o;i&UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ddlmZmZmZmZmZejeZejdkZejdZiZeeefed<iZeeeeeeeefffed <iZ eeeeeeeefffed <e!hd Z"ddl#Z#dd l$m%Z%m&Z&dd l'm(Z(dZ)dddddZ*deefdZ+de,fdZ-deefdZ.defdZ/d1dedefdZ0d2defdZ1dee2fdZ3ddl4m5Z5ddl6m7Z7de fdZ8de fd Z9de fd!Z:d"Z;de,fd#Zd'Z?d%e fd(Z@id)d*d+id,gd-id.d/gd0d1d2d3d4d*d5d6d3d7d5gd8 d9id:d;dd?d3d@gdAgdBdCdDdEdFgdGidHdIdJdEdKdEdLdMdNdOdPdQdRdSdCgdTdTdCdUdVdWdXdTdTdCd*dYdZd[dTid\ d]dCd^dTd_dCd`dadbdcdddedfdfdgdhdCdTdid4didjdkdldkdjdmdndCdodpdqdrdsdtdudvidwdCdZdxdyd*dCgd7dzd*d*d{d|d}d~dd5d*d*d*dWidXdd5d*d*d*didd5d*d*d*dWidd5d*d*d*dXid4dd5d*d*d*dXidd5d*d*d*dXidd5d*d*d*dXidd5d*d*d*dXidd5d*d*d*didd ididdTddddddddTddTddTddTddddCddTddddddididddCddTdiddidTgddddddidddTiddddiddddddddddddddd*d*dddddidddCd;dd*dd)did)didœdddWdTdCdddƜddddd˜dddiddCdCddd*dҜdd*d*d*d*dCd^dd*d4dOdCdTdԜ dd*dddqidgdCdTddTdڜddCddidXd1dCdkdݜdޜdidd*ddCd*d*dCdCid*dididdTidddiiddiidddddCddgdididdTdiddTdTdCddkdCdTggddddCddddCdddddidddkd4dddCdd`iddddTidTd1dCd`ddiidTdkdd d ZAgd d d ggddgdgdZBeeeefed<iZCidddddTddCddddddCddgddCddd d!d"dCddCdd#d$d%d"dCddCdd&d'd(ddTddCdd)d*d*d+dCddCdd,d-d.ddTddCdd/d0d1d2dCddCdd3d4d5ddTddCdd6d7d8ddCddCdd9d:d;ddTddCdd<d=d>d?dCddCdd@dAdBd?dCddCddCdAdBd?dCddCddDdEdFddTddCddGdHdIdJdCddCddKdLdMddTddCdidNdOdPdJdCddCddQdRdRdSdCddCddTdUdVddTddCddWdXdXdYdCddCddZd[d\ddTddCdd]d^d^d_dCddCdd`dadbddTddCddcdddedfdCddCddgdhdiddTddCddjdkdldmdCddCddndodpddTddCddqdrdsdtdCddudvdwdxd*dTddudydzd{d|dCddud}d~dd*dTddCddddddTddCddddddTddCdidddddCddCddddddTddCddddddCddCddddddTddCddddddCddCddddddTddCddddddCddudddddTddCddddddCddCddddddTddCddddddCddudddddTddCddddddTddCddddddTddCddddddCddudddddTddCdddddddgdCdÐdĜidŐdƐdǐdȐddgdCdÐdĜdɐdʐdːd̐ddgdCdÐdĜd͐dΐdddTddCddАdѐdddTddCddӐdԐdddTddCdd֐dאdddTddCddِdڐdddCddCdddܐdݐdgdߢdCdÐdĜddddddgdCdÐdĜddddddgdTdÐdĜddddddgdCdÐdĜdddddgdTdÐdddddddgdTdÐdĜdddddgdCdÐdĜddddgddCdÐdĜddddddgdCdÐdĜd ddddd gdCdÐdĜid d d d dCdÐdud ddddCdÐdudddddCdÐdudddddCddCddddddCddCdddd d!dCddCdd"d#d$d%dCddCdd&d'd(d)d*gdCdÐdĜd+d,d-dÐd.d/d0d1d2dTdÐdud3d4d5d2dCdÐdud6d7d8ddTddCdd9d:d;dd?d@dAdTd=dudBdCdDdTd=dEdFdGdHdIdCd=dudJdKdLddTd=duidMdNdOddTd=dudPdQdRdSdCd=dudTdUdVdSdCd=dudWdXdYdZdTd=dud[d\d]ddCd=dud^d_d`ddTd=dudadbdcddTd=dudddedfddTd=dudgdhdidjdTd=dudkdldmddCd=dudndodpddTd=dudqdrdsddTd=dudtdudvddTd=dCddwdxdyddTd=dCddzd{d|ddTd=dCdd}d~dddTd=dCddddddTd=dCdidddddCd=dCddddddTd=dudddddCd=dudddddTd=dudddd=d.ddddd=dddddCd=dEdddd=d.dddd=d.dddd=d.dddd=d.dddd=d.dddd=d.dddddTd=dudddddTd=dudddddTd=dudddddCd=dCdidddddCd=dCddddddTd=dCddddddTd=dCdddÐdddCd=dCddŐdƐdddTd=dCddȐdɐdddTd=dCddːd̐dddTd=dCddΐdϐdddTd=dCddѐdҐdddCd=dCddԐdՐdddTd=dudאdؐdddTd=dudڐdېdddCd=dudݐdސdddCddudddddTddudddddTddudddddTddudddddTddudddddTdduiZDd3de,deeeeffdZEdefdZFdeeeeffdZGdeeeeffdZHd*ddededeeeeffdZIdedeeeeffdZJ d4deeeefdeeeeffdZK d5d)ededeeeeefdeeeefdeef dZLdeeeffdZMhdZNhdZOhdZPe GddZQd4deeeefdedfdZRd4deeeefddfdZSd4deeeefddfdZTd6d e,d e,deeeffd ZUde2d e2de2fd ZVdZWdZXd4dZYdeeefdeeeffdZZdeeefdeeeffdZ[dddeeeefdededefdZ\deeeffdZ]deeeffdZ^dZ_dZ`dZadeeeffdZbdeeeffdZcdeddedfdZedefd Zfd!ed"edefd#Zgd!ed"efd$Zhd!ede,fd%Zid4d"efd&Zjd4d'Zkd4d"efd(Zld!ed"edeeeffd)Zmdefd*Znd!edeefd+Zod!edefd,Zpd-Zqd.Zrd!ed"efd/Zsd0ZtdS(7a Configuration management for Hermes Agent. Config files are stored in ~/.hermes/ for easy access: - ~/.hermes/config.yaml - All settings (model, toolsets, terminal, etc.) - ~/.hermes/.env - API keys and secrets This module provides: - hermes config - Show current configuration - hermes config edit - Open config in editor - hermes config set - Set a specific value - hermes config wizard - Re-run setup wizard N) dataclass)Path)DictAnyOptionalListTupleWindowsz^[A-Za-z_][A-Za-z0-9_]*$_LAST_EXPANDED_CONFIG_BY_PATH_LOAD_CONFIG_CACHE_RAW_CONFIG_CACHE>eIRC_PORT QQ_APP_ID IRC_SERVER IRC_CHANNEL IRC_USE_TLS IRC_NICKNAME QQ_STT_MODEL TERMINAL_ENV WECOM_BOT_ID WECOM_SECRET WEIXIN_TOKEN FEISHU_APP_ID WHATSAPP_MODEOPENAI_API_KEYQQ_STT_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENMATRIX_PASSWORDOPENAI_BASE_URLQQ_HOME_CHANNELQQ_STT_BASE_URLSIGNAL_HTTP_URLWEIXIN_BASE_URLMATRIX_DEVICE_IDMATRIX_HOME_ROOMQQ_ALLOWED_USERSQQ_CLIENT_SECRETSMS_HOME_CHANNELTERMINAL_SSH_KEYWEIXIN_DM_POLICYWHATSAPP_ENABLEDANTHROPIC_API_KEYFEISHU_APP_SECRETLANGFUSE_BASE_URLMATRIX_ENCRYPTIONTERMINAL_SSH_PORTWEIXIN_ACCOUNT_IDDINGTALK_CLIENT_IDFEISHU_ENCRYPT_KEYMATRIX_AUTO_THREADQQBOT_HOME_CHANNELQQ_ALLOW_ALL_USERSSLACK_HOME_CHANNELWECOM_HOME_CHANNELFEISHU_HOME_CHANNELHERMES_LANGFUSE_ENVIRC_SERVER_PASSWORDLANGFUSE_PUBLIC_KEYLANGFUSE_SECRET_KEYMATRIX_RECOVERY_KEYQQ_MARKDOWN_SUPPORTSIGNAL_HOME_CHANNELWECOM_CALLBACK_HOSTWECOM_CALLBACK_PORTWEIXIN_CDN_BASE_URLWEIXIN_GROUP_POLICYWEIXIN_HOME_CHANNELBLUEBUBBLES_PASSWORDDISCORD_HOME_CHANNELQQ_HOME_CHANNEL_NAMESIGNAL_ALLOWED_USERSWECOM_CALLBACK_TOKENWEIXIN_ALLOWED_USERSYUANBAO_HOME_CHANNELDINGTALK_HOME_CHANNELHERMES_LANGFUSE_DEBUGIRC_NICKSERV_PASSWORDMATRIX_DM_AUTO_THREADMATTERMOST_REPLY_MODESMS_HOME_CHANNEL_NAMETELEGRAM_HOME_CHANNELBLUEBUBBLES_SERVER_URLDINGTALK_CLIENT_SECRETMATRIX_REQUIRE_MENTIONQQ_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_IDWEIXIN_ALLOW_ALL_USERSHERMES_LANGFUSE_RELEASEMATTERMOST_HOME_CHANNELQQBOT_HOME_CHANNEL_NAMESLACK_HOME_CHANNEL_NAMEWECOM_CALLBACK_AGENT_IDWECOM_HOME_CHANNEL_NAMEBLUEBUBBLES_HOME_CHANNELFEISHU_HOME_CHANNEL_NAMESIGNAL_HOME_CHANNEL_NAMEWEIXIN_HOME_CHANNEL_NAMEDISCORD_HOME_CHANNEL_NAMEFEISHU_VERIFICATION_TOKENHERMES_LANGFUSE_MAX_CHARSYUANBAO_HOME_CHANNEL_NAMEDINGTALK_HOME_CHANNEL_NAMEMATRIX_FREE_RESPONSE_ROOMSSIGNAL_GROUP_ALLOWED_USERSTELEGRAM_HOME_CHANNEL_NAMEWECOM_CALLBACK_CORP_SECRETWEIXIN_GROUP_ALLOWED_USERSHERMES_LANGFUSE_SAMPLE_RATEMATTERMOST_HOME_CHANNEL_NAMEBLUEBUBBLES_HOME_CHANNEL_NAMEWECOM_CALLBACK_ENCODING_AES_KEY)Colorscolor)DEFAULT_SOUL_MD)true1yesHomebrewNixOS)brewhomebrewnixnixosreturnctjdd}|r:|}|tvrdSt ||Stdz }|rdSdS)z7Return the package manager owning this install, if any.HERMES_MANAGEDrzz.managedN) osgetenvstriplower_MANAGED_TRUE_VALUES_MANAGED_SYSTEM_NAMESgetget_hermes_homeexists)raw normalizedmanaged_markers 6/home/ubuntu/.hermes/hermes-agent/hermes_cli/config.pyget_managed_systemrts )$b ) ) / / 1 1C :YY[[ - - -7$((S999$&&3Nw 4c"tduS)aCheck if Hermes is running in package-manager-managed mode. Two signals: the HERMES_MANAGED env var (set by the systemd service), or a .managed marker file in HERMES_HOME (set by the NixOS activation script, so interactive shells also see it). Nrrr is_managedrs   t ++rcBt}|dkrdS|dkrdSdS)z;Return the preferred upgrade command for a managed install.ryzbrew upgrade hermes-agentrzzsudo nixos-rebuild switchNr)managed_systems rget_managed_update_commandrs4'))N##**  ** 4rc"tpdS)z C C Crmodify configurationcVtt|tjdS)z+Print user-friendly error for managed mode.fileN)printrsysstderr)rs r managed_errorrs&  ( (sz::::::rctjddkrdSddlm}|rdSt dz } i}t |d5}|D]q}|}d|vrW|d sB| d\}}}|||<r dddn #1swxYwYn#t$rYdSwxYw|d d }|d d } |dd} |dd} || | | dS)aRead container mode metadata from HERMES_HOME/.container-mode. Returns a dict with keys: backend, container_name, exec_user, hermes_bin or None if container mode is not active, we're already inside the container, or HERMES_DEV=1 is set. The .container-mode file is written by the NixOS activation script when container.enable = true. It tells the host CLI to exec into the container instead of running locally. HERMES_DEVrwNr) is_containerz.container-moder=#backenddockercontainer_namez hermes-agent exec_userhermes hermes_binz /data/current-package/bin/hermes)rrrr) renvironrhermes_constantsrropenr startswith partitionFileNotFoundError) rcontainer_mode_fileinfoflinekey_valuerrrrs rget_container_exec_infors z~~l##s**t------|~~t)++.??  %s + + 6q 6 6zz||$;;ts';';;$(NN3$7$7MCE(- D%  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 tthhy(++GXX.??Nh//I,(JKKJ(   s7 C*A5C C*C""C*%C"&C** C87C8r)atomic_replacec$tdz S)zGet the main config file path.z config.yamlrrrrget_config_pathrs   } ,,rc$tdz S)z&Get the .env file path (for API keys).z.envrrrr get_env_pathrs   v %%rcbttjjS)z'Get the project installation directory.)r__file__parentresolverrrget_project_rootrs >> ' / / 1 11rc6trdS tjdd}|rt |dnd}n#t $rd}YnwxYw tj||dS#ttf$rYdSwxYw)uMSet directory to owner-only access (0700 by default). No-op on Windows. Skipped in managed mode — the NixOS module sets group-readable permissions (0750) so interactive users in the hermes group can share state with the gateway service. The mode can be overridden via the HERMES_HOME_MODE environment variable (e.g. HERMES_HOME_MODE=0701) for deployments where a web server (nginx, caddy, etc.) needs to traverse HERMES_HOME to reach a served subdirectory. The execute-only bit on a directory permits cd-through without exposing directory listings. NHERMES_HOME_MODEri) rrrrrint ValueErrorchmodOSErrorNotImplementedError)pathmode_strmodes r _secure_dirrs||:>>"4b99??AA#+6s8Q   t ( )     s$AA A('A(,BBBctjdstjdrdStjdrdS t dd5}|}dddn #1swxYwYd|vsd |vsd |vrdSn#ttf$rYnwxYwd S) a3Detect if we're running inside a Docker/Podman/LXC container. When Hermes runs in a container with volume-mounted config files, forcing 0o600 permissions breaks multi-process setups where the gateway and dashboard run as different UIDs or the volume mount requires broader permissions. HERMES_CONTAINERHERMES_SKIP_CHMODTz /.dockerenvz/proc/1/cgrouprNrlxckubepodsF) rrrrrrreadrIOError)rcgroup_contents r _is_containerrs z~~())RZ^^>#d)) $ $ " HT5 ! ! ! ! ! " " ( )     sAA%%A:9A:homec|dz }|rdS|tdt|dS)zISeed a default SOUL.md into HERMES_HOME if the user doesn't have one yet.zSOUL.mdNutf-8encoding)r write_textrur)r soul_paths r_ensure_default_soul_mdrGsRy I 7;;;rct}trStjd} t |tj|dS#tj|wxYw|ddt |dD]-}||z }|ddt |.t|dS)a Ensure ~/.hermes directory structure exists with secure permissions. In managed mode (NixOS), dirs are created by the activation script with setgid + group-writable (2770). We skip mkdir and set umask(0o007) so any files created (e.g. SOUL.md) are group-writable (0660). Tparentsexist_ok)cronsessionslogsz logs/curatormemoriesN)rrrumask_ensure_hermes_home_managedmkdirrr)r old_umasksubdirds rensure_hermes_homerPs   D|| &HUOO  ' - - - HY     BHY     4$ ///DN  Fv A GGD4G 0 0 0 NNNN%%%%%s AA-c |std|ddD]-}||z }|st|d.|dz dz ddt|dS) zPManaged-mode variant: verify dirs exist (activation creates them), seed SOUL.md.z HERMES_HOME z7 does not exist. Run 'sudo nixos-rebuild switch' first.)rrrrrcuratorTrN)is_dir RuntimeErrorrr)rrrs rrrhs ;;==  54 5 5 5   ; 6Mxxzz 999   F]Y%%dT%BBBD!!!!!rmodelr providersfallback_providerscredential_pool_strategiestoolsetsz hermes-cliagentZiautoii) max_turnsgateway_timeoutrestart_drain_timeoutapi_max_retries service_tiertool_use_enforcementgateway_timeout_warninggateway_notify_intervalgateway_auto_continue_freshnessimage_input_modedisabled_toolsetsterminalrlocal modal_modecwd.timeoutenv_passthroughshell_init_filesauto_source_bashrcT docker_image*nikolaik/python-nodejs:python3.11-nodejs20docker_forward_env docker_envsingularity_image3docker://nikolaik/python-nodejs:python3.11-nodejs20 modal_image daytona_imagevercel_runtimenode24 container_cpucontainer_memoryicontainer_diskiF)container_persistentdocker_volumesdocker_mount_cwd_to_workspacedocker_run_as_host_userpersistent_shellbrowserx must_respondi,managed_persistence) inactivity_timeoutcommand_timeoutrecord_sessionsallow_private_urlsauto_local_for_private_urlscdp_url dialog_policydialog_timeout_scamofox checkpoints2r)enabled max_snapshots auto_pruneretention_daysdelete_orphansmin_interval_hoursfile_read_max_charsi tool_outputiPi) max_bytes max_linesmax_line_lengthtool_loop_guardrails) exact_failuresame_tool_failureidempotent_no_progressr)warnings_enabledhard_stop_enabled warn_afterhard_stop_after compression?皙?i)rC threshold target_ratioprotect_last_nhygiene_hard_message_limitprompt_caching cache_ttl5m openrouter)response_cacheresponse_cache_ttlbedrock)rCprovider_filterrefresh_intervalasyncdisabled)guardrail_identifierguardrail_versionstream_processing_modetrace)region discovery guardrail auxiliary)providerrbase_urlapi_keyr extra_bodydownload_timeoutih)rsrrtrurrv)rsrrtrurrvmax_concurrencyiX) vision web_extractrXsession_search skills_hubapprovalmcptitle_generationrdisplaycompact personalitykawaiiresume_displayfullbusy_input_mode interrupttui_auto_resume_recentbell_on_completeshow_reasoning streamingfinal_response_markdownr inline_diffs show_costskindefaulttui_status_indicatorkaomojiuser_message_preview) first_lines last_linesinterim_assistant_messagestool_progress_commandtool_progress_overrides)r context_pctr)rCfields)tool_preview_lengthephemeral_system_ttl platformsruntime_footer dashboardthemeprivacy redact_piittsedgevoicezen-US-AriaNeuralpNInz6obpgDQGcFmaJgBeleven_multilingual_v2)voice_idmodel_idzgpt-4o-mini-ttsalloy)rreveeni]i)rlanguage sample_ratebit_ratezvoxtral-mini-tts-2603z$c69964a6-ab8b-4f8a-9465-ec0925096ec8)rrzneuphonic/neutts-air-q4-ggufcpu) ref_audioref_textrdevicezen_US-lessac-medium)rsr elevenlabsopenaixaimistralneuttspipersttbase)rrz whisper-1zvoxtral-mini-latest)rCrsrrrzctrl+bg@) record_keymax_recording_secondsauto_tts beep_enabledsilence_thresholdsilence_duration human_delayoffi i )rmin_msmax_mscontextengine compressormemoryii_)memory_enableduser_profile_enabledmemory_char_limituser_char_limitrs delegation) rrsrtruinherit_mcp_toolsetsmax_iterationschild_timeout_secondsreasoning_effortmax_concurrent_childrenmax_spawn_depthorchestrator_enabledsubagent_auto_approveprefill_messages_filegoalsr skills ) external_dirs template_vars inline_shellinline_shell_timeoutguard_agent_createdr)rCkeep)rCinterval_hoursmin_idle_hoursstale_after_daysarchive_after_daysbackuphonchotimezonediscord)require_mentionfree_response_channelsallowed_channels auto_thread reactionschannel_promptsserver_actionswhatsapptelegram)rrslackr mattermost approvalsmanual<deny)rr cron_modemcp_reload_confirmcommand_allowlistquick_commandshookshooks_auto_accept personalitiessecuritytirith)rCdomains shared_files)r:redact_secretstirith_enabled tirith_pathtirith_timeouttirith_fail_openwebsite_blocklistr) wrap_responsemax_parallel_jobskanban)dispatch_in_gatewaydispatch_interval_secondscode_executionrprojectloggingINFO)level max_size_mb backup_count model_catalogzAhttps://hermes-agent.nousresearch.com/docs/api/model-catalog.json)rCurl ttl_hoursrnetwork force_ipv4)rErFvacuum_after_prunerHseen)pre_update_backup backup_keep)r onboardingupdates_config_version)FIRECRAWL_API_KEYBROWSERBASE_API_KEYBROWSERBASE_PROJECT_IDFAL_KEYVOICE_TOOLS_OPENAI_KEYELEVENLABS_API_KEY)r,rWHATSAPP_ALLOWED_USERSSLACK_BOT_TOKENSLACK_APP_TOKENSLACK_ALLOWED_USERSTAVILY_API_KEYTERMINAL_MODAL_MODE)r rSr ENV_VARS_BY_VERSION NOUS_BASE_URLzNous Portal base URL overridez.Nous Portal base URL (leave empty for default)rs) descriptionpromptrpasswordcategoryadvancedOPENROUTER_API_KEYz>OpenRouter API key (for vision, web scraping helpers, and MoA)zOpenRouter API keyzhttps://openrouter.ai/keysvision_analyzemixture_of_agents)r4r5rr6toolsr7r8GOOGLE_API_KEYzAlibaba Cloud DashScope API key (Qwen + multi-provider models)zDashScope API Keyz-https://modelstudio.console.alibabacloud.com/DASHSCOPE_BASE_URLzGCustom DashScope base URL (default: coding-intl OpenAI-compat endpoint)zDashScope Base URLHERMES_QWEN_BASE_URLzBQwen Portal base URL override (default: https://portal.qwen.ai/v1)z.Qwen Portal base URL (leave empty for default)HERMES_GEMINI_CLIENT_IDzfGoogle OAuth client ID for google-gemini-cli (optional; defaults to Google's public gemini-cli client)uKGoogle OAuth client ID (optional — leave empty to use the public default)z1https://console.cloud.google.com/apis/credentialsHERMES_GEMINI_CLIENT_SECRETz;Google OAuth client secret for google-gemini-cli (optional)z%Google OAuth client secret (optional)HERMES_GEMINI_PROJECT_IDz@GCP project ID for paid Gemini tiers (free tier auto-provisions)z;GCP project ID for Gemini OAuth (leave empty for free tier)OPENCODE_ZEN_API_KEYz=OpenCode Zen API key (pay-as-you-go access to curated models)zOpenCode Zen API keyzhttps://opencode.ai/authOPENCODE_ZEN_BASE_URLzOpenCode Zen base URL overridez/OpenCode Zen base URL (leave empty for default)OPENCODE_GO_API_KEYzOllama Cloud API key (ollama.com — cloud-hosted open models)zOllama Cloud API keyzhttps://ollama.com/settingsOLLAMA_BASE_URLz?Ollama Cloud base URL override (default: https://ollama.com/v1)z)Ollama base URL (leave empty for default)XIAOMI_API_KEYzhXiaomi MiMo API key for MiMo models (mimo-v2.5-pro, mimo-v2.5, mimo-v2-pro, mimo-v2-omni, mimo-v2-flash)zXiaomi MiMo API Keyzhttps://platform.xiaomimimo.comXIAOMI_BASE_URLzFXiaomi MiMo base URL override (default: https://api.xiaomimimo.com/v1)z)Xiaomi base URL (leave empty for default) AWS_REGIONz?AWS region for Bedrock API calls (e.g. us-east-1, eu-central-1)z AWS RegionzIhttps://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html AWS_PROFILEzFAWS named profile for Bedrock authentication (from ~/.aws/credentials)z AWS ProfileAZURE_FOUNDRY_API_KEYz0Azure Foundry API key for custom Azure endpointszAzure Foundry API Keyzhttps://ai.azure.com/AZURE_FOUNDRY_BASE_URLzLAzure Foundry base URL (set via 'hermes model' for endpoint-specific config)zAzure Foundry base URL EXA_API_KEYz1Exa API key for AI-native web search and contentsz Exa API keyzhttps://exa.ai/ web_searchrztool)r4r5rr<r6r7PARALLEL_API_KEYz5Parallel API key for AI-native web search and extractzParallel API keyzhttps://parallel.ai/r$z-Firecrawl API key for web search and scrapingzFirecrawl API keyzhttps://firecrawl.dev/FIRECRAWL_API_URLz6Firecrawl API URL for self-hosted instances (optional)z)Firecrawl API URL (leave empty for cloud)FIRECRAWL_GATEWAY_URLzQExact Firecrawl tool-gateway origin override for Nous Subscribers only (optional)z9Firecrawl gateway URL (leave empty to derive from domain)TOOL_GATEWAY_DOMAINzShared tool-gateway domain suffix for Nous Subscribers only, used to derive vendor hosts, e.g. nousresearch.com -> firecrawl-gateway.nousresearch.comzTool-gateway domain suffixTOOL_GATEWAY_SCHEMEzShared tool-gateway URL scheme for Nous Subscribers only, used to derive vendor hosts (`https` by default, set `http` for local gateway testing)zTool-gateway URL schemeTOOL_GATEWAY_USER_TOKENzuExplicit Nous Subscriber access token for tool-gateway requests (optional; otherwise read from the Hermes auth store)zTool-gateway user tokenz;Tavily API key for AI-native web search, extract, and crawlzTavily API keyzhttps://app.tavily.com/home)rnrz web_crawlr%uUBrowserbase API key for cloud browser (optional — local browser works without this)zBrowserbase API keyzhttps://browserbase.com/browser_navigate browser_clickr&uCBrowserbase project ID (optional — only needed for cloud browser)zBrowserbase project IDBROWSER_USE_API_KEYuUBrowser Use API key for cloud browser (optional — local browser works without this)zBrowser Use API keyzhttps://browser-use.com/FIRECRAWL_BROWSER_TTLz@Firecrawl browser session TTL in seconds (optional, default 300)zBrowser session TTL (seconds))r4r5r<r6r7 CAMOFOX_URLzYCamofox browser server URL for local anti-detection browsing (e.g. http://localhost:9377)zCamofox server URLz)https://github.com/jo-inc/camofox-browserr'z FAL API key for image generationz FAL API keyzhttps://fal.ai/image_generateTINKER_API_KEYzTinker API key for RL trainingzTinker API keyz/https://tinker-console.thinkingmachines.ai/keys)rl_start_trainingrl_check_statusrl_stop_training WANDB_API_KEYz0Weights & Biases API key for experiment trackingz WandB API keyzhttps://wandb.ai/authorizerl_get_resultsrz?OpenAI API key for voice transcription (Whisper) and OpenAI TTSz&OpenAI API Key (for Whisper STT + TTS)z$https://platform.openai.com/api-keysvoice_transcription openai_ttsz4ElevenLabs API key for premium text-to-speech voiceszElevenLabs API keyzhttps://elevenlabs.io/MISTRAL_API_KEYz7Mistral API key for Voxtral TTS and transcription (STT)zMistral API keyzhttps://console.mistral.ai/ GITHUB_TOKENzCGitHub token for Skills Hub (higher API rate limits, skill publish)z GitHub Tokenz"https://github.com/settings/tokensNOTION_API_KEYz5Notion integration token (used by the `notion` skill)zNotion API keyz%https://www.notion.so/my-integrationsskillLINEAR_API_KEYz4Linear personal API key (used by the `linear` skill)zLinear API keyzhttps://linear.app/settings/apiAIRTABLE_API_KEYz=Airtable personal access token (used by the `airtable` skill)zAirtable API keyz"https://airtable.com/create/tokens TENOR_API_KEYz=Tenor API key for GIF search (used by the `gif-search` skill)z Tenor API keyz5https://developers.google.com/tenor/guides/quickstartHONCHO_API_KEYz.Honcho API key for AI-native persistent memoryzHoncho API keyzhttps://app.honcho.devhoncho_contextHONCHO_BASE_URLz=Base URL for self-hosted Honcho instances (no API key needed)z,Honcho base URL (e.g. http://localhost:8000))r4r5r7HERMES_LANGFUSE_PUBLIC_KEYz'Langfuse project public key (pk-lf-...)zLangfuse public keyzhttps://cloud.langfuse.comHERMES_LANGFUSE_SECRET_KEYz'Langfuse project secret key (sk-lf-...)zLangfuse secret keyHERMES_LANGFUSE_BASE_URLz9Langfuse server URL (default: https://cloud.langfuse.com)z8Langfuse server URL (leave empty for cloud.langfuse.com)TELEGRAM_BOT_TOKENz"Telegram bot token from @BotFatherzTelegram bot tokenzhttps://t.me/BotFather messagingTELEGRAM_ALLOWED_USERSzSComma-separated Telegram user IDs allowed to use the bot (get ID from @userinfobot)z+Allowed Telegram user IDs (comma-separated)zhttps://t.me/userinfobotTELEGRAM_PROXYzaProxy URL for Telegram connections (overrides HTTPS_PROXY). Supports http://, https://, socks5://zTelegram proxy URL (optional))r4r5r6r7DISCORD_BOT_TOKENz'Discord bot token from Developer PortalzDiscord bot tokenz+https://discord.com/developers/applicationsDISCORD_ALLOWED_USERSz7Comma-separated Discord user IDs allowed to use the botz*Allowed Discord user IDs (comma-separated)DISCORD_REPLY_TO_MODEzDiscord reply threading mode: 'off' (no reply references), 'first' (reply on first message only, default), 'all' (reply on every chunk)z"Discord reply mode (off/first/all)r+zSlack bot token (xoxb-). Get from OAuth & Permissions after installing your app. Required scopes: chat:write, app_mentions:read, channels:history, groups:history, im:history, im:read, im:write, users:read, files:read, files:writezSlack Bot Token (xoxb-...)zhttps://api.slack.com/appsr,uSlack app-level token (xapp-) for Socket Mode. Get from Basic Information → App-Level Tokens. Also ensure Event Subscriptions include: message.im, message.channels, message.groups, app_mentionzSlack App Token (xapp-...)MATTERMOST_URLz3Mattermost server URL (e.g. https://mm.example.com)zMattermost server URLzhttps://mattermost.com/deploy/MATTERMOST_TOKENz-Mattermost bot token or personal access tokenzMattermost bot tokenMATTERMOST_ALLOWED_USERSz:Comma-separated Mattermost user IDs allowed to use the botz-Allowed Mattermost user IDs (comma-separated)MATTERMOST_REQUIRE_MENTIONzaRequire @mention in Mattermost channels (default: true). Set to false to respond to all messages.zRequire @mention in channels!MATTERMOST_FREE_RESPONSE_CHANNELSzJComma-separated Mattermost channel IDs where bot responds without @mentionz+Free-response channel IDs (comma-separated)MATRIX_HOMESERVERz7Matrix homeserver URL (e.g. https://matrix.example.org)zMatrix homeserver URLz%https://matrix.org/ecosystem/servers/MATRIX_ACCESS_TOKENz3Matrix access token (preferred over password login)zMatrix access tokenMATRIX_USER_IDz)Matrix user ID (e.g. @hermes:example.org)zMatrix user ID (@user:server)MATRIX_ALLOWED_USERSzLComma-separated Matrix user IDs allowed to use the bot (@user:server format)z)Allowed Matrix user IDs (comma-separated)rWzZRequire @mention in Matrix rooms (default: true). Set to false to respond to all messages.z&Require @mention in rooms (true/false)rjzCComma-separated Matrix room IDs where bot responds without @mentionz(Free-response room IDs (comma-separated)r5z@Auto-create threads for messages in Matrix rooms (default: true)z)Auto-create threads in rooms (true/false)rQz>Auto-create threads for DM messages in Matrix (default: false)z'Auto-create threads in DMs (true/false)r%zNStable Matrix device ID for E2EE persistence across restarts (e.g. HERMES_BOT)z)Matrix device ID (stable across restarts)r?uMatrix recovery key for cross-signing verification after device key rotation (from Element: Settings → Security → Recovery Key)zMatrix recovery keyrUzOBlueBubbles server URL for iMessage integration (e.g. http://192.168.1.10:1234)zBlueBubbles server URLzhttps://bluebubbles.app/rGuJBlueBubbles server password (from BlueBubbles Server → Settings → API)zBlueBubbles server passwordBLUEBUBBLES_ALLOWED_USERSzJComma-separated iMessage addresses (email or phone) allowed to use the botz,Allowed iMessage addresses (comma-separated)BLUEBUBBLES_ALLOW_ALL_USERSz-Allow all BlueBubbles users without allowlistzAllow All BlueBubbles Usersrz.QQ Bot App ID from QQ Open Platform (q.qq.com)z QQ App IDzhttps://q.qq.com)r4r5rr7r(z*QQ Bot Client Secret from QQ Open PlatformzQQ Client Secretr'z2Comma-separated QQ user IDs allowed