} n)#t$rY||dSdSwxYw ||n#||wwxYwttd td ||rtd|dttd||rtd|td|td| d|d| d| | zd| d dS)z/Print a shell-visible epilogue after TUI exits.rdrNrrb message_count input_tokens output_tokenscache_read_tokenscache_write_tokensreasoning_tokenszResume this session with:z hermes --tui --resume z hermes --tui -c ""zSession: zTitle: zMessages: zTokens: z (in z, out z, cache z , reasoning r) rrkrfrcrrhget_session_titlerrfrr8)rrtargetrircrrrrrrrr total_tokenss r_print_tui_exit_summaryrse &&9:: /  /  . . .  B****** Y[[..((  * > HHJJJJJ >'$$V,,GKK88=A>> A    > HHJJJJJ >7;;~66;!<< GKK88=A>>  ,? @ @ EAFF -A!B!B!GaHHw{{+=>>C!DD   ! !      > HHJJJJJ >  > HHJJJ > HHJJJJ  GGG %&&& -V - -... . ,E,,,--- GGG %V % %&&& * ((())) ,] , ,---  Y  Y Y* Y Y2? Y Y"%77 Y YEU Y Y Ys6'F+?FCFG  F.G -F..G G" ideallyInertpeerdirc|dz r:|dz s#|jdz r|jS|S)u6Return the npm workspace root for *dir*. In a workspace checkout the single ``package-lock.json`` and hoisted ``node_modules/`` live at the workspace root (the parent of the sub-package directory). Heuristic: if *dir* has a ``package.json`` but **no** ``package-lock.json``, and its **parent** has a ``package-lock.json``, the parent is the workspace root. Otherwise *dir* itself is the root (standalone project or prebuilt-bundle layout). Used by ``_tui_need_npm_install``, ``_make_tui_argv``, and ``_build_web_ui`` so that lockfile/node_modules resolution and ``npm install`` cwd stay consistent — a single helper prevents the checks from diverging if someone accidentally creates a sub-package lockfile (e.g. running ``npm install`` in the wrong directory). package.jsonpackage-lock.json)ryr)rs r_workspace_rootrFsd& ~ &&((**3355Z- - 6 6 8 8 z JrAinclude_child_workspacesr.cNt|}||kr|dfS ||}n#t$r|dfcYSwxYwd|g}|r|dz }|rt |D]i}|rS|dz r<|d||gj| d|t|fS)zJReturn Termux-only ``(cwd, npm_args)`` for installing deps for *dir* only.r@ --workspacepackagesrz--include-workspace-root=false) r relative_toas_posixrrsortediterdirryrappendtuple)rrws_root workspaceworkspace_args packages_dirchilds r!_termux_workspace_install_contextrasTc""G#~~BwOOG,,5577 {"/ :NZ'      4 4 6 677  <<>>u~'=&F&F&H&H"))&(9(9'(B(B(K(K(M(MN:;;; E.)) ))s'AAArcL|dz dz }t|}|dz }|r|sdS|dz dz dz dz }|sd S|sdS|dz d z }|sd S tj|d d pi}tj|d d pi}nV#t ttjf$r7| j | j kcYSwxYwdtdtfd}| D]\} } | st| ts| |vr.| ds| drMd St|| tr!|| ||| krd SdS)uQTrue when @hermes/ink is missing or node_modules is behind package-lock.json. Prebuilt bundle mode: when ``dist/entry.js`` exists and there is no ``package-lock.json`` (nix install layout only ships ``dist/`` + ``package.json``), skip reinstall entirely — the bundle is self-contained and there is nothing to install. With npm workspaces the single ``package-lock.json`` and the hoisted ``node_modules/`` live at the workspace root (the parent of the ``ui-tui/`` directory). The lockfile / ink / marker checks use that workspace root; only the prebuilt-bundle sentinel stays relative to *root* (``ui-tui/dist/entry.js``). Compares ``package-lock.json`` against ``node_modules/.package-lock.json`` (npm's hidden lockfile) by **content**, not mtime: git checkouts and npm rewrites can bump the root lockfile's timestamp even when installed deps already match, which used to trigger a spurious "Installing TUI dependencies" on every launch. For each entry in the root lock's ``packages`` map: - missing from hidden lock → reinstall (unless the entry is marked ``optional`` or ``peer``, which npm may intentionally skip per platform) - present but with differing fields (excluding npm-written runtime annotations like ``ideallyInert``) → reinstall Extra entries that exist only in the hidden lock are ignored — stale transitives left over from a removed dependency don't break runtime and we'd rather not force a reinstall for them. Falls back to mtime comparison if either lockfile is unparseable. distentry.jsrF node_modulesz@hermesinkrTz.package-lock.jsonr]r^rpkgrc>d|DS)Nc,i|]\}}|tv||Sr@)_NPM_LOCK_RUNTIME_KEYSr:krs r z=_tui_need_npm_install..comparable..s)PPPA9O0O0O10O0O0OrA)r)rs r comparablez)_tui_need_npm_install..comparablesPPPPPPrAoptionalr)rryrrrrfrrJSONDecodeErrorrst_mtimerprr) rentryrlockrmarkerwanted installedrrrs r_tui_need_npm_installr{saB 6MJ &Ed##G ( (D }}t||~~u N "Y . 6 GC ;;==t <<>>u ~ %(< >  t =DNNGN<<==AA*MMSQSJv///AABBFFzRRXVX ')= >===yy{{#fkkmm&<<<<<=QQQQQQ\\^^ c  #t$$   y wwz"" cggfoo 44 iot , , CJJ dOE E 2 2 44 5s A:DAE.-E.)rRzpackages/hermes-ink/src) rrz tsconfig.jsonztsconfig.build.jsonzbabel.compiler.config.cjszscripts/build.mjsz packages/hermes-ink/package.jsonzpackages/hermes-ink/index.jsz!packages/hermes-ink/text-input.js>.js.ts.cjs.jsx.mjs.tsx.jsonc#KtD]}||z }|r|V tD]Z}||z }|s|dD](}|r|jt vr|V)[dS)z?Yield source/config files that affect ``ui-tui/dist/entry.js``.*N)_TUI_BUILD_INPUT_FILESry_TUI_BUILD_INPUT_DIRSrrglobsuffix_TUI_BUILD_INPUT_SUFFIXES)rrrgbases r_iter_tui_build_inputsrs%cz <<>> JJJ$cz{{}}  JJsOO  D||~~ $+1J"J"J   rActjdpd}|dvrdS|dz dz } |j}n#t$rYdSwxYwt|D]5} |j|krdS$#t$rYdSwxYwdS)aTrue when ``dist/entry.js`` is missing or older than TUI inputs. The TUI bundle is self-contained. Rebuilding it on every launch adds a visible cold-start tax on slow Termux CPUs, while a simple mtime freshness check still rebuilds immediately after source updates, dependency updates, or local edits. Set ``HERMES_TUI_FORCE_BUILD=1`` to force the old behaviour. HERMES_TUI_FORCE_BUILDr>ronyestrueTrrF) rrerfrrrsrrrr)rrDr output_mtimergs r_tui_need_rebuildrsZ^^4 5 5 ; B B D D J J L LE ***t 6MJ &Ezz||, tt't,, yy{{#l22tt3   444  5s$A// A=<A=B33 CCc LtjdrtjdrdStjdrdSt dz dz dz }|sdSdd lm}t|} tj d d d |d gitjd|iddddd}n#ttj f$rYdSwxYwtjddtj}g}|jpd}|r9|t'|j|t'|dz dz t'jdz dz g|D]?}t|}|r||vr|d|@tj|tjd<dS)uzMake sure `node` + `npm` are on PATH for the TUI. If either is missing and scripts/lib/node-bootstrap.sh is available, source it and call `ensure_node` (fnm/nvm/proto/brew/bundled cascade). After install, capture the resolved node binary path from the bash subprocess and prepend its directory to os.environ["PATH"] so shutil.which finds the new binaries in this Python process — regardless of which version manager was used (nvm, fnm, proto, brew, or the bundled fallback). Idempotent no-op when node+npm are already discoverable. Set ``HERMES_SKIP_NODE_BOOTSTRAP=1`` to disable auto-install. nodenpmNHERMES_SKIP_NODE_BOOTSTRAPscriptslibznode-bootstrap.shrr'bashrzsource "z+" >&2 && ensure_node >&2 && command -v noderYTr]rgF)r]rXrnr_riraPATHrbinz.local)rrrrerfrryrr(rqrZr[rSubprocessErrorrpathsepr rrrrr{rrrurinsertrh) helperr(r$r_rpextrasresolvedextrars r_ensure_tui_noder s8|F U 3 3 z~~233 I % -0C CF >>  000000oo''((KN6NNN  ;2::}k::     Z/ 0 JNN62 & & , ,RZ 8 8EF #**,,H7 d8nn,,..5666 MM4 $$v-5ty{{X7MPU7UVWWW JJ <<>> aunn LLA   //BJvs2CCChermes_cli_dircx|ttj}|dz dz }|r|ndS)z3Find a pre-built TUI entry.js bundled in the wheel.Ntui_distr)r__file__rry)rbundleds r_find_bundled_tuirJs>h.z)J6Goo'' 177T1rAtui_dirc $tjd}|r|jdz sdS t j|dd|jgt|jddddd n#t$rYdSwxYw| S) uJTry to restore a missing ``ui-tui/`` from git, returning True on success. On Windows an antivirus / NTFS filter driver can leave tracked ``ui-tui/`` files deleted in the working tree after ``hermes update`` (HEAD stays intact; the files just vanish — see issue #49145). Those files are tracked, so ``git restore`` puts them back deterministically. Best-effort: returns False (rather than raising) when git is unavailable, this isn't a checkout, or the restore leaves the directory still missing — the caller then prints the manual-recovery message. rVrtFrestorerTr]rg)cwdrXrnr_rira) rrrrjrZr[rrqrr)r rVs r_restore_tui_workspacer Rs ,u  C w~.6688u  )T7< 0GN##        uu >>  s6A-- A;:A;c|rdSt|r3tjdst d|dSt d|dt jt jddS)aEnsure ``ui-tui/`` exists before any npm/node subprocess uses it as cwd. Without this, a missing workspace falls through to ``subprocess.run(..., cwd=)``, which crashes with ``NotADirectoryError`` (``WinError 267`` on Windows) instead of a usable message (#49145). We first try to self-heal via ``git restore``; only if that can't recover the directory do we abort with concrete manual-recovery steps. N HERMES_QUIETz Restored missing TUI workspace: zSError: the TUI workspace is missing from this Hermes checkout. Expected directory: a/ This usually means `hermes update` left tracked ui-tui files deleted. Recovery: 1. From the Hermes checkout, run `git restore -- ui-tui` 2. Run `npm install --silent --no-fund --no-audit --progress=false` 3. Retry `hermes --tui` If the checkout is still inconsistent, run `hermes update --force`.r2r ) rr rrerfr8r r r)r s r_ensure_tui_workspacerms~~g&&z~~n-- @ >W>> ? ? ?  N& N N NZ    HQKKKKKrAtui_devc tdtdtfd}tjd}|r5|r3t d|dt jt jd|s|rNt|}|d z d z r%|d }|d t|d z d z g|fSt}|$|d }|d t|g|j fS|st|d}t}d} |r|st|} |o| o| } | st!|rq|d} tjdst dt#||krdnd} |rt%|d\} | dg| ddddddt&jffd } | }|jdkr:ddlm}|jpdd |jpd}|| |}|r|} |d<| }|jdkr|jpdd |jpd}d |d!d }t d"|rt |t jdd}|r |d} |d#z d$z }t'j| d%d&gt|ddd'd()}|jdkr|jpd|jpd}d |d!d }t d*|rt |t jd|d+z d,z d-z }|rt|d.g|fS| d/g|fSd}|r|p| }|r|d} t'j| d%d&gt|ddd'd()}|jdkr|jpd|jpd}d |d!d }t d0|rt |t jd|d }|d t|d z d z g|fS)1uLTUI: --dev → tsx src; else node dist (HERMES_TUI_DIR prebuilt or esbuild).rrc|dkratjd}|r@tj|r!tj|tjr|Sddlm}||}|s4|dkr. ddl m }|dr |d}n#t$rYnwxYw|s&t|dtjd|S)Nr HERMES_NODErfind_node_executable)ensure_dependencyu. not found — install Node.js to use the TUI.r )rrerfrgisfileaccessX_OKrrhermes_cli.dep_ensurerrr8r r)renv_noderrgrs r _node_binz!_make_tui_argv.._node_bins &==z~~m44H BGNN844 8RW9U9U  :99999##C(( v  CCCCCC$$V,,8//77D      SHHH I I I HQKKK sB B,+B,HERMES_TUI_DIRz1Error: --dev is incompatible with HERMES_TUI_DIR=z The prebuilt TUI has no source code to hot-reload. Unset HERMES_TUI_DIR (e.g. `unset HERMES_TUI_DIR`) to use --dev from a checkout.r2r rrrz --expose-gcNFrruInstalling TUI dependencies…r@)rui-tuiTrinstall --include=dev--silent --no-fund --no-audit--progress=falsec ddlm}tjt tjtjdddi|ddiS) Nrwith_hermes_node_pathTr]rgCIrr r r rnr_rir])rr(rZr[rqPIPE)r(npm_cwdnpm_install_cmds r_run_tui_installz(_make_tui_argv.._run_tui_installsk > > > > > > >LL!!  :,,..:c::    rArmaybe_repair_npm_enginerrznpm install failed.rz hermes-inkr[buildr]rg)r rXrnr_rizTUI dev prebuild failed.rz.bintsxz src/entry.tsxr%zTUI build failed.)rrqrrerfr8r r rrryrrrrcrrrrrZCompletedProcessr\hermes_cli.npm_enginer0r rrrhrmr[rj)r rrext_dirprr did_installtermux_startuptermux_need_rebuild$skip_install_for_fresh_termux_bundlernpm_workspace_argsr.r_r0combined_output repaired_npmcombinedrink_dirr3 should_buildr,r-s @@r_make_tui_argvrBsCss2jnn-..G7  ` ` ` `        G  NW AF Z'0022 N y((mSVj1H-I-IJAMM$%%  9V$$D-W6F F 'g&&&K355N9g9/88 Bw;B/B+B) 1J !' * *Jiz~~n-- 4 2 3 3 3!'**5K|]}|VdSr>rrr:parts rr;z*_normalize_tui_toolsets..ss*!K!K4$**,,!K!K!K!K!K!KrA,cg|]}||Sr@r@)r:items rrz+_normalize_tui_toolsets..ws444t4444rA) r4rDAttributeErrorrMrrqrrrrrrr)r,rD raw_items normalizedrKs r_normalize_tui_toolsetsrObs.5::::::""8,,22 K (555 III",Xs";";IXJJ )dE]33 $" I "  5 5D$$$ 5!!!K!K4::c??!K!K!KKKKK!!#d))//"3"34444444444445sC7CC76C7cfd}|D]} t|dd5}|}dddn #1swxYwYn#ttf$rYgwxYw|dkrdS|sw t |}n#t$rYwxYw|dkr|dkrdS|cSdS) u_Return the container memory limit in bytes, or None if unconstrained. Node's V8 heap is NOT cgroup-aware: with a flat ``--max-old-space-size=8192`` it happily grows the heap toward 8GB regardless of the container's real memory limit. In a Docker/k8s container capped below ~9-10GB, the cgroup OOM-killer SIGKILLs Node before V8's own heap monitor ever fires — which runs no JS handler, writes no ``[tui-parent]`` breadcrumb, and the user sees only a bare gateway ``stdin EOF``. Reading the real cgroup limit lets us size the heap cap below it so V8 GCs/exits gracefully instead of being reaped silently. Checks cgroup v2 (``/sys/fs/cgroup/memory.max``) then v1 (``/sys/fs/cgroup/memory/memory.limit_in_bytes``). A literal ``max`` (v2) or the v1 "unlimited" sentinel (a huge near-INT64 value) means no limit. )z/sys/fs/cgroup/memory.maxz+/sys/fs/cgroup/memory/memory.limit_in_bytesrr]r^Nrrl )rlreadrrrrr) candidatesrgfryrds r_read_cgroup_memory_limitrUzs@ J dC'222 'affhhnn&& ' ' ' ' ' ' ' ' ' ' ' ' ' ' '$    H  %<<44   HHEE    H  A::  W  44 4sFA'A  A A AA AA-,A-=B  BB default_mbct}|s|S|dz}t|dz}||kr|S|dkrtd|n|S)uPick a V8 ``--max-old-space-size`` (MB) that fits the container. Returns ``default_mb`` (8192) when unconstrained or when the box is large enough that 8GB fits. In a memory-limited container, returns ~75% of the cgroup limit so the heap + non-heap RSS stays under the cgroup ceiling, clamped to a sane floor (1536MB — below this V8 GC-thrashes and the TUI is barely usable). Never exceeds ``default_mb``. ig?ii)rUrr)rWrdlimit_mbsizeds r_resolve_tui_heap_mbr[sj & ' 'E %H 4 E  ($3tU   E9rAcT tjS#t$r|pidp tjdpd}|r%t |r|cYSttcYSwxYw)z=Return a stable cwd value for the Node TUI child environment.PWDr) rr^rrfrerrrrrqr)r]rs r _safe_tui_cwdr^s!y{{ !!!iR__U++Jrz~~e/D/DJQQSS  i//11    <     !sA9B'B'&B'ct|dpd}|r!t|stt |d<t|dpd}|r!t|st ||d<t|dpd}tj |rot|}| st|d|z }| otj |tj }n6ttj||d}|st"j|d<dSdS)zMSeed/repair Python-related env vars shared by CLI and dashboard TUI launches.HERMES_PYTHON_SRC_ROOTr HERMES_CWD HERMES_PYTHONrrgN)rqrfrrrrrr^rrgdirname is_absoluteryrrrrrr executable)r]src_rootr python python_pathpython_is_executables r_apply_tui_python_envrks377344:;;AACCH :4>>0022:(+L(9(9 $% cggl##)r * * 0 0 2 2C /d3ii&&((/)#..L ))/R 0 0 6 6 8 8F wvP6ll &&(( @s<011K?K*2244X;PRPW9X9X#FLcggfoo$N$N$NOO ."~O..rAresume_session_idrverboserrimageworktree checkpointspass_session_id max_turns accept_hooksctdz }ddl}ddlm}|dd} ddlm}|| n,#t $rtd d YnwxYw| d d \}}tj |||d<| d|rdndd}| r ddl m}m}m}m}|}|r |||}n7#t $r*}t%d|t&jd}Yd}~nd}~wwxYw|st'jd|d|d<|d|d<t-||r ||d<||d<|r ||d<||d<t/|}|rd||d<|rt3|t4t6frag}|D]A}|d t;|dDB|rd||d!<n(t;|} | r| |d!<|r||d"<| r| |d#<| rd$|d%<| rd$|d&<| t;| |d'<|rd(|d)<n|rd*|d)<|rd$|d+<| d,d-}!tCd.|!Ds$|!"d/tGd0|!|d,<|$d1d|r||d1<tK||\}"}#d}$ tMj'|"t;|#|2}$n#tP$rd3}$YnwxYw|$d4vrtS|| tj*|n#tV$rYnwxYw|r ||n[#t $rYnOwxYwnJ# tj*|n#tV$rYnwxYw|r ||w#t $rYwwxYwwxYw|$d5kr?dd6l,m-}%t%t%d7t%|%d8gd9t'j|$dS):z%Replace current process with the TUI.rrNbuild_subprocess_envFT scrub_secretsinherit_profile_homeapply_terminal_config_to_envr]z5Failed to apply terminal config bridge for TUI launchexc_infozhermes-tui-active-session-r)rbrHERMES_TUI_ACTIVE_SESSION_FILENODE_ENV development production)_cleanup_worktree_git_repo_root_prune_stale_worktrees_setup_worktreeu#✗ Failed to create TUI worktree: r2r rgra TERMINAL_CWD HERMES_MODELHERMES_INFERENCE_MODELHERMES_TUI_PROVIDERHERMES_INFERENCE_PROVIDERrIHERMES_TUI_TOOLSETSc3fK|],}||V-dSr>rFrGs rr;z_launch_tui..- sK!!%)TZZ\\!JJLL!!!!!!rAHERMES_TUI_SKILLSHERMES_TUI_QUERYHERMES_TUI_IMAGErHERMES_TUI_CHECKPOINTSHERMES_TUI_PASS_SESSION_IDHERMES_TUI_MAX_TURNSrmHERMES_TUI_TOOL_PROGRESSoffHERMES_ACCEPT_HOOKS NODE_OPTIONSrc3@K|]}|dVdS)--max-old-space-size=Nr8)r:ts rr;z_launch_tui..U s/FFq||344FFFFFFrArrlHERMES_TUI_RESUMEr r]r1>rr1*)relaunchu⚕ Launching update...r)preserve_inherited).rtempfiletools.environments.localrvrr{rloggerdebugmkstemprrh setdefaultrXrrrrr8r r rrkrOrhrrrrrqrrrrfrrr[poprBrZcallr5runlinkrhermes_cli.relaunchr)&rlrr*r+r,rrmrrrnrorprqrrrsr rrvr]r{active_session_fdrwt_inforrrrrepor; tui_toolsets flattenedrKrt_tokensr}r r7rs& r _launch_tuirs|$X%GOOO>=====  U N N NC]BBBBBB$$----- ]]] LW[ \\\\\]-5-=-=+G.>..**H ,?C()NN:I}}\JJJG.             ">##D -&&t,,,%o''GG    ===CJ O O O OGGGGGG   HQKKK#FOL%foN# .#N(- $%4%- !"+3 '(*844L<%(XXl%;%; !" 1 ftUm , , 1I    !!-0YY__S-A-A!!! ?+.88I+>+>'(KK%%''E 1+0'( ("'  ("' ,(+ $%0,/ ()&))nn "#0*3 &'' 0*/ &')%( !"ggnb))//11G FFgFFF F FIG/C/E/EGGHHH((7++CGG &&&5#4  w00ID#D ?4SXX3???DD    DDD  8   #$57J K K K  I) * * * *    D    !!'****        I) * * * *    D    !!'****      rzz000000  '((( (6666HTNNNNNs6&AA4-C"" D, DD3$MO M'$O&M''O?N N! N!' N33 O?OP OP  O(%P 'O((P . O:9P : PP PP ctjdrdS ddlm}|tjd<dS#t $rYdSwxYw)uMPin the active kanban board into ``HERMES_KANBAN_BOARD`` for the chat session. Without this, in-process tools (``kanban_*``) and shelled-out CLI calls (``hermes kanban …``) resolve the board on different paths: the env-pin if set, otherwise the global ``/kanban/current`` file. A concurrent ``hermes kanban boards switch`` from another session can flip the file mid-turn, so the same chat sees its tool calls hit board A while its shell calls hit board B (#20074). Pinning at chat boot mirrors what the dispatcher already does for spawned workers. HERMES_KANBAN_BOARDNrget_current_board)rrerfhermes_cli.kanban_dbrrrs r_pin_kanban_board_envr su z~~+,, ::::::,=,=,?,? ()))      sA AAcN ddlm}|ddS#t$rYdSwxYw)u+Seed ``~/.hermes/skills/`` with the bundled skill library on first launch. Called from any CLI entrypoint that the user might use as their first interaction with Hermes — chat, dashboard (the desktop GUI's backend), and gateway. The skills_sync module is manifest-based and idempotent: skipped skills cost ~milliseconds, so calling this repeatedly is fine. Failures are swallowed because skills are an enhancement, not a hard dependency. Hermes still functions without them; the user just sees an empty skills library. rrTrN)rrrrs r_sync_bundled_skills_quietlyr sT 111111 $      s  $$cPt|ddrdSt|ddrdS tjrtjsdSn#t $rYdSwxYwt jddkrdS ddl m }|d ipid d}t|to)| dkS#t $rYdSwxYw) uDecide whether to launch the TUI for a chat/bare invocation. Precedence (highest first): 1. ``--cli`` flag → always classic REPL 2. ``--tui`` flag → always TUI (explicit ask) 3. no TTY → always classic (ambient prefs don't apply) 4. ``HERMES_TUI=1`` env → TUI 5. ``display.interface`` config value ("cli" | "tui") 6. default → classic REPL Explicit flags always win over config so muscle memory and scripts keep working regardless of the configured default. The TTY gate (3) is load-bearing: ambient TUI preferences (env var or config default) must never hijack a NON-interactive invocation. Kanban workers, cron jobs, and pipelines run ``hermes … chat -q`` with stdout on a pipe; booting the Ink TUI there hits its no-TTY bail-out, which prints a resume hint and exits 0 — a kanban worker then dies with "exited cleanly without calling kanban_complete — protocol violation" on every attempt (found dogfooding the desktop kanban board). A user who *explicitly* passes ``--tui`` still gets the informative bail-out. rXFrdTrrrrrbrc)rnr rrr rrrerfrrrrqrrrs)argsrr{s r_resolve_use_tuir sG.tUE""utUE""t   "" sz'8'8':': 5  uu z~~l##s**t111111""9b117R<<[%PP%%%H%++--*=*=*?*?5*HH uus$dt|d?dt|d@dt|dAdBddCl2m3}id6|j4d7t|d7ddDt|dDdd8|j5d9t|d9dd:t|d:dd;t|d;dd<|j6d=t|d=ddt|dddt|ddd>t|d>dd?t|d?dd@t|d@dd1t|d1dpt|dEdd/t|d/dpt|dEddFt|dFd}dG|7D} |dIi|dS#tp$r1}tdH|tj dYd}~dSd}~wwxYw)JzRun interactive chat CLI. continue_lastNresumezNo session found matching ''.z5Use 'hermes sessions list' to see available sessions.r rdrXrTUICLIz No previous z session found to continue.no_restore_cwdFrorrbr ru$⚠ session's recorded dir is gone (z); staying in u↪ restored workspace dir: )MIGRATION_GUIDE_URLRETIREMENT_DATEfind_retired_xai_refs format_issueru⚠ xAI retires z model(s) in your config on z: u ⚠ rz Migration guide: z z, Run 'hermes doctor' for details. zLIt looks like Hermes isn't configured yet -- no API keys or providers found.z Run: hermes setup)is_interactive_stdin#print_noninteractive_setup_guidancez;No interactive TTY detected for the first-run setup prompt.zRun setup now? [Y/n] n>rr?rz4You can run 'hermes setup' at any time to configure.)prefetch_update_checkyolorHERMES_YOLO_MODEignore_user_configHERMES_IGNORE_USER_CONFIG ignore_rulesHERMES_IGNORE_RULESrHERMES_SESSION_SOURCErr*r+r,rrmrrrnrprqrrrs)rr*r+r,rrmrrrnrorprqrrrsmain reasoning safe_modecompactci|] \}}||| Sr>r@rs rrzcmd_chat.. s ? ? ?tq!arAr r@)9r_apply_safe_modernrrqrrr8r rrkrfrcrrfrrrrgisdirr^realpathchdirrhermes_cli.xai_retirementrrrrrrr rrrhermes_cli.setuprrrOrsrPr5 cmd_setuprhermes_cli.bannerrrrerrrrXrr*r,rrr)ruse_tui continue_valrrlast_idkind resume_valrc _saved_cwdrrrr_load_config_for_xai_check_retired_xai_refs_refrrreplyrcli_mainkwargses rcmd_chatr s t$$GT4$77LGD(D99 lC ( ( 5lCCH & DLDDDEEEMNNN &0UU5F+6:::G >v/u=== % '2uuUFTFFFGGG x..J#1*==  #"DK h%%.66j%00  . . . . . .$9;;224;??E2JJ5QQWUW^^``J C"'-- ";"; CdZddWYW`WbWbddeeee C 0 0 < <@P@PQSQZQ\Q\@]@] ] ]$$$AZAABBB    D              POOOOO112L2L2N2NOO  U J  A3/@+A+AAA%4AAA   * Q Q   !Od9K9K!O!O!OPPPP J  X:MXXX Y Y Y J  S T T T       ( ) )  Z     $%%%         $#%%  / /M    HQKKK 12288::@@BBEE+,   EEE  $ $ $ dOOO F  DEEE  ,--  ? ? ? ? ? ? ! ! # # # #    D  (****      tVU##-), %&t)511625 ./ t^U++0,/ ()tXt$$:.2k *+  D(D ) )D)U33$..T:t44T:t444400D)T22$//$..$..T:u55mU;;#D*;UCCdK66 ~u==    &%$$$$$GD*d33 WT;55 DM  '$$//  74D11  w..  w-- '$$// GD*e44 wt]E:: 74):EBB WT;55 ne<<ak[`@a@a gd,@%HHmGTXZeglLmLm!" 74E22#F(@ ?v||~~ ? ? ?F6  mmm  st/DJ JJC M!! M.-M.:3P..QQR-- R:9R:>S SS_ `"&``cDtddlm}||dS)zGateway management commands.r)gateway_commandN)rhermes_cli.gatewayr)rrs r cmd_gatewayr s6 """222222ODrAcddlm}||}t|tr|dkrt |dSdS)z1Local OpenAI-compatible proxy to OAuth providers.r) cmd_proxyN)hermes_cli.proxy.clirrrr6)r _cmd_proxyrs rrr sY=<<<<< D  B"crQwwnnwwrAc ftdddlm}m}ddlm}m}ttdtd|dpd}|sttd ttd td td ttd tdtdt td }n'#ttf$rtdYdSwxYw|dkr|ddd}tdttdtdtdtdtdtdtdtdtdtdtdtd n<|dd!d!}td"n|}|dkrd#nd$}td%|t|d&pd d'krtd(|d)pd} | rtd*|  td+ } n#ttf$rd,} YnwxYw| d-vr}|dkr"td. } n!td/ } | r2|d)| d0dtd1| nt|dkr1td2td3 } n!td/ } | r3|d)| d0dtd4| ntd5dd6lm} | } | d7z }|std8|dS| d9z s"td:|d;}|std<dS t#j|d=d>d?d@gt'| t"jt"jdAdBdC|D}n #t$rtdEYdSwxYw|jdkrn|jpd }|r/dF|dGdndH}tdIt|dStdJntdKt5dz dLz }|dAdAM|dNz rtdO tdP } n#ttf$rd,} YnwxYw| d-vr=t9j|dAQ|dAdAMtdRnO|d&pd d'kr |d&d'tdStdTdSttdU|dkrtdVtdWntdXttdYtdUt t#j|dZpdZt'|d[d\t'|gt'| |]n#t$rYnwxYwt|dNz r|d&d'td^t|dkrZtd_td`tdatdbttdcnhtd_td`tddtdettdctdfttdgdStdhdS)izESet up WhatsApp: choose mode, configure, install bridge, pair via QR.whatsappr) get_env_valuesave_env_valuerr(u⚕ WhatsApp Setupz2================================================== WHATSAPP_MODErz&How will you use WhatsApp with Hermes?z& 1. Separate bot number (recommended)uF People message the bot's number directly — cleanest experience.zH Requires a second phone number with WhatsApp installed on a device.z 2. Personal number (self-chat)z/ You message yourself to talk to the agent.z3 Quick to set up, but the UX is less intuitive.z Choose [1/2]: z Setup cancelled.Nrbotu ✓ Mode: separate bot numberu ┌─────────────────────────────────────────────────┐u9 │ Getting a second number for the bot: │u9 │ │u9 │ Easiest: Install WhatsApp Business (free app) │u9 │ on your phone with a second number: │u; │ • Dual-SIM: use your 2nd SIM slot │u< │ • Google Voice: free US number (voice.google) │u; │ • Prepaid SIM: $3-10, verify once │u9 │ WhatsApp Business runs alongside your personal │u; │ WhatsApp — no second phone needed. │u └─────────────────────────────────────────────────┘z self-chatu' ✓ Mode: personal number (self-chat)zseparate bot numberzpersonal number (self-chat)u ✓ Mode: WHATSAPP_ENABLEDru✓ WhatsApp is already enabledWHATSAPP_ALLOWED_USERSu✓ Allowed users: z Update allowed users? [y/N] r>r?rz< Phone numbers that can message the bot (comma-separated): z( Your phone number (e.g. 15551234567): rlu ✓ Updated to: z+ Who should be allowed to message the bot?z4 Phone numbers (comma-separated, or * for anyone): u ✓ Allowed users set: uF ⚠ No allowlist — the agent will respond to ALL incoming messages)resolve_whatsapp_bridge_dirz bridge.jsu ✗ Bridge script not found at ruM → Installing WhatsApp bridge dependencies (this can take a few minutes)...ru5 ✗ npm not found on PATH — install Node.js firstr r#r$r%Tr]rgr*u ✗ Install cancelledrr1z (no output)u ✗ npm install failed:u ✓ Dependencies installedu)✓ Bridge dependencies already installedrrz creds.jsonu#✓ Existing WhatsApp session foundz8 Re-pair? This will clear the existing session. [y/N]  ignore_errorsu ✓ Session clearedu' ✓ WhatsApp is configured and paired!z( Start the gateway with: hermes gatewayu──────────────────────────────────────────────────u0📱 Open WhatsApp (or WhatsApp Business) on thez* phone with the BOT's number, then scan:u,📱 Open WhatsApp on your phone, then scan:u0 Settings → Linked Devices → Link a Devicerz --pair-onlyz --sessionru!