+ jHjaEREt}0tRt^RIHt]!4^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIt^RIt^RIt^RIHtHt^RIHt^RIHtHt^RIHt^RIHtH t H!t!H"t"H#t#H$t$H%t%^RI&t'^RI(H)t)^R I*H+t+H,t,^R I-H.t.^R I/H0t0H1t1^R I2H3t3^R I4H5t5H6t6H7t7H8t8H9t9H:t:H;t;Ht>H?t?^RI@HAtAHBtBHCtCHDtD^RIEHFtFHGtGHHtHHItIHJtJHKtKHLtLHMtMHNtNHOtO]P!]Q4tRRRltSRRltTRRltU!RR]V4tW] P!4R8HtY] P!R4t[ERt\]^k]]!0RkRkRkRkRkR kR!kR"kR#kR$kR%kR&kR'kR(kR)kR*kR+kR,kR-kR.kR/kR0kR1kR2kR3kR4kR5kR6kR7kR8kR9kR:kR;kRkR?kR@kRAkRBkRCkRDkREkRFkRGkRHkRIkRJkRKkRLkRMkRNkROkRPkRQkRRkRSkRTkRUkRVkRWkRXkRYkRZkR[kR\kR]kR^kR_kR`kRakRbkRckRdkRekRfk4t^]^kRgR/RhRillt_RjRklt`]P!4tb/tc]^k/td]^k/te]^k]]!0RlkRmkRnkRokRpkRqkRrkRskRtkRukRvkRwkRxkRykRzkR{kR|kR}kR~kRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkRkR[kR\kRkRk4tfRR0tg]!R4thRRltiRtjRRltk]]!0ERm4tlRRltmERRRlltnRRltoRRltpRRRR/tqRRltrRRltsRttRRltuERRRlltvERRRlltwRRltxRRltyRR/RRlltzRRlt{RRlt|Rt}Rt~ERRRlltRRlt]!4t]^kERtRt^ERIHtHt^ERIHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHtHt^ERIHtHtHtHt^ERIHtHt^.ERO^ERER .^.ERO^ ER .^ ER ./t]^k/tERERERlltERERltERERltERERltERERltERERERERERR/ERERllt]!4tERERltER ER!ltER"ER#lt]]!0ER$kRlkRnkERkER%kER&kERkER'kER(kER)kER*kER+kER,kER-kER kER.kER/kERkERkER0kERkER1kER2kER3kER4kRkER5kER kER kER6kER7k4tER8ER9ltER:ER;ltER<ER=ltER>ER?lt0ERmt]]!]EP!44],t0ERmt0ERmt]!ERBERC44tERDEREltERERFERGlltERtERtERtERHERIltERJERKltERLERMltERNtEROERPltERQERRltERSERTltERUERVltERWERXltERERYERZlltERER[ER\lltER]ER^ltER_ER`ltERaERbltERcERdltEREReERflltERgERhltERiERjltERkERlltERmERnltERoERpltERqERrltERsERtltERuERvlt] P!ERw4tERxERyltERzER{ltER|ER}ltER~ERltERtERERltERtERERltERERlt]R3ERERlltERERltERERltERERltERERlt]EPt]]!0ERm4t]3ERERlltERR/ERERlltERERltERERltERERltERERltERERERlltERERltERERERlltERERERllEtERR/ERERllEtERR/ERERllEtERR/ERERllEtERERlEtERERlEtERERlEtERR/ERERllEtERR/ERUu/uFpVERVEP4 2bK upCEt ERERlEt ERERlEt ERERlEt ERERlEt ERERlEtERRERRERR/ERERllEtERERlEtERERlEtERERlEtERERlEtERERlEtEREtEREtERERlEtERERlEtERERERRERR/ERERllEtERERlEtERERlEtERERlEtERERlEtERERlEtERERlEt/Et ]^k]EPB!4Et"ERERlEt#]ERERl4Et$ERERlEt%ERERlEt&ERERlEt'RgR/ERERllEt(ERERlEt)ERERlEt*ERERlEt+ERERlEt,ERERlEt-ERERlEt.ERERlEt/ERERlEt0ERERER/ERERlllEt1ERERER llEt2ERER lEt3ERER ER llEt4ER ERlEt5ERERlEt6ERERlEt7ERERlEt8ERERlEt9ERERlEt:]]!0ERm4Et;EREtERERlEt?ERERERllEt@EREtAERER lEtB]]!0ERm4EtC]]!0ERm4EtD]]!ER@04EtE]]!ERA04EtFE]CE]E,E]D,EtGER"ER#lEtHERER$ER%llEtIER&ER'lEtJER(ER)lEtKER*ER+lEtLER,ER-lEtMER.ER/lEtNER0ERER1ERER2ERER3RER4RER5RERRERRER6R/ EtOER7ER8lEtPER@ER9ER!ER:ER;ER:ERER9ER?ER9/EtQ]]!ER@ERA04EtRERBERClEtSERDERElEtTERFERGlEtUERHERIlEtVERJERKlEtWERLERMlEtXERNEROlEtYERPERQlEtZERRERSlEt[ERERTERUllEt\ERVRERR/ERWERXllEt]ERYERZlEt^ERER[ER\llEt_ER]ER^lEt`ER_.EROR3EtaER`.ERO.ERO3EtbERa.EROR3EtcERbEtdERcEteERdEtfEReERflEtgERgERhlEthERiEtiERjEtjERkERllEtkRERmERnERoERpERqERrE]dERsE]eERtE]fERuERvERwERxERyE]iERzE]j/ EtlER{EtmER|EtnER}ER~lEtoE]o!4]!ER,EtpERERlEtqERERERllEtrERERERllEtsERERRERR/ERERlllEttEREtuERER/ERERllEtvERERlEtwERERR/ERERlllEtxERERERllEtyERERlEtz]]!]4Et{]^kE]z!4Et|]^ kR#uupi(zConfiguration management for Hermes Agent: config.yaml / .env loading, saving, validation, migration, and the ``hermes