to use the botzQQ Allowed UsersrXz=Comma-separated QQ group IDs allowed to interact with the botzQQ Group Allowed Usersr7z4Allow all QQ users without an allowlist (true/false)zAllow All QQ Usersr6zMaximum tool-calling iterations per conversation (default: 90)zMax iterationsHERMES_TOOL_PROGRESSz=(deprecated) Use display.tool_progress in config.yaml insteadu.Tool progress (deprecated — use config.yaml)HERMES_TOOL_PROGRESS_MODEu.Progress mode (deprecated — use config.yaml)HERMES_PREFILL_MESSAGES_FILEzFPath to JSON file with ephemeral prefill messages for few-shot primingzPrefill messages file pathHERMES_EPHEMERAL_SYSTEM_PROMPTzOEphemeral system prompt injected at API-call time (never persisted to sessions)zEphemeral system prompt required_onlyc:g}tD]1\}}t|s|d|i|ddi2|sKtD]1\}}t|s|d|i|ddi2|S)z| Check which environment variables are missing. Returns list of dicts with var info for missing variables. name is_requiredTF)REQUIRED_ENV_VARSitems get_env_valueappendOPTIONAL_ENV_VARS)rmissingvar_namers rget_missing_env_varsrH s G,1133LL$X&& L NNFHJJmTJJ K K K Q/5577 Q QNHd ** QODO-OOPPP Nr dotted_keyc j|d}|}|ddD]}t|trE t|}n+#tt f$rt d|d|dwxYw||}\t|t rC||}||vst|t tfsi||<||}t dt|j d||d}t|tr||t|<dS|||<dS) uSet a value at an arbitrarily nested dotted key path. Supports both dict and list navigation: _set_nested(c, "a.b.c", 1) → c["a"]["b"]["c"] = 1 _set_nested(c, "a.0.b", 1) → c["a"][0]["b"] = 1 _set_nested(c, "providers.1", "x") → c["providers"][1] = "x" Intermediate dicts are created on demand. List indices are parsed from numeric path segments; the referenced index must already exist (we do not grow lists — the user is navigating into structure they wrote themselves). If a segment targets a non-container leaf (scalar), the leaf is replaced with a fresh dict so the write can proceed — this preserves the pre-existing behavior for bare scalar overrides (e.g. setting ``a.b.c`` where ``a.b`` was previously a string). Guards against #17876: before this fix the code unconditionally replaced any non-dict value (including lists) with ``{}``, silently destroying list-typed config like ``custom_providers`` whenever a caller used an indexed path. rNz!Cannot navigate into list at key z : segment z is not a numeric indexzCannot navigate into z at key ) split isinstancelistr TypeErrorrdictrtype__name__) configrrpartscurrentpartidxexistinglasts r _set_nestedr^ s|,   S ! !EGcrc  gt $ $  $iiz*   ? ??#???  clGG  & & {{4((H7""*Xd|*L*L" " dmGGVW (>VV VV  9D'4  "D  s A  (A2ct}gddtdtdtffd t|S)z Check which config fields are missing or outdated (recursive). Walks the DEFAULT_CONFIG tree at arbitrary depth and reports any keys present in defaults but absent from the user's loaded config. rdefaultsrprefixc`|D]\}}|dr|s|n|d|}||vr||d|dGt|tr;t||tr||||dS)NrrzNew config option: )rrr4)rrrrrr)rrrr default_valuefull_key_checkrs rrz)get_missing_config_fields.._check s"*.."2"2 > > C~~c"" "(?ss.?.?#.?.?H'!!#,#C#C#C   M400 >Z C@P@PRV5W5W >}gclH=== > >r)r) load_configrrDEFAULT_CONFIG)rrrs @@rget_missing_config_fieldsr sj]]FG > > > >c > > > > > > > F>6""" Nrc6 ddlm}m}n#t$rgcYSwxYw |}nF#t$r9}ddl}|jt d|gcYd}~Sd}~wwxYw|sgSt}g}|D]}|d|d}| d} |} d} | D](} t| tr| | vr | | } | } &d} | )t| tr)| s|||S)a3Return skill-declared config vars that are missing or empty in config.yaml. Scans all enabled skills for ``metadata.hermes.config`` entries, then checks which ones are absent or empty under ``skills.config.`` in the user's config.yaml. Returns a list of dicts suitable for prompting. r)discover_all_skill_config_varsSKILL_CONFIG_PREFIXNz)discover_all_skill_config_vars failed: %srr)agent.skill_utilsrr Exceptionr getLoggerrdebugrrrrrrr) rrall_varserrrvar storage_keyrrrrs rget_missing_skill_config_varsr sYYYYYYYYY   1133  (##)) 7      ]]F$&G  ,;;s5z;; !!#&&  D'4(( TW__!$- =Zs33=EKKMM= NN3    Ns&  ) A,.A'!A,'A, provider_keyentryrc * t|tsdSddddddddd }d |vrd|vr |d |d<hd }|D]7\}}||vr.||vr*td |pd ||||||<8t ||z t |z }|r>td|pd dt|ddl m }d}dD]} | | } t| trd| rP| } || } | jr | jr| }n td|pd | | |sdSd} | d}t|tr)| r| } n(| r| } | sdS| |d}| }|r||d<| d}t|tr+| r| |d<| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| d}t|tr|r||d<n&t|t r|rd|D|d<| d}t|t"r |dkr||d<| d}t|t"t$fr |dkr||d<|S)z>Return a runtime-compatible custom provider entry or ``None``.Nrurtapi_modekey_env default_modelcontext_lengthrate_limit_delay)apiKeybaseUrlapiModekeyEnv apiKeyEnv defaultModel contextLengthrateLimitDelay api_key_env>apirrrmodelsrurrrt transportrrrrstale_timeout_secondsrequest_timeout_secondsz[providers.%s: camelCase key '%s' auto-mapped to '%s' (use snake_case to avoid this warning)?z-providers.%s: unknown config keys ignored: %s, rurlparser)rtrruPproviders.%s: '%s' value '%s' is not a valid URL (no scheme or host) — skippedr)rrtrrrrci|];}t|t|+t|iz4_normalize_custom_provider_entry..H sO   *Q*<*< AB FFB   r)rrrloggerwarningsetkeysjoinsorted urllib.parserrrrschemenetlocrrfloat)rr_CAMEL_ALIASES _KNOWN_KEYScamelsnakeunknownrrturl_keyraw_url candidateparsedrraw_namerrurr model_namerrrs r _normalize_custom_provider_entryr s eT " "t'), & &N)5"8"8 /iK ',,..(( u E>>e500 NN9#UE    !"ii ""G'30GMMOO0 '  9ii ""G'30GMMOO0 '  9yy$$> +(>(>H(C  2X^^%5%52!)!1!1 :7##Auyy'A'AJ*c""1z'7'7'9'91(..00 7 YYx F&$  F  % 8 FD ! ! f   &   8YY/00N.#&&6>A+=+='5 #$yy!344"S%L11:6F!6K6K)9 %& rproviders_dictct|tsgSg}|D]:\}}t|t |}|||;|S)zMNormalize ``providers`` config entries into the legacy custom-provider shape.r)rrrrrr)r custom_providersrrrs r"providers_dict_to_custom_providersr#W sw nd + + -/$**,,00 U5e#c((SSS  !  # #J / / / rrc|t}gttdtttt fddffd }|d}|4t|tsgS|D]}|t|t|dD] }||S)ayReturn a deduplicated custom-provider view across legacy and v12+ config. ``custom_providers`` remains the on-disk legacy format, while ``providers`` is the newer keyed schema. Runtime and picker flows still need a single list-shaped view, but we should not materialise that compatibility layer back into config.yaml because it duplicates entries in UIs. Nrrc>|dSt|ddpd}t|ddpd}t|ddpdd}t|ddpd}|||f}|r|vrdS|r|r|vrdS||r||r|r|dSdSdS)Nrrrrt/r)rrrrrstripradd) rrrrtrpair compatibleseen_name_url_pairsseen_provider_keyss r_append_if_newz7get_compatible_custom_providers.._append_if_newv s = F599^R88>B??EEGGMMOO 599VR((.B//5577==??uyyR006B77==??FFsKKQQSSEIIgr**0b117799??AAh&  L,>>> F  H ).context_length`` if present and valid. Returns ``None`` when no override applies. This is the single source of truth for custom-provider context overrides, used by: * ``AIAgent.__init__`` (startup resolution) * ``AIAgent.switch_model`` (mid-session ``/model`` switch) * ``hermes_cli.model_switch.resolve_display_context_length`` (``/model`` confirmation display) * ``gateway.run._format_session_info`` (``/info`` display) * ``agent.model_metadata.get_model_context_length`` (when custom_providers is threaded through) Before this helper existed, the lookup was duplicated in ``run_agent.py``'s startup path only; every other path (notably ``/model`` switch) fell back to the 128K default. See #15779. Nr"rr&rtrrr) r.rrrrr'rrrr) rrtr"rr target_urlr entry_urlr model_cfgraw_ctxctxs r"get_custom_provider_context_lengthr5 s0 t D>vFF   D D D~tt**/00C&0d&;&;Css     D & - -t.b((--J t!%&&  YYz**0b88==  I33 8$$&$''  JJu%% )T**  -- 011 ?  