✓ WhatsApp paired successfully!z Next steps:z) 1. Start the gateway: hermes gatewayz2 2. Send a message to the bot's WhatsApp numberz) 3. The agent will reply automaticallyu; Tip: Agent responses are prefixed with '⚕ Hermes Agent'u) 2. Open WhatsApp → Message Yourselfu. 3. Type a message — the agent will replyz4 so you can tell them apart from your own messages.z1 Or install as a service: hermes gateway installuG⚠ Pairing may not have completed. Run 'hermes whatsapp' to try again.)rrrrrrr(r8rOrrrPr5rsrg!gateway.platforms.whatsapp_commonrrjrZr[rqDEVNULLr+r\r rhrmr(rrrmtree)rrrrr( current_modechoicewa_mode mode_label current_usersresponsephoner bridge_dir bridge_scriptrr_errr session_dirs r cmd_whatsappr s{ ????????LLLLLLLL GGG  (OOO!=117RL .+  6777  6777 VWWW V     0111 ?@@@ CDDD  -..4466FF+,    & ' ' ' FF  S== N?E 2 2 2G 3 4 4 4 GGG p q q q M N N N M N N N M N N N M N N N O P P P P Q Q Q O P P P M N N N M N N N O P P P p q q q q N?K 8 8 8!G ; < < < <%,%5%5 ! !;X  )Z))*** GGG ())/R6688FBB /000"M":;;ArM\ 3M33444 ?@@FFHHHH+,   HHH  >>  | + +%R%''HIIOOQQ 47sB9O9OPPP2522333  e   ? @ @ @Fegg EDEEKKMME  \ N3U]]35K5K L L L 5e55 6 6 6 6 Z [ [ [NMMMMM,,..J,M    ! ! A-AABBB  ' / / 1 1; \   #"5))  I J J J F ^ilQdii 0 0 6777MG - . . . 'NNN F ,---- 9:::"##j09>  | + + M+T : : : :   dT  : : : ) * * * *  0117R>>@@FJJ16::: < = = = < = = = F GGG *% @AAA :;;;; <=== GGG <=== * GGG  $$V,,6M""K   J%%''        GGGl"**,,Y )6222 1222  e   / " " " = > > > F G G G = > > > GGG O P P P P / " " " = > > > = > > > B C C C GGG O P P P H I I I  ABBBBB WXXXXXs\>!D EE !K--LLA TT/.T/!X>>YYA_ _)(_)c@tdddlm}|S)u"Set up WhatsApp Business Cloud API (official Meta integration). Walks the user through the Meta-side credentials (Phone Number ID, Access Token, App Secret, optional App/WABA IDs) plus webhook configuration. Includes field-shape validators that catch the most common setup mistakes (e.g. pasting a phone number into the Phone Number ID field). Distinct from ``hermes whatsapp`` (the Baileys bridge wizard) — the two adapters are complementary, not alternatives. See ``hermes_cli/setup_whatsapp_cloud.py``. whatsapp-cloudr)run_whatsapp_cloud_setup)rhermes_cli.setup_whatsapp_cloudr)rrs rcmd_whatsapp_cloudr s4!"""HHHHHH # # % %%rAc(ddlm}||dS)zInteractive setup wizard.r)run_setup_wizardN)rr)rrs rrr s+111111TrActdt|ddr1 ddlm}|t dn#t $rYnwxYwt |dS) uKSelect default model — starts with provider selection, then model picker.r*r#Fr)clear_provider_models_cachez Cleared model picker cache.rN)rrnhermes_cli.modelsrr8rselect_provider_and_model)rrs r cmd_modelr stY&&  E E E E E E ' ' ) ) ) 1 2 2 2 2    D 4((((((sA AArcf ddlm}||}|duo |jdkS#t$rYdSwxYw)a6Return True when provider_id maps to a profile with auth_type='api_key'. Used as a catch-all in select_provider_and_model() so that new providers declared in plugins/model-providers// automatically dispatch to _model_flow_api_key_provider without requiring an explicit elif branch here. r)get_provider_profileNrF) providersr rr)rr _ps r_is_profile_api_key_providerr# sa222222 ! !+ . .~;",)";; uus " 00c49:;<=>?@ABddlm}m}m}ddlm@m}m}ddlm =m >m }|}| d}t|tr| dd}|pd}d } | dAtAtrA d } | ptjd pd ?@|} d tt"tt"t"fff>@fd } dt"d t"fd<| |:dt"d t"f:=fd } d t"f:gf| !d?d@gf| !dAdBgftMdC| D|!D}1|1| |1ddAkrt)dEd S| |1d}2| |1dF}3|3rd}4||3vr|3'|}4BfdG|3D}5| |1d4(d/d4d}6tM|5|4dH|6dIJ}7|7t)dEd S|3|7}8n|2}8|8d?krtSd S|8dkrtU||n|8dKkrtW||n|8dLkrtY||n|8dMkrt[|||Nn|8dOkrt]||n|8dPkrt_|||Nn|8dQkrta||n|8dRkrtc|||Nnn|8dSkrte||nV|8dTkrtg||n>|8dkrti|n'|85dUs|8:vrJ| | |8}*|*t)dVd Stm||*n|8d=krto|n|8dWkrtq||n|8dXkrts||n|8dYkrtu||ni|8dZkrtw||nR|8d[krty||n;|8d\krt{||n$|8d]vst}|8rt||8||8d^vr%|85dUstd Sd Sd S)_aCore provider selection + model picking logic. Shared by ``cmd_model`` (``hermes model``) and the setup wizard (``setup_model_provider`` in setup.py). Handles the full flow: provider picker, credential prompting, model selection, and config persistence. r)resolve_provider AuthErrorformat_auth_error)get_compatible_custom_providersrr)custom_provider_aliasescustom_provider_slugresolve_provider_fullr*rrz (not set)Nr+rautorcddlm}ii|}dtdtdtdtdtddf fd }|d }t |t r|D]}t |t s||dd d |dd p|d d |dd |dd p+|d d p|dd |d}t |t r|D]\}}t |t s||dd p|||dd p|d d |dd |dd p+|d d p|dd dt ttfdtdtdtdtf d}i} |D]n} t | t s| dpd } | dpd } | r| sp| dpd } | | }| | | dd | dd | dd | di| dd| dd | || | | dd || | | dd d | |<p| S)Nrr,r provider_keyr*rrrct|pd}t|pd}t|pd}t|pd}t|pd}g}|r>||f||ff|r>||f||ffd|vr|D]} ||d|vr|D]} ||dSdS)Nr${)rqrrrrsr) rr.r*rrtemplate base_template identitiesidentityraw_api_key_refsraw_base_url_refss r _record_rawzRselect_provider_and_model.._named_custom_provider_map.._record_raw s7=b))//11HB//5577Mtzr??((**D|1r2288::L $$**,,E J L!!DJJLL?TZZ\\54I"JKKK !!"((**,|/A/A/C/CU.KLx *DDH$//(CCCC}$$ *JJH%00=IIII%$JJrAcustom_providersr default_modelurlapir!refscjt|pd}t|pd}t|pd}||f|f||f|ffD]}|dr||vr ||cSdS)Nrrrqrrrs)r<rr.r*name_lcpkey_lcr4s r _lookup_refzRselect_provider_and_model.._named_custom_provider_map.._lookup_refW s $*"oo++--3355G,,"--3355;;==G $$**,,E%  %   * * A;*8t#3#3>)))2rAkey_envmodelsdiscover_modelsTapi_mode) rrrrBr*rCrDrEr. api_key_ref base_url_ref) rr-rqrfrrrprrrr)rr-raw_cfgr7raw_list raw_entry raw_providersraw_keyrAcustom_provider_maprrrr.r}r5r6r*r(s @@r_named_custom_provider_mapz=select_provider_and_model.._named_custom_provider_map sj555555.0.0!/## J J J J  J   J   J J J J J J J<;;122 h % % %   !)T22 MM&"--MM'2..T)--QS2T2TMM)R00MM*b110 }}UB//0 }}UB// K00 mT * * &3&9&9&;&;  "!)T22 MM&"--8MM'2..T)--QS2T2TMM)R00MM*b110 }}UB//0 }}UB// ucz"           &!44S99  EeT** IIf%%+2244D *--3::<#E#E!IIj"55 ,*{$dL%))GR:P:P  !, %t\599Wb;Q;Q!!((  $ $"#"rAr:ct|pddS)Nrr)rqrrrstriprs)r:s r_norm_base_urlz1select_provider_and_model.._norm_base_url s839"~~##%%,,S1177999rArc t|pd}D]?\}}||dd|ddvr|cS@|S)Nrrr.)rqrrrsrrf)r requestedr} provider_info_custom_provider_mapr)s r_canonical_named_custom_keyz>select_provider_and_model.._canonical_named_custom_key s )r**002288:: "6"<"<">">   C33!!&"--!!."55  rAc dksttsdSdd}|sdSD],\}}|dd|kr|cS-dS)Ncustomrr)rrprfr) current_baser}rTrUrQeffective_providerrs r _active_custom_key_from_base_urlzCselect_provider_and_model.._active_custom_key_from_base_url s  ) )It1L1L )2%~immJ&C&CDD  2"6"<"<">">   C~m// B??@@LPP QrrAr!z user-configzUnknown provider 'zb'. Check 'hermes model' for available providers, or run 'hermes doctor' to diagnose config issues.z Warning: z) Falling back to auto provider detection. openrouterrrX)CANONICAL_PROVIDERS_PROVIDER_LABELS_PROVIDER_ALIASESgroup_providersprovider_group_for_slugrnonez Current model: z Active provider: c(i|]}|j|jSr@)slugtui_descr:r7s rrz-select_provider_and_model.. sGGGaqvqzGGGrAcxh|]7}|t|8Sr@r>rfs r z,select_provider_and_model.. sH  A rA model_catalogexcluded_providerscg|]?}|j|jhz8|j@Sr@)rfrdrs)r:r7 _cli_excluded _names_fors rrz-select_provider_and_model.. sS   >>!&16<<>>*:;;mK F   rAcg|] }|j Sr@rdrfs rrz-select_provider_and_model.. s>>>Q!&>>>rArgroupgroup_id descriptionrQu ▸ (ru ▸zgroup:membersrdu ← currently activer rhttps://http://r —  (z$Custom endpoint (enter URL manually)r8 remove-customzRemove a saved custom providerz aux-configzConfigure auxiliary models...cancelzLeave unchangedcg|]\}}}| Sr@r@r:r~rQs rrz-select_provider_and_model..- s***;1eQ***rAr No change.rc<g|]}||Sr@rf)r:mprovider_labelss rrz-select_provider_and_model..> s6   *+O  1 % %   rAzSelect z provider:rrmoaz ai-gatewaynousr openai-codex xai-oauth qwen-oauthz minimax-oauth copilot-acpcopilotzcustom:zyWarning: the selected saved custom provider is no longer available. It may have been removed from config.yaml. No change. anthropic kimi-codingstepfunbedrockvertex azure-foundry> openai-apitencent-tokenhubgmixaizaiarceegemininvidiaxiaomialibabaminimaxdeepseekkilocodelmstudio huggingface minimax-cn opencode-go ollama-cloud opencode-zenkimi-coding-cn>ryrXrx)Arr%r&r'rr(rrhermes_cli.providersr)r*r+rfrrprrrqrrr8rr]r^r_r`rardrsrrrrrrrgrPr_prompt_provider_choicerr_aux_config_menurIr[r\rJrKrLrMrNrSrRrOrrQ_remove_custom_providerrZrTrUrWrXrPr#rY_clear_stale_openai_base_url)Crr%r&r'rrr+config current_modelconfig_providercompatible_custom_providersrNrVr[r active_defwarningr;r]r^r_r`ra active_labelcanonical_descs_alias_to_canonr"_alias_canon_visible_slugs grouped_rows active_groupordered default_idxrAgid group_descrQr} is_activersrdrTrr short_url saved_model model_hint_has_saved_custom_list provider_idx selected_keyselected_membersmember_default member_labels group_label member_idxselected_providerrlrUrmrQr)r*rZr(rrsC @@@@@@@@@@rrr s    []]FJJw''M-&&9%)))R88 !0[MO 7##I)T""4#-- 33 K29%@AAKV#B"A&"I"Ix#4T#s(^0C+Dx#x#x#x#x#x#x#t:C:C::::65 c         . - / /F ~ R(F22**  JJ{ # # '   !]F M1144V<<%7  PgPPP Q Q Q  %%f--FF   !V++++C00T'TTTUUUFFFFFF  --0A"B"B+,,O Q&000+F3F; >DP**66:::&  GGG 0 0 0111 / / /000 GGGHG3FGGGO **_b117R<<=QRRXVXM  ?+*, % 4 4B#%7==??"3Jrw  -3355 P PNFF  ! !&6<<>>*: ; ; ? ?  O O O O     /    ?>*=>>>"?>22L7=D**6222"L 13GK22 v;' ! !j/C33J NNN ! **955  %&&&&& s G H&G==Hcddlm}m}m}|}|di}t |t r<|dpd}nd}|dks|sdS|d}|rB|ddtt|d krd |dd d nd |d dSdS) aQRemove OPENAI_BASE_URL from ~/.hermes/.env if the active provider is not 'custom'. After a provider switch, a leftover OPENAI_BASE_URL causes auxiliary clients (compression, vision, delegation) with provider:auto to route requests to the old custom endpoint instead of the newly selected provider. See issue #5161. r)rrrr*r+rrXNrrz.Cleared stale OPENAI_BASE_URL from .env (was: z...)r) rrrrrfrrprrrsr8r)rrrrrr+ stale_urls rrr s)MLLLLLLLLL +--C$$I)T""MM*--3::<<BBDD88 /00I ("--- 9~~"" RYss^ Q Q Q QN)NNN       rA) )visionVisionzimage/screenshot analysis) compression Compressionzcontext summarization) web_extractz Web extractzweb page summarization)approvalApprovalzsmart command approval)rMCPzMCP tool reasoning)title_generationzTitle generationzsession titles)memory_query_rewritezMemory query rewritezmemory retrieval queries)tts_audio_tagszTTS audio tagszGemini TTS tag insertion) skills_hubz Skills hubzskills search/install)triage_specifierzTriage specifierzkanban spec fleshing)kanban_decomposerzKanban decomposerztask decomposition)profile_describerzProfile describerzauto profile descriptions)curatorCuratorzskill-usage review pass _AUX_TASKSctt} ddlm}|D],}||d|d|df-n#t $rYnwxYw|S)aReturn built-in + plugin-registered auxiliary tasks for picker/menu use. Built-in tasks come first (preserving order), followed by plugin tasks sorted by key. Used by ``_aux_config_menu``, ``_reset_aux_to_auto``, and display-name lookups so plugin-registered tasks (registered via :meth:`hermes_cli.plugins.PluginContext.register_auxiliary_task`) appear in the same surfaces as built-in ones without core knowing about them. r)get_plugin_auxiliary_tasksr} display_namerr)rrhermes_cli.pluginsrrr)tasksrrs r_all_aux_tasksr s   E AAAAAA//11 V VE LL%,n(=u]?ST U U U U V       Ls=A A! A!task_cfgcPt|tsdSt|dpd}t|dpdpd}t|dpd}|rM|ddddd}d |d |rd |ndzS|dkr d|rd |ndzS|r|d |S|S) z;Render the current aux config for display in the task menu.r,rrr+r*rtrurzcustom (r · )rrprqrfrrrgrP)rrr+r*shorts r_format_aux_currentr sC h % %v8<< ++1r2288::H8<< ++5v66<<>>H&H  W%%+ , , 2 2 4 4EG  R0088BGGNNsSS"%"""&EnUnnn2FF658b99 (''''' OrAr*rrtaskrrc<ddlm}m}|}|di}t |t si}||d<||i} t | t si} | ||<|| d<|pd| d<|pd| d<|pd| d<||d S) uPersist an auxiliary task's provider/model to config.yaml. Only writes the four routing fields — timeout, download_timeout, and any other task-specific settings are preserved untouched. The main model config (``model.default``/``model.provider``) is never modified. rr save_config auxiliaryr+rr*rrN)rrrrrrp) rr+r*rrrrrauxrs r_save_aux_choicer s;::::::: +--C ..b ) )C c4 K NN4 $ $E eT " "D  E*[bE'N BE*}"E)KrAcddlm}m}|}|di}t |t si}||d<d}t D]\}}}||i}t |t si}|||<d} |ddvrd|d<d} d D]} || rd || <d} | r|d z }|||S) zReset every known aux task back to auto/empty. Returns number reset. Includes plugin-registered tasks (via ``_all_aux_tasks``) so a plugin that contributed an auxiliary task gets reset alongside built-ins. rrrFr+>Nrr,r,Trrr )rrrrrrprrf) rrrrcountr_name_descrchangedfields r_reset_aux_to_autor*s4 ;::::::: +--C ..b ) )C c4 K E,..eUtR((%&& ECI 99Z (: : : &E* G5  Eyy !e    QJEK LrAcddlm} |}t|dtr|dini}t t dt t dt dt dt d t d t t }td |Dd z}td |Ddz}g}|D]\}}} t||tr||ini} t| } | |d| zdz || } | || f| d| dtd|Dd} | dS|| d}|dkrdS|dkrCt}|rt d|dnt dt bt|r)uTop-level auxiliary-model picker — choose a task to configure. Loops until the user picks "Back" so multiple tasks can be configured without returning to the main provider menu. rrTru( Auxiliary models — side-task routingz@ Side tasks (vision, compression, web extraction, etc.) defaultu@ to your main chat model. "auto" means "use my main model" —z> Hermes only falls back to a lightweight backend (OpenRouter,z< Nous Portal) if the main model is unavailable. Override az@ task below if you want it pinned to a specific provider/model.c3<K|]\}}}t|VdSr>r)r:r~rs rr;z#_aux_config_menu..ds.==ZQas4yy======rArc3<K|]\}}}t|VdSr>r)r:r~descs rr;z#_aux_config_menu..es.==ZQ4s4yy======rAr(r) __reset__zReset all to auto)__back__Backcg|]\}}|Sr@r@r{s rrz$_aux_config_menu..ts + + +xq%U + + +rAr|NrrzReset z auxiliary task(s) to auto.z-All auxiliary tasks were already set to auto.)rrrrfrpr8rrrljustrrr_aux_select_for_task)rrr all_tasksname_coldesc_colentriestask_keyrrrcurrentrQrSr}rs rrrLs .-----1"kmm*4SWW[5I5I4*P*PXcggk2&&&VX  8999  PQQQ PQQQ NOOO LMMM PQQQ #$$ ==9=====A==9=====A)+$- . . HdD)3CGGH4E4Et)L)LT"%%%RT *(33G::h''V#*s*:)A)A()K)KVWVV  NNHe, - - - -9:::+,,,% + +7 + + +    ; Fcl1o *   F +  "$$A G=q===>>>>EFFF GGG S!!!c1"rAcddlm}ddlm}m}|}t |dtr|dini}t |tr|ini}t|dpd pd}t|dpd }t|d pd } tfd tD} |||| } n+#t$r} td | g} Yd } ~ nd } ~ wwxYwg} |dkr| sdnd}| dd|gf| || || | rdnd}| dd|gf| ddgfttd| dt!|tt#d| Dd}|d S| |\}}}|dkrd S|dkr(t%ddddt| dd S|dkrt'|d St)|||d S)u'Pick a provider + model for a single auxiliary task and persist it. Provider rows come from ``build_aux_picker_rows()`` — the shared aux-picker substrate — so this surface shows exactly what every other aux picker shows: authenticated built-ins, the user's own ``providers:`` / ``custom_providers:`` endpoints, and providers whose credential pool is temporarily exhausted. Only already-configured providers appear; users set up new ones through the normal ``hermes model`` flow, then route aux tasks to them here. rr)build_aux_picker_rowsformat_aux_picker_entriesrr+r,r*rrc30K|]\}}}|k |VdSr>r@r:r}rr~rs rr;z'_aux_select_for_task..-RR,#tQcTkkkkkkRRrA)current_providerrcurrent_base_urlz*Could not detect authenticated providers: Nu ← current__auto__zauto (recommended))rr __custom__zCustom endpoint (direct URL)rrz Configure u — current: cg|]\}}}| Sr@r@r{s rrz(_aux_select_for_task..s"D"D"D[Qq5"D"D"DrAr|r+r*rrz: reset to auto.)rrhermes_cli.inventoryr r rrfrprqrrnextrrr8rrrrr_aux_flow_custom_endpoint_aux_flow_provider_model)rrr r rrrrrrrr!r;r auto_marker custom_markerrSrd_labelrCs` rrrs.-----UUUUUUUU +--C&01E1Et&L&L T#''+r " " "RTC$.swwt}}d$C$CKswwtR   H8<< 33=v>>DDFFP& W--344::<N5TV NNJ B[ B BBGHHH NN!! --   (8?OORM NNL"P"P"PRTUVVV NNJ+,,, GGG T T T5H5R5R T TUUU GGG !"D"DG"D"D"Da P P PC {"3<D&& z zb2rRRRR ///000 |!$111T4?????s'E66 FFF provider_slugcurated_modelsrcddlm}ddlm}t fdt D}i} ||pi}n#t $ri}YnwxYwt|}|sptd|dtd td } n&#ttf$rtYd SwxYw| pd } n"||||| } | td d St|| pd d d | rt|d|d| d St|d|dd S)zHPrompt for a model under an already-authenticated provider, save to aux.r)_prompt_model_selection)get_pricing_for_providerc30K|]\}}}|k |VdSr>r@r s rr;z+_aux_flow_provider_model..r rAzNo curated model list for .z;Enter a model slug manually (blank = use provider default):zModel: Nr)rpricingconfirm_providerr}r: rz (provider default model))rrrrrrrrr8rOrrr5rPr) rrrrrrrr" model_listrselecteds ` rrrs877777::::::RRRR.2B2BRRRTXYYLG**=99?R n%%J  ;=;;;<<< KLLL  ""((**CC!8,    GGG FF 9"** '*       ,    F }HNRQSK >>>>H>>????? IIIIIJJJJJs# A AA !B//CCcddlm}tfdtD}t |dpd}t |dpd}ttd|tdt |rd |d nd }t|}n&#ttf$rtYd SwxYw|p|}|std d S |rd|d nd}t|} n&#ttf$rtYd SwxYw| p|} |d} n&#ttf$rtYd SwxYwtd| || | dd dd d} t|d| d| rd| ndzd S)zHPrompt for a direct OpenAI-compatible base_url + optional api_key/model.rmasked_secret_promptc30K|]\}}}|k |VdSr>r@r s rr;z,_aux_flow_custom_endpoint..r rArrr*z Custom endpoint for zH Provide an OpenAI-compatible base URL (e.g. http://localhost:11434/v1)z Base URL [rLz Base URL: NzNo URL provided. No change.zModel slug (optional) [zModel slug (optional): z0API key (optional, blank = use OPENAI_API_KEY): rXrrtrurz : custom (rr)hermes_cli.secret_promptr)rrrqrfrrr8rOr5rPrrgrP) rrr)rrr url_promptr: model_promptr*rrs ` rrr s======RRRR.2B2BRRRTXYYL8<< 339r::@@BB W--344::<  %''  x (    J++33IrBBII#NNI \ 1 1Y 1 1 1u5T^E^^^RT UVVVVVs6+DD)(D)+E00FFF99GGzSelect provider:rc  ddlm}||||}|dkrt|Sn#t$rYnwxYwt|t |dD]*\}}|dz |krdnd}td|d|d|+t t d t |d |dzd }|s|St|dz }d|cxkrt |krnn|Std t |n@#t$rtd Yn%ttf$rtYdSwxYw)zShow provider selection menu with curses arrow-key navigation. Falls back to a numbered list when curses is unavailable (e.g. piped stdin, non-TTY environments). Returns the selected index, or None if the user cancels. r)_curses_prompt_choicer u→rlrrKT Choice [1-z] (): Please enter 1-Please enter a numberN) rr/r8rr)rOrrrrrr5rP) choicesrrr/rSrcrrs rrrBs ::::::##E7G<< !88 GGGJ        %LLL'1%%&&1a%7** $6$$A$$$$%%%% GGG  FS\\FFgkFFFGGMMOOC c((Q,CC&&&&#g,,&&&&& 2CLL22 3 3 3 3 + + + ) * * * * *!8,    GGG44  s0(, 99;D#0D#D##E >E E zqwen3-coder-plusz qwen3-codercurrent_api_modec&ddlm}||}t|pd}|p|pd}gd}t t dt |dD]\}\}} } g} ||kr| d||kr| d| rd d | d nd} t d |d | | t d|  td} n%#ttf$rt dwxYw| s|pdS| dvrdS| dvrdS| dvrdS| dvrdSt d| ddS)zwPrompt for a custom provider API mode. Returns an explicit mode string, or None to keep auto-detect behavior. r)_detect_api_mode_for_urlr))rz Auto-detectzIUse Hermes URL heuristics; best for standard OpenAI-compatible endpoints.)chat_completionszChat Completionsz=Use /chat/completions for standard OpenAI-compatible servers.)codex_responseszResponses / Codexz:Use /responses for Codex-compatible tool-calling backends.)anthropic_messageszAnthropic Messagesz4Use /v1/messages for Anthropic-compatible endpoints.zSelect API compatibility mode:r detectedrz [z / ]rrKz z.Choice [1-4, Enter to keep current/detected]: z Cancelled.N> auto-detectrr,detect>2chat completionsr9r9>3codex responsesr:r:>4messagesrr;r;zInvalid API mode choice: z. Falling back to auto-detect.) hermes_cli.runtime_providerr8rqrrrsr8r)rrhrOr5rP)rr6r8 detected_modenormalized_current default_mode mode_optionsrSrtrQrrmarkersrrys r!_prompt_custom_api_mode_selectionrNws1 EDDDDD,,X66M-344::<<BBDD%<<"LL. GGG *+++,5lA,F,F%%( (eUK M ! ! NN: & & & L NN9 % % %07?,ejj)),,,,R )3))%)))*** #k##$$$$ <  %''%%''  x ( n  $#t# 444t >>>!! <<<   BBB## Ic I I IJJJ 4s 3D;;"Ecbddl}|ddddd}|jdd|}|dd}d|vsd |vrd |d }n1d |vrd |d }n|}|S)zGenerate a display name from a custom endpoint URL. Returns a human-friendly label like "Local (localhost:11434)" or "RunPod (xyz.runpod.io)". Used as the default when prompting the user for a display name during custom endpoint setup. rNrtrrurz/v1/?$ localhost 127.0.0.1zLocal (rrunpodzRunPod ()rrgrPsubrrs capitalize)rrcleanrs r_auto_provider_namerVsIII   Z , , 4 4Y C C J J3 O OE BF9b% ( (E ;;s  A DdkT11     TZZ\\ ! !!$!!!   KrAct|ddpd}|r|St|ddpd}|r=t|ddpdsd|dSt|pdS)zDReturn the value that should be persisted for a custom provider key.rFrrBrr0}rqrfrr)rTresolved_api_keyrFrBs r%_custom_provider_api_key_config_valuer[sm'' r::@bAAGGIIK-##Ir228b99??AAG!s=,,Y;;ArBBHHJJ! W    %2 & & , , . ..rAct|ddpd}|r|St|pdS)zDReturn the value that should be persisted for a custom provider URL.rGrrY)rTresolved_base_urlrGs r&_custom_provider_base_url_config_valuer^s^}((<<BCCIIKKL  &B ' ' - - / //rAc:ddlm}m}|} | dpg} t | t sg} | D]^} t | t rE| ddd|dkrd} |r | d|kr|| d<d } |r=|r;| d i} t | t si} d |i| |<| | d <d } |r!| d |kr|| d <d } nd | vr| d d d } |rK| d|ks| dr|| d<| dd d } | r| | d<|| d S`|st|}||d} |r|| d<n|r|| d<|r|| d<|r|| d <|r |r |d |ii| d <| | | | d<|| td|dd S)uSave a custom endpoint to custom_providers in config.yaml. Deduplicates by base_url — if the URL already exists, updates the model name, context_length, and api_mode but doesn't add a duplicate entry. Uses *name* when provided, otherwise auto-generates from the URL. When *key_env* is set the caller has already written the key to ``.env``, so the entry references it instead of inlining the secret (#69449). rrr8rrrFr*TrCcontext_lengthrENrBr)rru% 💾 Saved to custom providers as "z" (edit in config.yaml)) rrrrfrrrprPrrVrr8)rrr*r`rrErBrrrr!rr models_cfgs r_save_custom_providerrbs;::::::: +--C*++1rI i & &  eT " " uyyR'@'@'G'G ( ( __S ! !("("G 7++u44!&g  "YYx44 !*d33$!#J%5~$F 5!",h 99Z((H44(0E*%"Gu$$ *d+++ EIIi00G;;uyy?S?S;#*i  )T*** !*3&' C   FF -"8,,x 0 0E#"i #"i g%$j FF #3^"DEh U'CK O$ O O OPPPPPrAcddlm}m}|}|dpg}t |t r|st ddSt dg}|D]}t |tr|dd}|d d }|d d d d  d } | |d| d| t|| d ddl m } | dt |dd} t | dkrd} n#ttt t"jf$rt'|dD]\} } t d| d| t  t)dt+|d}|rt/|dz nd} n#t0t2t4f$rd} YnwxYwYnwxYw| | t+|krt ddS|| }||d<||t |tr|ddnt|}t d|ddS)z=Let the user remove a saved custom provider from config.yaml.rrr8zNo custom providers configured.NzRemove a custom provider: runnamedrrrtrurrwrCancelcurses_radiolistzSelect provider to remove:rr&cancel_returnsr rrKr0rLr}u ✅ Removed "z" from custom providers.)rrrrfrrr8rprgrPrrqhermes_cli.curses_uirgrMNotImplementedErrorrrZrr)rOrrrrrr5rPr)rrrrr!r4rrr:rrgrSrr5rremoved removed_names rrr3s.:::::::: +--C*++1rI i & &i /000 '(((G'' eT " " '99VY//D))J++C J33;;IrJJQQRUVVI NNd22i222 3 3 3 3 NN3u:: & & & & NN8999999 ( MM      77C ,gz7Q Rgq)) ! !DAq -q--A--   6S\\66677==??C"%/#c((Q,,4CC-x8   CCC  {cS^^++ lmmC  G'CK*4Wd*C*CU FI&&&W @, @ @ @AAAAAs8:8E33AH:AHH:H41H:3H44H:9H:_PROVIDER_MODELScz|tvrddlm}|t|<|St dt d|)zADefer the model-catalog import until something actually reads it.rrnzmodule z has no attribute )_LAZY_MODEL_EXPORTSrroglobalsrL__name__)rros r __getattr__rt|sR """666666* $ I8IIII J JJrAc|d}t|trHt|dpdSdS)Nagentreasoning_effortr)rfrrprqrrrs)r agent_cfgs r_current_reasoning_effortrysc 7##I)T""L9==!344:;;AACCIIKKK 2rAeffortcr|d}t|tsi}||d<||d<dS)Nrvrw)rfrrp)rrzrxs r_set_reasoning_effortr|sD 7##I i & &$ #w$*I !!!rAc  ttd|DdfdD}|fdD|sdSfd d}d}d krt |}n6|vr|}nd |vr|d }nd } d d lm} fd |D}|||||d||d}|d krdSt|t |kr||S|t |krd SdS#ttttjf$rYnwxYwtdt|dD]#\} } td| d | $t |} td| dzd|td| dzd|t t!d| dzd} | sdSt%| }d|cxkr| krnn ||dz S|| dzkrd S|| dzkrdStd| dzn2#t&$rtdYnt(t*f$rYdSwxYw)zOPrompt for a reasoning effort. Returns effort, 'none', or None to keep current.c3K|]X}t|#t|VYdSr>r>)r:rzs rr;z5_prompt_reasoning_effort_selection..sk  ,2VARARATAT KK     % % ' '      rA)minimallowmediumhighxhighrultracg|]}|v| Sr@r@)r:rzdedupeds rrz6_prompt_reasoning_effort_selection..s#III&v7H7Hv7H7H7HrAc3$K|] }|v|V dSr>r@)r:rzcanonical_orders rr;z5_prompt_reasoning_effort_selection..s-QQf63P3P63P3P3P3PQQrANc|kr|dS|S)Nu ← currently in user@)rzcurrent_efforts rrz2_prompt_reasoning_effort_selection.._labels" ^ # #444 4 rAzDisable reasoningzSkip (keep current)rbrrrfc&g|] }|Sr@r@)r:rzrs rrz6_prompt_reasoning_effort_selection..s!888f66&>>888rAzSelect reasoning effort:rrhr rrKrTr0z] (default: keep current): r2r3)rrpfromkeysrrrrjrgrr8rMrkrrZrr)rOrrrrr5rP)effortsrr disable_label skip_labelrrgr4rSrrzrrrrrs ` @@@r"_prompt_reasoning_effort_selectionrs   6=     G TOIIIIOIIIG NNQQQQQQQQQQ t (M&J'll 7 " "mmN33 W  mmH--   9999998888888}%%%z""" &       774  W  3<  #g,,  6t ,gz7Q R      $%%%w**** 6 (1((v(()))) G A 'q1u ' ' ' '((( $q1u $ $ $ $%%% GGG JAJJJKKQQSSF tf++CC}}}}1}}}}}sQw''a!e||va!e||t +AE++ , , , , + + + ) * * * * *!8,   44 sOAE(E?E"E;:E;*J<)J& J1 J<JK-KK existing_keyexisting_sourcecf ddlm ddlm}ddlm|jr |jdnd dtdtf fd }|shtd |j d  sd S|d }|stdd S| |tdt|dfSddl m } r | nd}td|j d|ddd| st|dfS| d} | rdnd} t| } n'#t"t$f$rtd} YnwxYw| dr\|d }|s!tdt|dfS| |tdt|dfS| dr(| s&| dtd|j d d St|dfS)!uShared API-key entry point for ``hermes setup`` / ``hermes model``. Handles both first-time entry and the already-configured case. When a key is already present, offers [K]eep / [R]eplace / [C]lear so the user can recover from a malformed paste without editing ``~/.hermes/.env`` by hand. Returns ``(resolved_key, abort)``. ``abort=True`` means the caller should ``return`` immediately — the user cancelled entry, declined to replace, or cleared the key and is now unconfigured. r)LMSTUDIO_NOAUTH_PLACEHOLDER)rr(rallow_lmstudio_defaultrcdkr |r dd}nd} |}n&#ttf$rtYdSwxYw|s dkr|rS|S)Nrz (Enter for no-auth default r1z (or Enter to cancel): r)rrr5rPr8)rr.enteredrrBr)rs r_prompt_new_keyz(_prompt_api_key.._prompt_new_keys * $ $)? $__=X___FF888F **62288::GG!8,    GGG22  /;*449O4. .s7AAzNo z API key configured.)rTT)rz Cancelled.zAPI key saved.F)format_secret_source_suffixrz API key: Nru... ✓zcredential_pool:z" [K]eep / [R]eplace (default K): z, [K]eep / [R]eplace / [C]lear (default K): rrQz No change.z API key updated.r5z7 API key cleared. Re-run `hermes setup` to configure z again.)rrrrr+r)rrrqr8rhermes_cli.env_loaderrrrOrrrsr5rP)rrrrrrnew_keyr source_suffix pool_backedmenurrrBr)s ` @@@r_prompt_api_keyrs# <;;;;;000000======-4-EMg&q))2G 4 C            6GL666777 8!