+ jHjt aRit40tRt^RIt^RIt^RIt^RIt^RIHt^RIH t H t ^RI H t H t HtHtHtHt]P$!R4tRRltRsR R ltR R ltR RltRjRRlltRRltRRR]R3RRRRR3.]!RRR4ORkN]!R4ORRRRR3N]!R4ORlNRmN]!RR R!R"R#R$R%R&4OR'R'RR]3N]!R(4O5t]^kR)R*ltR+R,ltR-]!4/R.R/lltR0R1lt R2R3lt!R4R5lt"]!] PF04t$]!] PJ] PL04t'R6R7lt(RnR8RR93.](!R:R;R4OR?]$R3NR@]$R3NRA]$R3N](!RBRCRD4ORE]$R3N](!RFRGRHRIRJRKRLRM4ORN]'R3NROR]"3N](!RPRQRR4O5t)]^kRSR/RTRUllt*RoRVRWllt+RXRYlt,RZR[lt-R\R/R]R^llt.RpR_R`llt/RqRaRbllt0RcRdlt1ReRflt2RgRhlt3R#)ruconfig.yaml / gateway.json → ``GatewayConfig.from_dict`` schema (the ``load_gateway_config`` phases). Precedence for top-level keys: key-presence at the TOP LEVEL of config.yaml wins; the nested ``gateway.`` form (what ``hermes config set gateway.`` produces) is consulted only when the top-level key is absent — not merely falsy/mistyped — so a present-but-empty top-level value is never silently replaced by the nested one. Both overwrite whatever legacy gateway.json set. N)Path)AnyOptional)UNAUTHORIZED_DM_BEHAVIORSPlatformPlatformConfig _coerce_dict _dict_slot_normalize_choicezgateway.configc0V^8dQhR\R\/#homereturn)rr)formats":/home/ubuntu/.hermes/hermes-agent/gateway/config_loader.py __annotate__rs  4 C czVR, pVP4'g/#\VRRR7;_uu_4p\P!V4;'g/pRRR4\P RV4X# +'giL(;i \ d#p\PRY4/uRp?#Rp?ii;i)uaLegacy ``gateway.json`` base layer (config.yaml keys always win). Malformed → ``{}`` + warning.z gateway.jsonr utf-8-sigencodingNu<Loaded legacy %s — consider moving settings to config.yamlzFailed to load %s: %s)existsopenjsonloadloggerinfo Exceptionwarning)rpathfdataes& rload_legacy_gateway_jsonr%s . D ;;==  $k 2 2a99Q<%%2D3 RTXY 3 2 .8 s4B !A:B : B B B:B5/B:5B:Fc:V^8dQhR\\,/#r r)rstr)rs"rrr9s[[#[rc\\'d \PPR4#R#)zW``os.environ['GATEWAY_ALLOW_ALL_USERS']`` when it is the bridge's own write, else None.GATEWAY_ALLOW_ALL_USERSN)_BRIDGED_ALLOW_ALL_USERSosenvirongetrrbridged_allow_all_usersr09s!8P8P2::>>3 4ZVZZrc0V^8dQhR\R\/#)r envrdict)rs"rrr>s$4rcB\4eVPRR4V#)zbRemove the bridge-owned ``GATEWAY_ALLOW_ALL_USERS`` from a child-process env (operator-set stays).Nr*)r0pop)r2s&rdrop_bridged_envr7>s , )40 Jrc0V^8dQhR\R\/#r valuerrbool)rs"rrrDscdrc\V\4'dR#\PR\ V4P 4R#)TzIIgnoring invalid quick_commands in config.yaml (expected mapping, got %s)F) isinstancer4rr type__name__)r:s&r_quick_commands_okrADs3% NNS U  rc<V^8dQhR\R\R\/#)r r:defaultr)rr()rs"rrrNs&HHsHSHcHrc$\V\V4#N)r r)r:rCs&&r_dm_behavior_choicerFNs U$=w GGrc0V^8dQhR\R\/#r keysrr(tuple)rs"rrrRs??S?U?rcZ\;QJd.RV4FNK 5#!RV44#)c3."TF qVRRR3xK R#5i)presenceNr/.0ks& r _presence..Ss>AQ D$/srKrIs*r _presencerVRs$ 5>>5>5>> >>rquick_commandsnonesttrNc"\V\4#rE)r>r4vs&rr]Ys At)listr[s&rr]r]]s :a;Nrmax_concurrent_sessionsreset_triggersalways_log_localwrite_sessions_json loop_watchdogloop_watchdog_probe_interval_sloop_watchdog_probe_timeout_sloop_watchdog_max_strikesfilter_silence_narrationunauthorized_dm_behaviorunauthorized_dm_decline_messagec `V^8dQhR\R\R\R\R\R\/#)r yaml_cfggateway_sectiongw_datakeymoder)r4rr(rK)rs"rrrks8**T*C*$*S*X[*`e*rc\V\4pVR9d8W09d RW,3#V'dW19dVR8XgW29d RW,3#R#VR8XdV'dW19d RW,3#R#VPV4pVR8Xd$VfV'dVPV4pVRJV3#\V\4'gV'dVPV4p\V\4V3#)zDReturn ``(found, value)`` for *key* under the given fallback *mode*.rNTNnestedrX)rNgwdata)FNr>r4r.)rqrrrsrtrurwr:s&&&&& r_bridge_lookuprzks  .F %% ?