iXUdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z e e j j ZddlmZddlmZmZmZddlmZmZmZmZmZmZddlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%dd l&m'Z'm(Z(e d Gd d Z)e d GddZ*de+fdZ,de-de-dzfdZ.de-de/fdZ0de-de/fdZ1de-de2de/fdZ3de4e-de-dzde+e-ddfdZ5dde+e-de/de4e-fdZ6dde+dzde/de4fdZ7 dde+dzde4e*fd Z8d!e9de4e9fd"Z:d!e9d#e-de/fd$Z;dd%e/dee9e9ffd*Z?ddd+d,d%e/d-e-dzd.e2de/fd/Z@dd%e/d-e-dzde/fd0ZAde/fd1ZBdd%e/de)fd2ZCd3d4deZMdd%e/de/fd?ZNde/fd@ZOde/fdAZPde/fdBZQde/fdCZRdDZSdEZTde9fdFZUddGe9dzde9fdHZVde9fdIZWdd%e/de fdJZXGdKdLeYZZde fdMZ[de fdNZ\de/fdOZ]ddPZ^dd.e2de/fdRZ_d dSdTe/ddfdUZ`dVe9dWe9dXe9ddfdYZadd%e/de4e9fdZZbdd%e/de4e9fd[Zcdd\d]e4e9d%e/dejdfd^Zedd%e/de9fd_Zfde4e9fd`Zgde/fdaZhdbZiedd?dgdd@dAddBgdCdBdDddEddFdGd dHddId;dd dJddKd>dd?dgddLdMddNgdOdNdPddQddRdSd dTddUdVddWddXdYd dZdd[d\d d]dd^d_dd`ddad;dd dbdgddcddddeddfdgddhgdidhdjddkddldmd dnddodpdd dqddrdsddtdgddudvdwdxgdydxdzdd{dd|d}d d~ddddd dddddddgdddddgddd/ddddd2d ddgdgZde4e>fdZde>de9fdZde4e9fdZde>fdZdZdZdZdZdZdZde/fdZde/fdZdZdZdZdZde9fdZde>ddfdZdZdZdZdS(zu Gateway subcommand for hermes CLI. Handles: hermes gateway [run|start|stop|restart|status|install|uninstall|setup] N) dataclass)Path) terminate_pid)%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUT!GATEWAY_SERVICE_RESTART_EXIT_CODEparse_restart_drain_timeout) get_env_valueget_hermes_home is_managed managed_errorread_raw_configsave_env_value) print_header print_info print_success print_warning print_errorprompt prompt_choice prompt_yes_no)ColorscolorT)frozenceZdZUeed<dZeed<dZeed<dZe e dfed<dZ edzed <e d efd Z e d efd ZdS) GatewayRuntimeSnapshotmanagerFservice_installedservice_running. gateway_pidsN service_scopereturnc8|jpt|jSN)rboolr selfs 7/home/ubuntu/.hermes/hermes-agent/hermes_cli/gateway.pyrunningzGatewayRuntimeSnapshot.running7s#>tD,='>'>>c.|jo|jo|j Sr$)rr)rr&s r(has_process_service_mismatchz3GatewayRuntimeSnapshot.has_process_service_mismatch;s%S$,St?S;SSr*)__name__ __module__ __qualname__str__annotations__rr%rr tupleintr!propertyr)r,rr*r(rr/s LLL#t###!OT!!!$&L%S/&&& $M3:$$$ ????X?TdTTTXTTTr*rc.eZdZUeed<eed<eed<dS)ProfileGatewayProcessprofilepathpidN)r-r.r/r0r1rr3rr*r(r6r6@s+ LLL JJJ HHHHHr*r6r"c t}tr,ddgdgfD]#} tj|gdzddd}|jD]}|}|r|dds4|d} tj|d |d d gzddd}t|j}|dkr| |#ttj f$rYwxYw#ttj f$rY!wxYwtr t}tjd d |gddd}|jdkr|jD]w}|}t#|dkrN|d|krB t|d}|dkr| |g#t$rYswxYwxn#ttj f$rYnwxYw|S)aoReturn PIDs currently managed by systemd or launchd gateway services. Used to avoid killing freshly-restarted service processes when sweeping for stale manual gateway processes after a service restart. Relies on the service manager having committed the new PID before the restart command returns (true for both systemd and launchd in practice). systemctl--user)z list-unitszhermes-gateway*z--plainz --no-legend --no-pagerTcapture_outputtexttimeoutr.serviceshowz--property=MainPID--value launchctllist)setsupports_systemd_services subprocessrunstdoutstrip splitlinessplitendswithr3add ValueErrorTimeoutExpiredFileNotFoundErroris_macosget_launchd_label returncodelen) pids scope_argsresultlinepartssvcrDr9labels r(_get_service_pidsrbFsD!""'2[MB  J #"J"J"JJ#'dA #M//11<<>>D JJLLE !a(9(9*(E(E! (C )~&&#*> *KK+/dA    "$+"3"3"5"56677 HHSMMM& (AB &z'@A    zz %''E^fe,#$F A%%"M//11<<>>!!D JJLLE5zzQ58u+<+<!"%eAh--C"Qww $ )!!! D!!:#<=    D  KsnBD-.A DD-D(%D-'D((D--EEBH1.0HH1 H,)H1+H,,H11I  I r9c |dkrdS tjddddt|gddd }n#ttjf$rYdSwxYw|jd krdS|j}|sdS t| d }n#t$rYdSwxYw|d kr|ndS) z@Return the parent PID for ``pid``, or ``None`` when unavailable.Nps-ozppid=z-pTr>r?r) rLrMr0rVrUrYrNrOr3rPrT)r9r]raw parent_pids r(_get_parent_pidrjs  axxt 4$C 1     z8 9tt At -    C t))"-335566 tt#a::T1s!*5AA=9B77 CC target_pidc|dkrdStj}t}|r8||vr4||krdS||t |pd}|r||v4dS)zHReturn True when ``target_pid`` is this process or one of its ancestors.rFT)osgetpidrJrSrj)rkr9seens r(#_is_pid_ancestor_of_current_processrps~Qu )++CUUD (#T// *  4  c""'a (#T// 5r*cttdsdSt|sdS tj|tjn#t ttf$rYdSwxYwdS)z@Ask a running gateway ancestor to restart itself asynchronously.SIGUSR1FT) hasattrsignalrprmkillrrProcessLookupErrorPermissionErrorOSError)r9s r(_request_gateway_self_restartrysx 69 % %u .s 3 3u V^$$$$  9uu 4sA A%$A% drain_timeoutcttdsdS|dkrdS tj|tjn$#t $rYdSt tf$rYdSwxYwddl}| t|dz}| |kr` tj|dn#t $rYdSt $rYnwxYw| d| |k`dS)a~Send SIGUSR1 to a gateway PID and wait for it to exit gracefully. SIGUSR1 is wired in gateway/run.py to ``request_restart(via_service=True)`` which drains in-flight agent runs (up to ``agent.restart_drain_timeout`` seconds), then exits with code 75. Both systemd (``Restart=always`` + ``RestartForceExitStatus=75``) and launchd (``KeepAlive.SuccessfulExit = false``) relaunch the process after the graceful exit. This is the drain-aware alternative to ``systemctl restart`` / ``SIGTERM``, which SIGKILL in-flight agents after a short timeout. Args: pid: Gateway process PID (systemd MainPID, launchd PID, or bare process PID). drain_timeout: Seconds to wait for the process to exit after sending SIGUSR1. Should be slightly larger than the gateway's ``agent.restart_drain_timeout`` to allow the drain loop to finish cleanly. Returns: True if the PID was signalled and exited within the timeout. False if SIGUSR1 couldn't be sent or the process didn't exit in time (caller should fall back to a harder restart path). rrFrTNg??) rsrtrmrurrrvrwrxtime monotonicmaxsleep)r9rz_timedeadlines r(_graceful_restart_via_sigusr1rsI2 69 % %u axxu V^$$$$ tt W %uu  3}c#:#::H //  h & &  GCOOOO!   44    D   C //  h & & 5s/A A"A"!A"'B== C CCr[ exclude_pidsc||dkrdS|tjks||vs||vrdS||dS)Nr)rmrnappend)r[r9rs r(_append_unique_pidrsT {cQhh bikkSL00C4KKKKr*F all_profilescf g}gd}ttt}|r|dnddtdt ffd } t rtjgdddd d d }|j d ks|j gSd|j dD]}| }| dr|tddC| drq|tdd}tfd|Dr=|s |r0 t|t!||n#t"$rYnwxYwdʐnptjgdddd }|j d krgS|j dD]-}| } | rd| vrd} d | dd} t| dkr1 t!| d } | d n#t"$rd} YnwxYw| s| } t| d krL| dr2t!| d} d| d d | t fd|Dr|s | rt|| |/n#t(tjf$rgcYSwxYw|S)a Best-effort process-table scan for gateway PIDs. This supplements the profile-scoped PID file so status views can still spot a live gateway when the PID file is stale/missing, and ``--all`` sweeps can discover gateways outside the current profile. )hermes_cli.main gatewayzhermes_cli.main --profilezhermes_cli.main -phermes_cli/main.py gatewayzhermes_cli/main.py --profilezhermes_cli/main.py -pzhermes gatewaygateway/run.pyrgcommandr"cdrd|vp d|vpd|vSd|vsd|vrdSd|vr d|vrdSdS)N --profile z-p z HERMES_HOME=z -p FTr)r current_homecurrent_profile_names r(_matches_current_profilez4_scan_gateway_pids.._matches_current_profiles  3133w></-//7:<0,00G;  7 " "f&7&75 W $ $)F )F)Fg)U)U5tr*)wmicprocessgetzProcessId,CommandLinez /FORMAT:LISTTutf-8ignore )r@rAencodingerrorsrBrN z CommandLine=z ProcessId=c3 K|]}|vV dSr$r).0p current_cmds r( z%_scan_gateway_pids../s(>>1 +>>>>>>r*)rez-Aewwrfz pid=,command=r?greprdrI c3 K|]}|vV dSr$r)rpatternrs r(rz%_scan_gateway_pids..Xs(BBgw')BBBBBBr*)r0r resolve _profile_argrQr% is_windowsrLrMrYrNrO startswithrZanyrr3rTisdigitjoinrxrU)rrr[patternscurrent_profile_argrr]r^pid_strstrippedr9r_ aux_partsrrrrs @@@@r(_scan_gateway_pidsrsD   H((002233L&|44>QY.4466r::WY # $       A <<> @^SSS#  F A%%)> K ++D11 % %zz||??>22 %"&s>':':';';">>>X>>>>>!$!(@(@(M(M!!.tS\\<PPPP)!!! D!"$K % ^:::# F  A%%  ++D11 @ @::<<6X#5#5 tQ//u::??#!