/>>>  ,   8w(((  ~BAAAAAInfer the current StepFun region from the configured endpoint.rzapi.stepfun.comchina international)rrrs)rrNs r_infer_stepfun_regionrIs8.b''))//11JJ&&w ?rAregionc&ddlm}m}|dkr|n|S)Nr)STEPFUN_STEP_PLAN_CN_BASE_URLSTEPFUN_STEP_PLAN_INTL_BASE_URLr)rrr)rrrs r_stepfun_base_url_for_regionrQsG W   &% ,rAc ddlm}mmddlm}m dtf fd } ttdtdt|}|r*|rdS|| td dSttd tdd l m } |d  }n&#ttf$rtYdSwxYw|r|| tddStddS#t$r/ttdttdttdtdtdtdttdtdd l m } |d }n'#ttf$rtYYdSwxYw|r|| tdYdStdYdSwxYw)zNRun the Claude OAuth setup-token flow. Returns True if credentials were saved.r)run_oauth_setup_tokenrr)save_anthropic_oauth_token%use_anthropic_claude_code_credentialsrc }n#t$rd}YnwxYw|rk|s"t|dr>tdddlm}td|ddSd S) Nrsave_fnu% ✓ Claude Code credentials linked.rdisplay_hermes_homez] Hermes will use Claude's credential store directly instead of copying a setup-token into z/.env.TF)rrrfr8rr)r_dhh_fnrrrrs r._activate_claude_code_credentials_if_availablezQ_run_anthropic_oauth_flow.._activate_claude_code_credentials_if_availablers 0022EE   EEE    & &u - - 15eii6O6O1P1P  2 1. I I I I 9 : : : G G G G G G BpwpwpypyBBB   4us  u< Running 'claude setup-token' — follow the prompts below.z9 A browser window will open for you to authorize access.Tru ✓ OAuth credentials saved.z8 If the setup-token was displayed above, paste it here:r(z* Paste setup-token (or Enter to cancel): Fu ✓ Setup-token saved.u) ⚠ Could not detect saved credentials.z/ The 'claude' CLI is required for OAuth login.z To install and authenticate:zE 1. Install Claude Code: npm install -g @anthropic-ai/claude-codez/ 2. Run: claude setup-tokenz. 3. Follow the browser prompts to authorizez) 4. Re-run: hermes modelz8 Or paste an existing setup-token now (sk-ant-oat-...):z$ Setup-token (or Enter to cancel): u2 Cancelled — install Claude Code and try again.)rrrrrrrrr8r+r)rrr5rPr) rrrrtokenr) manual_tokenrrrs ` @@@r_run_anthropic_oauth_flowrfs[  D$<  LMMM IJJJ %%''  ==?? t & &un E E E E 2 3 3 34  HIII AAAAAA //<egg L"8,    GGG55    & &|^ L L L L , - - -4 9:::u   ?@@@  .///  UVVV ?@@@ >??? 9:::  HIII AAAAAA (()OPPVVXXEE!8,    GGG555    & &un E E E E , - - -44 BCCCuu5ssAD?:D?1D? C('D?(D D? D  !D?.D??CI9HI9I=I9I!I9&I98I9c(ddlm}||dS)z(Authenticate Hermes CLI with a provider.r) login_commandN)rr)rrs r cmd_loginrs*------M$rAc(ddlm}||dS)zClear provider authentication.r)logout_commandN)rr)rrs r cmd_logoutrs*......N4rAc(ddlm}||dS)zManage pooled credentials.r) auth_commandN)hermes_cli.auth_commandsr)rrs rcmd_authrs*555555LrAc(ddlm}||dS)zShow status of all components.r) show_statusN)hermes_cli.statusr)rrs r cmd_statusrs*------KrAc(ddlm}||dS)zCron job management.r) cron_commandN)hermes_cli.cronr)rrs rcmd_cronrs*,,,,,,LrAc^ ddl}t|dd}|dvrtdtjdS|dkrdd lm}t|d d}|} ||}n6#t$r)}td |tjYd}~dSd}~wwxYwtd |d tdtjdSt| dS|dkrdd lm}|j } | ||j }nj#|j $r)}td|tjYd}~dSd}~w|j$r,}td|d|tjYd}~dSd}~wwxYw|dr*td|d|ddntd|ddS|dvrkddlm}m} |j} | | s!td| dtjdS|| |dktd |dkrd!nd"d#| d dSdd lm}|d$kr|} t|| d%d&'| d(rt-| d)pg} | d*pg} td+| d,| d-d.tj| rBtd/t-| d0d1| d2tjn0| d3rtd4tj| d3std5tjn| d6std7tjna| d8std9tjn0| d:std;tjdS |}n6#|j $r)}td<|tjYd}~dSd}~wwxYw|d6std=tjdS|std>tjdS |d?kr||@}|}|rt-|dApg} tdB| dCtj|dDpg}|rBtdEt-|dFd1|dGtjnw|dHkr||dIJ}nY|dKkr3||@}||dLJ}||dM}n tdN|tjdSn6#|j$r)}tdO|tjYd}~dSd}~wwxYwt||d%d&'dS)PuHSkill Sync — personal sync across devices, plus sharing with your org.rN sync_commandNrausage: hermes sync Your skills, across your devices: status Show what is synced, and from where pull Pull your synced skills push Push your opted-in skills now Reconcile now: pull then push enable Include a skill in your sync disable Exclude a skill from your sync device [--name N] Show or set this device's label Shared with your team: propose Share a skill with your organisationr2r device)skills_sync_client device_namezerror: zdevice label set to 'rz[New commits from this device will use this label; existing commits keep their previous one.propose)messagezcannot share this skill: zcould not share '': proposal_pendingzShared 'uE' with your organisation — an admin needs to approve it (proposal # proposal_idz*). It is not live for the team until then.zAdded 'z'' to your organisation's shared skills.>enabledisable)set_syncis_curation_eligible'z' is not sync-eligible (bundled, hub-installed, external, or not found). Only agent-created / user-authored skills under ~/.hermes/skills/ can sync.rzsync enableddisabledz for 'rrF)indent ensure_ascii org_available org_skillsorg_skills_modifiedz Org skills: z4 shared skill(s) from your organisation (your role: org_rolezJ). They load alongside your own, labeled by origin, and you can edit them.rz" with local edits not yet shared: , z[ Share them back with `hermes sync propose `. Org updates will not overwrite them.ruU Org skills: not applicable — this account isn't a member of a shared organisation.u/ Not logged into Nous Portal — sync is inert. nous_adminz* Sync is not enabled for your account yet.feature_enabledzt Sync feature is off for this instance (set HERMES_SYNC_ENABLED=1 or config.yaml sync.enabled: true). Sync is inert.rz` No sync base URL configured (config.yaml sync.base_url or HERMES_SYNC_BASE_URL). Sync is inert.z sync inert: z3sync unavailable: not enabled for your account yet.z\sync inert: no sync base URL configured (config.yaml sync.base_url or HERMES_SYNC_BASE_URL).pullr4updatedzorg: refreshed z( shared skill(s) from your organisation. conflictedzorg: zJ skill(s) have BOTH local edits and org updates, so they were left as-is: z Your local version is intact. Review it, then either propose it or delete the local copy and pull again to take the org version.pushzhermes sync push)r4rnowzhermes sync now)rrzUnknown sync subcommand: z sync failed: )rrnr8r r toolsrset_device_namerstable_device_idr propose_skillrSyncInertError SyncErrorrftools.skill_usagerrskill sync_statusdumpsrrhresolve_identityresolve_sync_base_url pull_skillsmaybe_pull_org_skills push_skills)r_jsonrSsscrstoredrr_rrrrrmodifiedr4 org_resultclashespull_respush_ress rcmd_syncrs $ - -C j  G    "q h333333t]D11   ,,T22   mmm#*5555qqqqq  4&444 5 5 5 3Z     1 c""$$%%%q i333333y &&tT\&BBFF!    1a11 C C C C11111}    2d22q22 D D D D11111  ::( ) ) K 5455)/M)B)B555     IDIII J J Jq ###DDDDDDDD ##E**  BH GGG%zz*55GGGZ       <X<<yy**<<< ZZ $ $  ,Z     zz+&&  D3: V V V V VL))  =Z     -..  EZ      J''  8Z     q''))    Q  sz2222qqqqq << % % A    q  $ $ & &  (    q# &==__h_77F2244J  y117R88%a%%% %..66<" :G ::99W--::: !ZF]]__h@R_SSFF E\\99HBSTTH&99FF 3c33#* E E E E1 = !a!! 3333qqqqq %++fQU+ ; ;<<< 1smA-- B 7BB  D'' F1E F"!F  FQ// R"9RR" EY ZZZc(ddlm}||dS)z Webhook subscription management.r)webhook_commandN)hermes_cli.webhookr)rrs r cmd_webhookrs*222222ODrAct|dd}|dvrtdtjdS|dkr$dd lm}||}|rt ||Std |tjdS) uSlack integration helpers. Dispatches ``hermes slack ``. Currently supports: manifest — print or write a Slack app manifest with every gateway command registered as a first-class slash. slack_commandNrzusage: hermes slack subcommands: manifest Generate a Slack app manifest with every gateway command registered as a native slash Run `hermes slack manifest -h` for details.r2r manifestr)slack_manifest_commandzUnknown slack subcommand: )rnr8r r hermes_cli.slack_clir r6)rrSr rs r cmd_slackr s $ . .C j  : q j??????''--  %V$$ $  ,s , ,3:>>>> 1rAc$ddlm}||S)z"Multi-profile collaboration board.r)kanban_command)hermes_cli.kanbanr )rr s r cmd_kanbanrs$000000 >$  rAc$ddlm}||S)z1Manage projects (named, multi-folder workspaces).r)projects_command)hermes_cli.projects_cmdr)rrs r cmd_projectrs%888888  D ! !!rAc(ddlm}||dS)z%Shell-hook inspection and management.r) hooks_commandN)hermes_cli.hooksr)rrs r cmd_hooksrs*......M$rAc(ddlm}||dS)z%Check configuration and dependencies.r run_doctorN)hermes_cli.doctorr)rrs r cmd_doctorr*,,,,,,JtrAct|dd}|dvr4ddlm}||}tjt |pdt d|tjtjddS) z$Dispatch `hermes security `.security_commandN)auditNr)cmd_security_auditzunknown security subcommand: r2r)rnhermes_cli.security_auditr!r rrr8r )rrSr!r7s r cmd_securityr#s $*D 1 1C o@@@@@@"!$'' TYQ    /# / /cjAAAAHQKKKKKrAcTddlm}||}|rtj||S)z%Dispatch `hermes approvals `.r)approvals_command)hermes_cli.approvals_suggestr%r r)rr%rs r cmd_approvalsr'sA>>>>>>  t $ $F   MrAc(ddlm}||dS)z)Dump setup summary for support/debugging.r)run_dumpN)hermes_cli.dumpr))rr)s rcmd_dumpr+s%(((((( HTNNNNNrAc(ddlm}||dS)z!Debug tools (share report, etc.).r) run_debugN)hermes_cli.debugr-)rr-s r cmd_debugr/s%****** IdOOOOOrAc(ddlm}||dS)zConfiguration management.r)config_commandN)rr1)rr1s r cmd_configr2s*000000N4rAc(ddlm}||dS)z#Skin management (list / use / set).r) skin_commandN)hermes_cli.skin_cmdr4)rr4s rcmd_skinr6s*000000LrAcpt|ddrddlm}||dSddlm}||dS)z,Back up Hermes home directory to a zip file.quickFr)run_quick_backup) run_backupN)rnhermes_cli.backupr9r:)rr9r:s r cmd_backupr<#sgtWe$$666666000000 4rAc(ddlm}||dS)z(Restore a Hermes backup from a zip file.r) run_importN)r;r>)rr>s r cmd_importr?/rrA check_updatesrAc ddlm}ddlm}m}t |d|djt dtt d|tt d tj d dd l m }m } t d |d n#|$rt d YnwxYwn#t$rt d YnwxYw|sdS ddlm}ddlm}|}|r3|dkr-|dkrdnd} t d|d| d|ddS|dkrt ddSdS#t"$rYdSwxYw)Nr)detect_install_method)CommandContextexecute_commandversionrX)surfacezInstall directory: zInstall method: zPython: )rFPackageNotFoundErrorz OpenAI SDK: openaizOpenAI SDK: Not installed)check_for_updates)recommended_update_commandr commitcommitszUpdate available: rlu behind — run 'rz Up to date)rrChermes_cli.slash_execrDrEr8rnrr rFrimportlib.metadatarHrMrrJrKr) rArCrDrE _pkg_versionrHrJrKbehind commits_words r_print_version_inforS6sh777777EEEEEEEE //)^^E%B%B%B C C HIII . . ./// B22<@@ B BCCC -S[&&((+ - -... +TTTTTTTT / 9h!7!799 : : : :# / / / - . . . . . / +++ )*****+  777777@@@@@@""$$  fqjj'-{{88 L 8V88l882244888     q[[ ,     [      sO#C#,CC#CC#CC##C?>C?A E+E++ E98E9c&tddS)z Show version.Tr@N)rSrs r cmd_versionrUesd++++++rActt|ddr1ddlm}tt j|dSt|ddr3t|ddst ddd lm}||dSt|ddst d dd lm }||dS) z9Uninstall Hermes Agent (or just the Chat GUI with --gui). gui_summaryFr)gui_install_summaryNr<rzuninstall --gui)run_gui_uninstall uninstall) run_uninstall) rnhermes_cli.gui_uninstallrXr8rrrhermes_cli.uninstallrYr[)rrXrYr[s r cmd_uninstallr^jst]E**@@@@@@ dj,,..//000tUE""tUE** , * + + +::::::$ 4 & &"[!!!222222M$rAc&d}tj|D]y\}}}d|D|dd<tj|dkr? t j||dz }n#t $rYnwxYw|z|S)a~Remove all __pycache__ directories under *root*. Stale .pyc files can cause ImportError after code updates when Python loads a cached bytecode file that references names that no longer exist (or don't yet exist) in the updated source. Clearing them forces Python to recompile from the .py source on next import. Returns the number of directories removed. rcg|]}|dv| S)> .worktreesvenvrrt.venvr@)r:ds rrz)_clear_bytecode_cache..s.   OOO OOOrAN __pycache__r )rwalkrgbasenamerrrr)rrldirpathdirnamesr~s r_clear_bytecode_cacherjsG "  1      7  G $ $ 5 5  g&&&1      NN    NsA,, A98A9)L_add_upstream_remote_atomic_replace_dir_capture_head_sha_cmd_update_check_cmd_update_impl(_cold_start_windows_gateway_after_update_count_commits_between_detect_venv_python_processes_discard_lockfile_churn_discard_stashed_changes_ensure_acp_launcher_ensure_fhs_path_guard_ensure_uv_for_termux _finish_dashboard_update_cleanup_for_each_systemd_gateway_unit$_format_concurrent_instances_message_format_time_ago#_format_venv_python_holders_message_gateway_prompt_get_origin_url_has_upstream_remote_install_psutil_android_compat_invalidate_update_cache_is_android_python_is_fork_leftover_pausable_gateway_pids_log_only_write_mark_skip_upstream_prompt_npm_bin_exists_npm_lockfile_changed_npm_manifest_paths_npm_manifests_digest"_pause_windows_gateways_for_update_print_curator_first_run_notice _print_curator_recent_run_notice$_print_fts_optimize_available_notice_print_stash_cleanup_guidance_record_npm_lockfile_hash_refresh_active_lazy_features,_refresh_active_memory_provider_dependencies"_refresh_windows_gateway_launchers_reload_updated_runtime_modules_resolve_pre_update_backup_mode_resolve_stash_selector_restore_stashed_changes%_resume_windows_gateways_after_update_run_logged_subprocess_run_pre_update_backup_should_skip_upstream_prompt._stash_apply_failed_only_on_existing_untracked_stash_local_changes_if_needed_sync_fork_with_upstream_sync_with_upstream_if_needed_update_node_dependencies_update_via_zip _upgrade_pip_before_lazy_refresh_validate_critical_files_syntax!_validate_critical_modules_import_venv_core_imports_healthy_venv_launcher_ancestors%_wait_for_windows_update_gateway_exit&_warn_incomplete_gateway_fleet_restart_web_build_toolchain_ready_web_toolchain_roots%_write_lazy_refresh_incomplete_marker_write_marker_file_write_update_incomplete_marker!_write_update_planned_stop_marker_UPDATE_RUNTIME_RELOAD_MODULES_UPDATE_CRITICAL_FILES_UPDATE_CRITICAL_MODULESOFFICIAL_REPO_URLSOFFICIAL_REPO_URLSKIP_UPSTREAM_PROMPT_FILE_PRE_UPDATE_SNAPSHOT_KEEP"_PRE_UPDATE_SNAPSHOT_MAX_FILE_SIZEz.bytecode-fingerprintcN tt}|sdSttz }||jdz}||d||dS#t$r&}t d|Yd}~dSd}~wwxYw)uPersist the current checkout fingerprint after a bytecode sweep. Never raises. A failed write just means the next launch re-sweeps — safe, merely redundant. Nz.tmpr]r^z)Could not record bytecode fingerprint: %s) rr_BYTECODE_FINGERPRINT_FILE with_namerrrgrrr) fingerprint stamp_pathtmp_pathr;s r_record_bytecode_fingerprintrs G4\BB   F!$>> '' &(@AAK':::$$$$$ GGG @#FFFFFFFFFGsA4AA44 B$>BB$c tt}|sdSttz } |d}n#t $rd}YnwxYw||krdSt t}|r(td|pd|||dkrdnd tdS#t$r&}t d |Yd}~dSd}~wwxYw) u7Clear ``__pycache__`` at launch when the checkout changed underneath us. The stale-bytecode bug class (issues #6207, #60242; Dhruv's WhatsApp ``cannot import name 'parse_model_flags_detailed'`` report) has one shared shape: the checkout's ``.py`` files change (git pull inside ``hermes update``, a manual ``git pull``, a ZIP update, a file-sync restore) while ``__pycache__`` retains bytecode from the previous revision, and a later process trusts the stale ``.pyc`` instead of the fresh source. Update-time clears alone can never close this class: ``hermes update`` always executes the PRE-pull updater code, so any hardening added to it only takes effect one update late, and manual ``git pull`` never runs the updater at all. This launch-time guard closes the loop: every ``hermes`` entry point compares the checkout fingerprint (cheap file reads, no git subprocess) against the last-validated stamp and sweeps the bytecode cache once when they diverge. Never raises — a failure here must not block launch. Nr]r^rzVCheckout changed since last launch (%s -> %s): cleared %d stale __pycache__ director%sunknownr r?iesz&Stale-bytecode launch sweep failed: %s) rrrrrrrrjrinforrr)rrrecordedrlr;s r)_sweep_stale_bytecode_if_checkout_changedrs3*D4\BB   F!$>>  !++W+==CCEEHH   HHH  { " " F' 55   KKh%I!||     %&&&&& DDD =sCCCCCCCCCDsFB;B;(AB; A"B;!A"" B;-A B;; C+C&&C+web_dirc$|jjdkr |jjn|j}|dz dz }|dz dz }|s|dz }|sdSt}|sdS t j|d }n#tt j f$rYdSwxYwt|tsdS| d }|sdSt|||kS) a&Return True if the web UI dist is missing or its source content changed. Uses a SHA-256 content hash of the web source tree (the same approach ``_desktop_build_needed()`` already uses for the Electron build), NOT mtime comparison. ``git checkout`` / ``git pull`` / ``hermes update`` rewrite source mtimes without changing content, which made the old mtime check unreliable in both directions: it could skip a rebuild when source had genuinely changed (serving a stale dashboard) and force a rebuild when nothing had. A content hash is stable across mtime churn. The dashboard source lives under ``web/`` but Vite outputs to ``hermes_cli/web_dist/`` (per vite.config.ts outDir), NOT ``web/dist/``, so the dist directory is never part of the hashed source tree. apps hermes_cliweb_distz.vitez manifest.json index.htmlTr]r^ contentHash)rrrj_web_ui_stamp_pathryrrrrrrrprf_compute_web_ui_content_hash)r project_rootdist_dirsentinel stamp_file stamp_data saved_hashs r_web_ui_build_neededr=s4-4N,?6,I,I7>((w~Ll*Z7H'!O3H ??  +l* ??  t#%%J     tZ 4 4g 4 F FGG T) *tt j$ ' 't ..J t ' g > >* LLs(B11C  C rc& tjdtddffd }ddlm}dz }g}|r(|d }|d |d D]]}|z }|rBt| } |s ||^tj |d D]\ } } fd| D| dd<t| D]V} t | z } t| } |s || WS)aReturn a SHA-256 hex digest of the web UI source tree. Covers ``web_dir`` (the dashboard frontend source) plus the root ``package.json`` / ``package-lock.json`` (workspace config that determines dependency resolution). Mirrors ``_compute_desktop_content_hash()``: ignored paths (``node_modules/``, ``dist/``, ``*.pyc``, ...) are skipped via the repo-root ``.gitignore`` so build output never feeds back into its own staleness check. rgrNct|}|d t |d5t fddD]}| dddn #1swxYwYn#t $rYnwxYwddS)Nrbc.dSNirRrTsrzB_compute_web_ui_content_hash.._hash_file..t!&&--rArA)rqrrencoderliterrrgrchunkrThrs @r _hash_filez0_compute_web_ui_content_hash.._hash_filens$""<0011   dD!! $Q!"7"7"7"7==$$EHHUOOOO$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $    D  s6"B72,B+ B7+B//B72B/3B77 CCrPathSpec .gitignorer]r^ gitignorerrTtopdownc g|]I}tt|z G|JSr@ match_filerqrrr:rdrhrspecs rrz0_compute_web_ui_content_hash..\   ??3W (9'F'F|'T'T#U#UVV    rAhashlibsha256rpathspecrryrrm from_linesrqrrrrfr hexdigest)rrrrrlinesrr7rri filenamesfnfprhrrs` @@@rrrbs A  $       "!!!!!|+IEC##W#55@@BB   {E 2 2D6 4  99;; ammL1122C??3''  1 )+(F(F(F  $9          ##  Bg#Bbnn\2233C??3''  2   ;;==rAc(ddlm}|dz S)zBReturn the path to the web UI build stamp file under $HERMES_HOME.rr'zweb-ui-build-stamp.jsonrr(r's rrrs(000000 ?  8 88rAct} |jddddlm}m}t |||j|jd}| tj |ddzd d S#t$r&}td |Yd }~d Sd }~wwxYw) z6Write the web UI build stamp after a successful build.TrrrEtimezone)rbuiltAtrrrr]r^z&Failed to write web UI build stamp: %sN)rrrrErrrutc isoformatrrrrrr)rrrrErrr;s r_write_web_ui_build_stamprs#%%J Dt<<<////////7 gNN#x|HL11;;==   djA>>>EPWXXXXX DDD =sCCCCCCCCCDsB B C &CC  )idle_timeout_secondsrr]r rrc  gtj tj t j||tjtjdddd| n<#t$r/}t j |ddt|cYd }~Sd }~wwxYwd fd }tj |d }| d }  d} n#tj$r5tj z } d d d n #1swxYwY| |krmd}  d} n=#tj$r+ } YnwxYwYnYnwxYw|dd} |rd|d} | | z } | dkrd} t j || | dS)uRun a subprocess that streams output, with an idle-output timeout. Issue #33788: ``npm run build`` (Vite) was invoked with ``capture_output=True`` and no timeout. On low-memory hosts (notably WSL2 with the default 4 GB cap) the build can stall or sit silent for minutes; users see a frozen terminal, assume the update is hung, and reboot — leaving the editable install in a half-state with the ``hermes`` launcher present but ``hermes_cli`` not importable. This helper fixes both halves: stdout is streamed (so the user sees progress), and if no bytes have appeared on stdout/stderr for ``idle_timeout_seconds``, the process is terminated and the call returns with a non-zero ``returncode``. The caller's existing stale-dist fallback (#23817) takes over from there. Returns a ``CompletedProcess`` with merged stdout (text), empty stderr, and an integer returncode. Never raises on idle timeout — propagation of failure is via the returncode. Tr]rgr )r r r rnr_ribufsizer]r r)r r NrcjJjD]} t|dn#t$rst t jddpd}||d|d}t|dYnwxYw5|tj dddn #1swxYwYdS)NTr r_asciirgri) r r8rPUnicodeEncodeErrorrnr rdecoder_time monotonic)roencsaferlast_output_tsr merged_chunksprocs r_readerz'_run_with_idle_timeout.._readersd{&&&K 3 3D 5000=====% 5 5 5cj*d;;Fw{{}}++C +BBII#V_I``'''t444444  5  3 3$$T***!&!2!2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3s"'=A:B:9B:?)C44C8 ;C8 rdaemonFrrYrru$ ⚠ Build produced no output for us — terminated. Common causes: out-of-memory on a low-RAM host (WSL/container), a stuck Node process, or an antivirus scan stalling I/O. r|rN)rr threadingLockrZPopenr+STDOUTrr4rqThreadr%waitrp terminatekillrh)rlr rrr]r;r reader_thread idle_killedridler?r=rrrrs ` @@@@r_run_with_idle_timeoutr(s6 "M_&&N >  DQ ?$     QQQ*3Bs3xxPPPPPPPPPQ 3 3 3 3 3 3 3 3 3 3$GDAAAMK 1%%B (    : :((>9 : : : : : : : : : : : : : : :***"    %1--BB!0%%%IIKKKBBB%+*  $q!!!ww}%%H  M4H M M M C 77B  &sBx K K KKsw1A!! B+$BBBC,,F!=D  F! D$ $F!'D$ (F!EF!7FF!FF! F!c |ddl} tdd}n#t$rYdSwxYw|jd||jsdSt jdrdSdD]G}t|z d z dz }| r!itj d t|icSH tjgd d d dd dd}|jdkrN|j}|r3t| ritj d |iSn#t$$rYnwxYwdS)uReturn extra env vars for native module builds on NixOS. On NixOS, python3 is typically not on the system PATH (it lives in the Nix store and only enters PATH inside a nix-shell or when explicitly installed as a system package). node-gyp uses Python to compile native addons like ``node-pty`` and its ``find-python.js`` does a bare ``PATH`` lookup — which fails on NixOS. Two-tier resolution: 1. Fast path — the hermes venv's python3 (present in managed installs) 2. Fallback — resolves the absolute python3 path via ``nix-shell`` Returns an env dict suitable for ``subprocess.run(env=...)`` or ``None`` when we are not on NixOS or python3 is already on PATH. rNz/etc/os-releaser]r^z ^ID=nixos$python3)rbrcrPYTHON)z nix-shellrr*z--runz which python3TrgFrJ)rXrnr_rirarY)rrrrsearchMrrrrjrrerqrZr[r\r rrr)r os_release venv_name venv_pythonr_ python3_paths r_nixos_build_envr2s III+,,666HH tt 29]J 5 5t|It'>> "Y.6B      >=bj=(C ,<,<== = = = >   D D DdWYV[eg      ! !!=..00L >\ 2 2 9 9 ; ; >="*=h ===       4s#* 885A5D,, D98D9r@) extra_argsrXr]rr3rXc itj|piddi dttdtjf fd dtdtjf fd }||}|jdkr|Sdd lm}|j pd d |j pd }|||} | s|Sdd l m } | d  d <|| S)uRun a deterministic npm install that does not mutate ``package-lock.json``. Prefers ``npm ci`` (strict, lockfile-preserving) when a lockfile is present; falls back to ``npm install`` only if ``npm ci`` fails (e.g. lockfile out of sync on a WIP checkout). Without this, ``npm install`` on npm ≥ 10 silently rewrites committed lockfiles (stripping ``"peer": true`` etc.), which leaves the working tree dirty and causes the next ``hermes update`` to stash the lockfile — repeatedly. ``--include=dev`` is forced on every invocation: the callers are frontend builds (web UI / TUI / desktop workspaces), and those builds need the dev toolchain (``tsc``, ``vite``, ``electron-builder`` — all ``devDependencies``). If the caller's environment has ``NODE_ENV=production`` (or npm config ``omit=dev``) — which leaks in from a shell profile, a container image, or the bundled TUI launcher that sets ``NODE_ENV=production`` on its subprocess env — npm silently omits devDependencies (exit 0, no error), so the build toolchain never installs and the subsequent build dies with ``tsc: command not found`` (exit 127). The flag overrides both the env var and npm config, unlike scrubbing ``NODE_ENV`` from the environment which only fixes the env-leak case. ``--no-save`` on the ``npm install`` fallback keeps it true to this function's contract: never mutate ``package-lock.json``. Without it, an out-of-sync lockfile gets rewritten by the fallback, which drifts the committed lockfile and makes every future ``npm ci`` fail — a self-reinforcing cycle where web devDeps never install and a stale dist is served on every update (PR #65595). r)rrlrc*t|S)N)r r]rX)$_run_npm_watching_for_engine_failure)rlrXr run_envs r_runz,_run_npm_install_deterministic.._runss&3 )     rAnpm_execdz }|r|ddg}|jdkr|S|dddgS)Nrcir!rr z --no-save)rjr\)r9lockfile ci_resultr8r r3s r_attemptz0_run_npm_install_deterministic.._attempt{so,, ??   !gt_JzJKKI#q((  tWioS STTTrArr/rrr'r) rrerrqrZr4r\r5r0r r rr() rr r3rXr]r>r_r0r?r>r(r8r7s ``` @@r_run_npm_install_deterministicr?Js\N76 r6D#66G $s) ;        U#U*"=UUUUUUUUXc]]F A >=====-%2>>)<">>H**399L  766666++G44VO>O P PPsA8C  CCoutputc |dD].}tfd|d|dd|dfDr|cS/dS)aReturn the build tool a failed ``npm run build`` could not resolve. Each shell words this differently: ``sh: 1: tsc: not found`` (dash), ``vite: command not found`` (bash/zsh), and ``'tsc' is not recognized as an internal or external command`` (cmd.exe). )tscvitec3 K|]}|vV dSr>r@)r:phraselowereds rr;z*_missing_web_build_tool..s<   g       rAz : not foundz: command not foundrz' is not recognizedN)rsr)rBtoolrHs @r_missing_web_build_toolrJsllnnG       $$$,,,-D---      KKK  4rAfatalrLc |dz sdS ddl}n!#t$rt||cYSwxYw|jjdkr |jjn|j}|dz dz d z } t |d z d d }n!#t$rt||cYSwxYw || |j |j znh#t$r[|rY| dS|| |j YnwxYwt||| S#| wxYw)uBuild the web UI frontend if npm is available, serializing across processes. Concurrent dashboard boots (e.g. the desktop app's retry loop after a readiness timeout) used to each spawn their own ``npm install`` + ``vite build`` over the same tree; the parallel builds starved each other, none finished, the dist sentinel never advanced, and every new boot re-triggered the build. One process builds under an exclusive flock; the rest serve the existing dist (stale is acceptable) or, when no dist exists yet, block until the builder finishes. Staleness is checked once, inside :func:`_do_build_web_ui`, after the lock is held — so a process that queued behind the builder skips the rebuild, and the (os.walk-based) check runs at most once per boot. rTrNrKrrrrz.web_ui_build.lockar]r^) rjfcntlrM_do_build_web_uirrrlrflockfilenoLOCK_EXLOCK_NBrh)rrLrOr dist_index lock_files r _build_web_uirWs n $ , , . .t6 666u5555556-4N,?6,I,I7>((w~L ,z9LHJ6(<>0BB$#B$)5CE,E=E,-EE,EE,,Fc|dz sdSt|sdSdtddfdddlm}t s|rd d | S|d d,fd }t ||krdndtrt|\dtdd ffd }|d}|j dkr4d|rdndd|rdndz|||r ddStddg|}|j dkrt|j pd|jpdz}|r0d|d |dtddg|}|j dkr)tjd!tddg|}|j dkr|jpd|j pdz}|} | r/d"| d#dnd} |jjd$kr |jjn|j} | d%z d&z } | d'z } | rd(| rd)| dSd|rdndd*|rdndz|||r ddSd+|jjd$kr |jjn|j} t-| |dS)-aWBuild the web UI frontend if npm is available. Args: web_dir: Path to the dashboard frontend source directory. fatal: If True, print error guidance and return False on failure instead of a soft warning (used by ``hermes web``). Returns True if the build succeeded or was skipped (no package.json). rTrnrNc t|dS#t$rZttjddpd}t||d|dYdSwxYw)Nr_r rgr )r8rrnr r rr)rnr_s r_sayz_do_build_web_ui.._say!s ^ $KKKKK! ^ ^ ^sz:t<<GH $++hy+99@@R[@\\ ] ] ] ] ] ] ^sA A76A7rr'z3Web UI frontend not built and npm is not available.zBInstall Node.js, then run: cd web && npm install && npm run buildu→ Building web UI...r_subprocess.CompletedProcessc|j|jfD]d}|st|tr)|ddn|}|r |edS)aRPrint captured npm output so users can see *why* a step failed. Windows users hitting `rm -rf` / `cp -r` errors (or any other sync-assets / Vite failure) would otherwise see only ``Web UI build failed`` with no hint of the underlying cause, because the npm calls run with ``capture_output=True``. r]rgr N)r r rbytesrrP)r_blobrnrZs r_relayz _do_build_web_ui.._relay3s]FM2  D FPQUW\F]F]p4;;wy;99@@BBBcgcncncpcpD T   rAr@)rwebsilentcJt|r gddRngdRS)Nr"z--prefer-offline)r3r])r?)ra build_envrr,r<s r_install_web_depsz+_do_build_web_ui.._install_web_depsMsl-  PVFL+LZL9KLLL]F^p]FsE]F]F     rA)raru✗u⚠z Web UI npm install failedrz# (hermes web will not be available)zD Run manually: npm install --workspace web && npm run build -w webFr[r2ru ⚠ Build could not resolve u% — reinstalling web dependencies...r irrrru< ⚠ Web UI build failed — serving stale dist as fallbackz Build error: z Web UI build failedu ✓ Web UI built)r_r[rN)rjrrqrr(_resolve_node_runtime_npmrrcrrr\r(rJr r rsleeprrrhrmrrr)rrLr(r_rdr1r2 missing_tool build_outputstderr_preview stderr_tailrrrUrZrcrr,r<s @@@@@rrPrP s n $ , , . .t  ( (t^3^4^^^^766666 # % %C   W DF G G G DU V V Vy%%''ID !"""      g&&G1870B0B""H^%''Q&G&P&P## T .K           $ ' ' 'B }  F%*U F F FErr E G    r  Y DW X X Xu eW 57 R R RB } / RBIOQS/TUU  [ De,eee f f f  U + + + +'eW(=7PYZZZB =A   KNNN'eW(=7PYZZZB }  RBIO< %++--HV^fkk.";";"="=cdd"CDDD\^ 070Cv0M0Mw~,,SZSa ,.; ,       DO P P P 97+778884  @%*U @ @ @Err E G    r  Y DW X X XuD ,3N,?6,I,I7>((w~LlG444 4rA desktop_dirc6|dz dz S)z;Return True when a local desktop renderer build is present.rrrj)rns r_desktop_dist_existsrqs & < / 7 7 9 99rAc6 tjdtddffd }ddlm}dz }g}|r(|d }|d |d D]]}|z }|rBt| } |s ||^d z d z }tj |dD]\ } } fd| D| dd<t| D]V} t | z } t| } |s || WS)aReturn a SHA-256 hex digest of all source files that feed the desktop build. Covers ``apps/desktop/`` (excluding anything matched by .gitignore) plus the root ``package.json`` / ``package-lock.json`` (workspace config that determines dependency resolution for the desktop workspace). Parses the repo-root ``.gitignore`` via *pathspec* so we automatically skip ``node_modules/``, ``dist/``, ``*.pyc``, etc. without maintaining a hardcoded skip-list. rgrNct|}|d t |d5t fddD]}| dddn #1swxYwYn#t tf$rYnwxYwddS)Nrrc.dSrrrsrrzC_compute_desktop_content_hash.._hash_file..rrArA)rqrrrrlrrIOErrorrs @rrz1_compute_desktop_content_hash.._hash_files#$""<0011   dD!! $Q!"7"7"7"7==$$EHHUOOOO$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $!    D  s6"B72,B+ B7+B//B72B/3B77C  C rrrr]r^rrrr>Trc g|]I}tt|z G|JSr@rrs rrz1_compute_desktop_content_hash..rrAr)rrrrrrr7rrnrirrrrhrrs` @@@r_compute_desktop_content_hashrws A  $       "!!!!!|+IEC##W#55@@BB   {E 2 2D6 4  99;; ammL1122C??3''  1 ')3K(* T(J(J(J  $9          ##  Bg#Bbnn\2233C??3''  2   ;;==rAc(ddlm}|dz S)zCReturn the path to the desktop build stamp file under $HERMES_HOME.rr'zdesktop-build-stamp.jsonrr's r_desktop_stamp_pathrys(000000 ?  9 99rA source_modec|rt|sdSnt|dSt}|sdS t j|d}n##ttjtf$rYdSwxYw| d|krdS| d}|sdSt|}||kS)a Return True when the desktop build output is stale or missing. Compares the current content hash against the saved stamp. Also returns True if the expected build artifact doesn't exist (e.g. first run after ``hermes update`` that pulled new source but hasn't built yet). TNr]r^ sourceModer) rq_desktop_packaged_executableryryrrrrrKeyErrorrfrw)rnrrzrrr current_hashs r_desktop_build_neededrs#K00 4  ( 4 4 <4$&&J     tZ 4 4g 4 F FGG T)8 4tt~~l##{22t ..J t0>>L : %%s (A44BBct} |jddt|}ddlm}m}|||j|jd}| tj |ddzd d S#t$r&}td |Yd }~d Sd }~wwxYw) z7Write the desktop build stamp after a successful build.Trrr)rr|rrrrr]r^z'Failed to write desktop build stamp: %sN)ryrrrwrErrrrrrrrrr)rrzr content_hashrErrr;s r_write_desktop_build_stamprs$&&J Et<<<4\BB ////////'%#x|HL11;;==  djA>>>EPWXXXXX EEE >DDDDDDDDDEsB B C(C  Cc|dz }tjdkr#t|d}nFtjdkr|dz dz |dz dz |dz dz g}n|d z d z |d z d z |d z d z |d z d z g}d |D}|sdStjdkr3t |dkr t fd|D}|r|}t |dS)z?Return the current platform's unpacked Electron app executable.releasedarwinz%mac*/Hermes.app/Contents/MacOS/Hermeswin32z win-unpackedz Hermes.exezwin-ia32-unpackedzwin-arm64-unpackedzlinux-unpackedrGHermeszlinux-arm64-unpackedc:g|]}||Sr@rprfs rrz0_desktop_packaged_executable..?s%444a4444rANr c6g|]}t|v|Sr@)_pe_machine_or_none)r:r7expecteds rrz0_desktop_packaged_executable..Js,NNN!+>q+A+AX+M+MA+M+M+MrAc4|jSr>)rrr7s rrz._desktop_packaged_executable..Msqvvxx'8rA)r})r rOrglobr_expected_windows_pe_machinesr)rn release_dirrSexistingmatchingrs @rr}r},sA )K |x+**+RSSTT  . (< 7 - - < . . =  * *X 5 * *X 5 0 08 ; 0 08 ;  54:444H t |w3x==1#4#4122NNNNxNNN  H x88 9 9 99rAiLididz x86 (32-bit)z x64 (AMD64)ARM64AMD64X86c\ddl}ddlm}|dd}|j|j_g|j_|j||j||jg|j _|j |j _|d}|d}| || || |sdSt |jS)aAsk IsWow64Process2 for the OS-native machine (None if unavailable/fail). ctypes defaults ``GetCurrentProcess``'s restype to ``c_int``, so the current-process pseudo-handle ``(HANDLE)-1`` is truncated to ``0xFFFFFFFF`` and zero-extended into a 64-bit invalid handle. On Win64 that makes ``IsWow64Process2`` fail with ``ERROR_INVALID_HANDLE`` (6), which is exactly the residual Windows-on-ARM failure after #71218: the gate fell through to ``PROCESSOR_ARCHITECTURE=AMD64`` (the emulated process arch) and rejected a correctly-built ARM64 ``Hermes.exe``. Binding ``restype``/``argtypes`` to ``wintypes.HANDLE`` keeps the full ``0xFFFFFFFFFFFFFFFF`` pseudo-handle. rNwintypeskernel32Tuse_last_error)rNrWinDLLHANDLEGetCurrentProcessrestypeargtypesPOINTERUSHORTIsWow64Process2BOOLbyref_PE_MACHINE_TO_NAMErfrt)rNrrprocess_machinenative_machines r$_windows_native_machine_from_iswow64rtsMMM}}Z}==H)1H&*,H'x''x'')H% (0}H$ooa((O__Q''N  # #""$$ _%% ^$$   t  " ">#7 8 88rAcddl}ddlm}|dd}|j||jg|j_|j|j_ t}tttfD]e}|d}||||rA|jt zr||f|pdS)u>PE machines this host can run in user mode, via GetMachineTypeAttributes. This asks the question the integrity gate actually cares about — "can this Windows host load a PE of machine X?" — instead of inferring it from a host-architecture name. It is also the only documented API that reports AMD64-on-ARM64 emulation support; ``IsWow64GuestMachineSupported`` only answers for 32-bit guests. Returns None when the API is unavailable (pre-Windows-11 build 22000) or reports nothing runnable, so callers fall back to name-based detection. rNrrTr)rNrrrrc_intGetMachineTypeAttributesrc_longrset_PE_MACHINE_ARM64_PE_MACHINE_AMD64_PE_MACHINE_I386rrt_MACHINE_ATTRIBUTE_USER_ENABLEDr)rNrrrunnablemachine attributess r"_windows_user_runnable_pe_machinesrsMMM}}Z}==Hv|$$2H%.17 H%-uuH%'8:JK""\\!__  , ,Wfll:6N6N O O    = = " LL ! ! !  trActjdkr t}n%#ttt t f$rd}YnwxYw|r|Stj dptj d}|r| Sddl}| pd S)uThe Windows host OS's NATIVE machine architecture, normalized upper. ``platform.machine()`` reports the PROCESS architecture, which lies under emulation: the desktop update chain runs an x64 hermes-setup.exe (and thus x64 Python) on Windows-on-ARM devices, where ``platform.machine()`` returns ``AMD64`` even though the OS is ARM64. The #71119 integrity gate then rejected the CORRECT ARM64 rebuild as an "architecture mismatch" (#69179 follow-up report). Probe order: 1. ``IsWow64Process2`` with a correctly-typed current-process HANDLE (#71218 + HANDLE-truncation fix). This is the only API that tells the truth from an x64 process emulated on ARM64. 2. ``PROCESSOR_ARCHITEW6432`` / ``PROCESSOR_ARCHITECTURE`` — WOW64 (32-bit) hosts and pre-1511 Windows 10 without the newer API. 3. ``platform.machine()``. Note ``GetNativeSystemInfo`` is deliberately NOT used: Microsoft documents that it "also returns emulated processor details when run from an app under emulation", so on the very WoA hosts this function exists to serve it reports AMD64 — no better than the env-var rung below it. rNPROCESSOR_ARCHITEW6432PROCESSOR_ARCHITECTURErr) r rOrrrL TypeErrorrrrerfupperr)renv_arch _platforms r_windows_native_machiners, |w 799DDJ?   DDD   K:>>":;; rz~~ $@ @   $>>## #         %2 , , . ..!AAc\tjdkr9 t}n%#ttt t f$rd}YnwxYw|r|St}|dvrtthS|dvrtthS|dvrthSttthS)aPE machine values the current Windows host can natively load. Preferred source is ``GetMachineTypeAttributes``, which answers this question directly (including AMD64-on-ARM64 emulation) instead of inferring it from an architecture name. Fallback is name-based: AMD64 hosts run x64 and (via WOW64) x86. ARM64 hosts run ARM64 and (Windows 11 emulation) x64. 32-bit x86 hosts run only x86. Unknown machines return the permissive full set so the integrity gate can never brick launch on exotic hosts. Host detection uses the OS-native machine (see ``_windows_native_machine``), not the process architecture. rN)rX86_64X64)rAARCH64)rI386I486I586I686) r rOrrrLrrrrrrr)rrs rrrs |w 9;;HHJ?   HHH   O%''--//G,,,!#344&&&!#455999 !! 02B CCrcddl} |j}n$#t$r}t d|d}~wwxYw|dkrt d|d|d5}|d}t|dks|dd d krt d |d |d d}|dks |dz|krt d| ||d}t|dks|dddkrt d|d|d\}} |d|dd} | |dz| zd} t| D]f} |d} t| dkrt d|d| d\}}t| ||z} g|| krt d|d| d dddn #1swxYwY|S)uParse ``path`` as a PE executable and return its COFF machine field. Raises ``ValueError`` with a human-readable reason when the file is not a structurally complete PE: missing MZ/PE magic (an HTML error page or JSON body saved as .exe), header truncation, or raw section data extending past the end of the file (the truncated-download / interrupted-extraction shape). Purely a header walk — cheap even on a 200 MB Electron exe. rNz unreadable: iz file is only u3 bytes — far too small to be a Windows executabler@rsMZu^missing MZ header — not a Windows executable (a truncated or non-binary file saved as .exe?)z>T"1"X..B %%dD$77: q==HrMI55[\\ \ ''"++ w<<"   } < <QRR R$00CC!--dGR@@C 2 00111z"" Q QAggbkkG7||b   !=>>>*0*<*K3OPPOO  & &>>>&5>>>  '1: Ns% A<A2GIIIcD t|S#t$rYdSwxYwr>)rrrcs rrr4s7 &&& tts  c t|}n&#t$r}t|cYd}~Sd}~wwxYwt}||vr4t|d|d}d|dt dSdS)zReturn a human-readable reason ``path`` cannot run on this Windows host, or ``None`` when the exe parses as a complete PE of a loadable architecture. Nzunknown machine 0x04Xzarchitecture mismatch: built a z executable but this is a z Windows host)rrrqr_PE_MACHINE_NAMESrfr)rgrr;rgots r_desktop_exe_integrity_errorr;s#D)) 3xx,..Hh##G-O'-O-O-OPP 8c 8 8&(( 8 8 8  4s 5055packaged_executablec4|j}|j|jdzz S)zDThe rollback tree before-pack.mjs preserves: ``.bak``.z.bak)rr)runpackeds r_desktop_backup_unpacked_dirrMs")H ?hmf4 55rAc|j}t|}||jz }|sdSt |dS|j|jdzz } t j|d ||n&#t$rt j|dYnwxYw||n#t$rYdSwxYw||jz }|r|ndS)aIRestore the previous unpacked desktop app from its ``.bak`` tree. Returns the restored executable path, or ``None`` when no usable backup exists (missing, or its exe fails the same integrity probe). The corrupt tree is kept alongside as ``.corrupt`` for diagnostics. Best-effort: never raises. Nz.corruptTr) rrrrjrrrrenamer)rr backup_dir backup_exe corrupt_dirrestoreds r_rollback_desktop_from_backuprSs1#)H-.ABBJ166J     t#J//;t/X]Z%?@K k6666 8 OOK ( ( ( ( 8 8 8 M($ 7 7 7 7 7 7 8(#### tt-22H(( 288d2s6C2BC B+(C*B++C CCc|tjdkr|dfSt|}||dfStd|td|t | t n#t$rYnwxYwt|}|1tdtdtd|d fStd td td d S)u|Windows post-build integrity gate for the self-update rebuild (#69179). Returns ``(verified_exe_or_None, rolled_back)``: - exe passed the probe → ``(exe, False)`` - exe corrupt/wrong-arch, previous build restored → ``(old_exe, True)`` - exe corrupt and nothing restorable → ``(None, False)`` On any integrity failure the corrupt cached Electron zip is purged and the desktop build stamp invalidated, so the updater's retry-once rebuild pulls a fresh, SHASUM-verified Electron download instead of re-staging the same corrupt bytes. No-op off Windows and when there is no executable to check. NrFu5✗ The built Hermes.exe failed its integrity check: z at: uN ↩ Update aborted — restored the previous working Hermes.exe from backup.zH Your existing version was kept and still works. Run `hermes desktop`zI (or the in-app update) again to retry with a fresh Electron download.Tu, ✗ No usable backup was found to restore.zG Run `hermes desktop --force-build` to rebuild, or re-run the Hermesz$ installer to repair the install.NF) r rOrr8_purge_electron_build_cacheryrrr)rnrr"rs r_ensure_desktop_exe_launchablerps= "clg&=&="E)) ()< = =E }"E)) I% I IJJJ *( * *+++  ,,, $$&&&&      --@AAH ^___ XYYY YZZZ~ 8999 STTT 0111 ;s B B Bctj}g}tjdptjd}|r"|t|t jdkr||dz dz dz nt jdkrktjd}|r(|t|dz d z ||d z d z dz d z natjd }|r%|t|dz ||d z dz t}g}|D]D}| }||vr*| |||E|S)uReturn the per-user Electron download cache directories for this OS. electron-builder's ``app-builder unpack-electron`` extracts the Electron distribution from a zip stored in this cache (NOT from node_modules), so a corrupt zip here — not a bad workspace install — is what poisons the build. Honors the ``electron_config_cache`` / ``ELECTRON_CACHE`` overrides that ``@electron/get`` respects, then falls back to the platform defaults. electron_config_cacheELECTRON_CACHErLibraryCacheselectronr LOCALAPPDATACacheAppDataLocalXDG_CACHE_HOMEz.cache) rrurrerfrr rOrrir) rurSoverridelocalxdgseenoutr5rs r_electron_download_cache_dirsrs 9;;DJz~~566Z"*..IY:Z:ZH*$x..))) |x$*X5 BCCCC   ~..  B   d5kkJ6@ A A A$*W4zAGKLLLLjnn-..  6   d3ii*4 5 5 5$/J6777eeDC  \\^^ T>> HHRLLL JJrNNN JrAcg}tD]v}|st|dD]<} |||-#t $rY9wxYww|dz }|rT|dD]>} tj |d||/#t $rY;wxYw|S)uClear the cached Electron download + half-written unpacked dir so the next ``pack`` re-downloads and re-stages from scratch. Root cause of the ``ENOENT … rename '…/linux-unpacked/electron' -> '…/linux-unpacked/Hermes'`` desktop build failure: a corrupt zip in the per-user Electron download cache (a partial download resumed into the same file leaves prepended/concatenated junk, or an interrupted write truncates it). electron-builder's ``app-builder unpack-electron`` extracts the distribution from that cached zip (NOT from node_modules); a bad zip yields a partial tree MISSING the 193 MB ``electron`` binary, so the final rename dies. Re-running repeats the same broken extraction forever. We deliberately do NOT try to detect corruption ourselves. stdlib ``zipfile`` silently tolerates the prepended/concatenated junk that is the most common corruption here — it reads from the end-of-central-directory backward, so ``testzip()`` returns clean on exactly the zips ``unzip -t`` and ``@electron/get`` reject. Gating the purge on a self-rolled validator would therefore skip the real-world case and never self-heal. Instead, on a packaged-build failure we unconditionally remove the version's cached zips and the stale unpacked dir, then let the caller retry once: ``@electron/get`` re-downloads with its own SHASUM verification (the real source of truth), and ``before-pack.cjs`` re-wipes the unpacked dir. If the failure was unrelated, a clean re-download is harmless and the retry fails the same way. Best-effort: never raises. Returns the paths removed so the caller can log them and decide whether a retry is worthwhile (empty list ⇒ nothing to clear, so no point retrying). zelectron-*.ziprz *-unpackedTr) rrrrrrrrrr)rnrl cache_dirzip_pathrrs rrrs=:G244   !!  y/?@@AA  H !!!x((((       )K#((66  H  hd;;;;x((((     Ns$ )A77 BB9+C%% C21C2z'https://npmmirror.com/mirrors/electron/cZ|dz dz dz dz }|r|S|dz dz S)a{Return the Electron package directory the desktop workspace installs. npm may keep workspace-only dev dependencies under ``apps/desktop/node_modules`` instead of hoisting them to the repo root. Which layout you get depends on the npm version and what else is installed, so a build path that assumes one or the other breaks intermittently across machines. ``apps/desktop/package.json`` points electron-builder's ``electronDist`` at ``node_modules/electron/dist`` relative to the desktop project, so prefer the workspace-local package and fall back to the root hoist when that's where npm landed it. rr>rrrp)r desktop_locals r _electron_dirrsG!6)I5FSM . (: 55rAct|dz }tjdkr|dz dz dz dz Stjdkr|dz S|d z S) atReturn the path to the Electron main binary inside the installed package. electron-builder reads the binary from ``build.electronDist`` since #38673, so this is the exact file whose absence makes a pack fail with "The specified electronDist does not exist". The basename differs per OS (the platform Electron is named for the host the build runs on). rrz Electron.appContentsMacOSElectronrz electron.exer)rr rO)rrs r_electron_dist_binaryr s`  & & /D |xn$z1G;jHH |wn$$ * rAch t|S#t$rYdSwxYw)aPTrue when ``node_modules/electron/dist`` holds a usable Electron binary. A directory that exists but is missing the binary (a partial extraction from a corrupt cached zip, or an interrupted postinstall) counts as NOT ok, since that is exactly the shape that makes electron-builder throw on the pinned electronDist. F)r rjr)rs r_electron_dist_okr'sC$\2299;;; uus # 11ct|}|dz o&|dz ot| S)uUelectron staged (package.json + install.js) but dist missing — blocked postinstall.r install.js)rryr)r electron_dirs r!_electron_pkg_staged_missing_distr5sT ..L  &//11 0 L ( 1 1 3 3 0!,// /rAmirrorrct|rdSt|}|dz }|sdSddlm}m}|d}|sdS|dz }t j|d |d z n#t$rYnwxYw||} |r|| d < tj |t|gt|| d n#t$rYdSwxYwt|S) zKBest-effort: run electron's install.js to populate dist/ (optional mirror).TrFrrrrrzpath.txtELECTRON_MIRRORr r]ra) rrryrrr(rrrrrZr[rq) rr]rr installerrr(rrdl_envs r_redownload_electron_distr?sf&&t ..L|+I     uLLLLLLLL   ' 'D uf$H M($////  "**,,,,      # "3 ' 'F +$* !c)nn-3|3D3D&X]^^^^^ uu \ * **s$/B BB*4C C-,C-ct||rdS|drdSt||tS)zDCanonical download, then fallback mirror unless the user pinned one.TrFr)rrf_ELECTRON_FALLBACK_MIRROR)rr]s r_try_redownload_electron_distrdsI s33t ww !!u $\3?X Y Y YYrActjdkrgS ddl}n#t$rgcYSwxYw |dz }n#t $rgcYSwxYw|sgStj}g} | ddg}n#t$rgcYSwxYw|D]} |j }n#t$rYwxYw| d}| d} | r|||krP t| } n#t tf$rYwxYw|| jvr||g} |D]N} || t#|j?#t$rYKwxYw| rV ||d\} } | D]'} |#t$rY$wxYwn#t$rYnwxYw| S) uTerminate any running desktop app executing from this build's ``release`` dir so a rebuild can replace its (otherwise locked) executable. On Windows a running ``Hermes.exe`` keeps an exclusive lock on ``release/win-unpacked/Hermes.exe``. electron-builder's pack then can't delete the stale binary and dies with ``remove …\Hermes.exe: Access is denied`` / ``ERR_ELECTRON_BUILDER_CANNOT_EXECUTE`` (before-pack hits the same EPERM cleaning the dir). The retry path repeats the failure because the lock is still held. POSIX lets you unlink a running binary, so this is a no-op off-Windows. Scope is deliberately narrow: only processes whose executable lives *inside* this desktop's ``release`` tree are stopped — a packaged install elsewhere or an unrelated "Hermes" process is never touched. Best-effort: never raises. Returns the PIDs we asked to stop. rrNrpidexerr)r rOpsutilrr{rrrgetpid process_iterrrfrrrrr#rr  wait_procsr$)rnr"rmevictims proc_iterrrr r!exe_pathstoppedr~alives r%_stop_desktop_processes_locking_buildr,ms" |w   "Y.7799        BG''77  !! 9DD    H hhuoohhuoo ckSBYY  Cyy((**HH$    H  (* * * NN4 G  NN    NN3tx== ) ) ) )    H   ((!(<G?bundlecddl}|dz dz }|sZ|jdkrOt|dt|dz}|r|d}|sdS ||}n#t$rYdSwxYw|d}|rt|ndS) zEReturn a bundle/framework CFBundleIdentifier for local macOS signing.rNr z Info.plist .frameworkzVersions/*/Resources/Info.plistzResources/Info.plistCFBundleIdentifier) plistlibrjrrrr read_bytesrrfrq)r-r1rrSridents r_desktop_macos_bundle_idr4sOOO J  -D ;;==!V]l::&++&GHHIID KK. / /M M    !a=D ;;==t~~doo//00 tt HH) * *E (3u:::D(s'B:: CCcxtjdkrdS ddlm}|di}t |t sdS|d}t |tsdS|pdS#t$r}td|dYd}~dSd}~wwxYw) u|Return the opt-in keychain identity for local macOS desktop signing. ``desktop.macos_signing_identity`` in config.yaml names a persistent code-signing certificate in the user's login keychain (a self-signed "Code Signing" cert made in Keychain Access is enough — no Apple Developer account needed). Signing with any identity gives the app a certificate-anchored Designated Requirement, which is the strongest way to keep macOS TCC grants (Full Disk Access, Accessibility, Automation, Files and Folders) stable across local rebuilds. Empty/unset keeps the default identifier-pinned ad-hoc signing. rNrrr>macos_signing_identityz; (warning: could not load desktop.macos_signing_identity: z!; falling back to ad-hoc signing)) r rOrrrfrrprqrrrr8)rr>r4r;s r%_desktop_macos_local_signing_identityr7s |xt111111+--##Ir22'4(( 4;;788(C(( 4~~'4'   6 6 6 6   ttttt s#9B*B;B B9B44B9appc Ztjd}|sdS tj|dt |gddd}|jd|j}|jdksd|vsd |vrdStj|d d d t |gdd }|jdkS#t$rYdSwxYw)uTrue when the bundle carries an intact non-ad-hoc (Team ID) signature. Used to make the relaunch fixup a no-op on properly signed/notarized builds even when CSC_LINK / APPLE_SIGNING_IDENTITY aren't in the environment (e.g. a release DMG install being repaired) — clobbering a Developer ID signature with an ad-hoc one would reset TCC grants and can break the hardened runtime. A *stale* real signature (in-place rebuild tampered with the bundle) fails --verify and returns False so the fixup can repair it. codesignFz-dvT)rarXrnrrzTeamIdentifier=zTeamIdentifier=not set--verify--deep--strictrarX) rrrZr[rqr r r\r)r8r:rrBverifys r'_desktop_macos_has_valid_real_signaturer@s|J''H u~ uc#hh 'uTPT   K004;00 ?a  #4F#B#B+v555 z8ZS B    A%% uusA B(3B B*)B*rrr4c tjdsdS|dz dz }|dz dz }|r|std|dz dddd d td t td t t d tddf fd}|dz }g}tj |D]u\}} } t |} | |j } td| DrI| D])} | | z }| dvs |j dvr||*vt|ddD]}||dg}|dz }|rHtj |D]3\}} }t |}|j dvr||4tt!