g,,CC:&    H  77JJJ  4s& A.AA EE/.E/ct}|dd}tdd}||fS)zS Check config version. Returns (current_version, latest_version). r#rr*)rrr)rrlatests rcheck_config_versionr8 sA ]]Fjj*A..G    11 5 5F F?r>rrrrrgatewayrrrrrrrrXfallback_modelr#r"rr> rrrrurrrtrr>rurrtrc2eZdZUdZeed<eed<eed<dS) ConfigIssuez$A detected config structure problem.severitymessagehintN)r __module__ __qualname____doc__r__annotations__rrrr<r< s1..MMM LLL IIIIIrr<c d |2 t}n"#t$rtdddgcYSwxYwg}|d}|t |t r|tdddt |t r!t|n t}|tz}|r5|tdd t|d d nt |trt|D]\}}t |t s>|tdd |d t|jddX|ds(|tdd |dd|ds(|tdd |dd|d}|t |trt|D]\}}t |t s=|tdd|dt|jdW|ds(|tdd|dd|ds(|tdd|ddnt |t s:|tdd t|jd!nt|rr|ds$|tdd"d|ds$|tdd#d$t |t r.d|vr*d|pivr$|tdd%d&|d}|r&|s$|tdd'd(|D]V} | d)r| t vr5| tvr,|tdd*| d+d,| d-W|S).a"Validate config.yaml structure and return a list of detected issues. Catches common YAML formatting mistakes that produce confusing runtime errors (like "Unknown provider") instead of clear diagnostics. Can be called with a pre-loaded config dict, or will load from disk. NerrorzCould not load config.yamlz+Run 'hermes setup' to create a valid configr"uOcustom_providers is a dict — it must be a YAML list (items prefixed with '-')zeChange to: custom_providers: - name: my-provider base_url: https://... api_key: ...r zRoot-level keys z( look like custom_providers entry fieldszLThese should be indented under a '- name: ...' list entry, not at root levelzcustom_providers[z] is not a dict (got )z1Each entry should have at minimum: name, base_urlrz] is missing 'name' fieldz#Add a name, e.g.: name: my-providerrtz] is missing 'base_url' fieldzDAdd the API endpoint URL, e.g.: base_url: https://api.example.com/v1r:zfallback_model[z] should be a dict, got z!Each entry needs provider + modelrsz] is missing 'provider' fieldz/Add: provider: openrouter (or another provider)rz] is missing 'model' fieldzAdd: model: zAfallback_model should be a dict with 'provider' and 'model', got zZChange to: fallback_model: provider: openrouter model: anthropic/claude-sonnet-4uHfallback_model is missing 'provider' field — fallback will be disableduEfallback_model is missing 'model' field — fallback will be disabledz8Add: model: anthropic/claude-sonnet-4 (or another model)zGfallback_model appears inside custom_providers instead of at root levelzDMove fallback_model to the top level of config.yaml (no indentation)u[custom_providers defined but no 'model' section — Hermes won't know which provider to useziAdd a model section: model: provider: custom default: your-model-name base_url: https://...rzRoot-level key 'uW' looks misplaced — should it be under 'model:' or inside a 'custom_providers' entry?zMove 'z' under the appropriate section)rrr<rrrrr r _CUSTOM_PROVIDER_LIKE_FIELDSrr enumeraterrr_KNOWN_ROOT_KEYS) rissuescpcp_keys suspiciousirfbr2rs rvalidate_config_structurerP s~ w ]]FF w w w)EGtuuv v v v w!#F & ' 'B ~ b$  (  MM+a%   )32t(<(<Gc"''))nnn#%%G #??J  kcvj'9'9cccb D ! ! %bMM  5!%..MM+![A[[DKKDX[[[K## yy((MM+!HAHHH=## yy,,MM+!LALLL^## $ % %B ~ b$  + %bMM  5!%..MM+[![[T%[[EY[[;## !99Z00 k%NaNNNM'' !99W-- k%KaKKK6'' (B%%  MM+gTXY[T\T\Tegg7     66*%%  k^E 66'??  k[N"d 0 > >CSXZX`^`CaCa k  U R      7##I  )   k  i (      >>#     & & &32N+N+N MM+3====    Ms 22cT t|}n#t$rYdSwxYw|sdSdg}|D]1}|jdkrdnd}|d|d|j2|dt jd |d zdS) zPrint config structure warnings to stderr at startup. Called early in CLI and gateway init so users see problems before they hit cryptic "Unknown provider" errors. Prints nothing if config is healthy. Nu3⚠ Config issues detected in config.yaml:rEu ✗u ⚠  z2 Run 'hermes doctor' for fix suggestions.  ) rPrr=rr>rrwriter)rrJlinescimarkers rprint_config_warningsrZ s*622   H IE11)+)?)?%%EY /&//2://0000 LLKLLLJTYYu%%./////s   ctjd}tjd}|! t}n#t$rYdSwxYw|di}t |t r|ddnd}|dv}g}|r|d|d |r|s|d |d |rtjd d }|d d|d|d|dtj d |dzdSdS)uWarn if MESSAGING_CWD or TERMINAL_CWD is set in .env instead of config.yaml. These env vars are deprecated — the canonical setting is terminal.cwd in config.yaml. Prints a migration hint to stderr. MESSAGING_CWD TERMINAL_CWDNrrr)rr rru ⚠ MESSAGING_CWD=u& found in .env — this is deprecated.u ⚠ TERMINAL_CWD= HERMES_HOMEz ~/.hermesru/⚠ Deprecated .env settings detected:zN Move to config.yaml instead: terminal:\n cwd: /your/project/pathz' Then remove the old entries from z /.envrTrU) rrrrrrrrinsertrrrVr)r messaging_cwdterminal_cwd_env terminal_cfg config_cwdconfig_has_explicit_cwdrW hint_paths rwarn_deprecated_cwd_env_varsrf s JNN?33Mz~~n55 ~  ]]FF    FF ::j"--L1;L$1O1OX!!%---UXJ(0HHE   #- # # #    7   #1A # # #    4JNN=+>>  QOPPP  >     P P P P    5))F233333 4 4sA AA interactivequietc f0Ygggd} t}|r|std|dn#t$rYnwxYwt\}}|dkrFt }|di}t |tsi}d|vrtd}td} |r7| d vr!d |d<|d  d n| r_| d vrI| |d<|d  d| dn d|d<|d  d||d<t||std|d|dkrt }d|vrtj dd} | r]| rI| |d<|d  d| dn d|d<|d  dt||s|dpd} td| |dkrD td} | r!tdd|stdn#t$rYnwxYw|dkrt }|d } t | t r| r|d!i}t |tsi}d"}| D]}t |ts|d#d}|d$dp|d%dpd}|d&d}|sv| d'd(d)dd*d}d+|vr|d+d(}d+|v|d(}|sE d"d,lm}||}|jpd-d.d(}n#t$rd/|}YnwxYw||vr|d(|}d0|i}|r||d#<|r |d1vr||d&<|d2r |d2|d3<|d4r |d4|d5<|||<|d6z }|d"kr||d!<|d d7t||sqtd8|d9t!|| d7D]3}||}td:|d;|d0d4|d|d?:#t$rYFwxYw|d@kr]t/}|dAi}t |tr#d2|vr|d2}|dBdC}t }|dAi}|d2d7|dDvrShdE} || vrJ|dCi}!t |!trd2|!vr|dCi}"||"d2<nJ||i}#t |#trd2|#vr||i}$||$d2<||dA<t||stdF|dGkrt/}|di}t |tsi}dH|vrEdI|dH<||d<|d  dJt||stdK|dLkrEt/}|di}t |tsi}|dM}%t |%tr|%r|dNi}&t |&tsi}&|%D]#\}'}(|'|&vri|&|'<d|&|'vr |(|&|'d<$|&|dN<||d<t||sCdOdP|%D})tdQ|)|d  dR|dSkrt/}|dTi}*t |*tr|*dUd7}+|*dVd7},|*dWd7}-g}.|+rt7|+r}|dXi}/|/dTi}0|0d2s|dm}?t |?tsi}?g}@|>D]5\}A}B|A|?vr,tSj*|B|?|A<|@ |A6|@r|?|dm<dI}=tPdXidmi}C|dX}Dt |Dtsi}D|Ddm}Et |Etsi}Eg}F|CD]5\}A}B|A|Evr,tSj*|B|E|A<|F |A6|Fr |E|Ddm<|D|dX<dI}=|=rt||@rS|d  drtM|@ds|s%tdtdO|@|FrS|d  dutM|Fds|s%tdvdO|F||kr|stdw|dx|tWdIy}G|Gr7|s5tdz|GD]#}Htd{|Hd#d;|Hd|$|r/|Gr,td}|GD]}H|Hd%rtd~|Hd%|Hdr$d"d7l,}I|I,d|Hdd;}Jn+t[d|Hdd;}J|JrPt|Hd#|J|d |Hd#td|Hd#n%|do d|Hd#dttWdqy}K|Gr d|GDn t9YYfd|KD}Kt9}Lt]|d6z|d6zD]0}M|L/t`|Mg1|LrC|r@|s=dt?|LD}N|Nr!tdtM|Nd|ND].\}:}Otd|:d|Od|d/t t[d }Pn#tbtdf$rd}PYnwxYw|Pdvr`t|ND]M\}:}O|Od%r?td|Od||:td~|Od%n&td|Od||:|Odr2d"d7l,}I|I,d|Od|:d}Jn9t[d|Od|:d}J|Jr=t|:|J|d |:td|:tOntdtg}Q|Qr{t }|QD]U}R|Rd}|Rd}Sti|||S|d  ||std|d|SV||d<t|n(||kr"t }||d<t|tk}T|Tr*|r'|s$tdtM|Td|TD]=}H|Hdd}Utd|Hdd|Hd|d|Ud*>t t[d }Pn#tbtdf$rd}PYnwxYw|PdvrTtt } d"dl6m7}Vn#t$rd}VYnwxYw|TD] }H|Hdd}S|Srd|Sd*nd}Wt[d|Hd|Wd;}J|Js|Srt7|S}J|Jr[|Vd.|Hd}Xti||X|J|d  |Hdtd|Hdd|Jn<|do d|Hdd|Hdddt t|ntd|S)a< Migrate config to latest version, prompting for new required fields. Args: interactive: If True, prompt user for missing values quiet: If True, suppress output Returns: Dict with migration results: {"env_added": [...], "config_added": [...], "warnings": [...]} ) env_added config_addedwarningsu ✓ Repaired .env file (z corrupted entries fixed)r0r tool_progressrr)false0norrkz;display.tool_progress=off (from HERMES_TOOL_PROGRESS=false))newallzdisplay.tool_progress=z! (from HERMES_TOOL_PROGRESS_MODE)rrz#display.tool_progress=all (default)u- ✓ Migrated tool progress to config.yaml: rSrHERMES_TIMEZONErz timezone=z (from HERMES_TIMEZONE)z$timezone= (empty, uses server-local)(server-local)u% ✓ Added timezone to config.yaml: ru8 ✓ Cleared ANTHROPIC_TOKEN from .env (no longer used) r"rrrrtrrurS-(rFz--rendpointrz endpoint-r)zno-keyzno-key-requiredrrrrrr*Nu ✓ Migrated z) custom provider(s) to providers: sectionu → : ) LLM_MODEL OPENAI_MODELu ✓ Cleared u> from .env (no longer used — config.yaml is source of truth)rrsr)r local_command>base.entiny.enlarge-v1large-v2large-v3small.en medium.enlarge-v3-turbodistil-large-v2distil-large-v3distil-small.endistil-medium.endistil-large-v3.5rtinylargesmallturbomediumu; ✓ Migrated legacy stt.model to provider-specific configrTz1display.interim_assistant_messages=true (default)u3 ✓ Added display.interim_assistant_messages=truerrrc3*K|]\}}|d|VdS)rNr)rprs r z!migrate_config.. s0$R$RDAqZZAZZ$R$R$R$R$R$Rru> ✓ Migrated tool_progress_overrides → display.platforms: z9display.platforms (migrated from tool_progress_overrides)rX summary_modelsummary_providersummary_base_urlrrmodel=)rr r  provider=z base_url=u@ ✓ Migrated compression.summary_* → auxiliary.compression: u/ ✓ Removed unused compression.summary_* keyspluginsrCrjz plugin.yamlz plugin.ymlz$plugins.enabled (opt-in allow-list, z grandfathered)u( ✓ Plugins now opt-in: grandfathered z( existing plugin(s) into plugins.enabledum ✓ Plugins now opt-in: no existing plugins to grandfather. Use `hermes plugins enable ` to activate.r rrrrlzCould not create Fz curator (z default key(s))u. ✓ Seeded curator defaults in config.yaml: zauxiliary.curator (u8 ✓ Seeded auxiliary.curator defaults in config.yaml: zConfig version:  → ru0 ⚠️ Missing required environment variables:u • r4z Let's configure them now: z Get your key at: r6rRr5rju ✓ Saved zSkipped z - some features may not workch|] }|d S)rrrvs r z!migrate_config.. s555Aai555rcRg|]#}|dv |d!