%(mm"'(%###"#; ( 0 0I9~~**y|/C/C/E/E*!)A,//"%((9RSS>":":;BBBBBBBBB@ @$<$L:B3L.F  L FLF.L A%L/I  L ILIB6LL.-L.c8t|p t}g}|s1 ddlm}t|||n#t$rYnwxYwt D]}t|||t ||D]}t||||S)aFind PIDs of running gateway processes. Args: exclude_pids: PIDs to exclude from the result (e.g. service-managed PIDs that should not be killed during a stale-process sweep). all_profiles: When ``True``, return gateway PIDs across **all** profiles (the pre-7923 global behaviour). ``hermes update`` needs this because a code update affects every profile. When ``False`` (default), only PIDs belonging to the current Hermes profile are returned. rget_running_pidr)rJgateway.statusrr Exceptionrbr)rr_excluder[rr9s r(find_gateway_pidsrbs<(355))HD   6 6 6 6 6 6 t__%6%6 A A A A    D  ""004h////!(FFF004h//// KsA AAct|p t}g} ddlm}ddlm}n#t $r|cYSwxYwt}|D]~} ||jdz d}n#t $rY%wxYw||dks||vs||vr:|||t|j |j||S) zDReturn running gateway PIDs mapped to Hermes profiles via PID files.rr) list_profilesz gateway.pidF) cleanup_staleN)r7r8r9) rJrrhermes_cli.profilesrrr8rSrr6name)rr processesrrror7r9s r(find_profile_gateway_processesr~s7<(355))H-/I2222225555555 UUD =??bb !/',">eTTTCC    H  ;#((cXoo   .w|',\_```aaaa s . ==A11 A>=A>r7ctddg}|dkr|d|g|gd|S)Nz-mzhermes_cli.maindefaultz --profile)gatewayrMz --replace)get_python_pathextend)r7argss r(_gateway_run_args_for_profilersU   t%6 7D) ['*+++KK///000 Kr*old_pidc4|dkrdStjd} tjt jd|t|gt|tj tj dn#t$rYdSwxYwdS)zDRelaunch a manually-run profile gateway after its current PID exits.rFaV import os import subprocess import sys import time pid = int(sys.argv[1]) cmd = sys.argv[2:] deadline = time.monotonic() + 120 while time.monotonic() < deadline: try: os.kill(pid, 0) except ProcessLookupError: break except PermissionError: pass time.sleep(0.2) subprocess.Popen( cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True, ) z-cT)rNstderrstart_new_session) textwrapdedentrOrLPopensys executabler0rDEVNULLrx)r7rwatchers r('launch_detached_profile_gateway_restartrs!||uo 2 egg3 6 ^T7CLL b;XY`;a;a b%%"      uu 4sAB BBsystemc6t|}t|}|s|dfS tdt g|ddd}n #t t jf$r|dfcYSwxYw||j dkfS)NrF is-activeTrrr@rArBactive) _select_systemd_scopeget_systemd_unit_pathexists_run_systemctlget_service_name RuntimeErrorrLrUrNrO)rselected_system unit_existsr]s r(_probe_systemd_service_runningrs+F33O'???FFHHK &%% & *,, -"     *3 4&&&%%%%& FM//11X= ==s"AA98A9 ActiveStateSubStateResultExecMainStatus properties.c t|} tdtddd|g|ddd}n$#tt jtf$ricYSwxYw|jdkriSi}|j D]7}d |vr| d d \}}| ||<8|S) zCReturn selected ``systemctl show`` properties for the gateway unit.rDr=z --property,Trrr=rd) rrrrrrLrUrxrYrNrPrQrO)rrrr]parsedr^keyvalues r(_read_systemd_unit_propertiesrs,F33O ""$$  #     *3W = A F ((**$$ d?? ZZQ'' Ukkmms Ms8A A+*A+gN@)r previous_pidrBrrBc ddl}t}t|}||z}||krt |}|dd}|dd} d} ddlm} | } n#t$rd} YnwxYw|dkr9| r || |krtd |d | d d S|td |d d S|dkr| dkr| d| d||ktd|dt|d|rdndd|sdndd|d dS)zFWait for the gateway service to become active after a restart handoff.rNrrrrrr✓ z service restarted (PID )T service restarted activating auto-restartrdrI⚠ z& service did not become active within zs. Check status: sudo z1hermes gateway status Check logs: journalctl --user z-u z -l --since '2 min ago'F) r}r_service_scope_label capitalizerrrrrprintrr3) rrrBr}r` scope_labelrprops active_state sub_statenew_pidrs r(!_wait_for_systemd_service_restartrsKKK   C&v..99;;Kyy{{W$H ))++ -V<<<yy33 IIj"--   6 6 6 6 6 6%o''GG   GGG  8 # # L0G|4K4KL[LL'LLLMMMt#<[<<<===t < ' 'I,G,G JJqMMM  1 1 ))++ 4  g{ g g#g,, g g&,477" g g7=&Eii2 g gJM g g g 5s"B33 CCct|}|sdS ddlm}n#t$rYdSwxYw|pi}|dsdS|dd}|dd}|d d}|d d}|d kr&|d kr t d t ||S|dkr|ttks|dkrt} t| } t d| dtd| g|ddtd| g|ddt ||SdS)zARecover a planned service restart that is stuck in systemd state.rFrread_runtime_statusrestart_requestedrrrrrrruG⏳ Service restart already pending — waiting for systemd relaunch...rrfailedz exit-codeu&↻ Clearing failed state for pending z service restart... reset-failedrcheckrBstartZ)rrrrrrrr0rrrrlowerr) rrrr runtime_staterrexec_main_statusr]r`rs r( _recover_pending_systemd_restartr4s ) 8 8 8E u6666666 uu('))/RM   0 1 1u99]B//L *b))Iyy!1266 YYx $ $F|## ^(C(C WXXX0%    xC ABBBB [   *622==??  _{7H7H7J7J___``` S !      cN     1%    5s  ++ctsdS tjddt gddd}n#tj$rYdSwxYw|jdkS)NFrFrGTrr?r)get_launchd_plist_pathrrLrMrXrUrY)r]s r(_probe_launchd_service_runningrjs ! # # * * , ,u &"3"5"5 6      $uu   !!s'A AAc^tt}trtd|Sddlm}t r|rtd|StrZt|\}}t|}td|dt| ||| Str>td t t|d Std |S) zBReturn a unified view of gateway liveness for the current profile.zTermux / manual process)rr r) is_containerzdocker (foreground)rz systemd (r)rrrr r!launchdzmanual process)r2r is_termuxrhermes_constantsris_linuxrKrrrrrWrr)rr rrrrs r(get_gateway_runtime_snapshotryso*,,--L{{ %-%    .-----zz llnn %)%    !""  +IQW+X+X+X(*?;; %. ...3?KKKRRTT+%%     zz %466==??:<<%#      " !   r*rHlimitr c|d|d|Dn d|D}|(t||kr|dd|S)Nc8g|]}|dkt|Srr0rr9s r( z(_format_gateway_pids..s#<<.s/W|W|W|ehtwz{t{t{X[\_X`X`t{t{t{r*z..., )rZrr)r[r rendereds r(_format_gateway_pidsr*sr@E@Q< > > r)r)degradedstarting initializingF)rrNrOrrrLrUrx)rr]statuss r(rDrDs  !    $$&&,,..LLL *3W =uusAAA&%A&cNtdrdStdrdSdS)zDReturn True when a container exposes working user or system systemd.FrTrCrr*r(_container_systemd_operationalrLs75)))t4(((t 5r*ctrtrdStjddSt rt St rtSdS)NFr;T)rrshutilwhichrArErrLrr*r(rKrK"sh ::u |K  (u xx*')))~~0-/// 4r*c"tjdkS)Ndarwinrr@rr*r(rWrW.s <8 ##r*c"tjdkS)Nwin32rRrr*r(rr1s <7 ""r*zhermes-gatewayz5Hermes Agent Gateway - Messaging Platform Integrationc:ddl}ddl}ddlm}t }|}||krdS|dz } ||}|j}t|dkr$| d|dr|dSn#t$rYnwxYw| t| ddS) aDerive a service-name suffix from the current HERMES_HOME. Returns ``""`` for the default root, the profile name for ``/profiles/``, or a short hash for any other path. Works correctly in Docker (HERMES_HOME=/opt/data) and standard deployments. rNget_default_hermes_rootrprofilesrd^[a-z0-9][a-z0-9_-]{0,63}$)hashlibrerrWr r relative_tor_rZmatchrTsha256r0encode hexdigest)r[r\rWhomer profiles_rootrelr_s r(_profile_suffixre=s'NNN III888888    $ $ & &D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?8O       >>#d))**,, - - 7 7 9 9"1" ==s+AB?? C  C  hermes_homecddl}ddlm}t|pt t }|}||krdS|dz } ||}|j}t|dkr'| d|dr d|dSn#t$rYnwxYwdS) aReturn ``--profile `` only when HERMES_HOME is a named profile. For ``~/.hermes/profiles/``, returns ``"--profile "``. For the default profile or hash-based custom paths, returns the empty string. Args: hermes_home: Optional explicit HERMES_HOME path. Defaults to the current ``get_hermes_home()`` value. Should be passed when generating a service definition for a different user (e.g. system service). rNrVrrXrdrYr) r\rrWrr0r rr]r_rZr^rT)rfr\rWrbrrcrdr_s r(rrXsIII888888  5s?#4#455 6 6 > > @ @D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?*a** *      2sAC C'&C'cHt}|stStd|S)aDerive a systemd service name scoped to this HERMES_HOME. Default ``~/.hermes`` returns ``hermes-gateway`` (backward compatible). Profile ``~/.hermes/profiles/coder`` returns ``hermes-gateway-coder``. Any other HERMES_HOME appends a short hash for uniqueness. -)re _SERVICE_BASEsuffixs r(rrts1  F  & &f & &&r*ct}|rtd|dz Stjdz dz dz |dz S)N/etc/systemd/systemrC.configsystemduser)rrrb)rrs r(rrs[   D ?)**->->->>> 9;; "Y . 