+ jHjla0t$Rt^RIHt^RIt^RIt^RIt^RIt^RI t ^RI H t ^RI H t ^RIHtHtHtHtHtHtHt^RIHt^RIHt^RIHtHtHtR R ltR R lt R Rlt!RRlt"RRlt#RRlt$RNt%RRlt&RRlt'RRlt(RRlt)RRlt*RR /t+R!],R"&R#R$lt-R%R&lt.]!4R'R(l4t/0ROmt0R,R-lt1R.R/lt2R0R1lt3R2R3lt4R4R5lt5R6R7lt6R+]2R)]4R*]5/t7]!4R8R9l4t8R:R;lt9R<R=lt:R>R?lt;R@RAlt<]!4RBRCl4t=RDRElt>RFRGlt?]!4RHRIl4t@]!RJRK4RLRMl4tAR#)PzExternal-tool checks for hermes doctor: terminal backends, git/rg, Node + agent-browser, npm audit, tool availability. Split out of ``hermes_cli/doctor.py``, which re-exports every name so ``hermes_cli.doctor.`` keeps resolving (and monkeypatching).) annotationsN)Path)_system_package_install_cmd)Finding_fail_and_issue check_bool check_infocheck_ok check_warn doctor_check)describe_vercel_auth) is_termux)docker_runtime_namedocker_runtime_start_hint find_dockerc V^8dQhRRRR/#)cmdstrreturn str | None)formats"$> s " 11c V^8dQhRRRR/#)rcommandrrrr)rs"rrr)sSZrc^RIp^RIHpHp^RIHpVP 4pVP 4F~pVPV4p\Wt4'gK'VPV4pV'gKB\V4PPR4PR4V8XgK|Vu# R# \dR#i;i)uThe pm package that provisions *command*, derived from pm's own package definitions (binary_rel → executable basename) — no restated name table, so new pm packages are covered without doctor changes.N)registrystore) BinaryPackagez.exez.cmd)r%r,r- pm.packagesr.current_target all_packages get_package isinstance_relrr" removesuffixr) r*r%r,r-r.target package_namepackagerels & r_pm_package_for_commandr:)s &-%%'$113L**<8G'11ll6*349>>66v>KKFSW^^'' 4  s*AB8B865B80B84B88 CCc V^8dQhRRRR/#)rr"rrztuple[str | None, str]r)rs"rrr>s ! !s !5 !rcV\V43F/pV'gK \V4pV'gK"\V4R3u# \V4R3#)aResolve the tool Hermes would actually run: the pm store first (pinned installs run tools out of the store, which nothing puts on PATH), then PATH. *name* is the command ("rg"); its pm package ("ripgrep") is resolved from pm's own definitions. Returns ``(path, ok-row detail)``.z (pm store))r:r(rr )r"r7stageds& r _doctor_toolr?>sO 6t<=  |, 6v; , , > t b  rc$V^8dQhRRRRRR/#)rr list[str]timeoutintrboolr)rs"rrrMs!S4rc \P!V3RRRV/VBP^8H# \PdR#i;i)zFTrue when *cmd* exits 0 within *timeout*; a timeout counts as failure.capture_outputTrBF) subprocessrun returncodeTimeoutExpired)rrBkws&&,r_run_okrLMsI~~cN$NN2NYY]^^^  $ $s'*AAc V^8dQhRRRR/#)rnode_installedrDrrAr)rs"rrrUs????rcV'd.MR.pVRR., p\V^4UUu.uF wr#V RV 2NK upp#uuppi)zpkg install nodejsznpm install -g agent-browserzagent-browser installz) ) enumerate)rNstepsisteps& r_termux_browser_setup_stepsrTUsM B';&*=wqqcD6N*= >> >s>c V^8dQhRRRR/#ritemdictrrDr)rs"rrrcsXXTXdXrcVVPR4;'g.pVPR4R8H;'dt\PPR4'*;'dH\V4;'d5\;QJdRV4F 'dK R# R#!RV44#)zQReturn True when Kanban is unavailable only because this is not a worker