& & c,$*2DHZ-- - x/5#:Po*+cVcc LL E v~ =V#'',ED %'' eT " "v##C( eT "E ))rc@V^8dQhR\R\R\RR/#)r rqrrrsrN)r4r)rs"rrrs/CC4C#CCQUCrc\FFwr4rVp\WW#V4wrV'dVeV!V 4'gK2V'd V!V 4MT W$&KH R#rE)_TOPLEVEL_BRIDGErz) rqrrrsyaml_keygw_keyruaccept transformfoundr:s &&& rbridge_toplevel_keysrsH5E1$ %hTXY +F5MM .7)E*U 6Fralsoc TV^8dQhR\R\R\R\R\/#)r rq gateway_cfgrsrr)r4r frozenset)rs"rrrs1""d""t"V_"rv"rc a\VR4oRV3Rllp\V\4'dTM/pV!VPR44V!VPR44T!VP 4UUu/uFAwrgVR8wgK\V\4'gK&Wc9g\ V4'gK?WgbKC upp4S#uuppi)uMerge every place a platform block may live into ``gw_data["platforms"]`` and return it. Order (later wins on shared keys, ``extra`` deep-merged so gateway.json defaults survive): ``gateway.platforms.*`` → top-level ``platforms.*`` → ``gateway.`` subsections (nested first so top-level config keeps precedence, matching the gateway.streaming fallback). An ``enabled`` key in any block sets the ``_enabled_explicit`` marker consumed by the env pass. Top-level adapter keys (``gateway.api_server.port: 8642``) reach ``extra`` in ``PlatformConfig.from_dict``. *also* names platforms whose ``gateway.`` shorthand counts even while no adapter is registered (a platform that left core, read before its plugin loads). platformsc(V^8dQhR\RR/#)r source_platformsrNr)rs"rr-merge_platform_sections..__annotate__s////rc<\V\4'gR#VP4Fwr\V\4'gKSPV/4p\V\4'dTM/p/VPR/4CVPR/4CpRV9dRVR&/VCVCpV'dWER&VSV&K R#)NextraenabledT_enabled_explicit)r>r4itemsr.)r plat_name plat_blockexisting merged_extramergedplatforms_datas& rmerge&merge_platform_sections..merges*D11 %5%;%;%= !Ij$//%)))R8H#-h#=#=x2HWhll7B7W:>>'SU;VWLJ&48 01//J/F".w(.N9 %&>r)r r>r4r.r_is_platform_name) rqrrsrrnested_gatewayrQr\rs &&&$ @rmerge_platform_sectionsrs 5N// %/{D$A$A[rN .  [ )* (,,{ #$ N002 `2DA; #-a#6 <=IIZ[\I] 142 `a  `s4 C C C 5C c0V^8dQhR\R\/#)r rtrr;)rs"rrrs34rcN\V4R# \\3dR#i;i)FT)r ValueErrorAttributeError)rts&rrrs,    's $$cHV^8dQhR\R\R\R\/#)r rqnamegateway_platformsr)r4r(rrK)rs"rrrs(  t 3 3 5 rcaVPS4p\V\4pV'g(V3RlW PR434p\WS4pW43#)z``(section, is_toplevel)`` for platform *name*: a top-level ``:`` block wins; otherwise the block under ``gateway.platforms`` / ``platforms`` so shared-key bridging and adapter hooks still run for nested-only configs.c3<"TFMp\V\4'gK\VPS4\4'gKBVS,xKO R#5irEry)rPsrcrs& rrR#platform_section..s`T'UYcdgimYn)s}BFFGKLNRtS)#d))'UsA"AAr)r.r>r4next)rqrrsectiontoplevelrws&f& rplatform_sectionrsRll4 G'4(H T(9<< ;T'UTv'  rc0V^8dQhR\R\/#r9r)rs"rrrsWWcWcWrc\V\4'd/VP4UUu/uFwr\V4VbK upp#T#uuppirE)r>r4rr()r:rQr\s& r _str_keyedrs<4>ud4K4K%++- 0-$!CFAI- 0VQVV 0sAc0V^8dQhR\R\/#rHrJ)rs"rrrs00#0%0rcZ\;QJd.RV4FNK 5#!RV44#)z7Keys copied verbatim into ``extra`` for every platform.c3*"TF qRR3xK