7T:K:K:K KKr*ceZdZdZdS)UserSystemdUnavailableErrora#Raised when ``systemctl --user`` cannot reach the user D-Bus session. Typically hit on fresh RHEL/Debian SSH sessions where linger is disabled and no user@.service is running, so ``/run/user/$UID/bus`` never exists. Carries a user-facing remediation message in ``args[0]``. N)r-r.r/__doc__rr*r(rsrssr*rsctjdpdtj}t |dz S)zIReturn the expected per-user D-Bus socket path (regardless of existence).XDG_RUNTIME_DIR /run/user/busrmenvironrgetuidrxdgs r(_user_dbus_socket_pathr~s; *..* + + I/IBIKK/I/IC 99u r*ctjdpdtj}t |dz dz S)zJReturn the per-user systemd private socket path (regardless of existence).rvrwrpprivateryr|s r(!_user_systemd_private_socket_pathrs@ *..* + + I/IBIKK/I/IC 99y 9 ,,r*ctptS)a6Return True when user-scope systemd has a reachable control socket. Some distros expose only the per-user systemd private socket even when the D-Bus session bus socket is absent. ``systemctl --user`` can still work in that configuration, so preflight checks must treat either socket as valid. )r~rrrr*r(_user_systemd_socket_readyrs4 " # # * * , , \0Q0S0S0Z0Z0\0\\r*ctj}dtjvr5d|}t|r|tjd<dtjvr]tjdd|}t|dz }|rd|tjd<dSdSdS)aEnsure DBUS_SESSION_BUS_ADDRESS and XDG_RUNTIME_DIR are set for systemctl --user. On headless servers (SSH sessions), these env vars may be missing even when the user's systemd instance is running (via linger). Without them, ``systemctl --user`` fails with "Failed to connect to bus: No medium found". We detect the standard socket path and set the vars so all subsequent subprocess calls inherit them. rvrwDBUS_SESSION_BUS_ADDRESSrxz unix:path=N)rmr{rzrrr)uid runtime_dir xdg_runtimebus_paths r(_ensure_user_systemd_envrs )++C **(3((    # # % % 8,7BJ( )!33jnn%68JS8J8JKK  $$u, ??   M5L(5L5LBJ1 2 2 2 43 M Mr*@cddl}||z}||krKtrtdS|d||kKtS)a3Poll for the user systemd runtime socket(s), up to ``timeout`` seconds. Linger-enabled user@.service can take a second or two to spawn its control socket(s) after ``loginctl enable-linger`` runs. Returns True once either the user D-Bus socket or the per-user systemd private socket exists. rNTg?)r}r~rrr)rBr}rs r(_wait_for_user_dbus_socketrsKKK~~')H ..  X % % % ' '  $ & & &4 3 ..  X % % & ' ''r*)auto_enable_lingerrc2ttrdSddl}|}t \}}|dur9t drdSt |ddtjd |rtj d r tj d d |gddd d }|j dkrFt drtd|ddSt |ddt |jp|jp d|j }t |d|d| n0#t&$r#}t |d|dd| Yd}~nd}~wwxYwt |d|pddd| dS)a9Ensure ``systemctl --user`` will reach the user-scope systemd instance. No-op when the user D-Bus socket or per-user systemd private socket is already there (the common case on desktops and linger-enabled servers). On fresh SSH sessions where both are missing: * If linger is already enabled, wait briefly for user@.service to spawn the socket. * If linger is disabled and ``auto_enable_linger`` is True, try ``loginctl enable-linger $USER`` (works as non-root when polkit permits it, otherwise needs sudo). * If the socket is still missing afterwards, raise :class:`UserSystemdUnavailableError` with a precise remediation message. Callers should treat the exception as a terminal condition for user-scope systemd operations and surface the message to the user. NrTrrBzGUser systemd control sockets are missing even though linger is enabled.z systemctl start user@zC.service (may require sudo; try again after the command succeeds))reasonfix_hintloginctl enable-lingerFr r@rArrB@u✓ Enabled linger for u — user D-Bus now availablez=Linger was enabled, but the user D-Bus socket did not appear.z` Log out and log back in, then re-run the command. Or reboot and run: systemctl --user start exit z#loginctl enable-linger was denied: z sudo loginctl enable-linger zloginctl enable-linger failed ().z%User D-Bus session is not available (zlinger disabled)rrgetpassgetuserget_systemd_linger_statusr_raise_user_systemd_unavailablermr{rNrOrLrMrYrrrrNrOr)rrusernamelinger_enabled linger_detailr]detailr4s r(_preflight_user_systemdrs$!##NNN  H$=$?$?!NM %c 2 2 2  F' \M")++MMM     "fl:66"! ^_h7# F A%%-c:::[H[[[\\\F/Z\GWGYGY\\ mSv}S8S@Q8S8SZZ\\F +EVEED(DD     +    +@@@@D(DD          6$ 72!2 7 7 7=(<< sE E9E44E9rrrc0|d|d}t|)zHBuild a user-facing error message and raise UserSystemdUnavailableError.zR systemctl --user cannot reach the user D-Bus session in this shell. To fix: z{ Alternative: run the gateway in the foreground (stays up until you exit / close the terminal): hermes gateway run)rs)rrrmsgs r(rr&s:  ! !   ! ! ! &c * **r*c4|st|rdgnddgS)Nr;r<)rrs r(_systemctl_cmdr6s, # """" ?K==h(??r*c|rdgnddgS)N journalctlr<rrs r(_journalctl_cmdr<s# AL>>,)AAr*rrc tjt||zfi|S#t$rt ddwxYw)a%Run a systemctl command, raising RuntimeError if systemctl is missing. Defense-in-depth: callers are gated by ``supports_systemd_services()``, but this ensures any future caller that bypasses the gate still gets a clear error instead of a raw ``FileNotFoundError`` traceback. z)systemctl is not available on this systemN)rLrMrrVr)rrkwargss r(rr@s_~nV44t;FFvFFF  7   s!$?c|rdndS)Nrrqrrs r(rrOs )886)r*cg}t}dD]X\}}t|}||vr|r*||||Y|S)N))Frq)Trr)rJrrrrS)scopes seen_pathsrra unit_paths r(get_installed_systemd_scopesrSs FEEJ<&& )888  " "       & MM% NN9 % % % Mr*c@ttdkS)Nrd)rZrrr*r(has_conflicting_systemd_unitsr`s +-- . . 22r*)zhermes.service_LEGACY_SERVICE_NAMES)rrrz hermes gateway z/hermes gateway _LEGACY_UNIT_EXECSTART_MARKERSc`dtjdz dz dz fdtdfgS)uReturn ``[(is_system, base_dir), ...]`` — directories to scan for legacy units. Factored out so tests can monkeypatch the search roots without touching real filesystem paths. FrorprqTrn)rrbrr*r(_legacy_unit_search_pathsrus<  i')3f<= t)**+ r*cNg}tD]\}}tD]}||z } |s|ddn#tt f$rYHwxYwt fdtDsm||||f|S)uReturn ``[(unit_name, unit_path, is_system)]`` for legacy Hermes gateway units. Detects unit files installed by older Hermes versions that used a different service name (e.g. ``hermes.service`` before the rename to ``hermes-gateway.service``). When both a legacy unit and the current ``hermes-gateway.service`` are active, they fight over the same bot token — the PR #5646 signal-recovery change turns this into a 30-second SIGTERM flap loop. Safety guards: * Explicit allowlist of legacy names (no globbing). Profile units such as ``hermes-gateway-coder.service`` and unrelated third-party ``hermes-*`` services are never matched. * ExecStart content check — only flag units that invoke our gateway entrypoint. A user-created ``hermes.service`` running an unrelated binary is left untouched. * Results are returned purely for caller inspection; this function never mutates or removes anything. rr)rrc3 K|]}|vV dSr$r)rmarkerrAs r(rz,_find_legacy_hermes_units..s'SS&v~SSSSSSr*) rrr read_textrxrwrrr)results is_systembaserrrAs @r(_find_legacy_hermes_unitsrs*-/G466 9 9 4) 9 9Dt I  '')) **GH*MM_-    SSSS4RSSSSS  NND)Y7 8 8 8 8 9 NsAAA'&A'c8ttS)z.s'BBB\Q66B1a&BBBr*c"g|] \}}}|||f Srrrs r(r&z.remove_legacy_hermes_units..s'@@@|q!V@QF@@@r*z$Legacy Hermes gateway unit(s) found:rrq rru(dry-run — nothing removed)cg|]\}}}| Srrrr<rs r(r&z.remove_legacy_hermes_units..+++Aq1+++r*zRemove these legacy units?Tz6Skipped. Run again with: hermes gateway migrate-legacycg|]\}}}| Srrrs r(r&z.remove_legacy_hermes_units..rr*stopFrr disabler ) missing_oku ✓ Removed rdu ⚠ Could not remove r2N daemon-reloadz1System-scope legacy units require root to remove.z1 Re-run with: sudo hermes gateway migrate-legacyu5 legacy unit(s) still present — see messages above.zRemoved z legacy unit(s).)rrrrunlinkrxrrrmgeteuidrrrZr) rrr user_units system_unitsrr8rrremoved remaininger<s r(remove_legacy_hermes_unitsrss(' ( (F  5666"u BBVBBBJ@@v@@@L GGG 0111!',,dI%16 *4**E***++++ GGG, -...