config`` command.)drop_stale_root_modulesN)contextmanagersuppress) dataclass)DecimalInvalidOperationPath)DictAnyLiteralOptionalListTupleSet) line_input)Colorscolor) managed_scope)DEFAULT_SOUL_MDis_legacy_template_soul)masked_secret_prompt) _IGNORED_MANAGED_VALUES_LEGACY_MANAGED_SYSTEM_MANAGED_FALSE_VALUES_MANAGED_TRUE_VALUES_chown_to_hermes_uid_container_or_chmod_skipped_resolve_hermes_uid_gidapply_secure_dir_policyget_managed_system)get_hermes_homeget_process_hermes_home)atomic_replacefast_safe_loadfile_signaturemkstemp_beside) _CONFIG_PARSE_FAILURES _FIX_PERMS _FIX_YAMLFailedConfigRead_backups_dir_display_refuse_failed_read_refuse_overwrite_warn_config_parse_failure_yaml_error_details_yaml_error_locationc$V^8dQhR\/#returnbool)formats"6/home/ubuntu/.hermes/hermes-agent/hermes_cli/config.py __annotate__r9:sDcR#Fr=r:r8is_uv_tool_installr>: r:c0V^8dQhR\R\/#r3methodr4strr6)r7s"r8r9r9?s#$r:cR#r<r=rBs&r8is_unsupported_install_methodrG?r?r:c0V^8dQhR\R\/#rArD)r7s"r8r9r9Dsssr:cR#r=rFs&r8"format_unsupported_install_warningrMDs r:c]tRt^ItRtRtR#)InvalidUserConfigErrorzDRaised when a run that cannot repair config finds invalid user YAML.r=N)__name__ __module__ __qualname____firstlineno____doc____static_attributes__r=r:r8rOrOIsNr:rOWindowsz^[A-Za-z_][A-Za-z0-9_]*$ LD_PRELOADLD_LIBRARY_PATHLD_AUDITLD_DEBUGDYLD_INSERT_LIBRARIESDYLD_LIBRARY_PATHDYLD_FRAMEWORK_PATHDYLD_FALLBACK_LIBRARY_PATHDYLD_FALLBACK_FRAMEWORK_PATH PYTHONPATH PYTHONHOME PYTHONSTARTUPPYTHONUSERBASEPYTHONEXECUTABLEPYTHONNOUSERSITEPYTHONBREAKPOINT PYTHONCASEOK NODE_OPTIONS NODE_PATHPERL5OPTPERL5LIBPERLLIBRUBYOPTRUBYLIB CLASSPATHJAVA_TOOL_OPTIONS _JAVA_OPTIONSJDK_JAVA_OPTIONSGOFLAGS RUSTFLAGSPATHSHELLBROWSEREDITORVISUALPAGERMANPAGERGIT_SSH_COMMAND GIT_EXEC_PATH GIT_SHELLGIT_SSH GIT_ASKPASS SSH_ASKPASS SUDO_ASKPASS GIT_EDITORGIT_SEQUENCE_EDITOR GIT_PAGERGIT_EXTERNAL_DIFFGIT_PROXY_COMMANDGIT_TEMPLATE_DIRGIT_DIRBASH_ENVENVZDOTDIRPROMPT_COMMANDVIMINITEXINIT HERMES_HOMEHERMES_PROFILE HERMES_CONFIG HERMES_ENVHERMES_CONFIG_PATHHERMES_ENV_PATHHERMES_OPTIONAL_MCPSHERMES_COPILOT_ACP_COMMANDHERMES_COPILOT_ACP_ARGSHERMES_YOLO_MODEHERMES_ACCEPT_HOOKSHERMES_REDACT_SECRETSHERMES_INTERACTIVEHERMES_EXEC_ASKHERMES_GATEWAY_SESSIONHERMES_CRON_SESSIONHERMES_SINGLE_QUERY_SESSIONHERMES_SESSION_KEYHERMES_SESSION_PLATFORM is_windowscRV^8dQhR\R\\,R\/#)r3keyrr4rDr r6)r7s"r8r9r9s%++c+(4.+C+r:cNVf\MTpV'dVP4#T#)zName used for env policy comparisons: Windows env names are case-insensitive, POSIX not. The override keeps both semantics testable on any host.) _IS_WINDOWSupper)rrwindowss&$ r8_env_var_policy_namers#(/kZG!399;*s*r:c(V^8dQhR\RR/#)r3rr4NrI)r7s"r8r9r9s    r:c\PV4'g\RV: 24h\V4pV\9gVP \ 4'd\RV: R24hR#)zTValidate an env name before a generic persistence write (exposed for batch callers).#Invalid environment variable name: zEnvironment variable a$ is on the writer denylist. Names that influence subprocess execution (LD_PRELOAD, PYTHONPATH, PATH, EDITOR, ...) or Hermes runtime location and security policy (HERMES_HOME, HERMES_YOLO_MODE, ...) cannot be persisted via the env writer. If you really need this, edit ~/.hermes/.env directly.N)_ENV_VAR_NAME_REmatch ValueErrorr_ENV_VAR_NAME_DENYLIST startswith_ENV_VAR_NAME_DENY_PREFIXES)r policy_names& r8validate_env_var_name_for_writersn  ! !