R#5irEr/rOs& rrR_plain..s/$QT4$srTrUs*r_plainrs$ 5/$/5/5/$/ //rnotice_deliveryc \VRR0R4#)publicprivate)r r[s&rr]r]s(9!h =RT\(]r reply_prefixreply_in_threadcron_continuable_surfacerequire_mentionsend_read_receipts allowed_chatsgroup_allowed_chatsallowed_topicsfree_response_channelsmention_patternsexclusive_bot_mentions"observe_unmentioned_group_messages dm_policy allow_fromallow_admin_fromuser_allowed_commands group_policygroup_allow_fromgroup_allow_admin_fromgroup_user_allowed_commandschannel_skill_bindingschannel_promptsgateway_restart_notificationtyping_indicatortyping_status_text root_blockc TV^8dQhR\R\R\R\R\/#)r plat platform_cfgrsrr)rr4r<)rs"rrrs1tTXeirc/pV'd~\PR0,pTPVP4UUu/uFwrgWe9gK WgbK upp4VP\ VP R/444\ Fewrp W9g V e W 9dKV R8Xd'\W,VP RR44WH&KEV 'dV !W,4MW,WH&Kg V#uuppi)aShared-key bridge; a ROOT-level ``:`` block (which ``merge_platform_sections`` never copies into ``platforms_data``) also gets its adapter keys promoted into ``extra``, with the same typed-key exclusion and explicit-``extra`` precedence as ``PlatformConfig.from_dict``.channel_overridesrdmrnpair)r _TYPED_KEYSupdaterrr. _SHARED_KEYSrF) rrrsrbridgedtypedrQr\rtonlyrs &&&$ r _bridged_keysrsG**.A-BB););)=P)=)=PQ|L$4$4Wb$ABC ,9  "t'7D.extra``, captured right after ``merge_platform_sections`` and BEFORE either copy site runs. Reading ``platforms_data`` live at a copy site would mistake values the earlier site bridged from the block's own ``extra:`` sub-dict for authored ones (``telegram: {reply_to_mode: all, extra: {reply_to_mode: off}}`` must still resolve to ``all``). Copies, never creates slots.r)rr>r4rr.)rrrs& rsnapshot_authored_extrarsW)..0 0JDJtT4J 4d< 12330  s A(AcHV^8dQhR\R\R\R\/#)r authoredmanagedrrr3)rs"rrrs)4$QUrc FV'g/#^RIHp\WPR4/4p/pVP 4EFYwrg\ VPV44p\ VPV44p \ V4\ \ VPR444,\ V 4,p V \ \ V PR444, \ V4,Fp W{K \ V PR44p VPV!W|44V 'gK\\W&4R4p V PV!W44V U u/uF#p V \P9gKWV ,bK% up WV&EK\ V#uup i)zRemove from *authored* (in place) every key the administrator pinned in a managed ``:`` block: the user's ``platforms..extra`` must not outrank it. A key the managed layer itself sets under ``platforms..extra`` stays authored.) _deep_mergegatewayr) hermes_cli.configrrr.rrsetrr rr)rrrrmanaged_platforms hook_pinsrrrootrwpinnedrt managed_extra destinations&&& r_apply_managed_extrarsY  -/Y9OQSTI~~' GKK-./33D9:TSdhhw.?!@AACKOSfjj.A!BCCs5zQQC R%VZZ%89  [67 =$Z%EwOK   {;F G:GI-3"%^-G-G"G /s#J-IIO(" Is )F Fwarnedc vV^8dQhR\R\R\R\R\\,R\/#)r rblockrrrr)r4r(r<rr)rs"rrr0s>!!$!t!!$!X`adXe!qu!rcaaaaSf \4oV'dRS R2MRS 2oRVVVV3RllpV!V4p\VPR4\4'dcV!VR,4VR&TP VR,Uu/uF-pVS9gK V\ P 9gK#VSV,bK/ up4V#uupi)uEffective ``:`` block for YAML→extra/env bridging: *block* (top-level or nested) overlaid with the keys the user authored in ``platforms..extra``. Returns a NEW dict and never mutates *block* or *extra*. For every key present in both with DIFFERENT values, ONE warning logs that the authored extra took precedence (equal values are silent). *warned* dedupes across both copy sites within one ``load_yaml_layer`` pass; ``None`` gives the caller a fresh local set. zthe top-level 'z:' blockz platforms.c0V^8dQhR\R\/#)r sourcerr3)rs"rr$_authored_wins..