++F+++++,=)EtLL, FGGG++F+++++GI! # # d # FD>%ub Q Q Q Q It,U%QS T T T T KK4K ( ( ( )4)) * * * qLGG& # # # 7D77A77 8 8 8   T " " " " " " " " #  O,U%QS T T T T T    D  :<<1   GGG M N N N J K K K' ' '4  &&&& '+ + + d+"FD>$eUWXXXX"It#4TXZ[[[[KK4K0001411222qLGG.+++?D??A??@@@$$T********+ 0UTVWWWWW     GGG<Y^^^____::::;;; I sV&AD>>F*E>>F F F+*F+AI22J7*J22J7;K KKc2t}t|dkrdSd|}td|dt dt dt dt dt d dS) NrIz + z5Both user and system gateway services are installed (rzF This is confusing and can make start/stop/status behavior ambiguous.zL Default gateway commands target the user service unless you pass --system.z Keep one of these:z hermes gateway uninstallz* sudo hermes gateway uninstall --system)rrZrrr)rrendered_scopess r($print_systemd_scope_conflict_warningr!s ) + +F 6{{Qjj((O]/]]]^^^WXXX]^^^%&&&-...;<<<<C C6C11C6rc|sdS|dD]K}|dr4|ddd}|pdcSLdS)NrrzUser=rrd)rrrPrrQrO)rr^rs r(_read_systemd_user_from_unitrLs     t##W#55@@BB!! ??7 # # !JJsA&&q)//11E=D  ! 4r*c tjdtjdtjdfD]F}|rB|r.|dkr|cSGdS)Nrrrr)rmrrO) candidates r(_default_system_service_userrWsi ,,bi.?.?9AUAUV%%  %** %y/@/@F/J/J??$$ $ $ $ 4r*cBtdgdd}dddd|S)Nz6 Choose how the gateway should run in the background:)zPUser service (no sudo; best for laptops/dev boxes; may need linger after logout)zGSystem service (starts on boot; requires sudo; still runs as your user)zSkip service install for nowrrrqr)rrdrI)r)choices r("prompt_linux_gateway_install_scoper^sD @   F(t , ,V 44r*ct}|dS|dkrt}tjdkrFt d|rt d|nt dt d|dfS|s; t d d }|pd }|rntd :t|d ||d fSt|d|d fS)NNFrrzY System service install requires sudo, so Hermes can't create it from this user session.zG After setup, run: sudo hermes gateway install --system --run-as-user zR After setup, run: sudo hermes gateway install --system --run-as-user z8 Then start it with: sudo hermes gateway start --systemFTz/ Run the system gateway service as which user?rrz Enter a username.r.rr)r.r) rrrmrrrrrOrsystemd_install)r.rrs r( install_linux_gateway_from_setuprks- . 0 0E }{ 244 :<<1   u v v v qreprrssssoppp Q R R R%<  3 3$%V`bccc *0b7799 1222  3 eDkJJJJd{%.... $;r*ctrdStsdStjdsdSt jdpt jd}|sB ddl}|t jj }n#t$rYd SwxYw tj dd |d d gd d dd}n(#t$r}dt|fcYd}~Sd}~wwxYw|jdkr0|jp|jp d|j}d|pdfS|jpd}|dvrdS|dvrdS|pd}dd|fS)zReturn systemd linger status for the current user. Returns: (True, "") when linger is enabled. (False, "") when linger is disabled. (None, detail) when the status could not be determined. )Nznot supported in Termux)Nznot supported on this platformr)Nloginctl not foundrrrN)Nz could not determine current userz show-userz--property=LingerrETFrrrzloginctl query failedr>1yestrue)Tr>0nofalse)Frzzunexpected loginctl output: )rrrNrOrmrrgetpwuidr{pw_namerrLrMr0rYrrNrOr)rrr]rrrr)s r(rrs{{/.. ::655 < # #*))y  8BIi$8$8H < < JJJ||BIKK008HH < < <;;; <  h0CY O     SVV|A-O6=O4OF If you want the gateway user service to survive logout, run:z# sudo loginctl enable-linger $USERN)rr)rrs r(print_systemd_linger_guidancers$=$?$?!NM GHHHHH 5  RSSS 899999 FmFFFGGG NOOO 344444r*czddl}t|tjjS)zReturn the real macOS user home for launchd artifacts. Profile-mode Hermes often sets ``HOME`` to a profile-scoped directory, but launchd user agents still live under the actual account home. rN)rrrrmr{r)rs r(_launchd_user_homers0 JJJ  RY[[))0 1 11r*cdt}|rd|nd}tdz dz |dz S)uReturn the launchd plist path, scoped per profile. Default ``~/.hermes`` → ``ai.hermes.gateway.plist`` (backward compatible). Profile ``~/.hermes/profiles/coder`` → ``ai.hermes.gateway-coder.plist``. ai.hermes.gateway-ai.hermes.gatewayLibrary LaunchAgentsz.plist)rer)rlrs r(rrsI   F,2 K ( ( ( (8KD   ) +n <$ NNr*crtjtjkr/ttj}|r|St jd}|r%t|}|r|SdD]$}t|z }|r|cS%dS)abDetect the active virtualenv directory. Checks ``sys.prefix`` first (works regardless of the directory name), then ``VIRTUAL_ENV`` env var (covers uv-managed environments where sys.prefix == sys.base_prefix), then falls back to probing common directory names under PROJECT_ROOT. Returns ``None`` when no virtualenv can be found. VIRTUAL_ENV)z.venvvenvN) rprefix base_prefixris_dirrmrzr PROJECT_ROOT)r  _virtual_envrs r(_detect_venv_dirr&s zS_$$CJ ;;== K :>>-00LL!! ;;== K' i' ;;== KKK  4r*ct}|Btr |dz dz }n|dz dz }|rt|StjS)NScriptsz python.exebinpython)r&rrr0rr)r  venv_pythons r(rrsh   D  << 2*\9KK,1K      ${## # >r*rb path_entriesct|dz dz t|dz dz t|dz dz t|dz dz g}fd|DS)zKReturn user-local bin dirs that exist and aren't already in *path_entries*.z.localr)z.cargogoz .npm-globalc^g|])}|vt|'|*Sr)rr)rrr,s r(r&z+_build_user_local_paths..s8 P P P!Ql%:%:tAww~~?O?O%:A%:%:%:r*r$)rbr, candidatess ` r(_build_user_local_pathsr1sz D8Oe #$$ D8Oe #$$ D4K%    D= 5 ()) J Q P P Pz P P PPr*r8target_home_dirctj}t|} ||}t t||z S#t $rt |cYSwxYw)aZRemap *path* from the current user's home to *target_home_dir*. If *path* lives under ``Path.home()`` the corresponding prefix is swapped to *target_home_dir*; otherwise the path is returned unchanged. /root/.hermes/hermes-agent -> /home/alice/.hermes/hermes-agent /opt/hermes -> /opt/hermes (kept as-is) Note: this function intentionally does NOT resolve symlinks. A venv's ``bin/python`` is typically a symlink to the base interpreter (e.g. a uv-managed CPython at ``~/.local/share/uv/python/.../python3.11``); resolving that symlink swaps the unit's ``ExecStart`` to a bare Python that has none of the venv's site-packages, so the service crashes on the first ``import``. Keep the symlinked path so the venv activates its own environment. Lexical expansion only via ``expanduser``. )rrb expanduserr]r0rT)r8r2rrrelatives r(_remap_path_for_userr6s"9;;L T A==..4((83444 1vv s3A**BBcnt}tjdz }t|dz }||krt |S ||}t ||z S#t $rt |cYSwxYw)uRemap the current HERMES_HOME to the equivalent under a target user's home. When installing a system service via sudo, get_hermes_home() resolves to root's home. This translates it to the target user's equivalent path: /root/.hermes → /home/alice/.hermes /root/.hermes/profiles/coder → /home/alice/.hermes/profiles/coder /opt/custom-hermes → /opt/custom-hermes (kept as-is) z.hermes)r rrrbr0r]rT)r2current_hermescurrent_defaulttarget_defaultr5s r(_hermes_home_for_target_userr;3s%&&..00Ny{{Y.7799O/**Y6N((>"""#!--o>>>H,--- ###>"""""#s1&BB43B4c^t}tt}t}|rt|nttdz }|rt|dz nttdz dz }ttdz dz }||g}t jd} | rLtt | j} | |vr| | gd} ttpd} td| d z} |r't|\}}t}t|}t!|}t!|}t!|}t!|}t!|}fd |D}|t%t ||| d |}d t(d |d|d|d|rd|ndd|dd|d|d|d|d|dt*d| dStt-}t|}|t%t j||| d |}d t(d|d|rd|ndd|d|d|d|dt*d| dS) Nr r) node_modules.binnode)z/usr/local/sbinz/usr/local/binz /usr/sbinz/usr/binz/sbinz/binr<r c0g|]}t|Sr)r6)rrhome_dirs r(r&z)generate_systemd_unit..rs$PPPa,Q99PPPr*:z[Unit] Description=zm After=network-online.target Wants=network-online.target StartLimitIntervalSec=0 [Service] Type=simple User=z Group=z ExecStart=z -m hermes_cli.mainrrz( gateway run --replace WorkingDirectory=z Environment="HOME=z" Environment="USER=z" Environment="LOGNAME=z" Environment="PATH=z" Environment="VIRTUAL_ENV=z" Environment="HERMES_HOME=z\" Restart=always RestartSec=60 RestartMaxDelaySec=300 RestartSteps=5 RestartForceExitStatus=zV KillMode=mixed KillSignal=SIGTERM ExecReload=/bin/kill -USR1 $MAINPID TimeoutStopSec=zT StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target zr After=network-online.target Wants=network-online.target StartLimitIntervalSec=0 [Service] Type=simple ExecStart=z Environment="PATH=zQ StandardOutput=journal StandardError=journal [Install] WantedBy=default.target )rr0r$r&rNrOrrparentrr3_get_restart_drain_timeoutrrr;rr6rr1rSERVICE_DESCRIPTIONrr rb)rr python_path working_dir detected_venvvenv_dirvenv_binnode_binr, resolved_noderesolved_node_dircommon_bin_paths_drain_timeoutrestart_timeoutrrrf profile_arg sane_pathrBs @r(generate_systemd_unitrTMs2!