|ddD]5}|j dkr d|jvr|nd}|||t%|6|||t%|t'jdddt |gdd dS)!uRe-sign a local Desktop build so macOS TCC grants survive rebuilds. A plain ``codesign --deep --sign -`` leaves the bundle with a cdhash-only Designated Requirement and strips electron-builder's entitlements. Every rebuild changes the cdhash, so TCC (Full Disk Access, Accessibility, Automation, Files and Folders: Desktop/Downloads/Documents, microphone) treats the rebuilt app as different code and the user must re-grant everything — and the lost entitlements break microphone/JIT under the hardened runtime. Instead, sign inside-out (standalone Mach-O binaries, then nested frameworks/helper apps, then the main bundle), preserving the repo's entitlement plists, and pin an explicit identifier-based Designated Requirement when signing ad-hoc. With a real ``identity`` the certificate anchors the DR, so no explicit requirement is needed. Raises on signing failure; returns True after strict verification passes. r:Frzentitlements.mac.plistzentitlements.mac.inherit.plistz)desktop entitlement plists missing under NT) entitlements identifierrrgrBrCrrcdddg}|r|ddgz }|(|r|dt|gz }|rdkr |dd |d gz }|t|tj|d d dS) N--force--signz--timestamp=nonez --optionsrz--entitlementsrz--requirementsz=designated => identifier "rTr>)rjrqrrZr[)rgrBrCrrr:r4s r sign_pathz0_desktop_macos_local_codesign..sign_path.s)Xx9KL  - [), ,D  # (;(;(=(= # %s<'8'89 9D  T(c// %'RZ'R'R'RS SD CIIt4======rAr c3@K|]}|dVdS).appN)endswithrGs rr;z0_desktop_macos_local_codesign..Js.;;t}}V$$;;;;;;rA> spawn-helperchrome_crashpad_handler>.node.dylibc*t|jSr>rrprs rrz/_desktop_macos_local_codesign..Sss17||rA)r}reverse)r Frameworks>rIr/c*t|jSr>rPrs rrz/_desktop_macos_local_codesign..^sS\\rArIHelper)rBrCr;r<r=r>)rrrjrrrrqrrrfrrprrrrrrr4rZr[)r8rnr4ent_main ent_inheritrGcontents standaloner_dirsfiles root_path rel_partsrrbundlesframeworks_dir_filesr7r-entr:s ` @r_desktop_macos_local_codesignra s>(|J''H uZ'*BBH *-MMK OO   +"4"4"6"6  R j8P R R   (,$( >>>>tn>SM >  >  >>>>>>>.ZHJ gh// & &eUJJ ))#..4 ;;;;; ; ;   & &DT!BBBBbiTGG!!"%%%  &Z%;%;TJJJ%% "e$$$$$G ,N"#%7>#:#: " " D%T Ax111q!!!W+A+A4PPPYY#]f44V[9P9PkkVZ &s7OPV7W7WXXXXXIc5Mc5R5RSSSSN :xSXX>4 4rA)publisher_signing_configuredrbc tjdkrdS|Kttjdptjd}|rdSt |}|dS|jd}t| dr| sdStj d}|sd St|rdStjd d t|gd t!pd } t#|||r|d krdnd}t%d|ddSnC#t&$r6}|d krt%d|dt%d|dYd}~nd}~wwxYw tj|dddd t|gd n*#t&$r}t%d|dYd}~nd}~wwxYwd S)u`Make a locally-built macOS desktop app survive in-place self-update without resetting the user's TCC permission grants. An ad-hoc-signed .app has no stable Designated Requirement, so when the self-updater rebuilds the bundle in place (new cdhash) Gatekeeper reports "Hermes is damaged and can't be opened" — and macOS TCC forgets every permission the user granted (Full Disk Access, Desktop/Downloads/Documents, Accessibility, Automation, microphone), re-prompting on every launch after every update. Clear the quarantine xattrs, then re-sign with a stable identity: ``desktop.macos_signing_identity`` (a persistent keychain cert — strongest) when configured, else ad-hoc with identifier-pinned Designated Requirements, preserving the repo's entitlement plists either way. No-op when a real publisher identity is configured (CSC_LINK / APPLE_SIGNING_IDENTITY) or the bundle already carries an intact Developer ID signature, so a properly signed/notarized build is never clobbered. Callers that already made the publisher-signing decision may pass it explicitly so a later dotenv load can't reverse it. Falls back to the legacy deep ad-hoc sign if the entitlement-preserving path fails. Best-effort: never raises. Returns True when no work was needed or signing + strict verification succeeded. rTNCSC_LINKAPPLE_SIGNING_IDENTITYrrIr:Fxattrz-crrar)rnr4zkeychain identityzstable ad-hoc identityu → macOS desktop signed with z$; TCC grants persist across rebuildsz6 (warning: configured macOS signing identity failed: uB; falling back to ad-hoc — TCC grants may need to be re-granted)z) (warning: stable macOS signing failed (z); using legacy ad-hoc sign)rEr<rFz* (warning: macOS relaunch fixup skipped: r)r rOrrrerfr}rrqrJrrrr@rZr[r7rar8r)rnrbr!r8r:r4rQr;s r!_desktop_macos_relaunchable_fixuprhkss6 |xt#+'+ JNN: & & R"*..9Q*R*R( ( $$t &{ 3 3C {t +a.C s88  V $ $CJJLLt|J''H u.s33tNGUCHH-U;;;;466=#H ] (+PX Y Y Y +3s??''@XE `U``` a a a4  ]]] s?? SSSS    [#[[[\\\\\\\\ ]C)Xxc#hhOW\]]]]] CCC A3AAABBBBBBBBC 5s0/E F,F  F)F<< G#GG#ctjdks|rdS|ds|drdSd|vrdSd|d<dS)u"Stop electron-builder grabbing a random keychain identity on self-update. The desktop self-updater rebuilds *and re-signs the .app on the end user's machine* (``hermes desktop --build-only`` → electron-builder ``--dir``). With ``CSC_IDENTITY_AUTO_DISCOVERY`` on (its default), electron-builder signs the ``type=distribution``, hardened-runtime bundle with whatever it finds in that user's keychain — typically a personal "Apple Development" cert. That stalls/fails the sign step (no Developer ID + no provisioning profile) or clobbers your real notarized signature with an unusable one, so every post-update launch trips Gatekeeper. Force ad-hoc signing for the local packaged rebuild instead: deterministic, and exactly what ``_desktop_macos_relaunchable_fixup`` already finishes off. No-op for source runs, off-macOS, when a real identity is configured (``CSC_LINK`` / ``APPLE_SIGNING_IDENTITY``), or when the caller already pinned the flag. Mutates ``env``; returns True when it set the flag. rFrdreCSC_IDENTITY_AUTO_DISCOVERYfalseT)r rOrf)r]rzs r_force_adhoc_macos_signingrlsh$ |x;u wwzcgg&>??u$++u)0C%& 4rAcPtjdkrdSttdrtjdkrdS t dd5}|dkcd d d S#1swxYwYd S#t$rYdSwxYw) a4Return True when Chromium/Electron should bypass the Linux sandbox. Ubuntu 23.10+ can enable AppArmor's ``apparmor_restrict_unprivileged_userns`` hardening, which breaks Chromium/Electron's user-namespace sandbox for normal users unless the app ships a working root-owned 4755 ``chrome-sandbox`` helper. In headless or non-interactive CLI contexts we may be unable to ``sudo chown/chmod`` that helper, so detect the host restriction and fall back to ``--no-sandbox`` rather than hard-failing the launcher. We intentionally do NOT return True for root users here: running Electron as root without a sandbox is a qualitatively riskier path than launching as an unprivileged desktop user on an AppArmor-restricted host. The root case should remain an explicit user choice. linuxFrrz6/proc/sys/kernel/apparmor_restrict_unprivileged_usernsr]r^rN) r rOrrrrlrRrrrrs r_desktop_linux_needs_no_sandboxros  |wur9"*,,!"3"3u JU\ ] ] ] +ab6688>>##s* + + + + + + + + + + + + + + + + + + uus6B*B = B BBBB B%$B%ctjdkrdS|jdz } |}n#t$rYdSwxYwt j|jS)z=Return True when ``chrome-sandbox`` exists as a regular file.rnFchrome-sandbox)r rOrlstatrrS_ISREGst_mode)rsandbox sandbox_lstats r-_desktop_linux_sandbox_helper_is_regular_filerwsk |wu!(+;;G  uu < - . ..s3 AActjdkrdS|jdz }|st d|dS |}n##t $rt d|YdSwxYwtj|j st d|dS|j dkrtj |j d krdStj d }|st d dSt d |d dt|g|ddt|gfD]6}tj|djdkrt d|dS7dS)z=Configure Electron's Linux SUID sandbox helper when required.rnTrqu?✗ Hermes Desktop is missing Electron's Linux sandbox helper: Fu1✗ Cannot stat Electron's Linux sandbox helper: u;✗ Electron's Linux sandbox helper is not a regular file: ri r{uN✗ Hermes Desktop requires sudo to configure Electron's Linux sandbox helper.u@→ Configuring Electron Linux sandbox helper (sudo required)...chownz root:rootchmod4755rgu9✗ Failed to configure Electron's Linux sandbox helper: )r rOrrjr8rrrrrsrtst_uidS_IMODErrrqrZr[r\)rrurvr{commands r_desktop_linux_sandbox_fixuprs |wt!(+;;G >>   YPWYYZZZu    K'KKLLLuu < - . . UGUUVVVuq  T\-2G%H%HF%R%Rt <  D  ^___u LMMM7KW>wPVX[\cXdXd@ef >' / / / :a ? ? WgWW X X X55 @ 4sAA;:A;ctg}d} ddlm}|pidpi}n#t$r||fcYSwxYw|d}t |t r%t j|tj dk}n(t |ttfr d|D}|d d}t |tr|rd nd }nKt |t r6| }|d vrd }n |d vrd }nd}||fS)aRead `desktop.*` launch options from config.yaml. Returns ``(electron_flags, disable_gpu)`` where ``electron_flags`` is a list of extra Electron CLI flags and ``disable_gpu`` is one of "auto"/"1"/"0" (normalized for the HERMES_DESKTOP_DISABLE_GPU env var the Electron app reads). Best-effort: any config error yields the safe defaults ``([], "auto")`` so a malformed config never blocks the launch. r,rrr>electron_flagsnt)posixcng|]2}t|#t|3Sr@)rqrr)r:rTs rrz+_desktop_launch_options../s1===Ac!ffllnn=Q===rA disable_gpur0)rrrr)rrknor)rrrfrrrqshlexrrrrrrrrrs)flagsrr desktop_cfg raw_flagsraw_gpurs r_desktop_launch_optionsrswEK"111111"{}}*// ::@b """k!!!!" 011I)S!!> Ibgo??? Ie} - ->=====oomV44G'4  !$-cc# GS ! !!mmoo##%% , , ,KK / / /KK K + s '.??rc  tdz dz }|dz s&td|tjd ddlm}|d n#t$rYnwxYwdd lm }|}t|d d rd |d<t|dd rd |d<t|ddrHtt|j |d<t|ddrItt|j|d<nt#j|d<t'\}}|dkrdt"jvr||d<t|dd }t|dd }t|dd } t+|} |s|sCt-} | s2tdtdtjdnd} |rA|rt/|sGtd|dz tdtd tjdt1tdz sJtd!td"td#td tjdtd$|dz nb| Itd%|d&z td'td(tjdntd)| n| pt3|t|*} | s|rd+nd,} td-| d.ntd/|t5}t7| td |0}|jdkrt;tsBtd1td2td#tj|jpdt=t|}|rtd3ntd4|rd+nd,} td5| d6|rd7nd8}t?||*rtd9|sJtA|}|r9td:d;!tEt|d<tGj$| d=|g||d >}|jdkr|st+|g}d }tKts$tM|}tOt|}|rPtd?|D]}td@|tA|tGj$| d=|g||d >}|jdkr|s|(dAst+|tdBtR}tU|}||dA<tKtstOt||CtA|tGj$| d=|g||d >}|jdkrtdDtdE|tj+dFkrtdGtdHtdItdJtj|jpdt+|} |s>tY|t[|| \}}| |s|tjd|} t]t|*t|dKd r|rOt/|s)tdL|dz tjdtdM|dz dNnN| 9tdO|d&z tdPtjdntdQ| dNdS|rEtdRtGj$| dSdTdUdVg||d >}tj|j| 8tdW|d&z tdPtjdt| g}t_| sVtar4tc| r%tdX|2dYntjd|3|tdZd[!|tGj$|||d >}tj|jdS)\z1Build and launch the native Electron desktop GUI.rr>rz!Desktop GUI source not found at: r rr4r<r@r' fake_bootFrHERMES_DESKTOP_BOOT_FAKEignore_existingHERMES_DESKTOP_IGNORE_EXISTINGrNHERMES_DESKTOP_HERMES_ROOTr HERMES_DESKTOP_CWDr,HERMES_DESKTOP_DISABLE_GPUr skip_build force_buildz@Desktop GUI requires Node.js/npm, but npm was not found on PATH.z&Install Node.js, then run: hermes guiuC✗ --skip-build --source was passed but no desktop dist found at: rz4 Pre-build first: cd apps/desktop && npm run buildzG Or drop --skip-build to install dependencies and build automatically.uK✗ --skip-build --source requires existing desktop workspace dependencies.z Install first: cd z && npm ciuI→ Skipping desktop source build (--skip-build --source); using dist at uF✗ --skip-build was passed but no packaged desktop app was found at: rz3 Pre-build first: cd apps/desktop && npm run packz0 Or drop --skip-build to package automatically.u9→ Skipping desktop package build (--skip-build); using )rzz source buildz packaged appu ✓ Desktop z& is up to date (content stamp matches)u0→ Installing desktop workspace dependencies...)rXr]u%✗ Desktop dependency install failedz Run manually: cd u\ ⚠ Dependency install failed with a missing Electron dist; repopulated it and continuing.u ⚠ Dependency install failed with a missing Electron dist; continuing to the build so electron-builder can attempt the Electron fetch itself.u→ Building desktop rJr2packug → No Developer ID configured; ad-hoc signing this local rebuild (CSC_IDENTITY_AUTO_DISCOVERY=false)u@ ⚠ Stopped running desktop app to free the build output (pid rrr[ruP ⚠ Desktop build failed; refreshed the Electron download and retrying once...z - ru ⚠ Desktop build still failing; the Electron download from GitHub looks blocked. Re-downloading via a public mirror (npmmirror.com)... (set ELECTRON_MIRROR to use another mirror)ru✗ Desktop GUI build failedz, Run manually: cd apps/desktop && npm run rz: If this says "Access is denied" on Hermes.exe, close anyz* running Hermes desktop window and retry.zC If the log shows Electron download retries, rebuild via a mirror:zB ELECTRON_MIRROR= hermes desktop --force-build build_onlyu/✗ --build-only --source produced no dist at: u"✓ Desktop source build ready at z (not launching; --build-only)u0✗ --build-only produced no launchable app at: z7 Expected an unpacked Electron app for the current OS.u ✓ Desktop packaged app ready: u1→ Launching Hermes Desktop from source build...rrrr!uH✗ Desktop package build completed but no launchable app was found at: u⚠ Falling back to --no-sandbox because this Linux host restricts unprivileged user namespaces and the Electron sandbox helper could not be configured.z --no-sandboxu'→ Launching packaged Hermes Desktop: rl)4rrjr8r rhermes_loggingr5rrr(rnrqrrrir{r rr^rrer}rfrqrrr2r?r\rrrlr,rhmaprZr[rrrrfrrprOrhrrrrorwrr)rrn_setup_logging_guir(r]config_electron_flagsconfig_disable_gpurzrrrr build_needed build_label nixos_envinstall_resultrepaired build_scriptr* build_resultpurgedrr7r mirror_envverified_executable rolled_back launch_resultlaunch_commands rcmd_guir?s ')3K . ( 0 0 2 2 ?+??@@@   FFFFFF&&&&&      766666  ! !Ct[%((.*- &'t&..403 ,-t]D))_,/T5E0F0F0Q0Q0S0S0[0[0]0],^,^ ()tUD!!0$'TX(A(A(C(C(K(K(M(M$N$N !!$&IKK ! 1H0I0I--V##(DBJ(V(V,> ()$%00K|U33J$ u55K6{CC*'))  T U U U : ; ; ; HQKKKTN  e' 44 r\gjp\prrsssLMMM_``` !,//.@HHJJ cdddFlFFFGGG_``` t^ilr^rtt u u u u ( t[fir[rtt u u u G H H H D E E E HQKKKK cNacc d d d d # &; ;' ' ' x N,7K..^K TTTT U U U U D E E E.-.>.@.@AAI;C^cirsssN(A--8FF=ABBBIIIIJJJH^6;!<<<8sKK8;<<<<7888-8K..^K :+::: ; ; ;&1=77vL)#;GGG =<=== ~ @ LL~|]a]f]fgjknpwgxgx]y]y|||}}}%>3|*D+[^fklllL'1,,#-0==E&( (66L8EEF8sKKHulmmm#,,lqll++++:+FFF#->3|2LR]cfns#t#t#tL'1,,#- 122-1==EWXXX3!#YY 06 ,-(66P-lCOOOO5kBBB)~sE<.Hk_iqvwww &!++4555S\SSTTT<7**XYYYFGGG[\\\Z[[[05A666">{"K"K  :2+>>>4R!4440#['23#6#>HQKKK&9# '| M M M Mt\5))   j' 44 ^ V\H\^^___ k{V7Kkkk l l l l ( ^[S\E\^^ _ _ _ K L L L HQKKKK h5Hhhh i i i+ ABBB"VT:s'KQ\bemrsss  )***" rYdgpYprrsss GHHH  -../N '(; < < * , , 1^_r1s1s  m n n n  ! !. 1 1 1 1 HQKKK/000 NCHH^4L4L N NOOON>{SXYYYMH] %&&&&&s A A,+A,)#_detect_concurrent_hermes_instances_kill_stale_dashboard_processes_scan_dashboard_processes exclude_pidsrc6dt|DS)zJReturn PIDs of stale ``dashboard``/``serve`` processes for update cleanup.cg|]\}}|Sr@r@)r:r _cmds rrz._find_stale_dashboard_pids..Bs V V VICC V V VrAr)rrs r_find_stale_dashboard_pidsr=s% W V!: !U!U!U V V VVrAr~cd}tfddDrd}ntfddDrd}|dSd}d }tjd }|r5 t|d }n#t $rYdSwxYwtjd }|r*|d d pd }|||fS)zJBest-effort parse of a dashboard/server cmdline into mode, host, and port.Nc3 K|]}|vV dSr>r@r:patternr~s rr;z+_parse_dashboard_runtime..Hs<    7      rA)zhermes dashboardzhermes_cli.main dashboardzhermes_cli/main.py dashboardr?c3 K|]}|vV dSr>r@rs rr;z+_parse_dashboard_runtime..Qs<    7      rA)z hermes servezhermes_cli.main servezhermes_cli/main.py server=i#rQz(?:^|\s)--port(?:=|\s+)(\d+)r z/(?:^|\s)--host(?:=|\s+)(\"[^\"]+\"|'[^']+'|\S+)z"')rrr,rrprrr)r~rAporthost port_match host_matchs` r_parse_dashboard_runtimerEsM D                     |t D D:GDDJ z''**++DD   44 MwWWJ?""((//>; t s"B BBrcd|pdd}|dvrdS|S)zDMap wildcard binds to a loopback address suitable for local probing.rQz[]>0.0.0.0r::rF)rrNs r_dashboard_probe_hostrns=%+,,..44T::J***{ rAzhermes-dashboard.servicerunitc tjdkrdSdddtdtdtjfd}d }d }d D]~} |g|d d d R}n"#t tjtf$rY2wxYw|j dkrB|j pd }tfd|Dr|}|}n||dS |g|dR}|g|dR} n##t tjtf$rYdSwxYw|j pd } | j pd } | dkr| dvrdSttd|d|rdnd} dg|dR} | g}|s|ddddfg}|D]} t jt#|ddddd !}nV#t tjtf$r7}|d"|d#|Yd }~yd }~wwxYw|j dkrtd$dS|d"|d#|jp|j pd td%|D](}| rtd&|)td'td(| d)dS)*aRestart a systemd-managed dashboard instead of raw-killing its PID. Returns True when a dashboard unit was found and handled (successfully or with a printed actionable failure). Returning True deliberately prevents the caller from falling back to ``os.kill``: systemd treats a direct SIGTERM of the service's main PID as a clean stop, so ``Restart=on-failure`` will not bring the dashboard back. rFr rrrYrc<tjdg|dddd|S)N systemctlTr]rgrW)rZr[)rYrs r _systemctlz6_restart_managed_dashboard_service.._systemctls3~  4       rAN))--userr@zlist-unit-filesz --no-legendz --no-pagerrrc3K|]9}||ddgkV:dS)rr N)r)r:rArs rr;z5_restart_managed_dashboard_service..sHNNc#))++Nsyy{{1Q3D6)NNNNNNrAz is-activez is-enabledr>linked-runtimeenabled-runtimelinkedstaticr generatedu*⟲ Restarting managed dashboard service (rzsystemctl --userzsudo systemctlrrestartr{r|Tr]rgrrWrlr$u ✓ restarted u ✗ failed to restart z zl Dashboard is managed by systemd; not raw-killing its PID because systemd would treat that as a clean stop.z Restart manually: z restart )r rOrqrrZr4rrprr\r rmrrrr8rr[rrhr )rrrscopelistedrr_ unit_rowsrr active_state enabled_state scope_labelrcommandsrir~rrs ` r"_restart_managed_dashboard_servicerysD |wu.0   #  Z5P    %)E15F&    Z-/35BDPFF":#>> 4s;AA.-A.CC:9C:'F>>H-H  Hr c td|d}|sdS|dd}|D]}|}|dd}t |d kr@|d}|d r"|d dd }|r|cSn#ttf$rYnwxYwdS) a,If *pid* belongs to a systemd service unit, return the unit name. Reads ``/proc//cgroup`` and extracts the service name (e.g. ``hermes-serve.service``). Returns ``None`` when the PID is not part of a systemd service, when the file is unreadable, or on non-Linux platforms. /proc//cgroupNr]rgrhrr rz.servicerr) rryrrmrrrrrJrsplitrPermissionError)r  cgroup_pathrnrorpcg_pathsvc_names r_get_systemd_service_for_pidrs 0C00011 ""$$ 4$$gi$HHOO%% $ $D::<>#q11"5$#OOO $ _ %     4s'CB)CCC+*C+ cgroup_entrycd|vrdSd|vrdSdS)a%Extract the systemd scope (``user`` or ``system``) from a cgroup path. The cgroup path format is ``/system.slice/.service`` for system services and ``/user.slice/user-.slice/.service`` for user services. Returns ``None`` when the scope cannot be determined. z/system.slice/rPz /user.slice/userNr@)rs r_extract_scope_from_cgrouprs)<''x%%v 4rAct td|d}|sdS|dd}|D]I}|}|dd}t |d kr |dcSJn#ttf$rYnwxYwdS) zReturn the cgroup path from ``/proc//cgroup``, or ``None``. Only the unified (``0::``) hierarchy cgroup entry is examined. rrNr]rgrhrr r) rryrrmrrrrrr)r rrnrorps r_get_pid_cgroup_pathrs  0C00011 ""$$ 4$$gi$HHOO%%  D::</cmdline`` (NUL-separated, lossless). macOS: falls back to ``ps -o command=`` + shlex (best effort — quoting is reconstructed, but hermes launch commands don't embed exotic args). Windows: returns ``None``; taskkill /F gives no graceful window and the desktop app manages its own backend there. rNrz/cmdlinerc@g|]}||ddS)r]rgr )rrGs rrz._dashboard_cmdline_for_pid..`s> GI 66rArpsrz-ozcommand=Tr]rgr rWrr)r rOrrgrjrlrRrrZr[rqr\r rrrrrrp)r  cmdline_pathrTryr}r_r~s r_dashboard_cmdline_for_pidrPs |wt---- 7>>, ' ' lD)) Qffhh               IIg..D <4  4S4 4        ! !4=&B--// 4 #;w''DD # # #==??DDD #|t Z!: ;ttse5D. A* D.*A..D.1A.2%D.7D.D.1DD.D'$D.&D''D..E Erc ddlm}g}g}|dz dz } |jddn#t$rYnwxYw|D]} d|vr d|vrg|d}t |d 5}t j|t j|t j dd d d d n #1swxYwY| |}#ttf$r.}| |t|fYd }~d }~wwxYw|D]&}td tj|'|D],\}}td tj|d|-d|DS)a!Best-effort respawn of manually-started dashboards after ``hermes update``. Spawns each recovered argv detached (new session, output to the profile's ``logs/dashboard-restart.log``). Returns the commands that failed to spawn; the caller prints the manual hint for those. rr'logszdashboard-restart.logTrr? --no-openab)rr r start_new_session close_fdsNu ✓ restarted: u ✗ failed to restart (r1cg|]\}}|Sr@r@)r:r~r~s rrz0_respawn_dashboard_processes..s - - - G - - -rA)rr(rrrrlrZrrr rrrqr8rrh) rr( respawnedfailedlog_pathr~log_fr;err_msgs r_respawn_dashboard_processesr{s?100000!#I*,F  6),CCH dT::::      // /g%%+W*D*D1G1[1h%%  $, %,&*"                   W % % % %$ / / / MM7CHH- . . . . . . . . /;; 9EJw$7$799::::"OO MEJw,?,?MMGMMNNNN - -f - - --sK9 AAC,/B' C'B+ +C.B+ /CD$DDallrpc4 ddl}tdz d5}||di}dddn #1swxYwYn#t $rgcYSwxYw|di}t |tsgS||g}g}|D]Y}d|vrSd|vrO|dd d dd d}||vr| |Z|S) zReturn optional extras referenced by a dependency group. ``group`` is usually ``all`` (desktop/server broad install) or ``termux-all`` (Termux-compatible broad install). rNpyproject.tomlrprojectzoptional-dependencies[r=r ) tomllibrrlrmrfrrrprr) rpr handler optional_depsr< referencedrers r!_load_installable_optional_extrasr s| -- 3 3D 9 9 >Vll6**..y"==G > > > > > > > > > > > > > > >  KK 7<>  """    D  HHH  A3GGGGGGGGH Oz # fQiiO GAqMMMM # # #"OOO #Z  2 / 1 1 1  ' ' ) ) 1 . 0 0 0%  & +++))))                 DD &  & +++))))                D s"BD++ F=6AE<;F=< F F=F  F= F=F88F=)G:9K: H KH  AK/)J J&%J&*K K KM!)L  M LMLML10M1 L>;M=L>>Mc$tdt\}}t||}|dvrttddS|dkrtddStdtd t t t t}td d |d d d |DzdS)zDHeal ``.lazy-refresh-incomplete`` via confirmed import-probe repair.uo⚠ A previous lazy-backend refresh may have left the venv unhealthy — running import-based package repair...r|)healthyruF✓ Lazy-refresh venv recovery confirmed — install is healthy again.N indeterminateuw ⚠ Import probes unavailable — cannot confirm venv health. Leaving `.lazy-refresh-incomplete` for the next launch.ue ⚠ Lazy-refresh package repair incomplete. Leaving `.lazy-refresh-incomplete` for the next launch. Recover manually with:rrl install --force-reinstall c3>K|]}tj|VdSr>rquoter:rs rr;z6_recover_lazy_refresh_marker_locked..}s*99!u{1~~999999rA) r8_default_venv_install_target_repair_venv_via_import_probesr _lazy_refresh_repair_specsrr_LAZY_REFRESH_REPAIR_PACKAGESrrh)install_prefix install_envr all_specss rr r asK  1#?"@"@NK +N L L LF (((-/// VWWW     F      F    ())). 34;;==>> ? ?    H388N++ H H Hhh99y99999 :     rActdt}|r1t\}}tdt|| ddlm} t jtj dddd gtd n2#t$r%}t d |Yd }~nd }~wwxYw|}|ritjdt!tdz i}t#|r,|dd |dd t'|dg|t#|rdndn.t'tj ddgt#rdndt)tdd S#t$r}t d|td|rEtdtdtdtdtj dnftdtd ttd!tj d"td!tj d#Yd }~d SYd }~d Sd }~wwxYw)$u'Heal ``.update-incomplete`` via full ``.[all]`` reinstall only. Narrow lazy-refresh import probes are not sufficient proof that a generic interrupted core install finished — a missing dep outside that probe set would otherwise look healthy and clear the breadcrumb too early. ug⚠ A previous `hermes update` was interrupted mid-install — finishing dependency installation now...u → Running from hermes.exe; applying package-only first aid, then quarantined full reinstall (core marker stays until that succeeds)...r|r ensure_uvr ensurepip --upgradez --default-pipT)r rXz,ensurepip during install recovery failed: %sN VIRTUAL_ENVrb PYTHONPATH PYTHONHOMEpipz termux-allrr]rprpuH✓ Dependency installation recovered — your install is healthy again.z'Interrupted-install recovery failed: %su3✗ Could not auto-recover the interrupted install.z Hermes is still running from the launcher that needs replacing. Close other Hermes windows, restart from a different terminal, then run:z cd /d "rz "z" -m pip install -e ".[all]"r) z cd rz -m ensurepip --upgradez -m pip install -e '.[all]')r8'_windows_running_hermes_launcher_lockedr/ r0 hermes_cli.managed_uvr8 rZr[r rfrrrrrrerq_is_termux_envr3_install_python_dependencies_with_optional_fallbackr ) self_lockedr3 r4 r8 r;uv_binuv_envs rr r sI  3:;;KH&B&D&D#      '~;GGGG5F333333  N N{KQ #       N N N LLG M M M M M M M M N  N NM3|f7L3M3MNNFf%% / <... <... ?&4V&<&<Gll%      @u-&4&6&6AllE     ())) XYYYYY FFF  >DDD CDDD  F 0    / /// 0 0 0 DDDD     , - - - *L** + + + @@@@ A A A DDDD E E E E E E E E E      FsDF+BF B4B/*F/B44C"F J"CI??Jc(tsdSt}|dSt|}|sdSt}|D]} |t |J#t$r7|t |YwxYw ddl }| }|gt| zD]m} t t|}n#t$rYbwxYw||vrdSnn#t$rYdSwxYwdS)zTrue when a venv ``hermes*.exe`` shim is this process or an ancestor. Best-effort: returns False when psutil is unavailable or inspection fails. FNrT) _is_windows_venv_scripts_dir_hermes_exe_shimsrrrqr{rsrr"Processrrrr!r) scripts_dirshimsshim_setshimr"r&rexe_norms rrA rA s ==u#%%Ku k * *E uH,, , LLT\\^^,,2244 5 5 5 5 , , , LLT** + + + + + ,  ^^  D4 ---  D tDHHJJ//7799::@@BB    8##tt$   uu 5sP AB>CC?FAE('F( E52F4E55F?F FFc@ ddlm}|}n#t$rd}YnwxYw|rhitjdt t dz i}t|r,|dd|dd|dg|fStj d dgdfS) zHReturn ``(install_cmd_prefix, env)`` for the project venv when possible.rr7 Nr; rbr< r= r> r) rB r8 rrrerqrrC rr rf)r8 rF r]s rr/ r/ s333333  $GG]C v0E,F,FGG #   ( GGL$ ' ' ' GGL$ ' ' '## ND% ($ ..s  "")r]heartbeat_interval_secondsrT ctjtjd fd }tj|d}| t j|td| | ddS# | dwxYw) a3Run dependency install command with periodic heartbeat output. Some resolvers/build backends (especially when compiling Rust/C extensions) can stay quiet for minutes. Emit a simple elapsed-time heartbeat so users know ``hermes update`` is still progressing even if pip/uv itself is silent. rNcsOttjz }t d|ddMdSdS)Nu% … still installing dependencies (uCs elapsed) — compiling Rust/C extensions can take several minutesTr )r"rrr r8)elapseddonerT r%s r _heartbeatz/_run_install_with_heartbeat.._heartbeats))677 %*,,.