process.toolsr"kanbanHERMES_KANBAN_TASKc3V"TFp\V4PR4xK! R#5i)kanban_N)r startswith).0tools& r -_is_kanban_worker_env_gate..gs$#VPUCI$8$8$C$CPUs')FT)getosenvironrDall)rWrZs& r_is_kanban_worker_env_gaterhcs HHW  # #E HHV  ( W W@T1U-U W WU  W W ##VPU#VX #X ##VPU#V VXrc V^8dQhRRRR/#)rtoolsetrrr)rs"rrrjsccrcbVR8Xd(\PPR4'gR#R#)zKOptional explanatory suffix for toolsets whose doctor status needs context.r[r\z;(runtime-gated; loaded only for dispatcher-spawned workers)r=)rerfrd)rjs&r _doctor_tool_availability_detailrljs#(2::>>2F#G#GL rcV^8dQhRR/#)rrzlist[tuple[str, str, str]]r)rs"rrrqs%?rc.p^RIHpHp^RIHpHpV!4RT3RT33FwrVT!4pTfTPRTR34K'\TRR4;'g\T4PpTPT!T4'd R TR T R 23MRTR T R 234K T# \ dTu#i;i \ dRpLi;i) aReturn ``(status, label, detail)`` rows (status ``ok``/``warn``) for web search/extract readiness. Uses the same active-provider resolvers as the tools but reports ``is_available()`` readiness, so an explicitly selected but unconfigured backend does not look healthy. See #78412. )get_active_extract_providerget_active_search_provider)_ensure_web_plugins_loaded_provider_is_readyz web searchz web extractNwarnz$(no provider selected or registered)r"ok()z# selected; provider not configured)) agent.web_search_registryrorptools.web_toolsrqrrrappendgetattrtype__name__) rowsrorprqrr capabilitygetterproviderr"s r_doctor_web_capability_rowsrqs(*DeR"$!-.HIM[vKwx  xH   KK-ST U x.II$x.2I2I 7I(7S7ST:4&{3 *$7Z.[\ ^y K    H s"B)B<) B98B9< C  C c$V^8dQhRRRRRR/#)r availablerA unavailable list[dict]rztuple[list[str], list[dict]]r)rs"rrrs#222Q[2`|2rc\V4.r2VFAp\V4'gVPV4K'RV9gK0VPR4KC W#3#)z>Adjust runtime-gated tool availability for doctor diagnostics.r[)listrhry)rrupdated_availableupdated_unavailablerWs&& r)_apply_doctor_tool_availability_overridesrsS-1)_b*)$//  & &t , . .  $ $X .   11rcV^8dQhRR/#)rrzset[str] | Noner)rs"rrrs/rc^RIHp^RIHpT!V!4;'g/R4Uu0uFp\ V4kK up#uupi \ dR#i;i)zHReturn toolsets enabled for the CLI, or None if config resolution fails.) load_config)_get_platform_toolscliN)hermes_cli.configrhermes_cli.tools_configrrr)rrrjs r _enabled_cli_toolsets_for_doctorrsP1?,? @S@SQSUZ,[\,[G ,[\\\ s$A A?AA AA image_genuf(image generation unavailable — check the provider selection and its key or SDK with 'hermes tools')zdict[str, str]_TOOLSET_SETUP_HINTSc V^8dQhRRRR/#rVr)rs"rrrsnntnnrc\VPR4;'g2VPR4;'gVPR4\94#) missing_varsenv_varsr")rDrdr)rWs&r _setup_gatedrs> (llDHHZ,@llDHHVDTXlDl mmrc V^8dQhRRRR/#)rrrrr)rs"rrrsQQzQjQrcVUu.uFp\V4'gKVNK pp\4pVfV#VUu.uF0p\VPR4;'gR4V9gK.VNK2 up#uupiuupi)zaFilter unavailable setup-gated toolsets (missing key OR setup hint) to those enabled for the