|$S)rr8r)rrrequired_namess r z"migrate_config.. sC V9N * *1553D3D * * * *rc\g|])}t|s|tv|t|f*Sr)rr)rrs rrz"migrate_config.. sK    && ,03D+D+D$T* ++D+D+Dr z$ new optional key(s) in this update:u • u — z Configure new keys? [y/N]: n)yrxz (Enter to skip): z1 Set later with: hermes config set rru ✓ Added  = r#z! skill setting(s) not configured:rrz (from skill: z# Configure skill settings? [y/N]: )rz skills.configz (default: u — skill 'rz' may ask for it later)8sanitize_env_filerrr8rrrrrrr save_configrrrsave_env_valuerreplacerrhostnamepopr read_raw_config setdefaultrrrr rrriterdirrryaml safe_loadrlenrrcopydeepcopyrgetpassinputrangeupdater2EOFErrorKeyboardInterruptrrrrr)Zrgrhresultsfixes current_ver latest_verrr old_enabledold_modeold_tz tz_display old_token custom_listr migrated_countrold_nameold_urlold_keyrrr new_entryepdead_varold_valrraw_stt legacy_modelrsr _local_models raw_local local_cfg raw_provider provider_cfg old_overridesrplatrmigratedcomps_model s_provider s_base_url migrated_keysauxaux_comp plugins_cfgrj disabled_set grandfathereduser_plugins_dirchild manifest_file_mfmanifestr curator_dirrtouched_curator_defaults raw_curator added_curatorkr_aux_curator_defaultsraw_auxraw_aux_curator added_aux missing_envrrrmissing_optional new_var_namesver new_and_unsetranswermissing_configfieldrmissing_skill_config skill_namer default_hintrrsZ @rmigrate_configr sCCG !##  Q Q OuOOO P P P      344KQ**Y++'4(( G ' ) )'(>??K$%@AAH V{00226JJJ+0('../lmmmm Vhnn...@@+3>>+;+;('../{HXHX/{/{/{||||+0('../TUUU 'F9      b`goF^``aaaQ V # #Y0"55F W&,,.. W%+\\^^z"'../b6<<>>/b/b/bcccc%'z"'../UVVV     L#J/C3C JjJJKKKQ %&788I V0"555VTUUU    D Rjj!344 k4 ( (9 E[9 E#ZZ R88Nnd33 $!#N$) $) $!%.. 99VR00))J33Quyy7K7KQr))Ir22nn&&,,..66sC@@HHbQQYYZ]_abbckk++dC00Cckkiinn;;999999!)'!2!2%<*EEc3OO$;;;:.::;.(( 33>33C"G, 1(0If%3w.OOO+2Ii(99W%%@16wIo.99Z((?-2:->Ik*&/s#!#!!&4{# -t444F###EeNeeefff#N$7$7$9$9::N?;K;KLEE+C0CCCub0A0ACCDDDD R5  H '11y"8R000 ywxwwwxxx    R''%$$ gt $ $% VG););"7+L{{:w77H ]]F**UB''C GGGT " " "555!!!  =00!( GR 8 8I%i66:':R:R$'NN7B$?$? -9 '* '{{8R88 !,559 9T9T#&>>(B#?#?L,8L)F5M     VTUUUR ""**Y++'4(( G 'w 6 648G0 1 'F9  N # * *+^ _ _ _     MKLLLR ""**Y++'4(( G $=>> mT * * h} h K44Ii..  +1133 < < dy((&(IdO")D/997;IdOO4#,GK 'F9      c99$R$RM>-<<||G,,=(+G (:(:(<(>-<<||J//C8<< 3K3Kv3U3U+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Cc*oo3355 C'' R88>>-<<||J//C+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Q 3z7MQ[Qg(,}%F###Q$Q{aeajajkxayay{{||||OPPPR ""jj++ +t,, K K ' '"z266<"Hh-- x==L(*M ##2#4#4y#@ #**,,3!'(8(@(@(B(B!C!C33$||~~%$(- (= ,3355A,1L,@M,3355%$*!%m!4!4E+/>#+>+>+D"EEEEEEEEEEEEEEE(***')HHH*'||F33Auz<//$%,,T2222 # # # "  #&3K " +F9      N # * *Zs=7I7IZZZ     X}--XXX J0R O)++f4y@K   dT  : : : : O O O J  & &'M;'M'M!'M'M N N N N N N N N O!""+..y"==jj++ +t,, K#% %++-- ( (DAq ##!%q!1!1 A$$Q'''   +F9 G   {B / / 3 3Ir B B **[))'4(( G!++i00/400 ! O! )//11 $ $DAq''%)]1%5%5"  ###  !0GI ")F; G       '..DM 2 2DDD699]3366 '..J#i..JJJ299Y//22 Z ???:??@@@'T:::KA5A ABBB A AC ?CK??3}+=?? @ @ @ @{ -...  Cwwu~~ :8CJ88999wwz"" >(>S](>(>(>??43x=44455;;== bs6{E222 $++CK8882S[223333 #**+`c&k+`+`+`aaa GGGG,%@@@9DO555555#%%N# EEM[1_j1n55??044S"==>>>>#K#KU#K  }--    K Q]++QQQ R R R+ K K dIIIDHH]B,G,GIIJJJJ GGG >??EEGGMMOO/0    %%"/JD$xxDB488M4#@#@BBCCCADKAABBBBB488M4#@#@BBCCCxx ++a& '0aTXXh5M5M0a0a0a b b %&W488Hd+C+C&W&W&W X X ^ ^ ` `5&tU333 ,33D9993T33444GGGG"IJJJ/00N# 8 8E,CI&G W - - - N # * *3 / / / 86S66W66777%/ !F z ! !$. !F 9::$G $GE$G QS-..QQQRRR' _ _C)44J ]SZ]]c-.@]]PZ]]] ^ ^ ^ ^  @AAGGIIOOQQFF+,   FFF  \ ! ! GGG ]]F 6AAAAAAA 6 6 6&5### 6+  '')R00;BJ7W7777 B3x=B,BBBCCIIKK))LLE%8"G"G3u:"G"GK U;;;N+223u:>>>?U????@@@@J'..h3u:hh3777C;P;Phhh      E F F F Ns%/ <<=2J00 J=<J=.Q11RR!6W W%$W%>Bvu u5 u u u u u  v uvu:v v&%v&*+y z  !zz N3AN6N6AO O AO Y<3AZ0Z0A[[A[[+A[2[2 A\\A\overridec|}|D]X\}}||vrJt||tr/t|trt |||||<S|||<Y|S)aRecursively merge *override* into *base*, preserving nested defaults. Keys in *override* take precedence. If both values are dicts the merge recurses, so a user who overrides only ``tts.elevenlabs.voice_id`` will keep the default ``tts.elevenlabs.model_id`` intact. )rrrr _deep_merge)rrresultrrs rrrsYY[[Fnn&&  U 6MM6#;-- 5$'' &fSk599F3KKF3KK Mrct|trtjdd|St|trd|DSt|t r d|DS|S)aRecursively expand ``${VAR}`` references in config values. Only string values are processed; dict keys, numbers, booleans, and None are left untouched. Unresolved references (variable not in ``os.environ``) are kept verbatim so callers can detect them. z \${([^}]+)}ctj|d|dS)Nr*r)rrrgroup)rs rz"_expand_env_vars..;s*bjnnQWWQZZ<<rc4i|]\}}|t|Sr_expand_env_vars)rrrs rr z$_expand_env_vars..?s'???41a#A&&???rc,g|]}t|Srr )ritems rrz$_expand_env_vars..As!7774 &&777r)rrresubrrr)objs rr r 1s#s v  < <    #t@??399;;????#t87737777 Jrct|tsdSi}|D]V}t|tr(t|dtsdS|d}||vrdS|||<W|S)zHReturn a name-indexed dict only when all items have unique string names.Nr)rrrrr)rindexedrrs r_items_by_unique_namerEs eT " "tG$%% Z8H8H#-N-N 44F| 7??44 Nrct|trfttrQtjdr<|krSttr|krSt |krS|St|t r6tt r!fd|DSt|trqttr\t|}tt|fd|DSfdt|DS|S)aRestore raw ``${VAR}`` templates when a value is otherwise unchanged. ``load_config()`` expands env refs for runtime use. When a caller later persists that config after modifying some unrelated setting, keep the original on-disk template instead of writing the expanded plaintext secret back to ``config.yaml``. Prefer preserving the raw template when ``current`` still matches either the value previously returned by ``load_config()`` for this config path or the current environment expansion of ``raw``. This handles env-var rotation between load and save while still treating mixed literal/template string edits as caller-owned once their rendered value diverges. z \${[^}]+}c i|]T\}}|t||ttr|ndUSN)_preserve_env_ref_templatesrrr)rrrloaded_expandedrs rr z/_preserve_env_ref_templates..lsr   U , ,6,M,MW##C(((SW   rNc g|]c}t||d(|dnddS)rN)rr)rrloaded_by_name raw_by_names rrz/_preserve_env_ref_templates..~s{  ,OODHHV$4$455.s    t (#c#hh..E Dot449>_AUAU9U9U &&       r) rrrsearchr rrrrrH)rrrcurrent_by_namerrs `` @@rrrTs'3JsC$8$8RY|UX=Y=Y c>>J os + + ?0J0JJ C G + +J'4   ZT%:%:      &mmoo     '4   ZT%:%: 088+C00 .??  &;+B $         )11     NrcjtfddD}|sStd}t|ts |rd|ini}|d<dD]I}|}|r||s|||<|dJS)uMove stale root-level provider/base_url/context_length into model section. Some users (or older code) placed ``provider:``, ``base_url:``, or ``context_length:`` at the config root instead of inside ``model:``. These root-level keys are only used as a fallback when the corresponding ``model.*`` key is empty — they never override an existing value. After migration the root-level keys are removed so they can't cause confusion on subsequent loads. c3BK|]}|VdSrr)rrrs rrz-_normalize_root_model_keys..s-UUQ6::a==UUUUUUr)rsrtrrrN)anyrrrr)rhas_rootrrroot_vals` r_normalize_root_model_keysr'sUUUU*TUUUUUH  &\\F JJw  E eT " " &+3E""w9::c??  "EIIcNN "!E#J 3 Mrct|}t|dpi}d|vrd|vr |d|d<d|vrtdd|d<||d<|dd|S)z;Normalize legacy root-level max_turns into agent.max_turns.rr N)rrrr)r agent_configs r_normalize_max_turns_configr*s &\\F 7++1r22LfL!@!@$*;$7 [!,&&$27$;K$H [!"F7O JJ{D!!! Mr)rcfgr ct|ts|S|}|D]+}t|ts|cS||vr|cS||},|S)u%Traverse nested dict keys safely, returning ``default`` on any miss. Canonical helper for the ``cfg.get("X", {}).get("Y", default)`` pattern that appears 50+ times across the codebase. Handles three common gotchas in one place: 1. Missing intermediate keys (returns ``default``, no KeyError). 2. An intermediate value that's not a dict (e.g. a user wrote a string where a section was expected). Returns ``default`` instead of AttributeError on ``.get()``. 3. ``cfg is None`` (callers sometimes pass ``load_config() or None``). Named ``cfg_get`` rather than ``cfg_path`` to avoid shadowing the ubiquitous ``cfg_path = _hermes_home / "config.yaml"`` local variable that appears in gateway/run.py, cron/scheduler.py, main.py, etc. Explicit ``None`` values are returned as-is (matches ``dict.get(key, default)`` semantics — ``default`` is only returned when the key is *absent*, not when it's present but set to ``None``). Examples: >>> cfg_get({"agent": {"reasoning_effort": "high"}}, "agent", "reasoning_effort") 'high' >>> cfg_get({}, "agent", "reasoning_effort", default="medium") 'medium' >>> cfg_get({"agent": "oops_a_string"}, "agent", "reasoning_effort", default="low") 'low' >>> cfg_get(None, "anything", default=42) 42 >>> cfg_get({"a": {"b": None}}, "a", "b", default="def") # explicit None preserved >>> cfg_get({"a": {"b": False}}, "a", "b", default=True) # falsy values preserved False )rr)r+rr noders rcfg_getr.smD c4 D$%% NNN d??NNNCy Krcl t}|}|j|jf}n#tt f$ricYSwxYwt |}t|}|(|dd|krtj |dS t|d5}tj |pi}dddn #1swxYwYn#t$ricYSwxYwt|t si}|d|dtj |ft|<|S)uRead ~/.hermes/config.yaml as-is, without merging defaults or migrating. Returns the raw YAML dict, or ``{}`` if the file doesn't exist or can't be parsed. Use this for lightweight config reads where you just need a single value and don't want the overhead of ``load_config()``'s deep-merge + migration pipeline. Cached on the config file's (mtime_ns, size) — same strategy as ``load_config()``. Returns a deepcopy on every call since some callers mutate the result before passing to ``save_config()``. NrOrrrr*)rstat st_mtime_nsst_sizerrrr rrrrrrrrr) config_pathst cache_keypath_keycachedrdatas rrrs%''     ^RZ0 w ' ;H  " "8 , ,F fRaRjI55}VAY''' + 0 0 0 +A>!