# & &>sgFGG&s+K,, 0F0FGb0c0c#C7+  1dr:OPENAI_API_KEYOPENAI_BASE_URLANTHROPIC_API_KEYANTHROPIC_TOKENDISCORD_HOME_CHANNELDISCORD_HOME_CHANNEL_NAMETELEGRAM_HOME_CHANNELTELEGRAM_HOME_CHANNEL_NAMESLACK_HOME_CHANNELSLACK_HOME_CHANNEL_NAMESIGNAL_ACCOUNTSIGNAL_HTTP_URLSIGNAL_ALLOWED_USERSSIGNAL_GROUP_ALLOWED_USERSSIGNAL_HOME_CHANNELSIGNAL_HOME_CHANNEL_NAMESMS_HOME_CHANNELSMS_HOME_CHANNEL_NAMEDINGTALK_CLIENT_IDDINGTALK_CLIENT_SECRETDINGTALK_HOME_CHANNELDINGTALK_HOME_CHANNEL_NAME FEISHU_APP_IDFEISHU_APP_SECRETFEISHU_ENCRYPT_KEYFEISHU_VERIFICATION_TOKENFEISHU_HOME_CHANNELFEISHU_HOME_CHANNEL_NAMEYUANBAO_HOME_CHANNELYUANBAO_HOME_CHANNEL_NAME WECOM_BOT_ID WECOM_SECRETWECOM_CALLBACK_CORP_IDWECOM_CALLBACK_CORP_SECRETWECOM_CALLBACK_AGENT_IDWECOM_CALLBACK_TOKENWECOM_CALLBACK_ENCODING_AES_KEYWECOM_CALLBACK_HOSTWECOM_CALLBACK_PORTWECOM_HOME_CHANNELWECOM_HOME_CHANNEL_NAMEWEIXIN_ACCOUNT_ID WEIXIN_TOKENWEIXIN_BASE_URLWEIXIN_CDN_BASE_URLWEIXIN_HOME_CHANNELWEIXIN_HOME_CHANNEL_NAMEWEIXIN_DM_POLICYWEIXIN_GROUP_POLICYWEIXIN_ALLOWED_USERSWEIXIN_GROUP_ALLOWED_USERSWEIXIN_ALLOW_ALL_USERSBLUEBUBBLES_SERVER_URLBLUEBUBBLES_PASSWORDBLUEBUBBLES_HOME_CHANNELBLUEBUBBLES_HOME_CHANNEL_NAME QQ_APP_IDQQ_CLIENT_SECRETQQBOT_HOME_CHANNELQQBOT_HOME_CHANNEL_NAMEQQ_HOME_CHANNELQQ_HOME_CHANNEL_NAMEQQ_ALLOWED_USERSQQ_GROUP_ALLOWED_USERSQQ_ALLOW_ALL_USERSQQ_MARKDOWN_SUPPORTQQ_STT_API_KEYQQ_STT_BASE_URL QQ_STT_MODEL IRC_SERVERIRC_PORT IRC_NICKNAME IRC_CHANNEL IRC_USE_TLSIRC_SERVER_PASSWORDIRC_NICKSERV_PASSWORD TERMINAL_ENVTERMINAL_SSH_KEYTERMINAL_SSH_PORTHERMES_TOOL_PROGRESS_MODE WHATSAPP_MODEWHATSAPP_ENABLEDMATTERMOST_HOME_CHANNELMATTERMOST_HOME_CHANNEL_NAMEMATTERMOST_REPLY_MODEMATRIX_PASSWORDMATRIX_ENCRYPTIONMATRIX_DEVICE_IDMATRIX_HOME_ROOMMATRIX_REQUIRE_MENTIONMATRIX_FREE_RESPONSE_ROOMSMATRIX_AUTO_THREADMATRIX_DM_AUTO_THREADMATRIX_RECOVERY_KEYHERMES_ACP_AUTH_METHODHERMES_ACP_AUTO_APPROVECOPILOT_CLI_PATHCOPILOT_ACP_BASE_URLnixos home-managerz /nix/storec$V^8dQhR\/#r2r5)r7s"r8r9r9s,,D,r:c\4RJ#)z;Check if Hermes is running in package-manager-managed mode.Nr r=r:r8 is_managedrs  t ++r:zUpdate Hermes through the Nix source that installed it (e.g. nix profile upgrade, or update your flake input and rebuild with nixos-rebuild or home-manager switch)c:V^8dQhR\\,/#r2)r rD)r7s"r8r9r9sUUHSMUr:c8\4\9d\#R#)z;Return the preferred upgrade command for a managed install.N)r _NIX_MANAGED_SYSTEMS_NIX_UPDATE_MSGr=r:r8get_managed_update_commandr#s026JJ?TPTTr:aptdockercFV^8dQhR\R\\,/#)r3pathr4)r r rD)r7s"r8r9r9s"DDD#Dr:cVPRR7P4P4pT\9dT#R# \dR#i;i) utf-8-sigencodingN) read_textstriplowerOSError_SUPPORTED_INSTALL_METHODS)r'rBs& r8_install_method_stampr1sR5;;=CCE996CtC s.? A AcFV^8dQhR\\,R\/#)r3 project_rootr4)r r rD)r7s"r8r9r9s...#.r:cVeTM \4p\VR, 4pV'dV#\\4R, 4pV'dVR8Xd\4'dV#\ 4pV'd!VP 4P RR4#VP4pV\8wd\VP9dR#TR, pTP4'g6TPRR7P4PR 4'dR #R # \dLgi;i \dR #i;i) aDetect how Hermes was installed: apt/docker/nix/nixos/home-manager/git/unknown. Order: code-scoped ``/.install_method`` stamp (authoritative) -> legacy ``$HERMES_HOME/.install_method`` -> managed marker -> /nix/store path -> .git dir -> unknown. The stamp lives next to the code because HERMES_HOME is shared data: a container and a host install can bind-mount the same home, so a home-scoped ``docker`` stamp would make the host ``hermes update`` refuse to run. A legacy ``docker`` value is therefore ignored unless we are really inside a container, and being in a container alone never implies 'docker'. Source installers clone a git checkout and publish ``install-stamp.json``; the ``.git`` fallback identifies it as a source install. Older installations may carry ``.install_method``, which remains authoritative for compatibility. The published image bakes a ``docker`` marker into ``/opt/hermes``. A manual clone in a container still resolves via ``.git``, not container presence alone. See issue #34397. z.install_methodr% -nixz.gitr)r*zgitdir:gitunknown)get_project_rootr1r!