##Kl##K$&&M%2Rs=!!!L6K|]}|VdSr$)rstrip)rr^s r(rz0_normalize_service_definition..s*IItT[[]]IIIIIIr*)rrOrP)rAs r(_normalize_service_definitionrXs7 99IItzz||/F/F/H/HIII I IIr*cdddl}t|}|dd||jS)a`Normalize launchd plist text for staleness checks. The generated plist intentionally captures a broad PATH assembled from the invoking shell so user-installed tools remain reachable under launchd. That makes raw text comparison unstable across shells, so ignore the PATH payload when deciding whether the installed plist is stale. rNz,(PATH\s*)(.*?)()z\1__HERMES_PATH__\3)flags)r\rXsubS)rAr\ normalizeds r('_normalize_launchd_plist_for_comparisonr^sCIII.t44J 667d   r*ct|}|sdS|d}|rt|nd}t ||}t |t |kS)NrFrrrr)rrrrrTrX)rr installed expected_userexpecteds r(systemd_unit_is_currentrds%V444I     u##W#55I?EO0;;;4M$F NNNH ( 3 37TU]7^7^ ^^r*cLt|}|rt|rdS|rt|nd}|t ||dt dg|dd td t|d dS) zMRewrite the installed systemd unit when the generated definition has changed.rFNr`rrrTr r u↻ Updated gateway z7 service definition to match the current Hermes install) rrrdr write_textrTrrr)rrrbs r(refresh_systemd_unit_if_neededrgs%V444I     !8!G!G!Gu?EO0;;;4M .f-XXXcjkkkO$V4LLLL v!5f!=!= v v vwww 4r*rcZttd|rtd|ttdtd|ttdtdtdtdS)NuI⚠ Linger not enabled — gateway may stop when you close this terminal.z Auto-enable failed: z1 On headless servers (VPS, cloud instances) run:z sudo loginctl enable-linger  Then restart the gateway:z systemctl --user restart rC)rr)rrs r(_print_linger_enable_warningrjs GGG UVVV 1 /v//000 GGG =>>> 7X 7 7888 GGG '((( F*:*<*< F F FGGG GGGGGr*ctstsdSddl}|}t d|}|rt ddSt\}}|durt ddStj dst||pddSt d tj dd |gddd d }n5#t$r(}t|t|Yd}~dSd}~wwxYw|jdkrt d dS|jp|jp d|j}t||p|dS)z@Enable linger when possible so the user gateway survives logout.Nrz/var/lib/systemd/linger/rTrr z5Enabling linger so the gateway survives SSH logout...rFr ru8✓ Linger enabled — gateway will persist after logoutr)rrrrrrrrrNrOrjrLrMrr0rYrrNrO)rr linger_filerrr]rrs r(_ensure_linger_enabledrms{{(**NNN  H<(<<==K GHHH$=$?$?!NM GHHH < # #$X}/T@TUUU ABBB  ( 3     $Xs1vv666A HIIImKv}K0K8I0K0K R R T TF 6+B]CCCCCs C)) D3DDc|rdStdo"td S)NTrF)rrrs r(rr%sM t  - - - 4 4 6 6 k?T\a?b?b?b?i?i?k?k;kkr*c8tjdd}|sct}t |t r|dini}t|dt}t|S)z?Return the configured gateway restart drain timeout in seconds.HERMES_RESTART_DRAIN_TIMEOUTragentrestart_drain_timeout) rmrrOr isinstancedictrr0rr)rhcfg agent_cfgs r(rErE+s )2B 7 7 = = ? ?C  ,6sD,A,AICGGGR(((r  MM')N     's + ++r*c|rtdtrXtttt ddrt dtt |}|rdnd}|r|st|std t|d |t|td tg|dd tdt| ddStd|tddS|jddtdt|d||t#||dtdg|dd td tg|dd ttdt| dttdtd|rdndd|dtd|rdndd|d td|rd!nd"d#td$t|r$t%|}|rtd%|nt't)tdS)&Ninstallz,Remove the legacy unit(s) before installing?TF)rr --systemru↻ Repairing outdated z systemd service at: enabler r rz service definition updatedService already installed at: Use --force to reinstallparentsexist_okz Installing z systemd service to: r`rrrz service installed and enabled! Next steps:rrhermes gateway startz! # Start the servicezhermes gateway statusz # Check statusrzjournalctl --userz -u z -f # View logsConfigured to run as: )rrrrrrrrrdrrgrrrrDmkdirrfrTrrmr)r.rrr scope_flagconfigured_users r(rr9sg 4(333   !###  G N N  &5 9 9 9 9 GGG%V444I &.BJ % &f555  j,@,H,Hjj_hjj k k k *& 9 9 9 9 H&6&8&89&PT^` a a a a _-f55@@BB___ ` ` ` F :y::;;; ())) 4$777 V,V44 V V9 V VWWW .f+VVVahiiiO$V4LLLLH.001&VXYYYY GGG [%f--88:: [ [ [\\\ GGG - k&(wwb k kj k k klll f&(wwb f fz f f fggg hv>||+> h hDTDVDV h h hiii GGG !6yAA  > >[[[\\\\ [)&11<<>>[[[\\\ S61rSSzSSTTTAGQ29===TO: 888999)++M  &'''!  D +t++    .f===J>>-44Lz2..I!~~&6;;..2..K|## ^(C(C QRRRR  ! !&6#>_:`:`&`&` PQQQ d6"A))rddP`PbPbddsyiBhoho@BddXbdd e e e e  ! !k ! 9K99::: > RSSSS >%''''577 T ! ! K L L L L u $ $ V W W W < = = = ,  n!&))T3C3E3EtTS_,``  ! NN4 w++++++ ,,r*c0t}|rd|ndS)z5Return the launchd service label, scoped per profile.rr)rerks r(rXrX<s'   F,2 K ( ( ( (8KKr*c.dtjS)Nzgui/)rmr{rr*r(_launchd_domainrBs ")++  r*ct}tt}tt}tdz }|ddt }t|}t}|rt|dz nttdz dz }|rt|nttdz }ttdz dz } || g} tj d} | rLtt| j } | | vr| | d t| d t"jd d d Dz} d |dddg}|r0|D]}| d |d|gdd|}d|d|d|d| d|d|d|d|dS)NlogsTr}r)r r=r>r?rCcg|]}||Srrrrs r(r&z*generate_launchd_plist..`s&]&]&]Q[\&]q&]&]&]r*PATHrzz z-mz hermes_cli.main)zgatewayzrunz--replacez z Label z? ProgramArguments z? WorkingDirectory zf EnvironmentVariables PATH z9 VIRTUAL_ENV z9 HERMES_HOME z RunAtLoad KeepAlive SuccessfulExit StandardOutPath zH/gateway.log StandardErrorPath z-/gateway.error.log )rr0r$r rrrXrr&rNrOrrDrrrtfromkeysrmrzrrQr)rGrHrflog_dirrarRrIrKrJrL priority_dirsrMrNrS prog_argspart prog_args_xmls r(generate_launchd_plistrFs!##Kl##Ko''//1122K&(G MM$M...   E{++K %&&M-:bs=5()))LSYDY\aDa@b@bH%2Rs=!!!L6???<<<<<< =ttvv = = =>>>>>r*c&t}t}tjddt d|gdd|r&|td|tddS) NrFrrFrrru✓ Service uninstalled)rrXrLrMrrrrrs r(launchd_uninstallrs'))J   ENK/@/@,J,J5,J,JKSXbdeeee+ )Z))*** #$$$$$r*c t}t}|std|jdd|tdtj ddtt|gdd tj dd td |gdd td dSt tj dd td |gdd n#tj $r}|jd vrtdtj ddtt|gdd tj dd td |gdd Yd}~nd}~wwxYwtd dS)Nu:↻ launchd plist missing; regenerating service definitionTr}rrrFrr r kickstartru✓ Service startedrHqu:↻ launchd job was unloaded; reloading service definition)rrXrrrDrrfrrLrMrr0rCalledProcessErrorrY)rrars r( launchd_startrs'))J   E      JKKKt<<<466III [/2C2CS__U]akmnnnn [_5F5F2P2P2P2PQY]gijjjj #$$$#%%%k [_5F5F2P2P2P2PQY]gijjjjj  (kkk +D**F;9A8F66F;ct}td|} tjdd|gddn'#tj$r}|jdvrnYd}~nd}~wwxYwt dd td dS) NrrFrTrrr$@rrB force_afteru✓ Service stopped)rXrrLrMrrY_wait_for_gateway_exitr)ratargetrs r( launchd_stoprs   E!! + +E + +F  Y7tRPPPPP  ( <8 # #   DDDD 4S9999      s>A" AA"rrrc4ddl}ddlm}||z}|||znd}d}||kr|}|dS|`|s^||krF t |dt d|dn#t ttf$rYdSwxYwd}| d ||k|}|t d|d |d dSdS) uWait for the gateway process (by saved PID) to exit. Uses the PID from the gateway.pid file — not launchd labels — so this works correctly when multiple gateway instances run under separate HERMES_HOME directories. Args: timeout: Total seconds to wait before giving up. force_after: Seconds of graceful waiting before escalating to force-kill. rNrFTr0u⚠ Gateway PID z& did not exit gracefully; sent SIGKILLg333333?z still running after us — restart may fail) r}rrr~rrrvrwrxr) rBrr}rrforce_deadline force_sentr9 remaining_pids r(rr slKKK......~~')H9D9Pdnn&&44VZNJ ..  X % %o ;4  ": "$..:J:Jn:\:\ c....TTTTUUUU&A   tt J 3 ..  X % %"$O%%M  dddWdddeeeu 4s$B''CCc t}td|}t}ddlm} |}| t |rt ddS|[ t|dn#tttf$rd}YnwxYw|'t|d}|st d|d d tj d d d |gddt ddS#tj$r}|jdvrt dt!