$$*D + + + + + + + + + + + + + + +   dD ! !#,Q<1t}T?R?R"Sh KsE03A A  C 1C C CC CC C/.C/cdtt}t|} |}|j|jf}n#t $rd}YnwxYwt|}|*|(|dd|krtj |dStj t}| t|d5}tj|pi}dddn #1swxYwYd|vr_t|dpi}|d |d|d<||d<|ddt#||}n)#t$$r} t'd| Yd} ~ nd} ~ wwxYwt)t+|} t-| } tj | t.|<|,|d|d tj | ft|<nt|d| S) aLoad configuration from ~/.hermes/config.yaml. Cached on the config file's (mtime_ns, size). Returns a deepcopy of the cached value when unchanged, since most call sites mutate the result (e.g. ``cfg["model"]["default"] = ...`` before ``save_config``). The cache is keyed on ``str(config_path)`` so profile switches (which change ``HERMES_HOME`` and therefore ``get_config_path()``) don't collide. NrOrrr rz Warning: Failed to load config: rr*)rrrr0r1r2rr rrrrrrrrrrrrr'r*r r ) r3r6r4r5r7rr user_configagent_user_configrrexpandeds rrrs!##K;H     02 /K   # #H - -F i3rr i8O8O}VAY''' ]> * *F :kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6k))$()A)A)GR$H$H!$((55=5@5M%k2'8 G$ T222 55FF : : : 8Q88 9 9 9 9 9 9 9 9 :,,G,O,OPPJ ++H.2mH.E.E!(+(1! ilDMRZD[D['\8$$x... OsN"A AAE7C8, E78C<<E7?C<A6E77 FFFu( # ── Security ────────────────────────────────────────────────────────── # Secret redaction is OFF by default — tool output (terminal stdout, # read_file results, web content) passes through unmodified. Set # redact_secrets to true to mask strings that look like API keys, tokens, # and passwords before they enter the model context and logs. # tirith pre-exec scanning is enabled by default when the tirith binary # is available. Configure via security.tirith_* keys or env vars # (TIRITH_ENABLED, TIRITH_BIN, TIRITH_TIMEOUT, TIRITH_FAIL_OPEN). # # security: # redact_secrets: true # tirith_enabled: true # tirith_path: "tirith" # tirith_timeout: 5 # tirith_fail_open: true u # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 uo # ── Security ────────────────────────────────────────────────────────── # Secret redaction is OFF by default. Set to true to mask strings that # look like API keys, tokens, and passwords in tool output and logs. # # security: # redact_secrets: true # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 c .trtddSddlm}t t }t t|}|}t tt}|r6t||t t|}g}| di}|r| d| t| di}d} t|t rt#d |D} nLt|t$r7t'| d o| d } | s| t(||||rd |nd t-|t/j|tt|<dS)z,Save configuration to ~/.hermes/config.yaml.zsave configurationNratomic_yaml_writerrr:Fc3K|]C}t|to)|do|dVDdS)rsrN)rrr)rrs rrzsave_config..sMcc[\*Q--V!%% 2C2CVgccccccrrsrr) extra_content)rrutilsr?rrr'r*rrr rrr_SECURITY_COMMENTrrr$rbool_FALLBACK_COMMENTrrrr) rr?r3current_normalizedr raw_existingrsecrO fb_is_valids rrrs ||*+++''''''!##K34OPV4W4WXX#J-.I/J[J[.\.\]]L 0   ) - -c+.>.> ? ?   E ..R ( (C (#''*++3 &''' (" - -BK"dCcc`bccccc B  C266*--A"&&//BB ( &'''(-7bggennn4 6:mDV6W6W!#k"2"2333rc t}i}|rtrdddni}t|fi|5}|}dddn #1swxYwYt |}|D]}|}|rn|dsYd|vrU|d\}}} | d||<|S)aLoad environment variables from ~/.hermes/.env. Sanitizes lines before parsing so that corrupted files (e.g. concatenated KEY=VALUE pairs on a single line) are handled gracefully instead of producing mangled values such as duplicated bot tokens. See #8908. rrrerrorsNrrz"') rr _IS_WINDOWSr readlines_sanitize_env_linesrrr) env_pathenv_varsopen_kwr raw_linesrWrrrrs rload_envrTsM~~HH CALSw)<<..sZBa:B!G:RQF(:r)r$)rrrZ match_rangess @@rrz&_sanitize_env_lines..sj" " " !Q*" " " " rr*) r rr _EXTRA_ENV_KEYSr'rrrfindrrrH)rW known_keys sanitizedrrstrippedkey_nameneedlersplit_positionsrNposendrr[s @rrOrOs&++--..@JI&.&.kk&!!99;; 8..s33    S4Z ( ( ( /1 " ? ?H^F--''C((##S#F *;$<===mmFC#f++,=>>((!" " " " &" " "      ! # ##O44 2 2301AO8L8L0L0Loa!e,,RUV^R_R_C(..002$$TD[111  2   X_ - - - - rc,t}|sdStrdddni}trddini}t|fi|5}|}dddn #1swxYwYt |}||krdSt t|t|z }|dkrVtdt||D}|t t|t|z z }tj t|j dd \}} tj|d fi|5}|||tj|dddn #1swxYwYt)||n5#t*$r( tj|n#t.$rYnwxYwwxYwt1||S) zRead, sanitize, and rewrite ~/.hermes/.env in place. Returns the number of lines that were fixed (concatenation splits + placeholder removals). Returns 0 when no changes are needed. rrrrKrNc3,K|]\}}||k dVdS)r*Nr)rabs rrz$sanitize_env_file../s*KK$!QAFFAFFFFKKr.tmp.env_dirsuffixrw)rrrMrrNrOabsrsumziptempfilemkstemprrrfdopen writelinesflushfsyncfilenor BaseExceptionunlinkrr) rPread_kwwrite_kwroriginal_linesr_rfdtmp_paths rrrs ~~H ??  q.bs(::DKKK::::::rNrSz ... and morerz The non-ASCII characters have been stripped automatically. If authentication fails, re-copy the key from the provider's dashboard. r) encodeUnicodeEncodeErrorrHordrdecoderrrrr)rr bad_charsrNchr_s r_check_non_ascii_credentialrCsc  W      I5!!JJ2 r77S==   H1HHHH#b''HHHH I I I WX 66==gFFI      ))::IbqbM::: : :  ; "%Y!!3!3    =  W  WZ     s  &&ctrtd|dSt|st d||dddd}t ||}tt}trddd ni}trd dini}g}| rHt|fi|5}| }dddn #1swxYwYt|}d }t|D]>\}} | |d r|d |d||<d }n?|sH|r+|dds|dxxdz cc<||d |dt'jt+|jdd\} } d} | r= t/j|j} n#t4$rYnwxYw t7j| dfi|5}|||t7j| dddn #1swxYwYtC| || ' t7j"|| n#t4$rYnwxYwn5#tF$r( t7j$| n#t4$rYnwxYwwxYwtK||t6j&|<dS)z)Save or update a value in ~/.hermes/.env.zset N#Invalid environment variable name: rTr rrrKrFrTrrjrkrlro)'rr_ENV_VAR_NAME_REmatchrrrrrrMrrrNrOrHrrendswithrrsrtrrr0S_IMODEst_moderrrurvrwrxryrrrzr{rr) rrrPr|r}rWrfoundrNrrr original_modes rrrks&||lSll###  ! !# & &HFsFFGGG MM$ # # + +D" 5 5E 'U 3 3E~~H=HO7i888RG(3; G$$H E+ ( & &g & & "!KKMME " " " " " " " " " " " " " " "$E** EU##4 ::<< " "c999 - - )))))E!HE E  )  r++D11  "III III ''e'''(((#HO(<(.s:RRR$tzz||/F/F#yyy/Q/QRRRRrrjrkrlro)!rrrrrrrrrrrMrrNrOrrsrtrrr0rrrrurvrwrxryrrrzr{r) rrPr|r}rrW new_linesrrrrs ` rremove_env_valuersZ ||ooo&&&u  ! !# & &HFsFFGGG~~H ??   sD!!!u>#  % ' '#BJsO QJE h  3"*#4#4 3 QJE Lrc|tjvrtj|St}||S)z/Get a value from ~/.hermes/.env or environment.)rrrTr)rrQs rrrs: bjz#zzH <<  rcXddlm}||tdtjS)uRedact an API key for display. Thin wrapper over :func:`agent.redact.mask_secret` — preserves the "(not set)" placeholder in dim color for the empty case. r) mask_secret (not set))empty) agent.redactrrtrsDIM)rrs r redact_keyr-s7 )((((( ;s% VZ"@"@ A A AArc t}tttdtjttdtjttdtjtttdtjtjtdt tdttdttttdtjtjgd }|D]7\}}t|}td |d d t|8d dl m }|}td dd d t|tttdtjtjtd| ddtd| di dtddtttdtjtj| di}td| ddtd| ddrdnd td!| d"drdnd t| d#it r| d#ini}| d$d%} | d&d%} td'| d(| d)tttd*tjtj| d+i} td,| d-d.td/| d0d1td2| d3d4d5| d-d6kr(td7| d8d9n| d-d:kr(td;| dkrMtd?| d@d9tdA} tdB| rdCndDnT| d-dEkrLtdF| dGd9tdH} tdI| rdCndDn| d-dJkrwtdK| dLdMtdNtdOs-tdPr tdQrtdRrdCndDn_| d-dSkrFtdT}tdU}tdV|pdDtdW|pdDtttdXtjtj| dYdZ}|rtd[|n*td[td\tjtttd]tjtj| d^i}| d_d`}tda|rdbndc|rtdd| dedfdgzdhditdj| dkdldgzdhdmtdn| dodpdq| dri d^i}| ddZpds}td|| dtdu}|r|dukrtdv|| dri}| dwi| dxidy}t%dz|D}|rtttd{tjtj|D]\}}| dtdu}| ddZ}|duks|rId||g}|r|d}|td |d~d d|tttdtjtjtd}td}td|rdCntdtjtd|rdCntdtj d dlm} m}!| }"|"r|!|"}#tttdtjtj|"D]}$|$d}%|# |%dZ}|$ ddZ}&|rt5|ntdDtj}'td |%dd |'d td|&dtjn#t6$rYnwxYwtttdtjttdtjttdtjttdtjtdS)zDisplay current configuration.u┌─────────────────────────────────────────────────────────┐u@│ ⚕ Hermes Configuration │u└─────────────────────────────────────────────────────────┘u ◆ Pathsz Config: z Secrets: z Install: u ◆ API Keys) )r9 OpenRouter)r(zOpenAI (STT/TTS))rmExa)rpParallel)r$ Firecrawl)r.Tavily)r% Browserbase)ryz Browser Use)r'FALrRz<14rSr)get_anthropic_key Anthropicu ◆ Modelz Model: rznot setz Max turns: rr u ◆ Displayrz Personality: rrz Reasoning: rFonrz Bell: rrrrOrz User preview: first z line(s), last z line(s)u ◆ Terminalrz Backend: rrz Working dir: rrz Timeout: rrrZrz Docker image: rr  singularityz Image: r#r$modalz Modal image: r%MODAL_TOKEN_IDz Modal token: configuredrdaytonaz Daytona image: r&DAYTONA_API_KEYz API key: vercel_sandboxz Vercel runtime: r'r(z Vercel auth: VERCEL_OIDC_TOKEN VERCEL_TOKENVERCEL_PROJECT_IDVERCEL_TEAM_IDsshTERMINAL_SSH_HOSTTERMINAL_SSH_USERz SSH host: z SSH user: u ◆ Timezonerrz Timezone: rtu◆ Context CompressionrXrCTz Enabled: rxrpz Threshold: r\rYdz.0f%z Target ratio: r]rZz% of threshold preservedz Protect last: r^r[z messagesrrz(auto)rsr z Provider: ryrz)Visionz Web extractc3vK|]4}|dddkp|ddV5dS)rsr rrNr)rts rrzshow_config..s\  j&!!V+AquuWb/A/Aru ◆ Auxiliary Models (overrides)rr12sru◆ Messaging Platformsrrz Telegram: znot configuredz Discord: )rresolve_skill_config_valuesu◆ Skill Settingsrrz<20s[]u────────────────────────────────────────────────────────────z+ hermes config edit # Edit config filez! hermes config set z+ hermes setup # Run setup wizardN)rrrtrsCYANBOLDrrrrrhermes_cli.authrrrrrrr$valuesrrrrrrrr)(rr env_keyrrranthropic_valuerump ump_firstump_lastr modal_token daytona_keyssh_hostssh_usertzrXrC _aux_comp_sm comp_providerrr aux_tasks has_overrideslabeltask_cfgprovmdlrtelegram_token discord_tokenrr skill_varsresolvedrrr display_vals( r show_configr7s ]]F GGG %DFLFQ R RSSS %RTZT_ ` `aaa %DFLFQ R RSSS GGG % V[&+ 6 6777 0_.. 