__annotate__=s % %T %d %rc<VUu/uFqS9gK VSV,bK ppVP4FKwr4W,V8wgKSV3S9gKSPSV34\PRVSSS4KM /VCVC#uupi)zL%s set in both %s and platforms.%s.extra; platforms.%s.extra took precedence)raddrr ) rrQoverlayrtr:rrrwheres & r overlay_onto$_authored_wins..overlay_onto=s(.=1u*;1eAh;=!--/JC{e#C(8(F Is+,b 9*%&$G$$>s BBr)rr>r.r4rrr) rrrrrr  effectiverQr s f&f$d @r_authored_winsr 0s~5=oi[ 1ZPY{C[E % %U#I%))G$d++)%.9 ' uW~Q~!%Z&,-^5O5O,O&!U1X+~Q R Qs CC,CcV^8dQhR\R\R\R\R\R\\,R\\,RR /#) r rqrrsrrrrrN)r4rrdrr)rs"rrrTsV)))'*)59)KO)Z^) SM),4TN) )rc Vf \V4pVEFpV\P8XdK\WPV4wr\ V\ 4'gKK\VPVP/4WPWR7p \WzW)R7p RV9p V 'd\ VPR4\ 4'dr\W7P4p \V R4VR,P4UUu/uF)wr\ V\ 4'gK\V4VbK+ uppV R&T ;'dRV9pV 'gV'g V 'gEKW\W7P4p \V R4pV'dVR,V R&RVR&VPV 4EK R#uuppi) uCopy shared keys (allow_from, require_mention, …) from each platform's YAML section into ``extra``. ``enabled`` is only written from a TOP-LEVEL block: for nested-only configs ``merge_platform_sections`` already merged it with the correct precedence. An explicit top-level enable/disable sets ``_enabled_explicit`` so the env pass honors ``enabled: false`` for migrated plugin platforms instead of re-enabling them on token/SDK presence. Nrr)rrrrTr)rrLOCALrr:r>r4r r.rr rr(r)rqrrsrrrrrr cfg_toplevelr rhas_channel_overrides plat_datacidov_dataenabled_was_explicitrs&&&&&&& rbridge_platform_shared_keysrTsw*>: 8>> ! %5h L]%^" ,-- # LLR (, \j R 3| C Z 0@0@AT0UW[%\%\">::>I y' *%11D$E$K$K$M.$MLCgt,"C'!$M.I) * ,II \0I3r4r r.rrrdebugr )rqrrrrrrrrrrr seededr$s&&&&&&&& rapply_plugin_yaml_hooksrs/*>:+2?%%'G  % % - %5h L]%^" ,-- # LLR (, \j  ---2225::rBC //DF fd # # z.**=w G N Nv V3H(  LLA5::q Q  sE E8 !E33E8c4V^8dQhR\R\RR/#)r rqrrNr3)rs"rrrs&<^<^t<^T<^d<^rcX^RIHpV!4pVPR4pVPR4pVf(\V\4'dVPR4pV'g\ 'g\ P!R4'gr\V4P4R9s\ 'd*R\ PR&\PR4M \ PPRR4VPR4pVeRVPR 4;'g/9dVP\P P"/4pVPR /4PRV4V'gG\ P!R 4'g+\V4P4\ PR &VPR /4p\V\4'dRV9dVP\P$P"/4p V PR /4PRVR,4V'gR\ P!R 4'g4\VR,4P4\ PR &R#R#R#R#R#)uThe YAML→env bridges that stay in core (per-platform ones live in plugin hooks). Top-level ``require_mention`` → Telegram when the ``telegram:`` section has none: users write it alongside ``group_sessions_per_user`` expecting it to work, and the telegram plugin's hook only runs when a telegram block exists. Signal ``require_mention`` → ``SIGNAL_REQUIRE_MENTION`` (env wins). ``allow_all_users`` (top-level or ``gateway.allow_all_users``) → ``GATEWAY_ALLOW_ALL_USERS``: every allow-all reader (authz mixin, startup access check, own-policy adapters, plugin gates) consults that env var, so the bridge is the one seam that makes the YAML key reach all of them (#110690). Platform values are ALWAYS seeded into the owning platform's ``extra`` (the adapters read extra first); the process-env write is skipped while a multiplexed secondary profile's scope is active — the loader runs inside ``_profile_runtime_scope`` for every secondary, and a first-writer-wins write there would make the secondary's policy the DEFAULT profile's (#80099 class). A secondary profile sets ``GATEWAY_ALLOW_ALL_USERS`` in its own ``.env`` like every other scoped authorization gate. )profile_scopedrallow_all_usersNr*truezconfig.yaml allow_all_users: true grants every sender on every platform access (bridged to GATEWAY_ALLOW_ALL_USERS; an explicit env var wins).rtelegramrTELEGRAM_REQUIRE_MENTIONsignalSIGNAL_REQUIRE_MENTION>1yesr$)gateway.platforms._sharedr"r.r>r4r+r,getenvr(lowerr-rr r6 setdefaultrTELEGRAMr:SIGNAL) rqrr"skip_env_bridgerr allow_alltl_require_mentiontg_plat signal_cfgsig_plats && rbridge_core_env_settingsr7s "9$&Oll9-O ./IZ>>#''(9:   8 8 Jc@d@d#&y>#7#7#9=Q#Q # #4:BJJ0 1 NNR  JJNN4d ;!&78%*;HLLQ[D\DbDb`b*c ++H,=,=,C,CRH7B'223DFXY ryy1K'L'L589K5L5R5R5TBJJ1 2 h+J*d##(9Z(G!,,X__-B-BBGGR(334EzRcGderyy1I'J'J36zBS7T3U3[3[3]BJJ/ 0(K)H#rc0V^8dQhR\R\/#r rr4)rs"rrrs9949D9rc VR, p/pVP4'd7^RIHp\VRR7;_uu_4pV!V4;'g/pRRR4^RIHpV!V4p^RIHpVPV4# +'giL5;i)uUser ``config.yaml`` with the managed overlay applied — the YAML the gateway loader sees. Raises on a malformed user file (the loader then falls back to env + gateway.json WITHOUT the managed layer). An ABSENT user file is an empty layer, not a reason to skip the administrator's values: a fleet host with no ``config.yaml`` must still honor them. Any pre-activation predicate (``gateway.relay.relay_explicitly_disabled``) reads through here so it cannot disagree with ``load_gateway_config()`` on which files count. z config.yaml)fast_safe_loadrrN)_expand_env_vars managed_scope) rutilsr;rrr< hermes_clir>apply_managed_overlay)rconfig_yaml_pathrqr;r"r<r>s& rread_yaml_layersrCsm+H   ) "[ 9 9Q%a(..BH:3  )H)  . .x 88: 9s A== B c4V^8dQhR\R\RR/#)r rrsrNr9)rs"rrrs!%7%7$%7%7$%7rc \V4pV'gR#VPR4p\W#V4\V\4'dVPR4MRp\ W#V4p^RIHpV!4^RIH pRp Ve ^RI Hp VPV !W%WR74p \!YyfRM#V Uu.uFqP"R 8XgKVNK up4p \%\ W#/44p ^R IHp \+WP-/4V4p\/4p\1W$WWV R 7\3W$WWWWR 7\5W%4R# \d#p\PRT4RpRp?LRp?ii;iuupi) zhOverlay ``read_yaml_layers`` onto *gw_data* in place. Raises on any failure (caller warns + falls back).Nrr)discover_plugins)platform_registryzplugin discovery skipped: %s)activation_predicate)rqplatform_namesrrpluginr=)rr)rrrr)rCr.rr>r4rhermes_cli.pluginsrFgateway.platform_registryrGrrrgateway.platform_activationrHconfigured_entriesrrrr@r>rrArrrr7)rrsrqrrrrrFrr$rrHrrr>rrs&& rload_yaml_layerrOsY%H ll9-OG<xZ\']^H((3V3VWY3Z\jkM%FWg_giH#)MlX6-  3Q7Jvs$)D?0E/ E/ ? E, E''E,chV^8dQh/^\9d \;R&^\9d \;R&#)r r}r)__conditional_annotations__rK)rs"rrrs<l%mbecr)r)multiplex_profilesrRrxNN)systemd_watchdog_secondsrSrwNN) streamingrTr4NN)rnNrrE)NN)NNNN)5rQ__doc__rrloggingr,pathlibrtypingrrgateway.configrrrrr r getLoggerrr%r+r0r7rArFrVr}rzrrrrrrr/ _TELEGRAMDISCORDSLACK_DISCORD_SLACKrrrrrrr rrr7rCrOr)rQs@rr_s   {{   + , @![  H? '1CTJ E:0-]^ N-/IK\^rsi&  It,  y$'  $&8:RS*9d; \#57N*,DFc~t4j) *,>@TU $[`&