}tj d dtt#|gddtj d d |gddt dYd}~dSd}~wwxYw)Nrrru✓ Service restart requestedFr0ru"⚠ Gateway drain timed out after z.0fus — forcing launchd restartrFrz-kTrru✓ Service restartedru'↻ launchd job was unloaded; reloadingrr )rXrrErrryrrrvrwrxrrLrMrrYrr0)rarrzrr9exitedrrs r(launchd_restartr7 s   E!! + +E + +F.00M......'o ? ⚠ Without message.channels the bot will ONLY work in DMs!uI5. Install to Workspace: Settings → Install App → copy xoxb-... tokenz56. Reinstall the app after any scope or event changesuJ7. Find your user ID: click your profile → three dots → Copy member IDz/8. Invite the bot to channels: /invite @YourBotzBot Token (xoxb-...)z&Paste the bot token from step 3 above.SLACK_APP_TOKENzApp Token (xapp-...)z,Paste the app-level token from step 4 above.SLACK_ALLOWED_USERSz'Paste your member ID from step 7 above.matrixMatrixu🔐MATRIX_ACCESS_TOKEN)zX1. Works with any Matrix homeserver (self-hosted Synapse/Conduit/Dendrite or matrix.org)z@2. Create a bot user on your homeserver, or use your own accountuN3. Get an access token: Element → Settings → Help & About → Access TokenzI Or via API: curl -X POST https://your-server/_matrix/client/v3/login \zK -d '{"type":"m.login.password","user":"@bot:server","password":"..."}'zL4. Alternatively, provide user ID + password and Hermes will log in directlyzT5. For E2EE: set MATRIX_ENCRYPTION=true (requires pip install 'mautrix[encryption]')zN6. To find your user ID: it's @username:your-server (shown in Element profile)MATRIX_HOMESERVERz0Homeserver URL (e.g. https://matrix.example.org)z@Your Matrix homeserver URL. Works with any self-hosted instance.z8Access token (leave empty to use password login instead)zMPaste your access token, or leave empty and provide user ID + password below.MATRIX_USER_IDu5User ID (@bot:server — required for password login)z4Full Matrix user ID, e.g. @hermes:matrix.example.orgMATRIX_ALLOWED_USERSz4Allowed user IDs (comma-separated, e.g. @you:server)z.Matrix user IDs who can interact with the bot.MATRIX_HOME_ROOMzSHome room ID (for cron/notification delivery, or empty to set later with /set-home)zLRoom ID (e.g. !abc123:server) for delivering cron results and notifications. mattermost MattermostMATTERMOST_TOKEN)uC1. In Mattermost: Integrations → Bot Accounts → Add Bot AccountuE (System Console → Integrations → Bot Accounts must be enabled)z:2. Give it a username (e.g. hermes) and copy the bot tokenuK3. Works with any self-hosted Mattermost instance — enter your server URLuA4. To find your user ID: click your avatar (top-left) → Profileu8 Your user ID is displayed there — click it to copy.uI ⚠ This is NOT your username — it's a 26-character alphanumeric ID.uL5. To get a channel ID: click the channel name → View Info → copy the IDMATTERMOST_URLz(Server URL (e.g. https://mm.example.com)z@Your Mattermost server URL. Works with any self-hosted instance.z&Paste the bot token from step 2 above.MATTERMOST_ALLOWED_USERSz*Your Mattermost user ID from step 4 above.MATTERMOST_HOME_CHANNELz@Channel ID where Hermes delivers cron results and notifications.MATTERMOST_REPLY_MODEuTReply mode — 'off' for flat messages, 'thread' for threaded replies (default: off)zFoff = flat channel messages, thread = replies nest under your message.whatsappWhatsAppu📲WHATSAPP_ENABLED)rrarrrtSignalu📡SIGNAL_HTTP_URLemailEmailu📧 EMAIL_ADDRESS)z61. Use a dedicated email account for your Hermes agentz82. For Gmail: enable 2FA, then create an App Password atz, https://myaccount.google.com/apppasswordszH3. For other providers: use your email password or app-specific passwordz-4. IMAP must be enabled on your email accountz Email addressz;The email address Hermes will use (e.g., hermes@gmail.com).EMAIL_PASSWORDz Email password (or app password)z;For Gmail, use an App Password (not your regular password).EMAIL_IMAP_HOSTz IMAP hostzBe.g., imap.gmail.com for Gmail, outlook.office365.com for Outlook.EMAIL_SMTP_HOSTz SMTP hostz?e.g., smtp.gmail.com for Gmail, smtp.office365.com for Outlook.EMAIL_ALLOWED_USERSz'Allowed sender emails (comma-separated)z3Only emails from these addresses will be processed.smsz SMS (Twilio)TWILIO_ACCOUNT_SID)z51. Create a Twilio account at https://www.twilio.com/zH2. Get your Account SID and Auth Token from the Twilio Console dashboardz93. Buy or configure a phone number capable of sending SMSz+4. Set up your webhook URL for inbound SMS:uF Twilio Console → Phone Numbers → Active Numbers → your numberu` → Messaging → A MESSAGE COMES IN → Webhook → https://your-server:8080/webhooks/twiliozTwilio Account SIDz&Found on the Twilio Console dashboard.TWILIO_AUTH_TOKENzTwilio Auth Tokenz8Found on the Twilio Console dashboard (click to reveal).TWILIO_PHONE_NUMBERz5Twilio phone number (E.164 format, e.g. +15551234567)z)The Twilio phone number to send SMS from.SMS_ALLOWED_USERSz5Allowed phone numbers (comma-separated, E.164 format)z9Only messages from these phone numbers will be processed.SMS_HOME_CHANNELzDHome channel phone number (for cron/notification delivery, or empty)z>Phone number to deliver cron job results and notifications to.dingtalkDingTalkDINGTALK_CLIENT_ID)u=1. Go to https://open-dev.dingtalk.com → Create ApplicationzQ2. Under 'Credentials', copy the AppKey (Client ID) and AppSecret (Client Secret)z.3. Enable 'Stream Mode' under the bot settingsz54. Add the bot to a group chat or message it directlyzAppKey (Client ID)z6The AppKey from your DingTalk application credentials.DINGTALK_CLIENT_SECRETzAppSecret (Client Secret)z9The AppSecret from your DingTalk application credentials.feishuz Feishu / Larku🪽 FEISHU_APP_ID)zJ1. Go to https://open.feishu.cn/ (or https://open.larksuite.com/ for Lark)z32. Create an app and copy the App ID and App Secretz(3. Enable the Bot capability for the appz<4. Choose WebSocket (recommended) or Webhook connection modez55. Add the bot to a group chat or message it directlyz?6. Restrict access with FEISHU_ALLOWED_USERS for production usezApp IDz-The App ID from your Feishu/Lark application.FEISHU_APP_SECRETz App Secretz1The App Secret from your Feishu/Lark application. FEISHU_DOMAINu+Domain — feishu or lark (default: feishu)z@Use 'feishu' for Feishu China, or 'lark' for Lark international.FEISHU_CONNECTION_MODEu=Connection mode — websocket or webhook (default: websocket)zCwebsocket is recommended unless you specifically need webhook mode.FEISHU_ALLOWED_USERSz,Allowed user IDs (comma-separated, or empty)z;Restrict which Feishu/Lark users can interact with the bot.FEISHU_HOME_CHANNELz/Home chat ID (optional, for cron/notifications)z0Chat ID for scheduled results and notifications.wecomzWeCom (Enterprise WeChat) WECOM_BOT_ID)u?1. Go to WeCom Admin Console → Applications → Create AI Botz=2. Copy the Bot ID and Secret from the bot's credentials pageu?3. The bot connects via WebSocket — no public endpoint neededz>4. Add the bot to a group chat or message it directly in WeComz>5. Restrict access with WECOM_ALLOWED_USERS for production usezBot IDz"The Bot ID from your WeCom AI Bot. WECOM_SECRETSecretz"The secret from your WeCom AI Bot.WECOM_ALLOWED_USERSz5Restrict which WeCom users can interact with the bot.WECOM_HOME_CHANNELwecom_callbackzWeCom Callback (Self-Built App)WECOM_CALLBACK_CORP_ID)uG1. Go to WeCom Admin Console → Applications → Create Self-Built AppzC2. Note the Corp ID (top of admin console) and create a Corp SecretzM3. Under Receive Messages, configure the callback URL to point to your serverzD4. Copy the Token and EncodingAESKey from the callback configurationuN5. The adapter runs an HTTP server — ensure the port is reachable from WeComzG6. Restrict access