CLI.r"r=)rrrrd)rrWapi_key_unavailableenabled_toolsetsrRs& r%_missing_api_key_toolsets_for_summaryrs,7NKD<;M44KN79"2": QL_AQL_qcfghglglmsgtgzgzxzc{@PdPL_AQQOAQsA2A2!A7 A7)A7c$V^8dQhRRRRRR/#r should_fixrDfrrNoner)rs"rrrs&[[$[7[t[rc\R4wr#\R4wrE\VRV3R4\VRV R2P43R4'g\R\ R4 24R#R#) gitrgz ripgrep (rg)z (faster file search)zInstall for faster search: ripgrepN)z git not found (optional))zripgrep (rg) not foundz (file search uses grep fallback))r?rstriprr)rrr git_detailr rg_details&& r_check_git_and_rgrsu"5)OC &MBsUJ')HI b>i[8M+N+T+T+VWT V V01LY1W0XYZ Vrdaytonavercel_sandboxsshc(V^8dQhRRRRRRRR/#) r terminal_envrrunning_in_containerrDissuesrArrr)rs"rrrs*<<<4jikq s**5G,Z8D3:h3F7)./wiWeLf  Wj)4bA5H1m\!#OPQ (b 2efhn p $Z0,? XY !,l;"rc V^8dQhRRRR/#rrrArrr)rs"rrrs H Hy HT Hrc \P!R4pV'g\RRRV4#RR4wr#p.ROpV'd VRV., pV'd)VR\PP V4., pYR'dV RV 2MTR., p\ \ V^R R R R 7R V 2R V 2R3RV 2V4R#)TERMINAL_SSH_HOSTzSSH host not configuredz'(needed for the 'ssh' terminal backend)z.s%"cKba299}QC-@#A#AKbs&(z-pz-i@zecho okTutf-8replace)rBtextencodingerrorszSSH connection to r=zCheck SSH configuration for N)USERPORTKEY)r-ozConnectTimeout=5rz BatchMode=yes)rerrpath expanduserrrL)rssh_hostssh_userssh_portssh_keyrs& r_check_ssh_backendrsyy,-H 8:c]_eg g"cKb"cH BC h bgg((122xj( $h JJC WS"4') T!( ,1CH:/NPR.SWst|s}U~AGHrc$V^8dQhRRRRRR/#)rissuerrrArrr)rs"rrrs!3 drcT\WVRR7'gVPV4R#R#)zL``check_ok(*ok)`` when *cond*, else ``check_fail(*bad)`` and record *issue*.T)failN)rry)condrtbadrrs&&&&&rrrs" d$ / / e 0rc V^8dQhRRRR/#rr)rs"rrrsaa9aarc\\P!R4R R RV4^RIHp\ RR4R# \ d\RRRT4R#i;i) DAYTONA_API_KEYz2run `hermes setup terminal` (Daytona) to enter it.)Daytonaz daytona SDK (installed)zdaytona SDK not installed(run hermes setup terminal)zARun hermes setup terminal and select Daytona, then restart HermesN)zDaytona API keyz (configured))zDaytona API key missingz+(needed for the 'daytona' terminal backend))rrerrrr ImportErrorr)rrs& r_check_daytona_backendrsc RYY( )+N W A6Ka# . a35RUXZ` aas9AAc V^8dQhRRRR/#rr)rs"rrrsNN)NNrc ^RIHp\P!RR4P 4;'gRpRP V4p\ W!9RRV R23RRV R V R23R V 2V4\ \P!R R 4P 4R9RRR V4\ \PPR4RJRR RV4\4pVP'd\RRVP R24MZVPPR4'd\RRVP R2RV4M\RRVP R2RV4VP Fp\#RV 24K \P!RR4P%4R!9p\#V'd R4R#R4R#)")_SUPPORTED_VERCEL_RUNTIMESTERMINAL_VERCEL_RUNTIMEnode24, zVercel runtimerurvzVercel runtime unsupportedz; use z'Set TERMINAL_VERCEL_RUNTIME to one of: TERMINAL_CONTAINER_DISK51200zSVercel Sandbox does not support custom container_disk; use the shared default 51200vercelNzHRun hermes setup terminal and select Vercel Sandbox, then restart Hermesz Vercel authpartialzVercel auth incompletez@Set VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_ID togetherzVercel auth not configuredzVConfigure Vercel Sandbox