0 0111 -\^^ - -... 1-// 1 1222 GGG % V[ 9 9:::   D33 g&& 14111j//112222111111''))O >{ > > >O! >??? GGG % V[&+ 6 6777 =VZZ;; = =>>> mVZZ4488nU\F]^iFjkk m mnnn GGG % v{FK 8 8999jjB''G CW[[AA C CDDD VW[[1A5%I%ITTTu V VWWW XW[[1CU%K%KVTTQV X XYYY5? Lbdf@g@gim5n5n v'++,b 1 1 1tvC q))Iww|Q''H O9 O OX O O OPPP GGG % V[ 9 9:::zz*b))H ?X\\)W== ? ?@@@ 7X\\%55 7 7888 ;X\\)R88 ; ; ;<<<||I(** mn>j!k!kmmnnnn i M 1 1 {.ACx!y!y{{|||| i G + + lm=i!j!jllmmm#$455  O!M+OOPPPP i I - - o(,,@l"m"mooppp#$566  O!M+OOPPPP i $4 4 4 M8<<0@(#K#KMMNNN W=AT3U3U$UZghvZwZw$U}JK^}_}_$UdqrBdCdC$U<<JUWW X X X X i E ) ) !455 !455 :!8[::;;; :!8[::;;; GGG % V[ 9 9::: J # #B H %%%&&&& F'7!D!DFFGGG GGG %)6; D DEEE**]B//Kooi..G 9g7UU4 9 9::: 6 Pd!C!Cc!IPPPPQQQ j!F!F!Ljjjjkkk Q1A2!F!FQQQRRRJJ{B//33M2FF mmGR((4H &&&'''! j&99  6]f44 4]44 5 5 5 ;++I }}Xr22 }}]B77I!!##M <  e6 V[QQRRR(00 < >H GGG %,fk6;GG H H H! ] ]%j S"-- WWWb11 ,1Uc%jjju[&*7U7U [3[[[k[[U;Lz;L;L;Lfj5Y5Y[[\\\\       GGG % FJ ' '((( %=vz J JKKK %3VZ @ @AAA %=vz J JKKK GGGGGsC8o<< p p c(trtddSt}|s&t t t d|tjdptjd}|s"dD]}ddl }| |r|}n |s#t dt d |dSt d |d |d tj |t|gdS) z"Open config file in user's editor.zedit configurationNzCreated EDITORVISUAL)nanovimvicodenotepadrz#No editor found. Config file is at:rRzOpening  in z...)rrrrrrrrrshutilwhich subprocessrunr)r3editorcmdrs r edit_configrsE||*+++!##K     (N### &&&'''Yx 7BIh$7$7F ;  C MMM||C      3444  ;  !!! 1[ 1 1f 1 1 1222NFC ,,-.....rctrtddSgd}||vsN|ds'|drEt ||t d|dtdSt}i}| rS t|d 5}tj |pi}dddn #1swxYwYn#t$ri}YnwxYw|d vrd }nu|d vrd }n\|rt!|}n8|dddrt%|}t'|||t)ddlm}|||d iddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5}||vr#t ||t/|t d|d6|d|dS)7zSet a configuration value.zset configuration valuesN)r9rr-r(rmrpr$rqrrrsrtrur.r%r&ryr'rrrrr*rr+r,rrrr})_API_KEY_TOKEN TERMINAL_SSHu✓ Set rrr)rvrxrT)rnrprFrrr*rr>) sort_keyszterminal.backendrzterminal.modal_moder/zterminal.docker_imageTERMINAL_DOCKER_IMAGEzterminal.singularity_imageTERMINAL_SINGULARITY_IMAGEzterminal.modal_imageTERMINAL_MODAL_IMAGEzterminal.daytona_imageTERMINAL_DAYTONA_IMAGEzterminal.vercel_runtimeTERMINAL_VERCEL_RUNTIMEz&terminal.docker_mount_cwd_to_workspace&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACEz terminal.docker_run_as_host_user TERMINAL_DOCKER_RUN_AS_HOST_USERz terminal.cwdr]zterminal.timeoutTERMINAL_TIMEOUTzterminal.sandbox_dirTERMINAL_SANDBOX_DIRzterminal.persistent_shellTERMINAL_PERSISTENT_SHELLzterminal.container_cpuTERMINAL_CONTAINER_CPUzterminal.container_memoryTERMINAL_CONTAINER_MEMORYzterminal.container_diskTERMINAL_CONTAINER_DISKzterminal.container_persistentTERMINAL_CONTAINER_PERSISTENTr)rrupperrrrrrrrrrrrrisdigitrrrrrrBr?r)rrapi_keysr3r:rr?_config_to_env_syncs rset_config_valuers||0111   H yy{{h#))++"6"67M"N"NRUR[R[R]R]RhRhiwRxRxsyy{{E*** 222,..22333 "##KK kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6   KKK  {{}}--- 0 0 0 E  sB " " * * , ,e  S%(((''''''k;%@@@@N4 !8 %&B   6  !":  "#< 12Z +,N  .  6 $%@ !": $%@ "#td?td@tdAtdBtdCt jd dS)DzHandle config subcommands.config_commandNshoweditr rrz&Usage: hermes config set z Examples:z3 hermes config set model anthropic/claude-sonnet-4z+ hermes config set terminal.backend dockerz0 hermes config set OPENROUTER_API_KEY sk-or-...r*rzenv-pathmigrateu*🔄 Checking configuration for updates...Fru ✓ Configuration is up to date!z Config version: rrz1 new config option(s) will be added with defaultsc<g|]}|d|S)rrrs rrz"config_command..s)KKK!aeeM6J6JKAKKKrcfg|].}|d|d,|/S)rr8rrs rrz"config_command..sN   55'' 01j0A0A    ru ⚠️ z required API key(s) missing:u • ru ℹ️ z$ optional API key(s) not configured:r<z (enables: rrOrFrT)rgrhrjrku✓ Configuration updated!rlu ⚠️ checku📋 Configuration Statusu ✓z (update available)z Required:u ✓ u ✗ z (missing)z Optional:u ○ rRz new config option(s) availablez+ Run 'hermes config migrate' to add themzUnknown config command: zAvailable commands:z4 hermes config Show current configurationz/ hermes config edit Open config in editorz6 hermes config set Set a config valuez; hermes config check Check for missing/outdated configz8 hermes config migrate Update config with new optionsz/ hermes config path Show config file pathz- hermes config env-path Show .env file path)getattrrrrrexitrrrrtrsrrrrr8GREENrrrrYELLOWrrREDrrr)argssubcmdrrrrrrrequired_missingoptional_missingrr< tools_strrr rrs rrrYsA T+T 2 2F ~6)) 6   5dE4((gt,, em : ; ; ; GGG +    G H H H ? @ @ @ D E E E HQKKKe$$$$$ 6   o     :   lnn 9    e@&+v{[[\\\ +??? 244"6"8"8 Z > kZ6O6O %:FLII J J J GGG F  # # E{EEEE F F F  a _^,,___ ` ` `KK{KKK  "     1 U%5!6!6UUU V V V' 1 1/#f+//0000  < \%5!6!6\\\ ] ] ]' < <,,EJRA$))E"1"I*>*>AAAAPR :#f+:y::;;;; !T???  ;  E7>#: E %4flCC D D D :  D GGG":. D De222FMBBCCCC  7    e/fkJJKKK "6"8"8 Z * $ $ 8{888 9 9 9 9 %^[^^z^^^`f`mnn o o o  eM6;//000) J JHX&& J+++,,,,e;x;;;VZHHIIII  eM6;//000/5577 K KNHdX&& K+++,,,,"-->CK:DIIeBQBi$8$8::: e>>  r)r)r)Fr)NN)TF)urBrrrplatformrr0rrrs dataclassesrpathlibrtypingrrrrr rrr systemrMcompilerr rrCr rr frozensetr\rhermes_cli.colorsrsrthermes_cli.default_soulrurrrrDrrrrrrrrrrBrrrrrrrrrrrr2rrrrrrrr#r.r5r8rI_VALID_CUSTOM_PROVIDER_FIELDSrGr<rPrZrfrrr rrr'r*r.rrrCrE_COMMENTED_SECTIONSrrTrrOrrrrrrrrrrrrrrrrrrr:s+       !!!!!!33333333333333  8 $ $ho9, 2:9::02tCH~222BDDeCd38n$<==>CCCAC4U3T#s(^#;<<=BBB)11111d ++++++++333333,     HSM    ,D,,,,HSM;C;;;; 3s8;;#;;;;*$****d-,,,,, -----&d&&&&2$2222   4t2   $$4&&&0"d""""4M RMM"M!" M  M    "% !'$'$',0#SJJ MdN7NfN sN 3 N 2N* B+ND dENF DGNH bINT bUNV RWNX CYNZ E[N\ (]N` aNb DcNd %eNf!%*/$) ![NNNeMD! #'+ ( "5  EMt uM^7_M~MP "!"&'  !"&'    QMn&) oMBTCMX!YMf! $  %'!#&-  gMV  "                          QPPW MMz -5-x- &- ; - !%- E- %- U- "7- - U-  !-&  '-( ! ! )-0 %d1-2 3-4 "25-6 !!" 555  S---{ MZ [ Md ee Mv   ' /0  '      ->  3    *  ?, , w MR   [  *   SMp !$  qMBCMZ,[Md  $!   eMD !%!$#$ $"'C""EMRRSMf R gM|   " %5}MJ !   KMz b{MBCMH"$IMMMlmM|}MH 2IMR2SMj#  kMHIMLbMM^ R_MjkMrRsMx#     yMT  "  UMv $&(  wMP   QMnoMDREMf e gMMJ#!)6 #  YMMMlYXX "67EEE   --T#tCy.)[6B [W&+"$78[&U,7 '[6L"7 7[F;= G[V$& W[f.: g[vT&* w[FcA G[VN4 W[f4@ g[v[& w[F=  G[V=  W[f5A g[v0 . w[F:; G[[V6(. W[f2-. g[v<H w[F)$' G[V3< W[f*%) g[v4@ w[F8#( G[V2> W[f9+* g[v:F w[FD$7 G[T@% U[bW%> c[p`& q[@[B A[P_B   Q[[[`"T9B $$a[pYO !!q[@ V() A [P 7C Q [` U') a [p 6B q [@ o&7 A [N K9 O [^ W(, _ [n X= o [~ B'0  [L _= M [\ XZ ] [l _ m [| I)& } [J e* K [^ J  . _ [[[n N$% . o [~ F%' .  [N O= O [^ jM _ [n o. o [~ j+  [NO+   O[^T",;;; _[nn')$o6 o[~\*)$o6 [Nn')$o6 O[^Y1$o6 _[lr&:$o6 m[|9 "# }[L7"@MMM M[\I!+"$56 ][lX:5'6 m[[[|M&' }[JP#, K[X\ 3 Y[rN"6 s[BM"0 C[RV$3 S[bV!F c[vG"'"# w[FV@G[T!@'+ ##U[b!@'+ ##c[pRL !!q[D;&' E[Rl?) S[`z1 a[l@%< m[zP> {[[[Ha6 I[V\/+W[hG/+i[zL)/ {[HF( I[VSA !!W[d!z0 ##e[r(c? **s[@P)6 A[NL' O[\B1 ][je= k[xs: y[H!\< ##I[XY= Y[hW; i[xg= y[[[H]' I[Xh*) Y[fc/ g[t c@ ""u[B"F/$$C[LG! M[XC$ Y[dK$e[nV*o[xM&y[BU#C[L=(  M[VT#W[`C a[n; o[|B  }[J:' K[[[ZB% [[jf0   k[zL2 {[JHE K[ZA# [[jg# k[zu) {[JyQ K[Z[. [[jk0 k[xJ  y[Ft" G[\S! ][jW" k[~VB [L  VB ""M [Z #_. %%[ [[h %h+ ''i [[B!d38n9M,0C0000f4S#X#78,tDcN';,,,,dxxx xxd38n xxxxv s tDcN?S    (,// T#s(^ $/ $sCx.////j8<'+ >> >>tDcN34> T#s(^ $ > c] >>>>B eCHo    "!!! WVV  MMhtCH~&>M$}J]MMMM`00(4S>":0d0000,*4*4$sCx.)A*4T*4*4*4*4Z@ @ @ D@ T#s(^@ @ @ @ Fddt((   ====@tCH~$sCx.< S#X 4S>     GK+++$sCx.)+#++s++++^!c3h!!!!H1T#s(^1111h$0>(XS#X(X(X(X(XV$sCx.:9t99999x*3****Z%S%%%%%%PCCCCCCCL5#5$5555p$$c$$$$$$$$""#""""s34S>C,sx}BCBCBBBBf f f R///@R7#R7cR7R7R7R7rFFFFFr