with WECOM_CALLBACK_ALLOWED_USERS for production usezCorp IDzYour WeCom enterprise Corp ID.WECOM_CALLBACK_CORP_SECRETz Corp Secretz+The secret for your self-built application.WECOM_CALLBACK_AGENT_IDzAgent IDz,The Agent ID of your self-built application.WECOM_CALLBACK_TOKENzCallback Tokenz1The Token from your WeCom callback configuration.WECOM_CALLBACK_ENCODING_AES_KEYzEncoding AES Keyz:The EncodingAESKey from your WeCom callback configuration.WECOM_CALLBACK_PORTz$Callback server port (default: 8645)z"Port for the HTTP callback server.WECOM_CALLBACK_ALLOWED_USERSz5Restrict which WeCom users can interact with the app.weixinzWeixin / WeChatWEIXIN_ACCOUNT_ID bluebubbleszBlueBubbles (iMessage)BLUEBUBBLES_SERVER_URL) zF1. Install BlueBubbles on a Mac that will act as your iMessage server:z https://bluebubbles.app/uG2. Complete the BlueBubbles setup wizard — sign in with your Apple IDuD3. In BlueBubbles Settings → API, note the Server URL and passwordz84. The server URL is typically http://:1234z<5. Hermes connects via the BlueBubbles REST API and receivesz( incoming messages via a local webhookzJ6. To authorize users, use DM pairing: hermes pairing generate bluebubblesuD Share the code — the user sends it via iMessage to get approvedz6BlueBubbles server URL (e.g. http://192.168.1.10:1234)u.The URL shown in BlueBubbles Settings → API.BLUEBUBBLES_PASSWORDzBlueBubbles server passwordu3The password shown in BlueBubbles Settings → API.BLUEBUBBLES_ALLOWED_USERSz]Pre-authorized phone numbers or iMessage IDs (comma-separated, or leave empty for DM pairing)u_Optional — pre-authorize specific users. Leave empty to use DM pairing instead (recommended).BLUEBUBBLES_HOME_CHANNELzKHome channel (phone number or iMessage ID for cron/notifications, or empty)zFPhone number or Apple ID to deliver cron results and notifications to.qqbotzQQ Botu🐧 QQ_APP_ID)z,1. Register a QQ Bot application at q.qq.comz<2. Note your App ID and App Secret from the application pagez;3. Enable the required intents (C2C, Group, Guild messages)z'4. Configure sandbox or publish the botz QQ Bot App IDz!Your QQ Bot App ID from q.qq.com.QQ_CLIENT_SECRETzQQ Bot App Secretz%Your QQ Bot App Secret from q.qq.com.QQ_ALLOWED_USERSzCAllowed user OpenIDs (comma-separated, leave empty for open access)u9Optional — restrict DM access to specific user OpenIDs.QQBOT_HOME_CHANNELz.= s---Qa---r*c i|] }|d| S)rrrs r( z"_all_platforms..> s - - -aah - - -r*)platform_registryr)rrarr install_hint_registry_entry)hermes_cli.pluginsrGrloggerdebug _PLATFORMSgateway.platform_registryrK all_entriesrrrar required_envrL)rGr platformsby_keyrKentrys r(_all_platformsrX( siS777777 SSS NPQRRRRRRRRS.-*---I - -9 - - -F??????? #..00    :   :[[272DL+A.."!.$        s$ A=A#A** A98A9r@c|d}|d}|jH ddlm}|d}t ||}n#t $rd}YnwxYw|s5 t |}n#t $rd}YnwxYw|rdnd S|d d }|sd St|}|d krK|rG|d kr/tdz dz dz }| rdSdSd S|ddkrtd}|r|rdS|s|rdSd S|ddkrYtd} td} td} t|| | | grdSt|| | | grdSd S|ddkr^td} td} |s| r2| r0td}|r|dvrd nd }d|S|s| s| rdSd S|dd!krtd"}|r|rdS|s|rdSd S|rdSd S)#zReturn a plain-text status string for a platform. Returns uncolored text so it can safely be embedded in curses menu items (ANSI codes break width calculation). rMNFr)PlatformConfigT)enabled configurednot configuredrrr r r sessionz creds.jsonzconfigured + pairedzenabled, not pairedrrtSIGNAL_ACCOUNTzpartially configuredrrrrrrMATRIX_PASSWORDMATRIX_ENCRYPTION)r r r z + E2EEr6 WEIXIN_TOKEN) r is_connectedgateway.configrZr%rcheck_fnr rr rallr)r@rWr\rZ syntheticrval session_fileaccountrimapsmtp homeserverre2eerltokens r(_platform_statusrpS sk LL* + +E     ) #999999*N4888 !%"4"4Y"?"?@@  # # #"  # # #!%.."2"233  # # #"  #)?||/?? ["--I    " "C&&&  )399;;&((*,,z9IE TL""$$ -,,((||Eh&& 011  7 <  *' *))||Eg%%,--.//.// S$% & & < S$% & & *))||Eh&&"#677  !233  )8 ) ) !455D"&W4::<<;O+O+OYYUWF((( (  *( *j *))||Eh&&n--  5 <  *% *)) |  s#4A A&%A&,!B BBc ddlm}n#t$rgcYSwxYw|}|sgSg}|d}|d}|d}|d}|dipi}|D]P\}} | dd kr2| d pd } |d |d | Q|dkr|r|d|nZ|dkr4|rdnd} t |pd} |d| d| dn |dkr|r|d||S)z>>> * $ $/?ZM&Q'' SSS5SSSTTTT ) # # # ?+??@@@ Ls  c " |d}|d}|d}tttd|d|dtj|d}|r%t|D]}t d|t |}|r6tt|d td |d d sd Sd }|dD]}tt d|dt |d} | r|d|krt d| |drt dt dt dtd|dd } | r%| dd} d|dvrg} | dD]} | } | dr=| dr(| dd} |  dr | dd } | r| | d| } t)|d| td | }n}tgd!}t+d"|d#}|d$kr t)d%d&t-d'n4|d#krtd(t d)nt d*btd|d|d+d } | r0t)|d| td,|d|d|krt-d-|d.d St d/|d0}t |}|rm|sk|d1kre| dd$ }|r6td2|d3d4r"t)||td5|tt|d|d6d S)7z2Interactive setup for Telegram, Discord, or Slack.rrar ─── r Setup ───rrz is already configured. Reconfigure ?FNrrrz Current: r7 The gateway DENIES all users by default for security.z7 Enter user IDs to create an allowlist, or leave emptyz- and you'll be asked about open access next.rrrDISCORDrz<@>z<@!zuser:r>7 Saved — only these users can interact with the bot.)/Enable open access (anyone can message the bot)XUse DM pairing (unknown users request access, you approve with 'hermes pairing approve')7Skip for now (bot will deny all users until configured)+ How should unauthorized users be handled?rdrGATEWAY_ALLOW_ALL_USERSr 2 Open access enabled — anyone can use your bot!B DM pairing mode — users will receive a code to request access.8 Approve with: hermes pairing approve 9 Skipped — configure later with 'hermes gateway setup'rz Saved u Skipped — z won't work without this.z Skipped (can configure later) _HOME_CHANNELrz Use your user ID () as the home channel?T Home channel set to z configured!)rrrCYANrrr rrrrrQrOrrRlstriprWrrrrrrupper)r@rrar instructionsr^existing_tokenallowed_val_setvarexistingrcleanedr_raccess_choices access_idxhome_varhome_valfirst_ids r(_setup_standard_platformr s W E W E%I GGG %>u>>u>>> L LMMM<< 455L$   $ $D {D{{ # # # #"9--N 7778886e666>>  FO9:9: %F %%&&& V--  1F y00 /X// 0 0 0 77> " "'  P Q Q Q P Q Q Q F G G G/H //%@@@E! \--R00F ++E&}}S11..!iikk>>$//@CLL4E4E@"%**U"3"3":":3"?"?C99;;11'::*"%abb'C.!LL---!hhuooGs6{G444WXXX")""" ++XZhjkll ??"# > > GGGU00U00011111r*cTddlm}ddl}||dS)z-Delegate to the existing WhatsApp setup flow.r) cmd_whatsappN)hermes_cli.mainrargparse Namespace)rrs r(_setup_whatsappr" s?,,,,,,OOOL##%%&&&&&r*c`tdtD}t|dS)z0Configure Email via the standard platform setup.c32K|]}|ddk|VdS)rrNrrs r(rz_setup_email..+ s0GG1U8w3F3F!3F3F3F3FGGr*NnextrQr)email_platforms r( _setup_emailr) s2GGZGGGGGN^,,,,,r*c`tdtD}t|dS)z7Configure SMS (Twilio) via the standard platform setup.c32K|]}|ddk|VdS)rrNrrs r(rz_setup_sms..1 s0CCa5U1B1B1B1B1B1BCCr*Nr) sms_platforms r( _setup_smsr/ s2CC:CCCCCL\*****r*c ddlm}m}m}m}t dt D}|d}|d}tttd|d|dtj td }|r1t||d |d |d |d dsdSt|dddgd}|dkr ddl m } n6#t$r)} |d| dt|Yd} ~ dSd} ~ wwxYw| } | |dt|dS| \} } t!d | t!d| t!ddt||d|ddSt|td rt!dddSdS)uHConfigure DingTalk — QR scan (recommended) or manual credential entry.r)rrrrc32K|]}|ddk|VdS)rrNrrs r(rz"_setup_dingtalk..; s0MM1ah*6L6LQ6L6L6L6LMMr*rrarrrrz# is already configured (Client ID: rrrFNz Choose setup methodzCQR Code Scan (Recommended, auto-obtain Client ID and Client Secret)z*Manual Input (Client ID and Client Secret)r)dingtalk_qr_authz! QR auth module failed to load (z ), falling back to manual input.z3 QR auth incomplete, falling back to manual input.r DINGTALK_ALLOW_ALL_USERSr z configured via QR scan!)hermes_cli.setuprrrrrrQrrrrr hermes_cli.dingtalk_authrr9rr)rrrrdingtalk_platformrrarmethodrr4r] client_id client_secrets r(_setup_dingtalkr5 sMM MMMMM g &E g &E GGG %>u>>u>>> L LMMM122H  OO8OOOPPP}6e666>>  F GGG ] Q 8  F{{  A A A A A A A    Mccccc d d d $%6 7 7 7 FFFFF  "!