_running_in_containerr r.replaceresolve _NIX_STOREparentsr/is_dirr,r-r)r3rootrBmanagedresolvedgit_paths& r8detect_install_methodrEs $(3<9I9KD "4*;#;  z !jH4D4D&D f}H ??   2 2K 2 H N N P [ [\e f f!g         s*0D'D8-4D8' D54D58 EEc$V^8dQhR\/#r2r5)r7s"r8r9r97str:cB^RIHpV!4# \dR#i;i)z=Import-safe wrapper around ``hermes_constants.is_container``. is_containerF)hermes_constantsrI ExceptionrHs r8r;r;7s$1~ s  c0V^8dQhR\R\/#rArC)r7s"r8r9r9As==#=$=r:c.VR8H;'g V\9#)zHTrue for every install method Nix owns ("nix", "nixos", "home-manager").r7)r!rFs&r8is_nix_install_methodrNAs U? < BRSC CDr:c$V^8dQhR\/#)r3r\rI)r7s"r8r9r9s;;#;r:cN\\V4\PR7R#)z+Print user-friendly error for managed mode.fileN)printr`sysstderr)r\s&r8 managed_errorrhs  (szz:r:c:V^8dQhR\\,/#r2)r dict)r7s"r8r9r9sRR$Rr:c \PPR4R8XdR#^RIHpV!4'dR#/p\ \ 4R, RRR7;_uu_4pVFipVP4pR V9gKVPR 4'dK5VPR 4wrEpVP4WP4&Kk RRR4R TPR R 4R TPR R4RTPRR4RTPRR4/# +'giLZ;i \dR#i;i)aRead container mode metadata from HERMES_HOME/.container-mode. Written by the NixOS activation script when container.enable = true; tells the host CLI to exec into the container instead of running locally. None when container mode is off, when already inside the container, or when HERMES_DEV=1 is set. Only FileNotFoundError is swallowed; other errors (permissions, malformed data) propagate. HERMES_DEV1NrHz.container-moderr)r*=#backendr%container_namez hermes-agent exec_userhermes hermes_binz /data/current-package/bin/hermes) osenvironrRrJrIopenr!r-r partitionFileNotFoundError)rIinfofliner_values r8get_container_exec_infors  zz~~l#s*-~~  /#&77{ S SWXzz|$;ts';';$(NN3$7MCE(- D% T 488Ix0$((#3^DTXXk84dhh|-OP  RRT S s;'D9$D&D&8D&D9& D6 1D96D99 EEc$V^8dQhR\/#r2r)r7s"r8r9r9s---r:c$\4R, #)zGet the main config file path. config.yamlr!r=r:r8get_config_pathrs  } ,,r:ignore_user_configFc(V^8dQhR\RR/#)r3rr4Nr5)r7s"r8r9r9s!;!;!;$!;r:cV'g%\PPR4R8XdR#\4p\ VRR7;_uu_4p\ V4pRRR4Xe\ V\4'dR#\R\V4P 24p^RI HpT!TR4p\T4pR T R T'dR T 2MR R 2p TeT RT R2, p T R\!T4 2, p \"P%T 4\'T 4Th +'giL;i \dR#\d pTpRp?LRp?ii;i)aReject an existing invalid config before a non-interactive agent run. Interactive surfaces keep ``load_config()``'s recovery behavior so the operator can repair the file; a one-shot run has no such chance, and defaults there could silently pick a hosted provider and spend against ``.env`` credentials. Missing/empty files stay valid first-run states; ``--ignore-user-config`` / HERMES_IGNORE_USER_CONFIG=1 remain authoritative.HERMES_IGNORE_USER_CONFIGrmNr)r*z,top-level YAML value must be a mapping, got  backup_configcorruptz+Hermes stopped because your settings file (z) has a formatting errorz at rLz. Fix it with `hermes config edit` and check with `hermes config check`, or add --ignore-user-config to run once with default settings.z! A copy of the broken file is at .z Details: )rvrwrRrrxr$ isinstancerj TypeErrortyperPrzrKhermes_cli.config_backupsrr0r/loggererrorrO) r config_pathr|data parse_errorexcr backup_pathwheremessages $ r8require_parseable_user_configrs8 RZZ^^,GHCO!#K f + 4 4!!