//G LLLL    ))677     rATr)r rar]g?rr) rEventrr r!r%rZr[rrrh)rlr]rT rY rrX r%s ` @@r_run_install_with_heartbeatr[ s ?  D JLLE  4888AGGIII          s   ss B&&,Cc"tjdkS)Nr)r rOr@rArrI rI .s <7 ""rActdz }|sdSddlm}||t }|r|ndS)zKReturn the venv Scripts directory if we're running inside the project venv.rbNr) venv_bin_dirwindows)rrrr^ rI )venv_dirr^ rs rrJ rJ 2sff$H ??  t------l8[]];;;Gnn&& 077D0rArM ctsgSttphd}|dfdt |DS)uEntry-point shims that uv may try to rewrite during ``pip install -e .``. On Windows these are .exe launchers generated by setuptools/uv. On POSIX they're regular Python scripts which can be replaced atomically — no self-replacement hazard exists outside Windows. > hermes-acp hermes-agentrGzhermes-gatewayc g|] }|dz  S.exer@r:rrM s rrz%_hermes_exe_shims..Ks$ B B BDKT--- ' B B BrA)rI r_load_console_script_namesrr)rM namess` rrK rK =sk == *,, - - Y1Y1Y1YE II B B B BF5MM B B BBrAr) max_attemptsrk c Jg}ts|Sddl}t|dz}gd}tdt |t |}t |D](}|s||j d|z}d} t|D]m} || dz } | r| |  | || ||fd} n#t$r } | } Yd} ~ fd} ~ wwxYw| t||} | r(t!d|jd t!d t!d |jd | jjd t!d*|S)uPPre-empt Windows file lock on the running ``hermes.exe``. Windows allows RENAMING a mapped/running executable (the kernel tracks the file by handle, not path), but blocks DELETE/REPLACE while it's loaded. uv needs to overwrite the entry-point shims during ``pip install -e .``; when ``hermes update`` runs, ``hermes.exe`` IS the live process, and uv fails with ``Access is denied. (os error 5)``. We rename live shims to ``hermes.exe.old.`` first. uv then writes fresh shims at the original paths. The ``.old`` files are cleaned up on the next hermes invocation by ``_cleanup_quarantined_exes``. Rename can still fail when *another* process has opened the .exe without ``FILE_SHARE_DELETE`` — typically AV real-time scanners with transient handles (recovers in <1s), or the Hermes Desktop backend child process (won't recover until the user closes it). We mitigate: 1. Retry up to ``max_attempts`` times with exponential backoff (100/250/500/1000 ms). Handles the AV-scanner case. 2. If all retries fail, schedule the .exe for replacement on next reboot via ``MoveFileExW(MOVEFILE_DELAY_UNTIL_REBOOT)``. This still lets uv create a fresh shim at the original path (Windows will keep the old file's content under a new name until the reboot), so the update can complete; the user just needs to reboot to fully unload the stale image. 3. Print a clear warning naming the most likely culprit (running Hermes Desktop / gateway / REPL) and pointing to ``--force``. Returns the list of (original, quarantined) pairs so the caller can roll back if the install itself fails before uv writes a replacement. Pairs where we used ``MOVEFILE_DELAY_UNTIL_REBOOT`` are NOT returned — they are already deferred and roll-back is meaningless. rN)rdrm r z.old.g@@ ⚠ zD is locked by another process; scheduled replacement on next reboot.zb The new shim was written at the same path, but a reboot is needed to fully unload the old one.u ⚠ Could not quarantine rwz&: another process is holding it open).zy Close Hermes Desktop, exit other `hermes` REPLs, stop the gateway, or pause AV scanning, then re-run `hermes update`.)rI r rrr+rrK rj with_suffixrr*rgrrr_schedule_replace_on_rebootr8r __class__rs)rM rk movedr r backoff_msattemptsrP rlast_excattemptdelayr scheduleds r_quarantine_running_hermes_exer| Ns.H&(E == KKK  d" # #E*))J1c,J8899H!+..2 2 {{}}  !!$+"?@@#'X  Gw'&0E " 5!!!  F### dF^,,,       0f==   ////    @      4$) 4 4x7I7R 4 4 4     J    Ls'.D D-!D((D-rP quarantine_targetc@tsdS ddl}ddlm}d}d}|jjj}|j|j|jg|_|j |_ |t|t|||z}t|S#t$rYdSwxYw)u7Schedule ``shim`` -> ``quarantine_target`` via PendingFileRenameOperations. Uses Win32 ``MoveFileExW`` with ``MOVEFILE_REPLACE_EXISTING | MOVEFILE_DELAY_UNTIL_REBOOT``. The OS persists the rename in ``HKLM\System\CurrentControlSet\Control\Session Manager\ PendingFileRenameOperations`` and applies it before any user-mode code runs on next boot — at which point no process can hold the .exe. Returns ``True`` if the schedule call succeeded, ``False`` otherwise (non-Windows, ctypes failure, lack of privilege, etc.). Never raises. FrNrr r)rI rNrwindllr MoveFileExWLPCWSTRDWORDrrrrqrr)rP r} rNrMOVEFILE_REPLACE_EXISTINGMOVEFILE_DELAY_UNTIL_REBOOTr rzs rrs rs s ==u ######$'!&)#m,8 ( 0(2BHNS &m  [ II ! " " %(C C   Bxx uusA`` do not rewrite ``hermes.exe``. The editable-install quarantine path would rename shims without uv recreating them on Windows (#57828). r|N)r[ )rlr]s r_run_package_only_installr ) s ------rArc: ddl}n#t$r|cYSwxYwtdz }|s|S t |d5}||didgpg}dddn #1swxYwYn4#t$r'}t d||cYd}~Sd}~wwxYwi ddl m }|D]f} ||}| d d d |j<W#t$rYcwxYwn#t$r|D]}| d d d } | } d D]$} | | vr| | d d} n%| d d d } | r| | <YnwxYw fd |DS)zGMap repair package names to their declared pin specs in pyproject.toml.rNrrr dependenciesz*lazy refresh repair spec lookup failed: %s Requirement;r z==z>=z<=z~=>rz!=r c`g|]*}||+Sr@)rfrs)r:r name_to_specs rrz._lazy_refresh_repair_specs.._ s1 C C C3L  SYY[[# . . C C CrA)r rMrryrlrmrfrrrpackaging.requirementsr rrrrrs)rr pyprojectrTraw_depsr;r rreqrbareopr}r s @rr1 r1 7 s //I      )T " " Xa||A**9b99==nbQQWUWH X X X X X X X X X X X X X X X  A3GGG$&L)666666  D !k$''15C1C1CA1F1L1L1N1N SX^^--..        ) ) ) ) )D::c1%%a(..00DD>  ::::b!,,Q/DE**,,$$S!,,Q/5577==??C )$( S! ) ) ) D C C C( C C CCs B# AB B#BB#BB## C-C CC E %AD98E 9 EE EE B?H  H install_cmd_prefixc t||}|dSddtD}d|d} tjt |d|gdddd d | }n3#t $r&}td |Yd}~dSd}~wwxYw|j d kr2td|j |j pddddSd|j D}g}t} |D]L} t| } | r.| | vr*| | || M|S)uaProbe lazy-refresh packages via real imports. Returns: - ``[]`` when probes ran and every package imported cleanly - ``[dist, ...]`` when probes ran and some packages failed - ``None`` when the probe could not run (missing venv Python, subprocess failure, non-zero probe exit) — this is *indeterminate*, not healthy Nrc3.K|]\}}d|d|dVdS)z (rz),Nr@)r:modrBs rr;z6_detect_broken_lazy_refresh_imports..s sK(1T######rAz import os import sys probes = [ a\ ] broken = [] for mod, attr in probes: try: imported = __import__(mod) if not hasattr(imported, attr): broken.append(mod) elif mod == 'certifi': # The module can import cleanly while cacert.pem is # missing/corrupt (brew Python upgrade, interrupted venv # rebuild) - every TLS call then fails (#29866). bundle = imported.where() if not os.path.isfile(bundle) or os.path.getsize(bundle) < 1024: broken.append(mod) except Exception: broken.append(mod) print('\n'.join(broken)) rTr]rgFrXrnr_rirar]z$lazy refresh import probe failed: %srz'lazy refresh import probe exited %s: %src^g|]*}||+Sr@rFr:ros rrz7_detect_broken_lazy_refresh_imports.. s=tzz|| rA)_resolve_install_target_pythonrhr rZr[rqrrrr\r r rmrr2 rfrr) r r]r0 probe_lines check_scriptr_r;broken_modulesrrr rs r#_detect_broken_lazy_refresh_importsr b s11CSIIKt))5PK &  & & &.    t\ 2       ;SAAAtttttA 5   ] b$3$ '   t!'!9!9!;!;NHUUD!!+//44  !3d?? HHSMMM OOC Os+A,, B6BBc|sdSt|} t|ddg|z|n8#tj$r&}td|Yd}~dSd}~wwxYwt ||}|gkS)z@Force-reinstall ``packages`` and re-probe imports. Never raises.Tr z--force-reinstallr|z#lazy refresh venv repair failed: %sNF)r1 r rZCalledProcessErrorrrr )r rr]specsr;afters r#_repair_broken_lazy_refresh_importsr s t &x 0 0E! )-@!I5!I I       (K|]}tj|VdSr>r, r. s rr;z1_repair_venv_via_import_probes.. s; ArAuA ⚠ Venv repair incomplete. Run manually, then `hermes update`:rr* r)r r8rhr r1 )r r]brokenmanuals rr0 r0 s1"11C M M MF ~ U    y  - 99V   - - -+F +,,,z XX :6 B BF MNNN Psxx*++PPPP 8rAr? ctrtnddttddffd } |ddd|dgt  dS#t j$rtd YnwxYw|gd g}g}t| D]T} |ddd|dg| |+#t j$r| |YQwxYw|r%td d ||r%tdd |t|t  dS)aInstall base deps plus as many optional extras as the environment supports. By default this targets ``.[all]``; Termux callers can pass ``group='termux-all'`` to use the curated Android-compatible profile. On Windows, pre-renames live ``hermes.exe`` / ``hermes-gateway.exe`` shims in the venv Scripts dir before each install attempt so uv can write fresh copies (Windows blocks REPLACE on a running .exe but allows RENAME). See ``_quarantine_running_hermes_exe`` for the rationale. Nrrc2t|zdS)Nr )r )rr]r rM s r_installzE_install_python_dependencies_with_optional_fallback.._install!s0  %3K      rAr rz.[r=r|u` ⚠ Optional extras failed, reinstalling base dependencies and retrying extras individually...)r rr!r@ u0 ✓ Reinstalled optional extras individually: ru1 ⚠ Skipped optional extras that still failed: r? ) rI rJ rrq!_verify_console_scripts_installedrZr r8r rrh#_verify_core_dependencies_installed)r r]rpr failed_extrasinstalled_extrasrrM s`` @rrD rD s *5@#%%%DK tCy T         )T====1222)*<#FFFF  (    n       H # # #$$$!M"$2???(( ( Hi}E}}}5 6 6 6  # #E * * * *, ( ( (   ' ' ' ' ' (  \tyyIY?Z?Z \ \     Z -@X@X Z Z   ((:5QQQQ%&8cBBBBBBs##A$$BB,'C$C;:C;c ddl}n#t$rgcYSwxYwtdz }|sgS t |d5}||}dddn #1swxYwY|didipi}d|DS#t$r'}t d|gcYd}~Sd}~wwxYw) zCReturn ``[project.scripts]`` entry-point names from pyproject.toml.rNrrrrc0g|]}|t|Sr@)rq)r:rs rrz._load_console_script_names..D!s#666d6D 666rAz>console script verification: failed to read pyproject.toml: %s) r rMrryrlrmrfrrr)r r rTrrrs rri ri 5!sR  //I       )T " " #a<<??D # # # # # # # # # # # # # # #((9b))--i<<B66g6666  UWXYYY sM B/ A, B/,A00B/3A04:B// C 9CC C ctsdStdStsdSdttffd }|}|sdSt dt |dd|t d t|gdz| nG#tj $r5}t d |t d Yd}~dSd}~wwxYw|}|r(t d d|d dSt ddS)uEnsure every declared console_script shim exists on disk after install. On Windows, ``uv pip install -e .`` can register ``hermes.exe`` in the wheel RECORD while the file never lands on disk — typically when the live ``hermes.exe`` shim is locked during ``hermes update``, or when uv/distlib skips a launcher write. The symptom is ``hermes-agent.exe`` and ``hermes-acp.exe`` present but ``hermes.exe`` missing, so ``hermes`` drops off PATH even though the install reported success (issue #52931). If any shim is missing we reinstall with ``--reinstall -e .`` under the same quarantine dance as the primary install path, then re-check. Nrc fdDS)NcHg|]}|dz |Srf )ryrh s rrzG_verify_console_scripts_installed.._missing..g!sF   T---/88::    rAr@)rj rM sr_missingz3_verify_console_scripts_installed.._missingf!s.        rA ⚠ Verification: z$ console script(s) missing on disk: ru3 → Reinstalling entry points with --reinstall...r  --reinstallrr!r z6console script verification: repair install failed: %sub ⚠ Entry point repair failed; try `hermes update --force` after closing other hermes processes." ⚠ Still missing after repair: z1. Workaround: python -m hermes_cli.main u' ✓ All console entry points restored) rI rJ ri rrqr8rrhr rZr rr)r r]r missingr still_missingrj rM s @@rr r J!s" ==#%%K & ( (E  d3i       hjjG   s7||  99W     ?@@@  !F!F!F F#      (OQRSSS  .     HJJM9  >=1I1I > > >     788888s#B;;C? *C::C?c 2  ddl}n#t$rYdSwxYwtdz }|sdS t |d5}||}dddn #1swxYwY|didgpg}n3#t$r&}t d|Yd}~dSd}~wwxYwg} ddl m } |D]?} | | } | | j | jf0#t$rY._missing_deps..!s-TTTtzz||T TTTrA)rZr[rqrrrr rm)r r_r applicabler]r0s r _missing_depsz:_verify_core_dependencies_installed.._missing_deps!s +  ^[!!4C C#GI FF    LLBA F F FIIIIII UT)A)A)C)CTTTTs-3 A$AA$A$r z( declared dep(s) missing after install: rrrJru; → Reinstalling base group with --reinstall to repair...r r z+dep verification: repair install failed: %su@ ⚠ Repair install failed; check `hermes update` output above.u2 ✓ All declared core dependencies now installedc<g|]}||Sr@r)r:rr s rrz7_verify_core_dependencies_installed..,"s) ; ; ;\  a # # ; ; ;rAu1 → Force-installing remaining missing dep(s): r r r|z/dep verification: per-package repair failed: %su ⚠ Could not install: zC. Run `hermes update --force` after closing other hermes processes.r )r rMrryrlrmrfrrrr r rrrrrrevaluater rrqr8rrhrI rJ r rZr rr[ )r r]rpr r rTrr rdepsr rr rr rrr r rM repair_argsr r r final_missingr r r0s ` @@@rr r !s$ //I      )T " " #a<<??D # # # # # # # # # # # # # # #88Ir**..~rBBHb  JANNN/1D*666666  D !k$'' SXsz23333        * * * * *D::c1%%a(D>  ::::b!,,Q/DE::<<%%c1--a06688D * T4L))) * * *J$$ f >   d # # #  $   (!!$''' $ $ $   d # # # # # $ 11CSIIKU49UUUUUUUU,mooG   Gs7|| G G 99WRaR[ ! ! G,/LL1,<,<55" G G GHHH*5@#%%%DK777K  ,#;       (DaHHH PQQQ "MOOM  BCCC LCCzz#q!!!$**,,:  BTzzzz"a((+?C TZZ\\''Q//288::;; ; ; ; ;] ; ; ;E NDIIe> d%**:*:*<*<<<L 4rAc t|Sr>)rcr|s rrC rC c"s )# . ..rAnpm_pathc|}|dp|dpd|vS)u&Return True if ``npm_path`` points at a Windows npm shim. On WSL the Windows install dir is exposed through the ``/mnt/c`` drive mount and PATH interop, so ``shutil.which("npm")`` can hand back ``/mnt/c/Program Files/nodejs/npm`` (or the ``npm.cmd`` / ``npm.exe`` shim). Those are detected here by their ``.exe``/``.cmd``/``.bat`` suffix, a ``/mnt/`` drive-mount prefix, or an embedded backslash (a UNC path). Callers use this only on a POSIX host — on native Windows an ``npm.cmd`` shim is the correct executable. )rg z.cmd.bat/mnt/\)rsrJr)r rs r_is_windows_npm_pathr g"sI ..  C -..  >>' " "  8 rAcddlm}|d}tr|S|sdSt|s|StjddtjD]W}|r'| dr,tj d|}|rt|s|cSXdS) a5Resolve an npm executable that belongs to the host's Node runtime. On WSL/Linux ``shutil.which("npm")`` may resolve a Windows npm exposed through PATH interop. Running that Windows npm against the Linux checkout operates over ``\wsl.localhost\...`` UNC paths and fails with EISDIR / symlink errors in symlink-heavy trees like ``ui-tui`` (#30271). Refuse a Windows npm on a POSIX host and re-scan PATH (skipping ``/mnt/*`` interop entries) for a Linux-native npm. Returns the npm path, or ``None`` when no suitable npm is reachable. rrrNrrr rc) rrrI r rrerfrrrsrrr)rr directoryrs rrfrfz"s655555  u % %C}} t  $ $ Z^^FB//55bjAA  IOO--88AA  LY777  1)<<     4rAc6eZdZdZdZdZdZdZdZdZ dS) _UpdateOutputStreamuStream wrapper used during ``hermes update`` to survive terminal loss. Wraps the process's original stdout/stderr so that: * Every write is also mirrored to an append-only log file (``~/.hermes/logs/update.log``) that users can inspect after the terminal disconnects. * Writes to the original stream that fail with ``BrokenPipeError`` / ``OSError`` / ``ValueError`` (closed file) no longer cascade into process exit — the update keeps going, only the on-screen output stops. Combined with ``SIGHUP -> SIG_IGN`` installed by ``_install_hangup_protection``, this makes ``hermes update`` safe to run in a plain SSH session that might disconnect mid-install. c0||_||_d|_dSr) _original_log_original_broken)selfr log_files r__init__z_UpdateOutputStream.__init__"s! %rAc|j, |j|n#t$rYnwxYw|jr-t |t t frt|ndS |j|S#tttf$r7d|_t |t t frt|ndcYSwxYw)NrT) r rrr rrqr]rr BrokenPipeErrorrr)r rs rrz_UpdateOutputStream.write"s 9   %%%%       F *4#u > >E3t999A E F>''-- -*5 F F F%)D ! *4#u > >E3t999A E E E  Fs$ 11)BA CCc|j+ |jn#t$rYnwxYw|jrdS |jdS#t t tf$r d|_YdSwxYw)NT)r r rr r r rrr s rr z_UpdateOutputStream.flush"s 9   !!!!        F ) N " " " " "*5 ) ) )$(D ! ! ! ! )s# 00AA:9A:cj|jrdS |jS#t$rYdSwxYwr)r r rrr s rrz_UpdateOutputStream.isatty"sM   5 >((** *   55 s $ 22c4|jSr>)r rRr s rrRz_UpdateOutputStream.fileno"s~$$&&&rAc,t|j|Sr>)rnr )r rs rrtz_UpdateOutputStream.__getattr__"st~t,,,rAN) rs __module__ __qualname____doc__r rr rrRrtr@rArr r "s{"&&& FFF( ) ) )''' -----rAr gateway_modectjtjddd}|r|Sddl}t |dr9 ||j|jn#ttf$rYnwxYw ddl m }|dz }| dd |d z }t|d d d }ddl }|d|j dd||d<t#|d|t_t#|d|t_d|d<n#t$$rd|d<YnwxYw|S)u$Protect ``cmd_update`` from SIGHUP and broken terminal pipes. Users commonly run ``hermes update`` in an SSH session or a terminal that may close mid-install. Without protection, ``SIGHUP`` from the terminal kills the Python process during ``pip install`` and leaves the venv half-installed; the documented workaround ("use screen / tmux") shouldn't be required for something as routine as an update. Protections installed: 1. ``SIGHUP`` is set to ``SIG_IGN``. POSIX preserves ``SIG_IGN`` across ``exec()``, so pip and git subprocesses also stop dying on hangup. 2. ``sys.stdout`` / ``sys.stderr`` are wrapped to mirror output to ``~/.hermes/logs/update.log`` and to silently absorb ``BrokenPipeError`` when the terminal vanishes. ``SIGINT`` (Ctrl-C) and ``SIGTERM`` (systemd shutdown) are **intentionally left alone** — those are legitimate cancellation signals the user or OS sent on purpose. In gateway mode (``hermes update --gateway``) the update is already spawned detached from a terminal, so this function is a no-op. Returns a dict that ``cmd_update`` can pass to ``_finalize_update_output`` on exit. Returning a dict rather than a tuple keeps the call site forward-compatible with future additions. NF) prev_stdout prev_stderrr rrSIGHUPr'rTrz update.logrNr r]) bufferingr_z === hermes update started seconds)timespecz === r r r r)r r r signalrr SIG_IGNrrrr(rrlrErrrr r)r state_signal_get_hermes_homelogs_dirrr _dts r_install_hangup_protectionr "s<zz   E w!!  NN7>7? ; ; ; ;G$    D ! JIIIII##%%.td333l*#WEEE H|!!++Y+?? H H H   %j(})=xHH (})=xHH !k !!!!j! Ls$ AA*)A*.CEEEc|sdS|drx |dtjt_n#t$rYnwxYw |dtjt_n#t$rYnwxYw|d}|< ||dS#t$rYdSwxYwdS)zWRestore stdio and close the update.log handle opened by ``_install_hangup_protection``.Nrr r r )rfr r rr r rh)r r s r_finalize_update_outputr :#s   yy =#*==CJJ    D  =#*==CJJ    D yy$$H  NN    NN         DD  s5*A AA*B BB*(C C"!C"cPt|ddpdpdS)a5Normalize ``args.branch`` into a non-empty branch name. Centralizes the "default to main, accept --branch override, treat empty or whitespace-only values as the default" parsing so every consumer of ``--branch`` (check path, git-update path, ZIP-fallback path) agrees on the same answer. branchNr)rnrrrs r_resolve_update_branchr P#s, D(D ) ) 3V : : < < FFrAsaved_mbc,|dkrd|ddSd| ddS)u%Human label for a before/after database size delta, in MB. A negative delta means the file GREW — concurrent session writes during a long optimize can outweigh what the rebuild freed. Printing "reclaimed -163.0 MB" for that reads as data loss, so say "grew by" instead. rz reclaimed z.1fz MBzgrew by r@)r s r_size_delta_labelr [#s71}}-H----- (xi ( ( ( ((rAc ddlm}m}m}m}m}|r |ddS|t }|dkr+t|tj d|dvr,t||tj dt|dd r>t|}t|tt|d d dSt|d d }t| } ddlm} m} m} | } | s@t| | jt+| tj |  t-|| | t+| dS#| t+| wxYw)zUpdate Hermes Agent to the latest version. Thin wrapper around ``_cmd_update_impl``: installs hangup protection, runs the update, then restores stdio on the way out (even on ``sys.exit`` or unhandled exceptions). r)rCformat_docker_update_message is_managed managed_error%recommended_update_command_for_methodzupdate Hermes AgentNdockerr >nixnixosraFr )r branch_explicitgateway)r )UPDATE_EXIT_CONCURRENT UpdateLockdescribe_holder)rrCr r r r rr8r rrnr rnrr hermes_cli.update_lockr r r acquireholderr ror)rrCr r r r install_methodr r _update_io_stater r r _update_locks r cmd_updater h#sYz|| +,,,+*<88N!! **,,---  ))) 33NCCDDD  tWe$$(-- x!>!>??     4E22L 2|LLL :<(acpr<rrrAclawcrondumprrloginr*r=setuprbackuprdoctorhonchoimportlogoutmemoryrrrr>r pairingpluginsprofilerFwebhookinsightsr0rrr?rZ completionr>rrrrrr rrl)rrrrh)r} _SUBCOMMANDS_SESSION_FLAGSr_rrrps r_coalesce_session_name_argsr6 #sY)))LT<;;N F A c$ii--Q N " " MM% FAECII Q**3//G<// T!W%%%Q CII Q**3//G<// / chhuoo... MM% FA% c$ii--& MrAc /ddlm}m}m}m}m}m}m}m}m } m } m } ddl m } t|dd} | |}| }td|td||}|D]}|j|ks |dkr|jr|jr,td |j|jr d |jd nd ztd |jrdndtd|jd|jr(|jp|j}td|d|jntdS| dkr%|}|}|stddStdddddddddddddd tdd d!d"d!d#d!d#d!d$ |D]}|j|ks |dkr |jrd%nd&}|j}|jpd'dd(}|jrdnd}|jr|jp|jnd'}|jrd'}|jr|jd)|jpd*}|dd+}nd'}t||d,d|dd|dd|dd| tdS| d-kr|j} |||dkrtd.ntd/|dSdS#t6t8f$r1}td0|t;jd1Yd}~dSd}~wwxYw| d2kr|j}t|d3d4}t|d5d4}t|d6d4}t|d7d4} t|d8d}|p|du} ||||| ||t|d9d:}!td;|d<|!| s|rDt|d8dp |}"|rtd=|"d>ntd?|"d@| s|r6 ddAlm }#|#|rtdB|d n#tB$rYnwxYw| s|s||!}$|$r%|$"dCrtdDnZ|$r6tG|$"dEg}%t|%dFn"tdG$||s||}&|&rm>}?m } m?}@|;|s'td|dt;jd1|:|}!|<|!\}}A|=|!}|>|!}B|?|!\}C}D}E|@|}Ftd|td|!|rtd||Ard |Ad nd ztd|rdndtd|Btd|!dz @rdndtd|!dz @rdnd|Cr>td|Cd)|Dpd*|Ertd|Etd|d|Fr=t:jAdk}G| |Gr|Fdn|Fz }Htd|Fd|d|Hd tdS| dkrk|j}t|dd4}It|dd}Jddlm:};mB}K|;|s'td|dt;jd1|Jp|}F |K|Fn=#t6$r0}0td0|0t;jd1Yd}0~0nd}0~0wwxYw|Ir5| |Frtd|FddStd|FddS||F}&|&r&td0|&t;jd1||F|Jr|nd}'|'r9td|'| std| dPdSdSdS| dkrddlmC}L |L|jD|jE}Mtd|jDd|jEtd|MddS#t6tRt8f$r1}td0|t;jd1Yd}~dSd}~wwxYw| dkrddlmF}N|j}|jGp|d}O |N||O}Ptd|d|PdS#t6t8f$r1}td0|t;jd1Yd}~dSd}~wwxYw| dkrddlmH}Q |Q|jIt|dd}!|!j}td|d|!||}&|&s||}'|'rtd|'tdS#t6tRt8f$r1}td0|t;jd1Yd}~dSd}~wwxYw| dkr#ddlJ}RddlKmL}SmM}TmN}U |ROd5}V|S|jPtO|Vt|dd}Wt|Wt|dad4so tdST}Xn#ttf$rd }XYnwxYw|Xdvrtd ddddSdddn #1swxYwY|T|jPt|ddt|dd4t|dd4}Wtd|WjWjd|WjWjXtd|WjY|WjWjZrtd|WjYdƝ|Wj[rtd|WjWjdȝtd|WjWjdMdS#|Ut6f$r1}td0|t;jd1Yd}~dSd}~wwxYw| dkrddlKm\}Ym]}ZmN}Uddlm0}:m.}[|j} |[|}\|Z|:|\}]|]'td|\d͝t;jd1t|dd4}^t|dad4std|\d|]jPpdћtd|]jX|^rtdӦntdԦtdզ td֦ST}Xn#ttf$rd }XYnwxYw|XdvrtdצdS|Y|\|^ئ}Wtd|WjWjd|WjWjX|Wj[rtd|WjWjdȝdSdS#|Ut6f$r1}td0|t;jd1Yd}~dSd}~wwxYw| dkrddlKm^}_mN}U |_|j}`n?#|Ut6f$r0}td0|t;jd1Yd}~nd}~wwxYw|`std|jdߝdStd|`"dtd|`"dd*|`"d9rtd|`d9|`"drtd|`d|`"drtd|`d|`"drtd|`d|`"drtd|`d|`"drtd|`d|`"dpg}a|artd|aD]}b|b"dd{rdnd}3d&|bdd |3d }c|b"d9r|cd|bd9z }ct|c|b"dtd|bdtdSdS)u;Profile management — create, delete, list, switch, alias.r) list_profilescreate_profiledelete_profileseed_profile_skillsset_active_profileget_active_profile_namecheck_alias_collisioncreate_wrapper_scriptremove_wrapper_script_is_wrapper_dir_in_path_get_wrapper_dirrprofile_actionNz Active profile: zPath: rzModel: rwrrzGateway: runningr*zSkills: z installedzAlias: u → hermes -p rzNo profiles found.z Profilez<16rlModelz<28Gatewayz<12Alias Distributionu-───────────────ruQ───────────────────────────u!───────────u<────────────────────u ◆r—@?rS z<15usez Switched to: default (~/.hermes)z Switched to: r r createcloneF clone_allno_alias no_skills clone_fromrr)rrT rQ clone_configrR rS rrz Profile 'z ' created at zFull copy from z5 (excluding session history, backups, and snapshots).z.Cloned config, .env, SOUL.md, and skills from r!)clone_honcho_for_profilezHoncho config cloned (peer: skipped_opt_outz`No bundled skills seeded (--no-skills). Delete .no-bundled-skills in the profile to opt back in.copiedz bundled skills synced.u9⚠ Skills could not be seeded. Run `{} update` to retry.u ⚠ Cannot create alias 'u' — z/ Choose a custom alias: hermes profile alias z --name z$ Or access via flag: hermes -p z chatzWrapper created: u ⚠ z is not in your PATH.z3 Add to your shell config (~/.bashrc or ~/.zshrc):z( export PATH="$HOME/.local/bin:$PATH"z~/z Next steps:z0 setup Configure API keys and modelz" chat Start chattingz/ gateway start Start the messaging gatewayz Edit z/.env for different API keysz Edit z"/SOUL.md for different personalityu. ⚠ This profile has no API keys yet. Run 'z setup' first,z8 or it will inherit keys from your shell environment.z!/SOUL.md to customize personalitydeleter)rdescribe)r all_missingr, overwriternrz'profile describe: --all requires --autor2rzJprofile describe: --all is mutually exclusive with a profile name / --textzr?rzInstall cancelled.rD)rrD create_aliasu ✓ Installed 'z' vz Profile path: zA Next: copy .env.EXAMPLE to .env and fill in required keys: z /.env.EXAMPLEz^ Cron jobs were included but are NOT scheduled automatically. Review them with: hermes -p z cron listz Use with: hermes -p r)update_distribution read_manifestrr )r` normalize_profile_namezt' is not a distribution (no distribution.yaml). Only profiles installed via `hermes profile install` can be updated. force_configz Update 'z' from: z (no source)z Currently at version z6 --force-config set: config.yaml WILL be overwritten.zC config.yaml will be preserved (pass --force-config to overwrite).zA User data (memories, sessions, auth, .env) will NOT be touched.z Proceed? [y/N] zUpdate cancelled.)rz u ✓ Updated 'u' → vz6 Cron files were refreshed. Review with: hermes -p r)describe_distributionrr z Profile 'z/' is not a distribution (no distribution.yaml). Distribution: rzVersion: rFzDescription: authorzAuthor: licensezLicense: hermes_requireszRequires: Hermes rzSource: installed_atzInstalled: env_requiresz Environment variables:requiredrrvz default: )_rr8 r9 r: r; r< r= r> r? r@ rA rB rrrnr8r is_defaultr*r+gateway_running skill_count alias_pathri distribution_namedistribution_versionrrrr rplugins.memory.honcho.clirV rrfrformatrqrrrur rrrr ry r(r` rread_profile_metawrite_profile_metarlist_describable_profilesdescribe_profilerzrrrra rb rc rd re rf rjrOrj rk old_namenew_namerm rBrn archiverhermes_cli.profile_distributionrp rq rr TemporaryDirectoryr_render_distribution_planrOrrrsrPr5rrF target_dirr has_cronrw rx r{ )drr8 r9 r: r; r< r= r> r? r@ rA rB ractionrdhhrr7 alias_displayrrrr*gwrg rrrP rQ rR rS rT rU profile_dir source_labelrV r_rX collision wrapper_pathprofile_dir_displayr _profiles_modall_flag auto_flagoverwrite_flag text_value_hhr;metartag_pdtargetsok_count fail_counttgtoutcomer` ra rb rc rd re rf r+r dist_name dist_version dist_sourceri is_windowsrNrh custom_namerj rk new_dirrm rB result_pathrn rrp rq rr tmpplananswerrw rx ry canonrrz r{ renv_reqserrosd r cmd_profiler $sD!                          544444 T+T 2 2F ~..00 !!