auth with VERCEL_TOKEN, VERCEL_PROJECT_ID, and VERCEL_TEAM_IDz Vercel auth TERMINAL_CONTAINER_PERSISTENTtruez^Vercel persistence: snapshot filesystem only; live processes do not survive sandbox recreationz(Vercel persistence: ephemeral filesystem>r=0r)zVercel disk settingz(uses platform default))zVercel custom disk unsupportedz((reset terminal.container_disk to 51200))z vercel SDKr)zvercel SDK not installedr>1onyesr)tools.terminal_tool_backendsrrerrjoinr importlibutil find_specr rtr labelr_r detail_linesrlower)rrr supported auth_statusline persistents& r_check_vercel_backendrsGii18<BBDPPG 45I W 25E7)ST~4V*ayyk,K LPwyBxCODFLM RYY0' : @ @ BFX X ?BP bdjl Y^^ % %h /t ;=Z H WY_a'(K~~~!K$5$5#6a 89    % %i 0 00Ak6G6G5H2JMOQW X4+:K:K9LA6NQikq r((\$()):FCIIKOiiJpN"LNrc$V^8dQhRRRRRR/#)rrrrrArrr)rs"rrrs& S S SY S4 Src ^RIHpV!4^RIHpV!V4pVf\ RV R2RRV4#VP 4F&wrVp\WVV3Wg3VPR4V4K( R# \dRpLai;i) r)discover_plugins) get_providerNzUnknown terminal backend ''z,(no built-in or plugin backend by that name)zRFix terminal.backend in config.yaml, or install/enable the plugin that provides itz()) hermes_cli.pluginsr agent.terminal_env_registryr rr doctor_checksrr)rrr r rrtrdetails&& r_check_plugin_backendrs7< -!;L>KM{su{} }%3356V_uov||D7I6R6 sA// A?>A?c$V^8dQhRRRRRR/#rr)rs"rrr,s!6666T6rcr\P!RR4p^RIHpV!4pV'dVR8wd\ R4Rp\ W$VP4V\9d \V,!VP4R#V\9d\W!P4R#R# \dRpLi;i)zJDocker/SSH/Daytona/Vercel/plugin terminal backends, gated on TERMINAL_ENV. TERMINAL_ENVlocal) is_containerFrukRunning inside a container — using local terminal backend (docker-in-docker is not configured by default)N) rerhermes_constantsrrrrr_BACKEND_CHECKS_BUILTIN_TERMINAL_BACKENDSr)rrr _is_containerrs&& r_check_terminal_backendr+s99^W5L%B,   8A B ,ahhG& %ahh/ 7 7lHH5 8 %$%s B&& B65B6c V^8dQhRRRR/#)rrrDrr)rs"rrr@sTdrc^RIHpV!RR7pV'g@V'd8\4'g(^RIp^RIHpVP RRR7V!RR7pV'd\RR V R 24R#\4'd\R R RR 7R#\ RR4R# \dRpLi;i \dp\ RR T R 24Rp?L{Rp?ii;i)zJRead the runtime's installed selection; only --fix may acquire through PM.)_find_agent_browserF)validateNz agent-browserT)explicitzagent-browser install failedrurvzCagent-browser is not installed (expected in the tested Termux path)zUInstall it manually later with: npm install -g agent-browser && agent-browser installrNzagent-browser not installedz&(run: hermes pm install agent-browser)) tools.browser_tool_installrrrr%ensurer r _termux_browser_hints)rrresolvedr%excs& r_check_agent_browserr&@sB&6  :<< C  F IIoI 5*E:HAhZq/2||cuGK L  02Z[ %  C 53%qz B B Cs(B &B3 B0/B03 C>CCc$V^8dQhRRRRRR/#)rlinesrrNrDrrr)rs"rrrZs!