$D5 <:dD11 "NtTXzObObNc de 7 Y7K  -E 5k]BZ"T%> +,` ` 6{m1EE / <=>>G LL  ){:-5 4   s;D* DD* D' "D** E8EEE  Ec$V^8dQhR\/#r2r)r7s"r8r9r9s&&d&r:c$\4R, #)z&Get the .env file path (for API keys)..envrr=r:r8 get_env_pathrs  v %%r:c$V^8dQhR\/#r2r)r7s"r8r9r9s22$2r:cd\\4PPP4#)z'Get the project installation directory.)r __file__parentr=r=r:r8r:r:s! > ' ' / / 11r:c\V4#)uchmod a directory owner-only (0700) and apply HERMES_UID/GID ownership. No-op when managed; in a container only an explicit HERMES_HOME_MODE is applied. HERMES_HOME_MODE (e.g. 0701) overrides the mode so a web server can traverse HERMES_HOME to a served subdirectory without directory listings. Also applies ``HERMES_UID``/``HERMES_GID``-based ownership when those env vars are set (#34107 — Docker deployments need this so profile subdirs created at runtime by kanban workers don't land as root:root and block subsequent uid-mapped workers). Delegates to the canonical import-safe primitive ``hermes_constants.apply_secure_dir_policy`` so callers outside this package (``get_scratch_dir``) share one implementation (#117347). )rr's&r8 _secure_dirrs #4 ((r:c \4'g\4'dR#\PP \ V44'd\P !VR4R#R# \\3dR#i;i)zchmod a file 0600. Skipped when managed (activation sets 0640 group-readable) or in a container (mounts often need broader permissions).Ni) rrrvr'existsrDchmodr/NotImplementedErrorrs&r8 _secure_filers^||244 77>>#d) $ $ HHT5 ! % ( )   sAA--BBcRV^8dQhR\R\\,R\/#)r3rtemplater4)r r r6)r7s"r8r9r9s%  $ (4. D r:cT;'g\4R, pVPPRRR7VP4'd$\P !W4\ V4R#\\4R#)aCreate a missing config.yaml the way the installers do: copy cli-config.yaml.example (the display keys there are commented out), else write stripped DEFAULT_CONFIG. Never DEFAULT_CONFIG verbatim -- the gateway merges no defaults, so every written display key becomes a global that beats each platform's own default (#121230). Shared by ``hermes config edit`` and ``hermes doctor --fix`` so the seeders cannot drift. Returns True when the template was copied (the fallback, like save_config, writes get_config_path()).zcli-config.yaml.exampleT)r?exist_okF) r:rmkdirrshutilcopy2r save_configDEFAULT_CONFIG)rrs&&r8seed_config_filersc II+-0IIHTD9 X+[! r:c(V^8dQhR\RR/#)r3homer4Nr)r7s"r8r9r9s$4r:c &VR, pVP4'd'VPRR7p\ T4'gR#VP \ RR7\#T4R# \\3dR#i;i \EdTP4'gh\P!RR\T4R7wr4\P!TR RR7;_uu_4pTP\ 4RRR4M +'giM;i\P!YA4L \dL\\4;_uu_4\P !T4RRR4h +'gih;ii;ii;i) zSeed DEFAULT_SOUL_MD on first run; upgrade a legacy comment-only scaffold in place. A SOUL.md the user actually customized is never touched.zSOUL.mdr)r*Nutf-8z .SOUL.md.z.seed)prefixsuffixdirw)rr,r/UnicodeDecodeErrorr write_textr is_symlinktempfilemkstemprDrvfdopenwriter<runlinkr)r soul_pathexistingfdtmp_namehandles& r8_ensure_default_soul_mdrs=y I  **K*@H'x00 _w?&1+,    ##%%  ''{7PSTXPYZ  2sW55 _-6555 JJx + '"" (## #"  seA+B+B?B!F%%F !D6,D  D6 D D66"F E8 / F 8 F  F  Fc\4p\V4p^RIHpV!V4V\9dVP 4'dR#^RIHpV!V\\4R#)zEnsure the ~/.hermes directory skeleton exists with secure permissions. Memoized per home path: this runs on EVERY ``load_config()`` and the ~14 mkdir/chmod syscalls made repeated loads the dominant cost of hot read paths.)assert_named_profile_home_liveN)initialize_home) r!rDrJr_HERMES_HOME_ENSUREDr@hermes_cli.config_homer_HERMES_HOME_SUBDIRS)rrrrs r8ensure_hermes_homer8sJ  D d)C@"4( ""t{{}}6D.0DEr:)rOPTIONAL_ENV_VARS)_API_MODE_ALIASES_CAMEL_ALIASES_KNOWN_PROVIDER_KEYS_PROVIDER_NORMALIZE_WARNED_canonical_api_mode_coerce_ssl_verify)_custom_provider_entry_to_provider_config_entries_for_route _normalize_custom_provider_entry_normalize_provider_models_pick_provider_base_url_route_model_cfg_warn_once_per_provider4apply_custom_provider_extra_headers_to_client_kwargs*apply_custom_provider_tls_to_client_kwargscoerce_provider_idfind_provider_entryget_compatible_custom_providersget_custom_provider_api_mode"get_custom_provider_context_length!get_custom_provider_extra_headers$get_custom_provider_model_capability+get_custom_provider_session_affinity_header get_custom_provider_tls_settingsis_provider_enablednormalize_extra_headers"providers_dict_to_custom_providersstringify_provider_map)NEUTRAL_PERSONALITY_NAMES prompt_textrender_personality_promptresolve_ephemeral_system_prompt)check_config_versionread_config_version_stampFIRECRAWL_API_KEYBROWSERBASE_API_KEYBROWSERBASE_PROJECT_IDFAL_KEYVOICE_TOOLS_OPENAI_KEYELEVENLABS_API_KEYSLACK_BOT_TOKENSLACK_APP_TOKENTAVILY_API_KEYTERMINAL_MODAL_MODEchV^8dQhR\R\\\\3,,/#)r3 required_onlyr4)r6listrjrDr )r7s"r8r9r9ws' ( ( (d38n9M (r:c \R3.pV'gVP\R34VUUUUu.uF;wr#VP4F"wrE\ V4'dKRV/VCRV/CNK$ K= upppp#uuppppi)z.Check which environment variables are missing.TFname is_required)REQUIRED_ENV_VARSappendritems get_env_value)rgroupstablervar_namer{s& r8get_missing_env_varsr ws~ $' (F  (%01#) ("( E#kkmNHX& ?>T>=+>+ ?"( (( (s *A7 A7 cFV^8dQhR\R\\,/#r3rr4)rDr)r7s"r8r9r9scr:c.p.p^pV\V48dW,pVR8Xd4W^,V^,R8XdVPR4V^, pKRVR8Xd$VPRPV44.pMVPV4V^, pKVPRPV44V#)ahSplit a dotted config-key path, honoring backslash-escaped dots (``a\.b`` -> ``a.b``). Backslashes before any other character are preserved verbatim. ``hermes config set`` uses ``.`` as the nesting separator, so a key that itself contains a literal dot (e.g. provider names like ``qwen3.5-397b-wafer``) was silently split into bogus nested segments (#84064). \rrL)lenrjoin)rpartscurrentichs& r8_split_key_pathrsEG A c#h, V :#!eAE*c1 NN3  FA  9 LL) *G NN2  Q LL!" Lr:c tV^8dQhR\R\R\\\\ 3,,/#)r3 containerrr4)rjrr tuplerDint)r7s"r8r9r9s.T$8E#s(O;Tr:caa\S\4'd S'gR#\VV3Rl\\ S4^R44R4#)uReturn ``(literal_key, n_consumed)`` for the longest dotted literal key present in *container*, or None. With no multi-segment literal this is the historic plain-split walk. Dots in config key names are the norm, not the exception — model IDs (``grok-4.6``, ``glm-5.3``), Matrix room IDs (``!room:chat.example.cc``), and versioned provider names all embed dots. Users typing ``providers.myprov.models.grok-4.6.context_length`` do not know the escape syntax exists, so when navigating an EXISTING mapping we prefer an existing literal key equal to the dot-join of the next N path segments (longest match wins) over blindly splitting. See #84064 / #80006 / 91095 / #91607 / #99124. Nc3<"TF6pRPSRV4S9gKRPSRV4V3xK8 R#5i)rN)r).0nrrs& r8 (_greedy_literal_match..sEh+CasxxPUVXWXPYGZ^gGg !#((5!9 q !+Cs AA)rrjnextranger)rrsffr8_greedy_literal_matchr&s< i & &e h5UQ+Ch  r:cRV^8dQhR\R\R\\,/#)r3rpartr4)rjrDr )r7s"r8r9r9s* ] ] ]C ]HSM ]r:cra\V\4'gR#VR,o\V3RlV4R4#)u?Existing literal dotted key that creating an intermediate mapping ``part`` would shadow (``grok-4`` beside ``grok-4.5``) — the write would produce a phantom sibling the runtime never reads, so callers fail loudly instead. Called when a write is about to CREATE a new intermediate mapping named ``part``. See #84064. Nrc3<"TF8p\V\4'gKVPS4'gK4VxK: R#5iN)rrDr)rkrs& r8r!