## 1<11222 &&&''' =??  Av%%,)*C*C *C74174412C- ----EVA4E'Tyy9VVBBBBCCC<U$%L$:AFMS]SS16SSTTT   =??((**  & ' ' ' F  .) @ . .' @ . . @ . . - . .+ . .     ,  , ,  , ,  , , , ,) , ,    Q QAFf$$9)<)<)<  6DW%ss+E/>YB01 GQ\+QV%E| " -OO0F0M#OOCRCy VOTOOOOOOBOOOUOOOOO P P P P  5    t $ $ $y  89999,d,,-----:9-.    -A-- HQKKKKKKKKK  8   gu--D+u55 4U33D+u55 g  |T::J :Jd$:L(.%#)!##D->>K @@@;@@ A A A y D,55R9P9P9R9RO,OOO XXXX  y RRRRRR//55FDTDDDEEE D ! I ,,[99 fjj):;; S Hb!9!9::FV<<<====SZZ  N11$77 NOOOIOOPPP`$```LLLLMMMM#8#8#>#>L#N@,@@AAA6688N!"T+;+;+=+="T"T"TUUU! U""LMMM 7&*S1H1H1U1U-V-V&V## 7 7 7&)+&6&6### 7 / " " " MtMMM N N N ?t??? @ @ @ LtLLL M M M X  XS"5SSSTTTW 3WWWXXXXZdZZZPQQQV 3VVVWWW GGGGGO->?    -A-- HQKKKKKKKKK  8   dE5))  N4S ) ) ) ) ) )-.    -A-- HQKKKKKKKKK  :   988888mU;;<<vu5566 gdK??@@T6400 t^T22  I  ;#* M M M M HQKKK   t  \Z     HQKKK   PWZWa b b b b HQKKK  )  LZ     HQKKK    9   77==JJGGGGGG"&ssuu++KK"/"?"?"E"EK   oooCJ7777  %%'' ::::LLLL  22;??D88M**0bD &:$:::;;;;#'88,>#?#?GiiRndnn%%% HQKKK    77==JJGGGGGG"&ssuu++KK"/"?"?"E"EK00 *%*1 :$:::;;;;   oooCJ7777   HQKKK 877777  333FFG ?@@@ fG   C**3.*IIGz A RG$8RRW=PRRSSSSa P(<PPPP 0 H(a--QQQ / / / hll***** 6    ~d##  ?    -A-- HQKKKKKKKKK  8  666666 04 0 0 0 (.v66K ;4;;k;; < < < < <-.    -A-- HQKKKKKKKKK  8  666666 (. 74#E#EK#D C4CCkCC D D D.-d33I @44T:: @> >>??? GGGGGO->?    -A-- HQKKKKKKKKK  9            * ,,4J,KK s#|KII")$"E"E *$///tUE22$!&'G!H!H!N!N!P!P!V!V!X!X$&78$$$!#$\112333                       "(' T>488dGU33$T7E:: D Tdm&8TTT]=RTT U U U 6T_66 7 7 7}) :?:::} U6:m6HUUU K$-2DKKK L L L L L!:.    -A-- HQKKKKKKKKK  8            POOOOOOO $ **400E#mOOE$:$:;;G[u[[[ "4??L4.. S5SS'.2QMSSTTTAAABBBaRSSSS_```YZZZ "#677==??EEGGFF "34   FFF ---...F&&u<HHHD VDM$6VVt}?TVV W W W} @!%!3@@@   ":.    -A-- HQKKKKKKKKK  6  \\\\\\\\ (():;;DD!:.    -A-- HQKKKKKKKK   *D-***    F 3&!1!133444 9txx 37799::: 88M " " : 84 #688 9 9 9 88H   5 34>33 4 4 4 88I   6 44 ?44 5 5 5 88% & & E C$/@*ACC D D D 88H   5 34>33 4 4 4 88N # # ; 94#799 : : :88N++1r  = , - - - = =$&FF:t$<$<Ljj*0BvJ00#00066-((87B}$5777Dd 66)$$0;ByM;;<<< O  s853J,,K.=&K))K.BY$PY P YPEY6VYV$!Y#V$$B9YZ'6&Z""Z' [\)&\\>A c d2d  d A7i j"2jj x y&&yy A}**~2&~--~2!88A@:@ &A@5@5A@:A A7ACCAD C&ADDAD D$AK8D:AAHF 3AF?F>AHF?AGGAHGAGGAHG, AK8G9 AK8HAH H AK8H AH H C)AK8K8 AL5L&AL0L0AL5MC AS'P'3AQQAS'QAQ1Q.AS'Q0AQ1Q1AS'R AAS'S' AT$S3&ATTAT$T7AUU AVU&AU?U?AVc ddlm}|j}td|jd|j|jrtd|j|jrtd|j|jrtd|jtd|j td |j |j r=|j |z }|rtd ntd |j rutd |j D]]}|jrd nd}tj|jdu}|s|j r|j dz }| r |dD]k}|} | r| dr.| ddd} | |jkrd}nln#t0t2f$rYnwxYw|rdn |jrdnd} d|jd|d| d} |jr | d|jz } t| _|jrtddSdS) zAPrint a human-readable summary of a pending distribution install.r)MANIFEST_FILENAMEr| z vrz Author: z Requires: Hermes z Source: z Target: uC (profile exists — will overwrite distribution-owned files only)u ⚠ Profile exists but is NOT a distribution. Installing here will overwrite its SOUL.md, skills/, cron/, and mcp.json. Your memories, sessions, auth.json, and .env will be preserved, but any hand-edits to distribution-owned files will be lost.z Env vars:r rNr*z utf-8-sigr^rjrr Tu✓ setz needs settingrJ u • rwrrrvuj ⚠ This distribution ships cron jobs. They will NOT run automatically — review and enable manually.)r r rr8rrFrrr} r provenancer rryr r rrerfrrrmrrrrrrr ) r r mfexisting_is_distributionr r alreadyenv_pathryror}rs rr r K&s-AAAAAA B 4RW 4 4 4 4555 ~% #2>##$$$ y* (RY(())) : 8B$688999 * * *+++ * * *+++ } %)O6G$G#P#P#R#R #  W X X X X S       o/  B " ;**CjnnRW--T9G t5577 ?V3##%% $,#5#5{#5#K#K#V#V#X#X&&C#&99;;D#')4??3+?+?) ("&**S!"4"4Q"7"="="?"?C"bg~~*. % .$%78  #*ZYY2;0YTYF9bg9999999D~ 10000 $KKKK }   <       sBHH.-H.cddlm}g}tD]^\}}t|}||\}}}|dkr$|dks ||s6t ||sG|||f_|st ddSt t|d|D]\}}t d|d|t|S) z>Print live listening dashboard processes and return the count.r) _pid_existsNr?&No hermes dashboard processes running.z& hermes dashboard process(es) running:z PID r$)gateway.statusr rr_dashboard_listeningrr8r)r liver r~rrArrs r_report_dashboard_statusr &s#******"$D133 $ $ W*733 ? "dD ;    199KK,,9 #D$//   S'N####  6777q SYY > > >???++ W )))))**** t99rArcddl} |t||fd5 ddddS#1swxYwYdS#t$rYdSwxYw)uTrue when something is accepting TCP connections at host:port. Any listener counts — even a 401 response proves a dashboard is up. Used by the unified profile-launch routing to decide attach-vs-start. rNg?rTF)socketcreate_connectionrr)rrr s rr r &s MMM  % %'    F   I    3:#4#4#6#6 GGG  #4 # # #  0 GGG <=== KLLL KLLL  GGG'((..007C ' (   }}   J      V n  NNNNNN GGG/006688CG??>22//"899 ' (     2333  7 9:::  >>>>>>>  BSBBCCC  "M(++M  " "2 & &F>>>>>>>>UUUUUUkmm~~k2.. b11$j!.oj599Xr**0b117799 %$E(O 6 5c : :  ,     C  9C99:::   O777777t$$$$$ OOO N3NNN O O O O O O O OO GGG HH H H HIII @AAA @AAA GGGGGs) 77A AA&#E 4FF9A I4I>=I>K L!&L  L5B4O** P$4&PP$(P;; Q"QQ"cD tjdkrddlm}||Sddl}ddlm}tj |std||}| dz dz } | |}n"#t$r}td |d}~wwxYwt|jd ks t!jd |jdstd t!jd |jdstdtjt'tddzt'tddz}tjt'tddz} d} d} d} tj||} tj| } || jstdt1tdr+| jtjkrtdtj|jd|| } tj| }||jstdt1tdr+|jtjkrtd|jdzdkrtdtj|jd| | } nc#t$rt6$rL}|jt't;dddkrtd|td|d}~wwxYwtj| }||jstd |jd!krtd"t1tdr+|jtjkrtd#t1tdr|jdzd$zrtd%tj | d&5}d} |!d'}dddn #1swxYwYt!jd(|std"|| dkrtj"| | dkrG tj#|jd| n#t6$rYnwxYwtj"| | dkrtj"| SS#| dkrtj"| | dkrG tj#|jd| n#t6$rYnwxYwtj"| | dkrtj"| wwxYw))zGRead and unlink a Desktop SSH token from its private runtime directory.rr) read_tokenNrz)--ssh-session-token-file must be absoluter\z desktop-sshz@--ssh-session-token-file must be under the desktop-ssh directoryrz [0-9a-f]{32}z4--ssh-session-token-file has an invalid runtime pathz[0-9a-f]{16}\.tokenr z0--ssh-session-token-file has an invalid filename O_DIRECTORY O_NOFOLLOWrz3--ssh-session-token-file has an unsafe runtime rootgetuidz9--ssh-session-token-file runtime root has the wrong owner)dir_fdz7--ssh-session-token-file has an unsafe parent directoryz3--ssh-session-token-file parent has the wrong owneriiz6--ssh-session-token-file parent has unsafe permissionserrnoELOOPz%--ssh-session-token-file is a symlinkz*--ssh-session-token-file is not accessiblez.--ssh-session-token-file is not a regular filerz2--ssh-session-token-file contains an invalid tokenz,--ssh-session-token-file has the wrong owneriz/--ssh-session-token-file has unsafe permissionsrQAz [0-9a-f]{64})$r rOhermes_cli.windows_ssh_runtimer rpathlibrrrgisabsr6rurrrrpr fullmatchO_RDONLYrnrlfstatS_ISDIRrtrr|r rr __import__rsrfdopenrRrhr)rgr _stat_Path token_path token_rootrelativer;directory_flags file_flagsroot_fd directory_fdfile_fd root_statdirectory_stat file_stat token_streamrs r_read_ssh_session_token_filer S's |w======z$%%%%%% 7==  FDEEEtJ )M9Jf))*55 fff[\\beef 8>ar|OX^TUEV'W'WOPPP <.q0A B BMKLLLkGB q$A$AAGBP\^_D`D``Owr<;;;JGLG3 Tgj/::G))I==!233 X !VWWWr8$$ ^)9RY[[)H)H !\]]]78>!#4ogVVVLXl33N==!788 \ !Z[[[r8$$ X)>")++)M)M !VWWW&.588 !YZZZghnQ/LQQQGG     T T TyGJw$7$7"EEEE !HIIsRIJJPS S T HW%% }}Y.// OMNN N   " "QRR R 2x  MY%5%D%DKLL L 2x  Pi&7%&?6%I PNOO O Yw $ $ * G %%b))E * * * * * * * * * * * * * * *|OU33 SQRR R a<< HW    1    (.+LAAAAA     H\ " " " a<< HW      a<< HW    1    (.+LAAAAA     H\ " " " a<< HW     sB B5 B00B5E0LTM$AMM$$C TQ( T(Q,,T/Q,0(T9!S S('S(!V=!UV U,)V+U,,3Vc:|sdSd|ddvS)uYTrue when *path* looks like an Electron-packaged renderer dist. Packaged Desktop sets ``HERMES_WEB_DIST`` to ``.../app.asar/dist`` or ``.../app.asar.unpacked/dist``. A standalone ``hermes dashboard`` that inherits that value serves the desktop frontend in the browser (issue #52945 — "Desktop IPC bridge is unavailable"). Fzapp.asarr r)rgrcs r_is_electron_packaged_web_distr 's, u dC00 00rAc t|dd}|r1t|ddst|ddrtdt|ddr*t}tj|dkrdndt|ddrit }|s#t dtjdtd t }tj|rd ndt|d d}t|d d}|r$tj d|stdd}|r|stdtj ddkrOtj dd}t|r tj dd|s tj dd ddlm} | } n#t"$rd} YnwxYw| dvrt|ddst|ddsptj ddkrLd|jpdd|jd| } t)|j|jrst d|jd t d!| d"| |js+ ddl} | | n#t"$rYnwxYwtjdt d#| d$tjd%d&d'd|rd(nd)d*t3|jd+|jd,| g } |r| d-|g|r| d.|g|jr| d/t|d0dr| d1t|d2dr| d3dd4lm}|dd5} dd6lm}t3||d7<n&#t"$r|d7dYnwxYwtj d8kr=tCj"| |9}tj|#n tj$tj| ||rtK|} dd:l&m'}|d;<n#t"$rYnwxYw ddl(}ddl)}nq#tT$rd}t d=t d>tVd?tjd@t dA|tjd Yd}~nd}~wwxYwtY ddBl-m.}|n,#t"$rt^0dCdDEYnwxYw|rdtj d<nCdtj vr@t|d2ds/tctVdFz dDGstjd nt|d2dr)dtj vrtetj dn tVdHz dIz }|dJz 3sdtj v}|r:t dK|t dLtctVdFz dDG|dJz 3sUt dM||rt dNt dOt dPtjd t dQt dR|ntetj d4}|dJz 3sDt dS|t dOt dTtjd t3|tj d<t dU| ddVl5m6}|n5#t"$r(}t dW|tj7XYd}~nd}~wwxYw ddYl8m9}|t^dZ[n,#t"$rt^0d\dDEYnwxYwdd]l:m;}ty|||j|j|j t|d0dt|ddpd|||^dS)_zGStart the web UI server, or (with --stop/--status) manage running ones.ssh_session_token_fileNrFstopz?--ssh-session-token-file cannot be used with --status or --stoprr zrequested via --stoprr headless_backendssh_owner_noncez [0-9a-f]{16}z5--ssh-owner-nonce must be 16 lowercase hex charactersz8--ssh-session-token-file is only valid with hermes serveHERMES_DESKTOPrHERMES_WEB_DISTrHERMES_SERVE_HEADLESS)r= r)rrXisolated open_profilerurQruz /?profile=z*Machine dashboard already running on port r!z Managing profile 'rz+Routing to the machine dashboard (profile 'zB' preselected). Use --isolated for a dedicated per-profile server.rzhermes_cli.mainrr=r?z--portz--hostz--open-profilez--ssh-owner-noncez--ssh-session-token-filerinsecurez --insecurerz --skip-buildrurwr rYrr|r4r<r@z;Web UI dependencies not installed (need fastapi + uvicorn).zMRe-install the package into this interpreter so metadata updates apply: cd rezP -m pip install -e . If `pip` is missing in this venv, use: uv pip install -e .zImport error: rzu9terminal config → env bridge failed for dashboard/serveTr}r`rKrrru6⚠ --skip-build was passed but no web dist found at: z0 Attempting one recovery build of the web UI...u6✗ --skip-build was passed but no web dist found at: z3 The recovery build did not produce a usable dist.zG Pre-build first: npm install --workspace web && npm run build -w webz. Or drop --skip-build to build automatically.u( ✓ Recovery build produced a web distu8→ Skipping web UI build (--skip-build); using dist at u5✗ HERMES_WEB_DIST is set but no web dist found at: zD Or unset HERMES_WEB_DIST to build and use the default web UI dist.u)→ Using web dist from HERMES_WEB_DIST: r u⚠ Plugin discovery failed: r2start_background_mcp_discoveryzdashboard-mcp-discoveryr thread_namez9Background MCP tool discovery failed at dashboard startup) start_server)rr open_browser allow_publicinitial_profileheadlessssh_session_tokenr )=rnr6r r rrr8rrr rrerfr rrr= rrrr no_open webbrowserrlrfrqrrrrvrr rOrZrr"execvper rr5fastapiuvicornrMrrrr{rrrWrrjrirr r hermes_cli.mcp_startupr r r r )r _token_filerpids remaining_headless_backend_ssh_owner_nonce_ssh_session_token_inherited_web_distr= _launch_profiler:r reexec_argvrvr]r rrr r! rr{ _dist_root _recoverabler r;r r s r cmd_dashboardr. 's $ 8$??K\h&&\*1$*F*F\Z[[[tXu%%)(** eqjja(((tVU## ()++  : ; ; ; HQKKK'/EFFFF/00  i&Q'''  &8%@@t%6==R _>N O ORPQQQU,USTTT z~~&''3.. jnn->CC )*= > > 4 JNN,d 3 3 3 6 .555$??????1133 $$$#$ 444j%00 5nb11 5 JNN+ , , 3 3Y 0[YY49YYYY  49 5 5  KtyKKK L L L BBBSBB C C C< %%%%OOC(((( D HQKKK  P/ P P P   ND"3 )) 9GGk c$)nn di o    H    35EF G G G  J    :KH I I I < ,   { + + + 4U + + -   | , , , 4u - - /   ~ . . .AAAAAA#"USSS ) @ @ @ @ @ @!$%<%<%>%>!?!?C   ) ) ) GGM4 ( ( ( ( ( ) <7 " "#KS999D HTYY[[ ! ! ! ! Js~{C 8 8 8G9+FF FFFFFF&&&&&            KLLL  J  J J J J J   "q""###   !"""$BBBBBB$$&&&& $$$ P"  $ $ $ $ $$5H/2 *++ "* , ,WT>>  HQKKK |U + +.H !BJ.. -. / / / ,z9  \)1133 >-BJ>L @[z[[\\\HIIIlU2$????-5577 [z[[\\\QOPPP_```FGGG < = = = UUUVVVV"*%6788CCEE \)1133  V*VV W W W [ \ \ \ X Y Y Y HQKKK),J $% F*FFGGGF777777 FFF 3c33#*EEEEEEEEE F  IIIIII&&1          G       322222.d333 L Y Y%T:u55nb99?R",(      s,G== H  H K K)(K)4 P P87P8:S SSS'' U1AUU'U88&V! V!;` `>`99`>a&bbc(ddlm}||dS)z?Register a self-hosted dashboard OAuth client with Nous Portal.r)cmd_dashboard_registerN)hermes_cli.dashboard_registerr0 r_impls rr0 r0 (s%MMMMMM E$KKKKKrAc(ddlm}||dS)z4Enroll a self-hosted gateway with a relay connector.r)cmd_gateway_enrollN)hermes_cli.gateway_enrollr5 r2 s rr5 r5 (s%EEEEEE E$KKKKKrAcddlm}m}m}t |dd}|dkrt ||dS|dkrt ||dSt ||dS)zPrint shell completion script.r) generate_bash generate_zsh generate_fishshellrzshfishN)hermes_cli.completionr8 r9 r: rnr8)rparserr8 r9 r: r; s rcmd_completionr@ )sPPPPPPPPPP D'6 * *E ~~ ll6""##### & mmF##$$$$$ mmF##$$$$$rAc(ddlm}||dS)z?Show a byte/char breakdown of the system prompt + tool schemas.rcmd_prompt_sizeN)hermes_cli.prompt_sizerC r2 s rrC rC )s%?????? E$KKKKKrAc 8ddlm}m}t|ddpd}|dkr |dS||t|ddt|d d t|d dt|d dt|d dt|dddS)z!View and filter Hermes log files.r)tail_log list_logslog_namervrNrrHfollowFlevelrsince component) num_linesrI rJ rrK rL )hermes_cli.logsrF rG rn)rrF rG rH s rcmd_logsrO )s33333333tZ11.7)s///a16///rA)r,r\rrrrrrrrrrrrrrrrrrrrnovitarrrrrrrr)rr]r)_cps r_build_provider_choicesrX 3)sn  @@@@@@x//3/////           s ))>D prompt-size import-agentr" r<lsprrrrAr# r$ r% helprpetssendskinsyncrhooksr& r*proxyr=r' slackrr( rr) egressr+ kanbanr, r- portalrrrr]consolerr>r journeymigrater. r/ r0 rr rFr1 fallbackr2 learningr0rr approvalsr?rZr3 monitoringrp computer-use memory-graphr>rrrrrrrrrrrrrrcRtjdd}d}|t|kr}||}|dkr#|dzt|kr ||dzSdS|dr5d|vr|dz }c|tvr|dzt|kr|dz }|dz }|SdS)uReturn the first non-flag, non-flag-value token in ``sys.argv[1:]``. Used by ``main()`` to decide whether plugin discovery has to run at argparse-setup time. Handles common invocations like ``hermes -m gpt5 --provider openai chat "msg"`` by skipping the values attached to known top-level flags. Does NOT fully simulate argparse — unknown ``--foo=bar`` / ``--foo bar`` flags degrade gracefully (``bar`` may be wrongly classified as a positional, which at worst forces a one-time plugin discovery). r Nrrrrr)r r}rr_TOP_LEVEL_VALUE_FLAGS)r}rtoks r_first_positional_argvrs |)s 8ABB>#   czzQ,,,QT1B1BQ FA  4rAc@t}|dS|tvrdSdS)aTrue when the CLI might be invoking a plugin-registered subcommand. Returning False lets ``main()`` skip plugin discovery entirely during argparse setup, saving ~500-650ms per invocation for users whose enabled plugins don't contribute any CLI command. NFT)rs _BUILTIN_SUBCOMMANDS)r s r_plugin_cli_discovery_neededrv )s1 # $ $E }u $$$u 4rAc|sdS ddlm}||dS#t$r9}t jt d||Yd}~dSd}~wwxYw)a+Materialize the deferred platform whose top-level CLI command matches. Bundled platform plugins are cheap-registered as *deferred* entries to avoid importing every gateway SDK during normal startup. A platform that registers a top-level ``hermes `` command (e.g. Photon -> ``ctx.register_cli_command(name="photon", ...)``) only runs that side effect when its module is imported. On the unknown-top-level-command slow path, ``discover_plugins()`` records the deferred loader but does not import it, so the CLI registration never happens and ``hermes photon`` fails with argparse ``invalid choice`` (issue #54678). Resolving only the platform whose name matches the first positional token keeps normal startup cheap while making the targeted command available. Nr)platform_registryz2Deferred platform CLI resolution failed for %s: %s)gateway.platform_registryrx rfrr getLoggerrsr)rrx r;s r&_resolve_deferred_platform_cli_commandr{ )s   ??????l+++++    (##)) @            s# A&.A!!A&>Nrlr" rArr[tickr mcp_actionr=)r$ r rctt|ddp"tjddkS)NrdFrr)rrnrrerfrs r_is_tui_chat_launchr )s4 eU++Rrz~~l/K/Ks/R S SSrAc|jdkrdS|jdkrt|dddkrdS|jdkrt|dddvrdSd S) Nr" Tr rr[r$ r>r[r} F)r~rnrs r"_command_has_dedicated_mcp_startupr )sj |ut |y  WT3Dd%K%Ku%T%Tt |v'$"E"E"X"Xt 5rAc6t|rdS|jdvS)NF>Nr| rA)r r~rs r_should_background_mcp_startupr )s%4  u </ //rAct|ddrdtjd<t|t|jd\}}|jtvs|rt||d|vsdStt|dd} dd l m }|n,#t$rt d d YnwxYwd }t|rd}nit|rd}nWt!|rH dd lm}|tdn,#t$rtdd YnwxYwd}|r> ddlm}|n,#t$rtdd YnwxYw ddlm}ddlm} |} | | |ddlm} | | dS#t$r tdd YdSwxYw)zCDiscover plugins/MCP/hooks for commands that can run an agent turn.rFrr)NNNrsrr z&plugin discovery failed at CLI startupTr}r zcli-mcp-discoveryr z3Background MCP tool discovery failed at CLI startup)discover_mcp_toolsz(MCP tool discovery failed at CLI startupr)register_from_config)rsz-shell-hook registration failed at CLI startup)rnrrer_AGENT_SUBCOMMANDSrfr~_AGENT_COMMANDSrrr rrrr r r r" r rr%r rragent.shell_hooksr agent.outbound_webhooks) r _sub_attr_sub_set _accept_hooksr _run_inline_mcp_discoveryr r rr _hooks_cfgregister_outbound_webhookss r_prepare_agent_startupr )s'tVU##-), %&T,00|LLIx ''  (!$ 488HDD~u==>>M 777777     4       !%4  *%*!! +D 1 1*%*!! ' - - *  M M M M M M * */         LLE        %*!   : 9 9 9 9 9       LL:         111111:::::: []] ZmDDDD       #":.....     ;        sHB((&CC D##&E  E E%%&F F4G&G21G2ct|ddsdSdtjd<dtjd<dtjd<dS)NrFrHERMES_SAFE_MODErr)rnrrers rrrB*sH 4e , ,%(BJ!".1BJ*+(+BJ$%%%rAcXdD]&\}}t||st|||'dS)N)rNr*Nr+Nr,N)rmFrNrNroF)rsetattr)rrBrs r_set_chat_arg_defaultsr J*sH  ) ) gtT"" ) D$ ( ( ( ) )rAc tsdStjddkrdStjdd}d|vsd|vrdSt |rdSt|rtdd St}td |D}|s|d vrdSd d l m }|\}}}| t|t!|}t#|ddrtdd St#|ddrdt%|t'|jt#|ddt#|ddt#|ddt#|dd|js|jr|jd|_|jd vrt1|t#|dd ot#|dd }|rPt3|dd dtjd<dtjd<t#|ddrdtjd<nt%|t|d SdS)zHRun obvious Termux non-TUI chat/oneshot/version paths on a light parser.FHERMES_TERMUX_DISABLE_FAST_CLIrr N-h--helpr@Tc3XK|]%}|dkp|dkp|dV&dS)rrz --oneshot=Nr8r9s rr;z._try_termux_fast_cli_launch..n*sU  t Isk)IS^^L-I-IrANrArbuild_top_level_parserfuncrFoneshotr*r+r,r-r)rArrnrHERMES_DEFER_AGENT_STARTUPHERMES_FAST_STARTUP_BANNERrsr)rcrrerfr r}rrrSrs rhermes_cli._parserr set_defaultsr parse_argsr6 rnr r<r rrr~r r ) r}r has_oneshotr r? _subparsers chat_parserrinteractive_prompts r_try_termux_fast_cli_launchr Y*s ) + +u z~~6773>>u 8ABB> ? ?DtY&&%0000ttY%% t$$$ L$..T:t44T:t44t\488      t)t|/C  |~%%t$$$!(w!=!==bgdT[]aFbFbBb  ) D)T * * *7:BJ3 47:BJ3 4t^U33 847 01 "4 ( ( (t 5rAcltsdSdtjddvsdtjddvrdSttjdd}|sdSt }|dvrdSddlm}|\}}}|t | ttjdd}t|d dst|d drdSt|d ddvrdSt|sdSt|d S)aLaunch obvious Termux TUI invocations before building every subparser. `hermes --tui` is the hot path on phones. The full parser setup imports command modules for model, fallback, migrate, kanban, bundles, plugins, etc. even though the TUI immediately execs Node. On Termux only, parse the lightweight top-level/chat parser and hand off to ``cmd_chat`` when the invocation is unambiguously the built-in TUI/chat path. Fr r Nr r rr r rFr r~T) rcr r}rrs r r r rr r6 rnr) wants_tuir r r? r r rs r_try_termux_fast_tui_launchr *sW * + +u sx|x38ABB<77u !""..I u " $ $E N""u999999'='='?'?$FK(+++   8!""FF G GDtY&&'$ 4*H*HutY%%^;;u D ! !u TNNN 4rAc t|dd}|dkruddlm}m}|}t |dt si|d<d|dd<||tdtd dS|d krdd lm }m }|d z t|d d}g}|dvr| d|dvr| dfd|D} | std|ddStd| D]=\} } | z } | j } td| d| d| dd>t|ddss td}n'#t"t$f$rtdYdSwxYw|dkrtd dS| D]2\} } | z td!| d| d"3td#td$|ddSdd%lm}||dS)&Nmemory_commandrrrr- rr+u% ✓ Memory provider: built-in onlyz Saved to config.yaml reset)r(rmemoriesrr>rr- )z MEMORY.mdz agent notes>rr)zUSER.mdz user profilecLg|] \}}|z ||f!Sr@rp)r:rTrmem_dirs rrzcmd_memory..*sF   !!T! 7K7K7M7M I   rAu1 Nothing to reset — no memory files found in z /memories/ z: This will permanently erase the following memory files:u ◆ rwu) — rIrrFz Type 'yes' to confirm: z Cancelled. z Cancelled. u ✓ Deleted rzE Memory reset complete. New sessions will start with a blank slate.z Files were in: )r )rnrrrrrfrpr8rr(rrrrrOrrrsrPr5rhermes_cli.memory_setupr )rrSrrrr(rrfiles_to_resetrrTrrgsizer r r s @r cmd_memoryr *sR $($ / /C e||>>>>>>>>&**X..55 "!F8 ')x$ F 6777 ())))) IIIIIIII!/##j0x// & & &  ! !"> ? ? ? _ $ $  ! !"= > > >    %3     hEXEXEZEZhhh    F KLLL > >GAtQ;D99;;&D rrrr)tools_disable_enable_commandz post-setup)run_post_setup_commandr) tools_command)rnhermes_cli.tools_configr r r rrr )rr r r r s r cmd_toolsr +s T>4 0 0F ...HHHHHH$$T***** <  BBBBBB ''--.....W999999 drAcL ddlm}ddlm}|}||}||j|j}t||| dS#t$r}td|Yd}~dSd}~wwxYw)Nrrb)InsightsEngine)daysrzError generating insights: ) rfrcagent.insightsr generater rr8format_terminalrhr)rrcr rienginereportrs r cmd_insightsr /+s 1******111111 Y[[##di DD f$$V,,---  111 /A//0000000001sA8A<< B#BB#c ddlm}t|ddpd}|}|d}t |t r|ni}|dkr4ddlm}|d}t |t r|ni}|d } t | t r| ni} | d } t | t r| ni} td td |d rd ndd|d rtd|ddrdndd|dddtd|ddrdndtd|ddrdndd|dddtd| d pd!} | d r| rtd"| ntd#td$| rd%nd&d'td(td)dStd*|tj +tj d,dS)-z?Gateway monitoring status: health & diagnostics export posture.rrmonitoring_actionNrrm ) otlp_exportergateway_health_exportrl otlpzGateway monitoringz Health export: rrz+ (monitoring.gateway_health_export.enabled)z Metrics: metrics_enabledTrrz (interval export_interval_secondsrzs)z Diagnostic events: diagnostic_events_enabledz Warning/error logs: warning_error_events_enabledlogs_export_interval_secondsrzZ Content safety: always on (rendered messages are never exported; not configurable)endpointrz OTLP endpoint: z9 OTLP endpoint: not configured (monitoring.export.otlp)z OTel SDK: rz not installedz% (optional extra: hermes-agent[otlp])z= Scope: gateway service health + redacted diagnostics only.zF No prompts, messages, tool args/results, usage analytics, or traces.zUnknown monitoring action: r2r) rrrnrfrrpagent.monitoringr r8 is_availabler r r)rrr rmon_rawmonr gh_rawgh export_raw export_cfgotlp_rawr r s rcmd_monitoringr =+s^------ T. 5 5 AF []]Fjj&&G%gt44<"C 222222011'55=662WWX&& )3J)E)EM::2 >>&))!+Hd!;!;CXX "### <y0A0A#Q99z<<< = = = 66)   N IRVVTX Tdd?lm}m}|d@dAdB }|dC}|dDdEdF }|dGdHdIJ|dKdHdLJ| || |tA|tBtDtFM ddNl$m%}||n2#t$r%}tL'dO|Yd}~nd}~wwxYwtQ|tRPtU|tVQ|dRdSdT }| tXt[|t\UddVl/m0}||tc|tdWtg|thXtk|tlYto|tpZts|tt[tw|tx\t{|t|]dd^l?m}||dd_l@mA}||}| tdd_lCmA}||} | tt|t`t|tat|tbt|tct|tdt|tet|tf|dgdhdi }!ddjlSm}"|"|!t|tkdl}#t||#mt|tnt|tot|tpt|tqt|tr|dsdtdu }$ddvlam}%mb}&|%|$|$ |&t|twtr ddxlfmg}'ddylhmi}(mj})t}*|'D]}+||+d|+dz|+ld{d|td}jn~},|+d|,|+ld|, |+d|*o|+d|(tt|)jrsD]}+|+d|*vr ||+d|+dz|+ld{d|td}jn~},|+d|,|+ld|, |+dnD#t$r7}-tjut'd|-Yd}-~-nd}-~-wwxYw|ddd }. ddjlwm}/|/|.nD#t$r7}-tjut'd|-Yd}-~-nd}-~-wwxYw|ddd }0 ddjlxm}1|1|0nD#t$r7}-tjut'd|-Yd}-~-nd}-~-wwxYw|dddgdd}2 ddjlym}3|3|2nD#t$r7}-tjut'd|-Yd}-~-nd}-~-wwxYwt|tt|t|ddd VVd}4|4dd}5|5ddHdJ|4dd|4ddd }6|6ddgdd|6ddgdd|6ddHdJ|4ddd WWd}7|7dd}8|8ddHdJ|7ddVWfd}9V |9t|t|ddd }:|:d};|;dd}<|<dd|<dtdd|<dddd„}=|;ddĬ}>|>dddƬ|>dgdȢddʬ˦|>ddHdͬJ|>ddHdϬJ|>ddHdѬJ|>ddgdԬզ|>dd׬|=|>dئ|>ddHdڬJ|>dddgddެ˦|>ddHdJ|>ddHdJ|;dd}?|?dd|?dddHdJ|;dd}@|=|@d|@ddHdJ|;dd}A|=|Ad|;dd|;ddd }B|BddHdd|BdddHdd|;ddd }C|CddHdJ|CdKdHdJ|;ddd }D|Ddtdd|Ddtd |Dd dHd J|Dd td  |Ddtdd|DddHdJ|Ddtd |;dd|;dd}E|Edd|Eddd|;ddd }F|FdGdHd J|Fdtd!d"|;d#d$}G|Gdd|Gdtd%d&|: tjt|:'t |t (t|t)t|t*t|t+t|t,t|t -t#|t$.t'|t(/|d0d1}H|Hd2dd3gd4d56|H Yfd7t+|t,t.8t1|t29t5|t6:t9|t:;dd|KD}M|Mrd|_t j}N |Lt _Y|K}O|Nt _nh#tX$r>}P|Nt _|Pjdkrd|_Y|K}OYd}P~Pn$d}P~PwwxYwd|_Y|K}O|Ojrt|OdSt_|Od?drd@t`jdA<te|Ot_|OdBdr_tg|Ojt_|OdCdt_|OdDdt_|OdEdt_|OdFdG|Ojs|OjrL|OjEdH|O_dID](\}Q}RtI|O|Qstq|O|Q|R)t|OdS|Oj=dJD](\}Q}RtI|O|Qstq|O|Q|R)t|OdStI|OdKrL|O|O}Stu|Str|Sdkrt j|SdSdSdSYdS(Lz Main entry point for hermes CLI.r)configure_windows_stdiorr Nr r )r)cmd_moarz0Configure Mixture of Agents provider/model slotsz7Configure the provider/model set used by /moa .)r\ rr moa_command)destrlszShow current MoA model slots)aliasesr\ configurerzInteractively pick MoA modelsrrM zPreset name to create or update)nargsr\ rY rmzDelete a MoA presetzPreset name to deleter\ ) cmd_fallbackrj z>Manage fallback providers (tried when the primary model fails)zManage the fallback provider chain. Fallback providers are tried in order when the primary model fails with rate-limit, overload, or connection errors. See: https://hermes-agent.nousresearch.com/docs/user-guide/features/fallback-providersfallback_commandz._dispatch_secrets,sd-t443T::3T:: % % %&*<99T?? " 4 4 49K99T?? "!!