#trcVFp\V4K \R4\VR7Fp\V4K R#)zTermux browser setup:r N)rrT)rNr(rrSs$* rr#r#Zs54&'+>J4KrcV^8dQhRR/#rrrr)rs"rrrbs???rc(^RIHp^RIHp^RIHp^RIHp^RIH pT!4'g-\T!44'gT!4fT!4'dR#\T!4RR 4'g\R4R#R# \dR#i;i) a2Playwright Chromium presence, using the exact predicate browser_tool uses to hide browser_* tools. Lazy import: browser_tool is ~150KB; an import failure is a separate bug surfaced elsewhere. Camofox, a CDP override, a cloud provider, or Lightpanda all bypass the local Chromium requirement (no warning). )_is_camofox_mode)_get_cloud_provider)_get_cdp_override_raw)_chromium_installed)_using_lightpanda_engineNz(Install with: hermes pm install chromium)zPlaywright Chromiumz(browser engine))z!Playwright Chromium not installedz/(browser_* tools will be hidden from the agent))tools.browser_toolr-tools.browser_tool_cloudr.tools.browser_tool_cdpr/r!r0&tools.browser_tool_lightpanda_fallbackr1rrDrr)r-r.r/r0r1s r_check_chromiumr6bs 7@@BST"7"9::>Q>S>_c{c}c} )+-Xn p p=> p sB BBcV^8dQhRR/#r+r)rs"rrrws,,4,rcZ^RIHpHp^RIHpHpT!4'gR#T!4wrET'g\RRT R24\R 4R#\T!4R RT R23R 4'g\T4R#R# \ dR#i;i \ dpRRT 2rTRp?LzRp?ii;i) zLightpanda engine (browser.engine / AGENT_BROWSER_ENGINE); independent of Node since Browser Use mode spawns ``lightpanda serve`` itself.)r1lightpanda_engine_status)LIGHTPANDA_INSTALL_HINTfind_lightpanda_binaryNFzstatus check failed: z%browser.engine=lightpanda is shadowedrurvuZFix: pick Lightpanda in `hermes tools` → Browser Automation, or set browser.engine: auto Lightpanda)z(Lightpanda selected but binary not foundz/(browser tools will fail until it is installed)) r5r1r9tools.browser_lightpandar:r;rr rr)r1r9r:r;usedreasones r_check_lightpandarAwsm\ $ % %:/1  :axqMJop .0<1VHA2Owyy*+y  : 5aS9f:s(A= B= B  B  B*B%%B*c$V^8dQhRRRRRR/#rr)rs"rrrs!    T rcB\R4'g"\4'd\R4'd \R4M+\4'd\ RRRR7M \ RR4\ V4'd\4'g \4\4R #) zJNode.js, agent-browser resolution, Playwright Chromium, Lightpanda engine.nodezNode.jszHNode.js not found (browser tools are optional in the tested Termux path)z2Install Node.js on Termux with: pkg install nodejsFr zNode.js not foundz3(optional; PM agent-browser is a native executable)N) r(rr r r#r r&r6rA)rrs&&r_check_node_and_browserrEskV+f2E2E hRch j &(]^J'' rc V^8dQhRRRR/#)rnrCrrr)rs"rrrs<.s!#_>^FJJq!$4$4>^s" --workspacez depsz(no known vulnerabilities)ufix is an upstream lockfile bump — a local manual fix does not persist (the next `hermes update` reinstalls from the committed lockfile)ruz critical, z high, u moderate — rvu ^ workspace audit includes runtime and build dependencies; if manual npm remediation errors with an arborist crash it's a known npm bug — clears via a lockfile bumpuT ^ runtime dependency tree; report/pin the fix in package-lock.json — see #116774z has z npm z; wait for an upstream lockfile fix, then update your installation (Docker: pull a rebuilt image; recreating the same image restores the same dependencies)z moderate )criticalhighmoderate)jsonrrQrGrHrstdoutrloadsrdrDr r rryrKr)rMnpm_dirrrNrOr_rQ audit_result audit_datar\r]r^totalworkspace_scopedremedyrYs&&&&& @r _audit_onerhs6 !