#_phantom_sibling..s)UIqAs); V@TIsAA A)rrjr$)rr(rs&&@r8_phantom_siblingr.s2 i & & CZF UIUW[ \\r:c$V^8dQhR\/#r3 dotted_keyrI)r7s"r8r9r9s:d:dC:dr:c \V4pTp^pV\V48EdW5Rp\V4^8Hp\V\4'd?V^,pV'dW$\ V4&R#V\ V4,pT^, pKw\V\4'd\WF4p V ebV wrW[,\V48XdW$V &R#\VPV 4\\34'g/WJ&WJ,pW[, pKV^,pV'dW$V&R#\WH4p V e.V PRR4p \ RV: RV: R V : R V R 2 4hVPV/4pV^, pEKn\ R \V4P R V: 24hR# \ \ 3d\ RT: RT: R24hi;i)axSet a value at a dotted key path, creating intermediate dicts on demand. Numeric segments index lists; the index must already exist (lists are never grown). Guards against #17876: before this fix the code unconditionally replaced any non-dict value (including lists) with ``{}``, silently destroying list-typed config like ``custom_providers`` whenever a caller used an indexed path. Dotted key names (#84064 family): when navigating an existing mapping, an existing literal key equal to the dot-join of the next N segments is preferred over blind splitting (see ``_greedy_literal_match``), so ``models.grok-4.6.supports_vision`` lands on the real ``grok-4.6`` entry. And when a write WOULD create a new intermediate mapping that shadows an existing dotted sibling (``grok-4`` beside ``grok-4.5``), it raises ``ValueError`` instead of silently writing a phantom the runtime never reads. Nz!Cannot navigate into list at key z : segment z is not a numeric indexrz\.zRefusing to create nested key  in z-: the mapping already contains a literal key zT that contains a dot. If you meant that key, escape its dots with a backslash (e.g. z).zCannot navigate into z at key )rrrrrrrrjr&rRr.r< setdefaultrrP)configr1rrrr remainingat_leafr(rrconsumedshadowedescapeds&&& r8 _set_nestedr;s J 'EG A c%j."I i.A% gt $ $Q\BNNUYVXZ[[((r2G FA3DM4J4J3K8T^Sabc cU z* @7 ~F#h&=?@@ @s *F%%&G  clear_api_keyTclear_api_modeclear_base_urlc V^8dQhR\\\3,R\R\R\R\\\3,/#)r3 model_cfgr<r=r>r4rjrDr r6)r7s"r8r9r9sDCH~15NR%)#s(^r:c>\V\4'gV#V'dIVPRR4VPRR4VPRR4VPRR4V'dVPRR4V'dVPRR4V#)aRemove stale inline endpoint credentials from a model config. ``model.api_key`` is valid only for explicit custom endpoints; built-in providers resolve credentials from env/auth.json/the pool. Leftovers keep secrets in config.yaml and can contaminate later custom resolution paths.api_keyNapikey_env api_key_envapi_modebase_url)rrjpop)r@r<r=r>s&$$$r8 clear_model_endpoint_credentialsrJs| i & & i& eT"  i& mT* j$' j$' r:c$V^8dQhR\/#)r3rr)r7s"r8r9r9s$r:c.pTp^pWRp\V\4'd\V^,4pW6,^pM.\V\ 4'd\W54pVfR#VwrgMR#WG, pV\V48XdW#V3#VPW634W6,pK \\\ 3dR#i;i)anWalk *parts* through nested dicts/lists (escape-aware, greedy-literal like ``_set_nested``). Returns ``(parents, container, key)`` where ``container[key]`` is the addressed leaf and ``parents`` lists the ``(container, key)`` hops above it, or ``None`` when any hop is missing, a list index is non-numeric/out of range, or a scalar is hit before the path is consumed.N) rrrrr IndexErrorrjr&rr) r5rr?rrr6rr8rs && r8_locate_nestedrOs GG A "I gt $ $ )A,' H  & &)'=E}!MC  E ?S( (~&,z:6  sB&&C?Cc$V^8dQhR\/#r0rI)r7s"r8r9r96s  C r:cZ\V\V44pVf\#Vwr4pWE,#)aReturn a dotted-path value (``_MISSING`` when absent); same navigation as ``_set_nested`` so ``models.grok-4.6.context_length`` reads the real ``grok-4.6`` entry. Mirrors ``_set_nested``'s navigation: honors backslash-escaped dots and prefers an existing literal dotted key over blind splitting, so ``config get providers.p.models.grok-4.6.context_length`` reads the real ``grok-4.6`` entry instead of reporting the key unset (#84064). )rOr_MISSING)r5r1locr~rrs&& r8 _get_nestedrT6s1 !