###qrArd z:Manage the iron-proxy egress credential-injection firewallzManage iron-proxy, the optional TLS-intercepting egress firewall that swaps proxy tokens for real API credentials before outbound requests leave a sandbox. Disabled by default. See: https://hermes-agent.nousresearch.com/docs/user-guide/egress/iron-proxy) proxy_clict|dd}|.t|dr|jur||SdS)Negress_commandr r)rnrr r )rrS_dispatch_egress egress_parsers rr% zmain.._dispatch_egress?,s^d,d33 ?wtV44?JZ9Z9Z99T?? "  """qrA) cmd_migratecmd_migrate_xairi z?Migrate configuration for retired models or deprecated settingszxDiagnose and (optionally) rewrite the active config.yaml to replace references to retired models or deprecated settings. migrate_typerz;Migrate xAI models scheduled for retirement on May 15, 2026zScan config.yaml for references to xAI models retiring on May 15, 2026 and, with --apply, rewrite them in-place to the official replacements per the xAI migration guide. The original config.yaml is backed up before any rewrite.z--apply store_truez:Rewrite config.yaml in-place (default: dry-run, no writes)r r\ z --no-backupz8Skip the timestamped backup of config.yaml when applying)rrr5 )register_subparserzLSP CLI registration failed: %s)r)rrz.Set up WhatsApp Business Cloud API integrationzConfigure the official Meta WhatsApp Business Cloud API adapter (Business account required, public webhook URL required). Distinct from `hermes whatsapp` which sets up the Baileys bridge for personal accounts.)r )register_send_subparser)r)r)r)r)r)r)r) add_parser) build_parser)r)r)r#)r')r+)r/)r<rpz.Inspect / prune / clear ~/.hermes/checkpoints/uManage the filesystem checkpoint store — the shadow git repo hermes uses to snapshot working directories before write_file/patch/terminal calls. Lets you see how much space checkpoints occupy, force a prune, or wipe the base.) register_cli)r?c(ddlm}||dS)Nr)import_agent_command)hermes_cli.agent_importr2 )rr2 s rcmd_import_agentzmain..cmd_import_agent-s+@@@@@@T"""""rA)r4 )r2)r6)rS )r )r r]zDCreate, list, and manage skill bundles (aliases for multiple skills)zSkill bundles let you load several skills under one slash command. `/` from the CLI or gateway loads every referenced skill at once.)r0 bundles_command)r )discover_plugin_cli_commands)r get_plugin_managerr\ rrrargparse)r\ rrformatter_classsetup_fn handler_fnzPlugin CLI discovery failed: %sruBBackground skill maintenance (curator) — status, run, pause, pinaThe curator is an auxiliary-model background task that periodically reviews agent-created skills, prunes stale ones, consolidates overlaps, and archives obsolete skills. Bundled and hub-installed skills are never touched. Archives are recoverable; auto-deletion never happens.zcurator CLI wiring failed: %sr] z0Browse, install, and select petdex animated petszPetdex (https://github.com/crafter-station/petdex) is a public gallery of animated sprite pets for coding agents. Install one and Hermes shows it reacting to agent activity across the CLI, TUI, and desktop app.zpets CLI wiring failed: %srh rk ro z/Timeline of learned skills + memories over timezA terminal rendition of the desktop Star Map / Memory Graph: a timeline bar chart of learned skills and memories over time (oldest at top, newest at bottom) plus a playable constellation scrubber. Mirrors the TUI `/journey` overlay and the desktop panel.)r r\ rrzjourney CLI wiring failed: %s)r )r rn zBManage the Computer Use (cua-driver) backend (macOS/Windows/Linux)awInstall or check the cua-driver binary used by the `computer_use` toolset. Supported on macOS, Windows, and Linux. Use `hermes computer-use install` to fetch and run the upstream cua-driver installer. This is equivalent to the post-setup hook that `hermes tools` runs when you first enable the Computer Use toolset, and is a stable target for re-running the install if it didn't fire (e.g. when toggling the toolset on a returning-user setup). Use `hermes computer-use doctor` to run cua-driver's `health_report` MCP tool and surface its check matrix (TCC, bundle identity, version, platform support, ...) in human-readable form.computer_use_actionr z=Install or repair the cua-driver binary (macOS/Windows/Linux)r: zRe-run the upstream installer even if cua-driver is already on PATH. The upstream install.sh always pulls the latest release, so this performs an in-place upgrade.rz1Print whether cua-driver is installed and on PATHr) z;Run cua-driver `health_report` and surface the check matrixuDrive cua-driver's stable `health_report` MCP tool and render its check matrix (TCC permissions, bundle identity, version, platform support, screenshot probe, …) as human-readable output. cua-driver owns the health model; this command stays thin so new checks added upstream surface here without code changes. Exits 0 when overall=ok, 1 when degraded/failed, 2 when the binary is missing or unreachable.z --includerCHECKzRun only the listed checks. Repeat for multiple (e.g. --include tcc_accessibility --include bundle_identity). Unknown names are reported by cua-driver.)r rmetavarr\ z--skipzASkip the listed checks. Repeat for multiple. Wins over --include.z--jsonzEEmit the raw structured payload as JSON (same shape as `tools/call`). permissionsz=Check or grant macOS Accessibility + Screen Recording (macOS)uIComputer Use drives the Mac through cua-driver, whose TCC grants attach to cua-driver's own identity (com.trycua.driver) — not the terminal or the Hermes app. `status` reports the driver's grant state; `grant` launches CuaDriver via LaunchServices so the macOS permission dialog is attributed to the process that does the work.computer_use_perms_actionz?Report Accessibility + Screen Recording grant state (read-only)z/Emit the normalized permission payload as JSON.grantz=Request the grants (opens the dialog attributed to CuaDriver)c > t|dd}|dkr0ddlm}|tt|dddS|dkrUddl}dd lm}m}|}|rd } dd lm}|j |d gd d ddd|j }n#t$rYnwxYw|rtd|d|dntd| |} | rO| dr:| dpd} td| dtdn!| rtdntdn#t$rtdYnwxYwdStdtddS|dkrdd lm} | t#t|d!gpgt#t|d"gpgtt|d#d$} t%j| |d%krWt|d&d} | d'kr"dd(lm}t%j|| dkrddl}dd)lm}|} tt|d#drCt|| d*d +t%j| d,rdnd-| d.s-td/| d0dt%jd-| d1s#td2t%jd-d3}td4| d5pd1d| d0d| d6r\td7|| d8d9td7|| d:d;| d,std<n+td7|| d,d=| d0d| d>D]/}|dd?kr!td@|dAdB|dC0| dDrtd@| dDt%j| d,rdnd-dSdS)ENr< r r)install_cua_driverupgradeF)rD r)cua_driver_update_checkresolve_cua_driver_cmdr)_cua_driver_envr Tr]rgr)rXrnr_rirYr]zcua-driver: installed at rwrupdate_availablelatest_versionrM u# ⬆ Update available: cua-driver r!z. Run: hermes computer-use install --upgradeu ✓ Up to date.z: Refresh to latest: hermes computer-use install --upgradezcua-driver: not installedz" Run: hermes computer-use installr) rincludeskipr)rJ rK json_outputr? r@ rA )request_permissions_grant)computer_use_statusr)r sort_keysreadyr platform_supportedz!Computer Use is not supported on rOrz;cua-driver: not installed. Run: hermes computer-use installc|durdn|durdndS)NTu✅Fu❌u•r@)rs rrz0main..cmd_computer_use..y.s199%%AJJ55TYrAz cua-driver: rF can_grantr accessibilityz Accessibilityscreen_recordingz Screen Recordingz. Grant: hermes computer-use permissions grantz) driver health (no permission toggles on checksrzrq rQr$rr")rnr rC rrZtools.computer_use.cua_backendrE rF rG r[r rrrr8rftools.computer_use.doctorrrr rtools.computer_use.permissionsrM rrN rr )rr rC rZrE rF rgrFrG stlatestrr7 perms_actionrM rrN glyphr5computer_use_parsercomputer_use_permss rcmd_computer_usezmain..cmd_computer_use0.s4d;; Y   B B B B B B  tGD)U,K,K'L'L M M M M F X               *)++D GGGGGG,jn{+'+$QZde+O--UUWW G !D>HdHHgHHHIIII>D HTNNN ] " ""4)DdKKLw&&TTTTTT2244555x''$$$$NNNNNN((**fe44556%++bd+CCDDDH"W+4QQ1555./ ObnOOOPPPHQKKK+ WXXXHQKKKZZVR ]%AkVVR ^VVVWWWk?oIuuR%899IIIJJJOuuR(:%;<<OOOPPPg;PNOOOmuuR[11mm\^_i\jmmmnnnHEEA{d**CqzCCQy\CCDDDg;202g;00111bk0q111  ) ) + + + F&&(((((s%,>B++ B87B8'A r\ c|dd||ddd|ddd|d dd |d d |dd |dd |dd |dtd|dtd|dd |dd |dd |dd |d!d" |d#d$ |d%td&|d'td(|d)td*|d+td,|d-td.|d/td0|d1d2d34|d5d6d2d74dS)8Nz --older-thanAGEre z --newer-thanzZOnly match sessions active within the last AGE (e.g. '5h', '2d') or after an ISO timestampz--beforeTIMEzjOnly match sessions started before TIME (duration ago like '5h', or ISO timestamp like '2026-07-05 14:30')z--afterzTOnly match sessions started at/after TIME (duration ago like '5h', or ISO timestamp)rb z$Only match sessions from this sourcer z--titlez7Only match sessions whose title contains this substringz --end-reasonz(Only match sessions with this end reasonz--cwdz>Only match sessions whose working directory is under this pathz--min-messagesz&Only match sessions with >= N messagesrc r\ z--max-messagesz&Only match sessions with <= N messagesrz_Only match sessions whose model name contains this substring (e.g. 'sonnet', 'gpt-5', 'hermes')rzSOnly match sessions billed through this provider (e.g. openrouter, anthropic, nous)rz%Only match sessions from this user IDz --chat-idz-Only match sessions from this chat/channel IDz --chat-typez8Only match sessions with this chat type (e.g. dm, group)z--branchz= N total tokens (input+output)z --max-tokensz9Only match sessions with <= N total tokens (input+output)z --min-costz:Only match sessions costing >= N USD (actual or estimated)z --max-costz:Only match sessions costing <= N USD (actual or estimated)z--min-tool-callsz(Only match sessions with >= N tool callsz--max-tool-callsz(Only match sessions with <= N tool callsz --dry-runr* z0List matching sessions without changing anythingr+ r -ySkip confirmation) add_argumentrfloat)r7default_older_helps r_add_session_filter_argsz&main.._add_session_filter_args.st  #     :     Q     9    z(NOOO  U      !K      Z      3-U      3-U      1     1     B      M      K      O      L      L      uM      uM      S;      S;      C     T,5H      rArl z*Export sessions to JSONL, Markdown, or QMDrBz}Output path. JSONL: file path (use - for stdout, required). md/qmd: output directory (default: /session-exports)ry)jsonlmdqmdhtmltracerp zgExport format (default: jsonl). 'trace' emits Claude Code JSONL for the Hugging Face Agent Trace Viewer)r4rr\ z--uploadzgtrace only: upload to your Hugging Face traces dataset instead of writing a local file (needs HF_TOKEN)z--publiczFtrace --upload only: create/update a public dataset instead of privatez --no-redactzJtrace only: skip the forced secret redaction; only use after manual reviewz--onlyz user-promptszhExport only a filtered view (user-prompts: one prompt record per line for jsonl, headed sections for md))r4r\ z --session-idz%Session ID or unique prefix to exportzgOnly export sessions older than AGE (duration like '5h'/'2d', bare number of days, or an ISO timestamp)z--redactzDRedact secrets (API keys, tokens, credentials) from exported contentz --lineagesinglelogicalz6md/qmd only: export one row or its compression lineagez--delete-after-verifiedzTmd/qmd only: after verified single-session export, delete that session (needs --yes)rEz.md/qmd only: overwrite an existing export filezDelete a specific sessionrzSession ID to deleter rj rk prunezCDelete old sessions (filterable by time window, source, title, ...)uDelete sessions older than AGE — days if bare number, or a duration like '5h'/'2d'/'1w', or an ISO timestamp (bare prune with no filters defaults to 90 days; any filter matches all ages)z--include-archivedz3Also delete archived sessions (excluded by default)r uBBulk-archive (soft-hide) sessions matching filters — no deletionzeOnly archive sessions older than AGE (duration like '5h'/'2d', bare number of days, or ISO timestamp)optimizezAReclaim disk space: merge FTS5 segments + VACUUM (no data change)zoptimize-storagezOMigrate the search index to the compact v23 layout (reclaims disk on large DBs)uRebuild the full-text search index in the compact v23 external-content layout. On large databases this reclaims a large fraction of state.db (the old layout stored duplicate copies of every message and indexed tool output). Runs foreground with a progress bar, throttles so a running gateway stays responsive, and VACUUMs at the end. Safe to interrupt and re-run — it resumes where it left off. No conversation data is changed; only the search index is rebuilt.z --no-vacuumFzgSkip the final VACUUM (index is rebuilt but freed pages aren't returned to the OS until a later VACUUM))r rr\ z'Skip the disk-space confirmation promptrepairz>Repair a malformed state.db schema so hidden sessions reappearzRecover a state.db whose schema is malformed (e.g. 'table messages_fts already exists'), which makes Desktop/Dashboard show no sessions. A backup is made first; sessions and messages are preserved and the FTS search index is rebuilt if needed.z --check-onlyz@Only report whether the database opens cleanly; do not modify itz2Skip the timestamped backup copy (not recommended)recoverz=Rebuild canonical session data into a separate clean databasea5Offline, non-destructive recovery for a damaged state.db. The source database and its WAL/SHM/rollback-journal sidecars are copied before SQLite opens anything. Canonical rows are rebuilt into a new output database; derived search indexes are recreated and the active database is never replaced automatically.Tz6Source state.db or preserved backup to inspect/recover)rc r r\ z--outputz;New recovery database path (required unless --inspect-only)ri z--inspect-onlyzIOnly report canonical table readability; do not create an output databasez --work-dirzNExisting directory for the disposable source copy (defaults beside the output)z --chunk-sizerm z1Rows committed per recovery batch (default: 1000)z--allow-partialznBest-effort salvage across damaged row ranges; the output remains separate and every skipped range is recordedz--reportz5JSON report path (defaults to .recovery.json)statszShow session store statisticsrzSet or change a session's titlezSession ID to renamer+zNew title for the sessionzretitle-skillsz@Re-title sessions whose auto-title came from a /skill's own textuSessions opened with a /skill were auto-titled from the expanded message, which embeds the whole skill body — so the title describes the SKILL, not the request. This regenerates those titles from what the user actually typed. Lists what it would change unless --apply is passed.z'Write the new titles (default: dry run)r z*Maximum sessions to examine (default: 200)browseuBInteractive session picker — browse, search, and resume sessionsrp z#Max sessions to load (default: 500))sessions_parser)r )r )r )rU)r )r^)r )r r3 z2Print shell completion script (bash, zsh, or fish)r; r)rr< r= zShell type (default: bash))r rr4r\ c$t|Sr>)r@ )rr? s rrzmain..K0s^D&5Q5QrA)r. r0 )r)rO rB )get_container_exec_infor4c3JK|]}|d|vVdSr7r8)r:r _known_cmdss rr;zmain..0sMc9J9J [rArrrr r*r+r,r-r)rA)r r r r rmNr )r r r r r r r r r )rUhermes_cli.stdior rr rr r}r% r r r r r rrrhermes_cli.moa_cmdr r. add_subparsersrl hermes_cli.fallback_cmdr rr r r0 r" hermes_cli.migrater' r( rrrr5 agent.lsp.clir, rrrrrrrrr hermes_cli.send_cmdr- rrrrrrrrrrrrrrhermes_cli.portal_clirr/ rrrrrrrrr#rr'rr+rr/rr<hermes_cli.checkpointsrr?rrr2rr6rrS rr rr hermes_cli.bundlesr5 rr rv plugins.memoryr6 rr r7 rrfr RawDescriptionHelpFormatterrr{ rs _cli_commandsrrrz rshermes_cli.curatorhermes_cli.petshermes_cli.journeyrr rr rr rr _functoolspartialrrr rr rr rrUrr rr^rr rr rr. r0 rrrrO rrC rr rrr6 iorr4keysrr r StringIOr r6r7rFrnrrer r<r rrr~r r rr )[r r subparsersr r moa_parsermoa_subparsers moa_configure moa_deleter fallback_parserfallback_subparserssecrets_subparsers secrets_bw secrets_op _secrets_cli_op_secrets_clir! _proxy_clir' r( migrate_parsermigrate_subparsers migrate_xai _lsp_register_lsp_errwhatsapp_cloud_parserr- _add_portal_parser_build_kanban_parser kanban_parser_build_project_parserproject_parsercheckpoints_parser_register_checkpoints_clir4 bundles_parser_bundles_registerr5 r6 r r7 seen_plugin_commandscmd_info plugin_parser_exccurator_parser_register_curator_cli pets_parser_register_pets_clijourney_parser_register_journey_clicomputer_use_subcomputer_use_installcomputer_use_doctorcomputer_use_perms_subcomputer_use_perms_statusr` r~ sessions_subparsers sessions_listro sessions_exportsessions_deletesessions_prunesessions_archivesessions_optimize_storagesessions_repairsessions_recoversessions_renamesessions_retitlesessions_browsecompletion_parserr rr_processed_argv_io_has_cmd_token _saved_stderrrr;rBrrr% r r^ r_ r& r? r s[ @@@@@@@rrr+s <<<<<<!!!!       !####      ./// 38ABB< ' ' - / / /      #$$"$$999999&<&<&>&>#FJ (+++ zY7777******&& ?M'J  ..M.BBNftf;YZZZ"--kH:Ts-ttMvS7XYYY**8dVJ_*``JF)@AAA))) 544444 ++ M ` ,  O*88>P8QQ"" K# "" ^#"" 5# "" *#  l 333  ** D M +  N(66&??? zY7777 <;;;;;J''' zY7777  z:::: j84444  z:::: j84444j84444 ==== GFFFFFz""" GFFFFF((44MJ/// NMMMMM**:66N[111zY7777  z::::*<@@@@ :]CCCC j84444 zY7777  z:::: $.. =E/QPPPPP0111 J:>>>> ###j;KLLLL  z:::: j84444 ==== ====  z::::  ** S ( +NVUUUUUUUn%%%_555 ====$%%%W$ W C C C C C C O O O O O O O O#&55 88:: ; ; * 5 5V$!&) ( ]B ? ?$.z$:$:$V !6!! %$]333<< --9!..H\4J.KKK$((&)9::::      33I3K3K L L L..00>EEGG L LF#';;; * 5 5V$!&) ( ]B ? ?$.z$:$:$V !6!! %$]333<< --9!..H\4J.KKK L W W W  h ' ' - -.OQU V V V V V V V V W  ** Q E +  NQLLLLLLn---- QQQ(##))*I4PPPPPPPPQ '' ? $ (  KNFFFFFF;'''' NNN(##))*FMMMMMMMMN  **^, > R +  NQLLLLLLn---- QQQ(##))*I4PPPPPPPPQ  z:::: zY7777 %// Q & 0&+99?T9UU+66 L7%% 4 & @ +55 J 9 6  $$ 8 %   $$ P %$$ T% *44 L Q 5  0>> (?!7 A A N!B!!** >+ %% L& [)[)[)[)[)[)z$$*:$;;;Z1111 !++ K>,O *88>O8PP'226@V2WWMJR.D3_ _ _ B*44C5O   P !  777 6 !   7 !   U!    + !    : !  D! 4    S!   9% E !   ! c!    =! *4425O  4J KKK  l1D!)33 R4N <  B  +55 Q6 1 "" P# !4 > > ^ 9 !? ! !** v + ** 6 +*44 M G 5  O   O!    A! +55 L G 6  !!  E " !!  J" !! X" !!  ]" !!  @ " !! ; "!!  D" ""71P"QQQ)4485O  4J KKK  :U VVV*55 O / 6  !! 6" !!  9 "*44 Q5O  J!  S/T!    o N N N!*<@@@@J~FFFF j84444 ====  z:::: :]CCCC Z1111 ==== #-- A.""''' ) #""(Q(Q(Q(Q"RRR #5$Z1111 j84444 ZIIII:99999,,..N>38ABB<888  1#(122,??O+2*i*H*HSJ  # # % %&&&cee"1N2"   6CJ$$_55D&CJJ 6 6 6&CJx1}}#(J $$_55DDDDDD 6$   11 |DtVU##-), %&4   tY%%  L$..T:t44T:t44t\488      t) t|/C  - -MD'4&& -dG,,, |  - -MD'4&& -dG,,,tV YYt__ b#   277 HRLLLLL  77 s( 55A AA'$B BB=Q Q>Q99Q> F2e?? g -f;;gg.. h/8-h**h/ i j'-jj=k l-l  lQ8?AR8R8 ATS4AS<S<AT__main__rr>)rX)F)rV)NFNNNNNFNNFFFNF)r)rrNNNr)rr)r(/r hermes_bootstrapModuleNotFoundErrorhermes_cli._subprocess_compatrrr rgrrhrdrpardir_bootstrap_rootrrrr_early_recovery_modrecover_if_neededrobjectrr!r(rqr<rBrErUrV__annotations__r|rrrrrrrrrrrrrrr6r8 rrrrrrrZr rtypingr functoolsr hermes_cli.sessions_cmdrhermes_cli.subcommands._sharedr_add_accept_hooks_flaghermes_cli.subcommands.cronrhermes_cli.subcommands.syncrhermes_cli.subcommands.gatewayrhermes_cli.subcommands.profilerhermes_cli.subcommands.modelrhermes_cli.subcommands.setuprhermes_cli.subcommands.whatsapprhermes_cli.subcommands.slackrhermes_cli.subcommands.loginrhermes_cli.subcommands.logoutrhermes_cli.subcommands.authrhermes_cli.subcommands.statusrhermes_cli.subcommands.webhookrhermes_cli.subcommands.hooksrhermes_cli.subcommands.doctorrhermes_cli.subcommands.securityr hermes_cli.subcommands.approvalsrhermes_cli.subcommands.dumprhermes_cli.subcommands.debugrhermes_cli.subcommands.backupr!hermes_cli.subcommands.import_cmdr#hermes_cli.subcommands.import_agentrhermes_cli.subcommands.configrhermes_cli.subcommands.skinrhermes_cli.subcommands.consolerhermes_cli.subcommands.versionrhermes_cli.subcommands.updater hermes_cli.subcommands.uninstallr hermes_cli.subcommands.dashboardrhermes_cli.subcommands.guirhermes_cli.subcommands.logsr"hermes_cli.subcommands.prompt_sizerhermes_cli.subcommands.memoryrhermes_cli.subcommands.acprhermes_cli.subcommands.toolsrhermes_cli.subcommands.insightsr!hermes_cli.subcommands.monitoringrhermes_cli.subcommands.skillsrhermes_cli.subcommands.pairingrhermes_cli.subcommands.pluginsrhermes_cli.subcommands.mcprhermes_cli.subcommands.clawrrrr&rr(rr)_FORCE_IPV4_EARLYr-_read_raw_early _cfg_pathrj_early_cfg_rawr.apply_managed_overlayrerf_early_sec_cfgrrp _early_redactrs_early_net_cfgrr5_setup_loggingrr}rrB _apply_ipv4rrr rrErFrGhermes_cli.model_setup_flowsrHrIrJrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r\rz rsrrcrqrrrrrrrrrrTr`rkrqrrrr frozensetrrrrrrrrrrrrr rrBrOrrUr[r^rkrrrrrrrrrrrr#rrrrrrrrrrrr_DEFAULT_QWEN_PORTAL_MODELSrNrVr[r^rbrrqrtryr|rrrrrrrrrrrrr rrrrr#r'r+r/r2r6r<r?rSrUr^rjhermes_cli.update_cmdrkrlrmrnrorprqrrrsrtrurvrwrxryrzr{r|r}r~rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr4r(r2r?r6rJrWrPrqrwryrrr}rrrrrrrrrrrrrrrrrrrrrr rrrrr,r4r7r@rarhrlrorwrr Namespacerhermes_cli.dashboard_procsrrrrrr_DASHBOARD_SYSTEMD_UNITrrrrrrr_warn_stale_dashboard_processesr r r r r r r r% r r rA r/ r[ rI rJ rK r| rs r r r LAZY_REFRESH_IMPORT_PROBESr LAZY_REFRESH_REPAIR_PACKAGESr2 r r1 r r r0 rD ri r r r rC r rfr r r r rm r r r6 r r r r r r r r. r0 r5 r@ rC rO rS rX ru rq rs rv r{ r r r r r r rr r r r r r r r r r r r r rr@rArr" s!4***r    D HGGGGG '""27<<0I0I29#U#UVV#(""HOOA'''$$$$$$>===== ))++++   D Ft:$ $ $ $ T - - - -  -  -  -  -  - - - - `,,,,,0000% % % % Z)- ,,,>66-66666L    ,)T)))) ;tCy;T;;;;;tCy;T;;;;<<<<<GGGGGG8D8888/3://// ,,,,,,,,, $t$$$$"!### *Q-- 000000ZZZZZZ999999999999????????????;;;;;;;;;;;;AAAAAA;;;;;;;;;;;;======999999======??????;;;;;;======AAAAAACCCCCC999999;;;;;;======EEEEEEIIIIII======999999????????????======CCCCCCCCCCCC777777999999GGGGGG======777777;;;;;;AAAAAAEEEEEE======????????????777777999999st$t**,,-- !!###jFjFjFjFZ.-----444444|f45555  EDDDDD!!M1I(**0b   0 0 0 0 0 0@]@PPNN    D  ""* 4 4+// B??Nz.$// U . 2 23C D D  ,:=#m:L:L:R:R:T:TBJ67'++Ir:: :nd + + %0B0B<0P0P % $      D   >>>>>>NtLLCHQRRLLLLbQQ788 E    D   IIIIII $      44444444 .  8 $ $S#X(=CC$J&*d*sTz****Z BC B B B BG4GGGG D        $"CdCCCC #    qdqqqqhnTnhsmnnnnb 0#(3-@$$Z%tZ%tZ%Z%Z%Z%z%s%x}%%%%P (3-EI99 94SNDSN4SNE$s)T/4JSNSNSNSNl5f5c55550,8C=,,,,^::S:C::::0!!x~!!!!!.t......(,""!#cc}c c C=csm c  c  cd^c c C=c C=cccc}cccccL    *    ((d((((VRRRjfYfYfYR&&&& ) ) ) c d    @'@'@'@'F   X*** DsC}% &"U3S=12*$3*         @CD9"9"9"9"xL@sL@tL@L@L@L@f 2K2K 2K2K2K 2K  2K2K2K2Kj3WC3W43WD3W3W3W3Wl129K$$$$$` CCCsCT\]`TaCCCCL##* / / / /0000NR GQGQGQGQX7B7B7BL,KKK+#+$++++MMMMn [[[[ [  [[[[@CC      *ZZZ~@ @ @ F   D   """      26, , , $, $, , , , ^,,, <@MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMd5GGGG$+D+D+D+D\"M$"M4"M"M"M"MJ6t6d6s6666r9D9999 DD D4 DD D D D D(!$!% aLaLaL caL aL aL  aL c3h$  aL aLaLaLaLH4$sCx.4/4444r#%!% Q"Q"Q" Q" Q"c3h Q"  Q" c3h$  Q" Q"Q"Q"Q"h+Q c+Q +Q c3h +Q  +Q  +Q+Q+Q+Q\CC$J*38(((4(4(D((((V6;KKKdKdKtKKKK\:d:t::::4999999x:T:::: !&t!&4!&QU!&Z^!&!&!&!&HETE4EDEEEE$!:d!:x~!:!:!:!:fn}wwwe#-"9hsm"9"9"9"9JHSMB&/&/&/&/&/RDsDDDD<0D0S0000fdx}t $6d6t6666 3t33333:--,4TN- ----`"tDz""""J8T8d4j8888zF666666$       D T    DT! "+"+"+"+ "+ SM "+  "+"+"+"+JZZ4ZDZZZZFtFS FFFFR)T)hsm))))*x}@$@69^^^ ^#^/2^ ^^^^H48AAAA#+4.A AAAAHD$486 /t /PT / / / /#d#t####L#tCy#~!6####Lr'($r'r'r'r'p%)WWWc(T/W #YWWWW&c&eCcM.BT.I&&&&Rd s5 (ii i i iiiiXccDj< S S4Z    ccDj(((3(S4Z(SW((((V(C(DI,<((((V(.4S ?(.tDI(.(.(.(.Z#BST#YN/T////545555 T d     BTBSBTBBBBIIII UUUU [[[[|    @OFOFOFOFd     F/eDItCH~7L,L&M////("&&( $$$ c$ c3h$ $!$ $  $$$$N#T####14$;1111C4CDJCCCC$/0dddd(+d %d ddddN d t     FT%d *;%<"&#  c c3h$    D  4$; $    :2U5c?C#78 4tCH~"& . . . c . c3h$  . . . . .(Dc(DtCy(D(D(D(D\"&IIIS I c3h$ I #Y IIII`"& S 3i c3h$    8"&)))S ) c3h$ ) ))))^"& ?C?C?CS ?C c3h$ ?C  ?C  ?C?C?C?CDDI0"&B9B9B9S B9 c3h$ B9 B9B9B9B9P"& tDtDtDS tD c3h$ tD  tD  tDtDtDtDnS (,S#X(= D[://S#X-/////34&#3:####LF-F-F-F-F-F-F-F-RNNTNNNNb,GCGGGG ) )# ) ) ) )H2H2H2VLdLtLLLL^F F F RB B B B J#8 s # $    U U U U pVsVsVVVVr 1 1 1 1 1 1wwwt  % % % %*  c     2!y<#   $ d    Fd* t     :.-- eV_ -!E7+ 7) $TTTTT0D0000 R R R R j,,,, ) ) ) )CTCCCCL&T&&&&R<<<~." 1 1 1***Z       iiiX+ zDFFFFFsy .B>>CC3PM('P(M0-P/M00B%PPP"9QQ$#Q$*Q==RR