~~w&PK&PVYZaVb59w_hrt*?*AP 9E8K8K8Q8Q8S8STZZ 3 34Y[  B/334ErJ#_>^#_ (* ,PPQ=1P A: we_&B C \TAX[F %!H:[ghZWeflemmn(o popqr  'ugU75>*:;}}  we_(:gh>O=PPQ&R S    s&AFBF3A.F#F FFc$V^8dQhRRRRRR/#rr)rs"rrrs!&&&'&d&rc"^RIHp\R4pV'd \V4M\ 4'd \ R4MRpV'dp^RIHpV!4pVRR.3VR R R .3VR R R .3VR.33FFwrxp V 'dTMTR, P4'gK/\WGWVP4KH \ 4'd&\R4\Fp \V 4K R#R# \dTR, R, pLi;i)anpm audit per Node package tree (root, web/ui-tui workspaces, WhatsApp bridge). PROJECT_ROOT is audited with --workspaces=false so the apps/* glob (Electron, node-pty, ...) is never resolved for a routine check; web and ui-tui via --workspace. The WhatsApp bridge may live under a writable HERMES_HOME mirror rather than the (possibly read-only) Docker install tree, hence the shared resolver.  PROJECT_ROOTnpmN)resolve_whatsapp_bridge_dirscriptszwhatsapp-bridgezRoot npm packagez--workspaces=falsez web workspacer[webzui-tui workspacezui-tuizWhatsApp bridge node_moduleszTermux compatibility fallbacks:)hermes_cli.doctorrlr(rrr !gateway.platforms.whatsapp_commonrnrexistsrhrOr"_TERMUX_INSTALL_ALL_FALLBACK_NOTES) rrrlr>rMrnwhatsapp_bridge_dirrbrrNnotes && r_check_npm_auditrxs/ 5 !F#c&k +e*.s S{t&!1U!:{s "TFr"rtrrz (missing rrvz(system dependency not met)c32"TF wpq!R8gxK R#5i)rtNr)r`status_s& rrbr~sGhlfaT>hszERun 'hermes setup' to configure missing API keys for full tool accessN)rrrlsysrinsertr model_toolsr{r|ranyrrdr rlr rrrrry)rrrlr{r|rrweb_rowstidrWrrrr api_disableds&& r_check_tool_availabilityrs.HHOOAs<()IFH_HabIH SS S{ SSSS S{ SSS.0 (1B E\ IB,7UKD88F;Ku;T44KKU%))#r266vsCEefiEjk!)vt^ 3UC"*88N+IItxx /CIIr7?9TYYx013EYE]E]^bci^jmJFK4<( 9ELssGhGsssGhGGG _`HCUs!H7.H7:H<H<)z=Termux uses the Hermes APT package: pkg install hermes-agent.zNMatrix E2EE extra is excluded on Termux (python-olm currently fails to build).zYLocal faster-whisper extra is excluded on Termux (ctranslate2/av build path unavailable).zaSTT fallback: use Groq Whisper (set GROQ_API_KEY) or OpenAI Whisper (set VOICE_TOOLS_OPENAI_KEY).>rrmodalrr managed_modalr)B__conditional_annotations____doc__ __future__rimportlib.utilrrerrGrpathlibrhermes_cli.doctor_platformrhermes_cli.doctor_reportrrrrr r r hermes_cli.vercel_authr rr rtools.environments.dockerrrrr r(r:r?rLrTrurhrlrrrr__annotations__rrrrrrrrrrrrr&r#r6rArErKrhrxr)rs@rrsyL#  Byyy74aa ?* !? &"X<2y(n nQ[[o<4 H  aN4 S,i9OQacxy66(4?*,,  <) X&&R17;a<ar