< =C {A# >r:c0V^8dQhR\R\/#)r3r1r4rC)r7s"r8r9r9Escdr:c\V\V44pVfR#Vwr4pWE\V4FwrgV/8wdR#WgTpK R#)ajRemove a dotted-path value; True if it existed. Empty dict containers left behind are dropped, while user-authored empty lists and non-empty sibling branches are preserved. Same escape-aware, greedy-literal navigation as ``_set_nested`` / ``_get_nested`` (#84064): unsetting an unescaped dotted key removes the real literal entry rather than a phantom sibling. FT)rOrreversed)r5r1rSr?rrrr(s&& r8 _unset_nestedrXEs] !< =C {Gc  )  b=   L * r:OPENROUTER_API_KEY EXA_API_KEYPARALLEL_API_KEYFIRECRAWL_API_URLFIRECRAWL_GATEWAY_URLTOOL_GATEWAY_URLCONNECTOR_GATEWAY_URLTOOL_GATEWAY_DOMAINTOOL_GATEWAY_SCHEMETOOL_GATEWAY_USER_TOKENPERPLEXITY_API_KEYAPI_SERVER_KEYBROWSER_USE_API_KEYTELEGRAM_BOT_TOKENDISCORD_BOT_TOKENTERMINAL_SSH_HOSTTERMINAL_SSH_USER SUDO_PASSWORD GITHUB_TOKENHONCHO_API_KEYc0V^8dQhR\R\/#rrC)r7s"r8r9r9gs 1 1C 1D 1r:cRV9dR#VP4pV\9;'g+VPR4;'gVPR4#)a Return whether `hermes config set` routes this credential-shaped key to .env through the provider credential lifecycle. Non-secret env settings (``*_HOME_CHANNEL``, ``*_ALLOWED_USERS``) are ``config_env_routing.is_env_setting_key`` and take the plain ``.env`` path.rF TERMINAL_SSH)_API_KEY_TOKEN_SECRET)r_ENV_CONFIG_KEYSendswithr)r key_uppers& r8_is_env_config_keyrvgsX cz I%% 0 0   ? @ 0 0    /1r:c0V^8dQhR\R\/#)r3as_jsonr4)r6rD)r7s"r8r9r9ts    r:c,V'd\P!VRR7#\V\4'd V'dR#R#VfR#\V\\ 34'd'\ P!VRR7P4#\V4#)z.Format a config value for command-line output.F) ensure_asciitruefalsenull) sort_keys) jsondumpsrr6rjryaml safe_dumprstriprD)rrxs&$r8_format_config_get_valuertsmzz%e44%v+G+ }%$&&~~eu5<<>> u:r:c\V^8dQhR\\\\3,,/#r2rrjrDr )r7s"r8r9r9s 4S#X#7r:c`aaa^RIHo.oRRVVV3RllloS!\\44S#)z>Check which config fields are missing or outdated (recursive).)skip_deep_mergec<V^8dQhR\R\R\/#)r3defaultsrrrjrD)r7s"r8r9/get_missing_config_fields..__annotate__s! > > > >c >r:c <VP4Fwr4VPR4'dKV'gTMV RV 2pW19dSPRVRVRRV 2/4KQ\V\4'gKi\VP V4\4'gKS!W#4'dKS!WAV,V4K R#)r~rrdefault descriptionzNew config option: N)rrrrrjrR) rrrr default_valuefull_key_checkmissingrs &&& r8r)get_missing_config_fields.._checks"*.."2 C~~c"""(s#.?H!xM -1DXJ/O QR]D11jSAQSW6X6X+F88}clH=#3r:rK)hermes_cli.moa_configrr load_config)rrrs@@@r8get_missing_config_fieldsrs(5G > > >;=) Nr:c\V^8dQhR\\\\3,,/#r2r)r7s"r8r9r9s#]]tDcN';]r:caa^RIHpHoT!4pT'g.#\ 4oTT3RlT4pTUUu.uF;wrETe1\T\4'gK!TP4'dK9TNK= upp# \d.u#i;i \d#p\P RT4.uRp?#Rp?ii;iuuppi)zVReturn skill-declared config vars (``skills.config.``) that are missing or empty.)discover_all_skill_config_varsSKILL_CONFIG_PREFIXz)discover_all_skill_config_vars failed: %sNc 3v<"TF.q\S.S RVR, 2PR4O5!3xK0 R#5i)rrN)cfg_getsplit)rvarrr5s& r8r!0get_missing_skill_config_vars..s> lck\_GFV(;'<V^8dQh/S[;R&S[;R&S[;R&#)r3severityrhintrI)r7 __classdict__s"r8r9ConfigIssue.__annotate__s)ML  I r:r=N)rPrQrRrSrT__annotate_func__rU__classdictcell__)rs@r8rrs.r:rc bV^8dQhR\\,R\R\R\RR/#)r3issuesrrrr4N)rrrD)r7s"r8r9r9s5884 $88c88QU8r:c<VP\WV44R#r+)rr)rrrrs&&&&r8_issuers MM+h67r:c V^8dQhR\\,R\\\3,R\R\ \ \\3,R3,R\RR/#) r3rentrylabelfields.rr4N)rrrjrDr r)r7s"r8r9r9sc[[  [&*38n[=@[ %S/3& '[14[>B[r:c zVF4wrVVPV4'dK\VRV RV RV 2V4K6 R#)zdAppend a warning for every falsy ``field`` of *entry* (message: ``