## > MO P P P $%6 7 7 7 F#) =+Y777/???16:::  @@@@@AAAAA !!2333 - . . ? 5v > > > > > ? ?sC%% D/DDctttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw| |}nT#t$r!ttdYdSt$r}td|d}Yd}~nd}~wwxYw|r;|dd}|dd}t d|r|stdd}d}|r|sttdtdtdtdtt!dd}|stddSt!dd}|stddSt#d|t#d|ttdtd t!d!d} | r6| d"d} t#d#| t d$ntgd%} td&| d'} | d kr0t#d(d)t#d*d+td,nj| d'kr/t#d(d-t d.td/n5| d0kr t#d(d1td2ntd3ttd4t!d5d} | r"t#d6| t d7| tt d8dS)9uHInteractive setup for WeCom — scan QR code or manual credential input.u: ─── 💬 WeCom (Enterprise WeChat) Setup ───r)r*zWeCom is already configured.z Reconfigure WeCom?FNzDScan QR code to obtain Bot ID and Secret automatically (recommended)z)Enter existing Bot ID and Secret manuallyz% How would you like to set up WeCom?r)qr_scan_for_bot_infoz WeCom QR scan import failed: z WeCom setup cancelled.z QR scan failed: bot_idrsecretu5 ✔ QR scan successful! Bot ID and Secret obtained.z9 QR scan did not complete. Continuing with manual input.uQ 1. Go to WeCom Application → Workspace → Smart Robot -> Create smart robotsz 2. Select API Modez? 3. Copy the Bot ID and Secret from the bot's credentials infouA 4. The bot connects via WebSocket — no public endpoint neededz Bot IDru0 Skipped — WeCom won't work without a Bot ID.z SecretTu0 Skipped — WeCom won't work without a Secret.rz8 Enter user IDs to create an allowlist, or leave empty.z. Allowed user IDs (comma-separated, or empty)rr,r)rrDisable direct messagesrrrdWECOM_DM_POLICYopenrr rpairingrrrIdisabled Direct messages disabled.rz2 Chat ID for scheduled results and notifications.1 Home chat ID (optional, for cron/notifications)r-ru💬 WeCom configured!)rrrrr rrrgateway.platforms.wecomrrrrrrrrrr)existing_bot_idexisting_secretmethod_choices method_idxrrrr4 credentialsallowedrrrrbs r( _setup_wecomrp s GGG %Lfk Z Z[[[#N33O#N33O? 45553U;;  F GGGN3NFXYZZJ F FQ ( D D D D D D D ( ( ( ?#?? @ @ @#'  ( + #2244 $   8999 # # #8388999"  # W$266$266UVVV V  R S S SFF  fggg)***TUUUVWWW  U333  L M M M F T222  L M M M F>6***>6*** GGGHIIIIJJJEPUVVVGT//#r**,g666OPPPP     ##PR`bcdd ?? ,f 5 5 5 4f = = = N O O O O 1__ ,i 8 8 8 ^ _ _ _ Q R R R R 1__ ,j 9 9 9 7 8 8 8 8 R S S S GGGCDDD EPU V V VD 7+T2225t55666 GGG*+++++s65B<< C$CC$* C55'E E(EEc`tdtD}t|dS)z2Configure Yuanbao via the standard platform setup.c32K|]}|ddk|VdS)rrBNrrs r(rz!_setup_yuanbao.. s0KK!QuX5J5JA5J5J5J5JKKr*Nr)yuanbao_platforms r(_setup_yuanbaor s4KKzKKKKK-.....r*ctrDtdp!tdStr t SdS)z6Check if the gateway is installed as a system service.FrT)rKrrrWrrr*r(_is_service_installedr st ""1$E22299;;j?T\`?a?a?a?h?h?j?jj 1%''..000 5r*c\trtd}td}|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYw|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYwdStritrI tj dd tgddd }|jd kS#tj $rYdSwxYwtt!d kS) z2Check if the gateway service is currently running.FrTrrrrrFrGr?r)rKrrrrrNrOrrLrUrWrrMrXrYrZr)user_unit_existssystem_unit_existsr]s r(_is_service_runningr s  ""#0>>>EEGG2$???FFHH   ' "2"4"45 D"=&&((H4445 *";<       ' "2"4"454=&&((H4445 *";<    u .007799 ^f&7&9&9:#$F$) )(   55   "" # #a ''s6?BB21B28?C::DD1E99F  F c tttdtjtt dt dt dt dt d}t d}|r1|r/tt dtd d sd S d d lm }m }n9#t$r,}td|t dYd }~d Sd }~wwxYw|s tdt dd Sttddst dd Sd d l } |j|tt!}nS#t"$r!tt%dYd St$r}td|Yd }~d Sd }~wwxYw|st%dd S|dd}|dd}|dd} |dd} t)d|t)d|| rt)d| t)dt dpdtgd } t+d!| d } | d krOt)d"d#t)d$d%t)d&dt d't d(n| d)kr@t)d"d*t)d$d+t)d&dt%d,n| d-krj| pd} t-d.| d /d0d}t)d"d1t)d$d%t)d&|t d2n?t)d"d3t)d$d%t)d&dt%d4tt d5t d6t d7t d8t d9t d:gd;}t+d<|d }|d kr0t)d=d3t)d>dt d?n|d)kr0t)d=d*t)d>dt%d@nUt-dAdd /d0d}t)d=d1t)d>|t dB| rDttdC| dDdr"t)dE| t dF| tt dGt dH|| rt dI| d Sd S)Jz8Interactive setup for Weixin / WeChat personal accounts.u0 ─── 💬 Weixin / WeChat Setup ───z> 1. Hermes will open Tencent iLink QR login in this terminal.z0 2. Use WeChat to scan and confirm the QR code.zG 3. Hermes will store the returned account_id/token in ~/.hermes/.env.zL 4. This adapter supports native text, image, video, and document delivery.r7rbzWeixin is already configured.z Reconfigure Weixin?FNr)check_weixin_requirementsqr_loginz Weixin adapter import failed: z1 Install gateway dependencies first, then retry.z> Missing dependencies: Weixin needs aiohttp and cryptography.z2 Install them, then rerun `hermes gateway setup`.z Start QR login now?Tz Cancelled.z Weixin setup cancelled.z QR login failed: z QR login did not complete. account_idrrobase_urluser_idWEIXIN_BASE_URLWEIXIN_CDN_BASE_URLz%https://novac2c.cdn.weixin.qq.com/c2c)%Use DM pairing approval (recommended)Allow all direct messagesOnly allow listed user IDsr+ How should direct messages be authorized?WEIXIN_DM_POLICYrWEIXIN_ALLOW_ALL_USERSrWEIXIN_ALLOWED_USERS DM pairing enabled.zY Unknown DM users can request access and you approve them with `hermes pairing approve`.rdrr z$ Open DM access enabled for Weixin.rIz+ Allowed Weixin user IDs (comma-separated)rr allowlistz Weixin allowlist saved.rrzH Note: QR login connects an iLink bot identity (e.g. ...@im.bot), not azM scriptable personal WeChat account. Ordinary WeChat groups typically cannotzN invite an @im.bot identity, and iLink does not deliver ordinary-group eventszI to most bot accounts. The settings below only apply when iLink actuallyuO delivers group events for your account type — otherwise DM remains the onlyz, working channel regardless of this choice.)z!Disable group chats (recommended)zAllow all group chatsz Only allow listed group chat IDs$ How should group chats be handled?WEIXIN_GROUP_POLICYWEIXIN_GROUP_ALLOWED_USERS Group chats disabled.zM All group chats enabled (only takes effect if iLink delivers group events).z? Allowed group chat IDs (comma-separated, not member user IDs)zK Group allowlist saved (only takes effect if iLink delivers group events).z Use your Weixin user ID (rWEIXIN_HOME_CHANNELrzWeixin configured!z Account ID: z User ID: )rrrrrr rrgateway.platforms.weixinrrrrrrMr0r rrrrrrr)existing_accountrrrr4rrrrorrrr default_allowr group_choices group_idx allow_groupss r( _setup_weixinr s GGG %BFK P PQQQ GGGOPPPABBBXYYY]^^^$%899">22NN 56664e<<  FPPPPPPPPP """NNN!gk((3/@/@+A+A"B"BCC  1222 /#//000 4555r22J OOGR ( (Ez2..Hooi,,G& 333>5)))4((333(-8M*N*N*yRyzzz GGGN Ln^_``JQ)9555/999-r222-...noooo q)6222/888-r222<==== q 2 H-bghhhppqtvxyy );777/999-y99912222):666/999-r2223444 GGGYZZZ^____```Z[[[`aaa=>>>M DmUVWWIA~~,j9993R888,---- a,f5553R888effff_acnsttt||~ACEFF ,k:::3\BBBcddd>  VwVVVX\ ] ] > 0' : : : <7<< = = = GGG&''', ,,---,***+++++,,s6C D%!D  D22F%%'G5 G5G00G5c* tttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw|^ |}nR#t$r!ttdYdSt$r}td|Yd}~nd}~wwxYw|rd}|std|s$ttdtdttdd}|stddStdd} | stddSddg} td| d } | dkrdnd} d} d dlm}||| | }|r*|d } t d!| pd"ntd#n)#t$r}td$|Yd}~nd}~wwxYw|| | d| d%}|d&}|d'} |d(d} |d)}|d } t%d|t%d| t%d*| |rd+}n`td,d-g}td.|d }|dkrd/nd+}|d/kr-td0td1td2t%d3|| r tt d4| tgd5}td6|d }|d kr?t%d7d8t%d9d:t d;td<n|dkr0t%d7d=t%d9d:td>nYt%d7d8|pd:}td?|dd@d:}t%d9|t dAtdBdCg}tdD|d }|d kr t%dEdFtdGnt%dEdHtdIttdJd}|r"t%dK|t dL|tt dMtdN|tdO| | rtdP| dSdS)QuMInteractive setup for Feishu / Lark — scan-to-create or manual credentials.u. ─── 🪽 Feishu / Lark Setup ───r"r#z$Feishu / Lark is already configured.z Reconfigure Feishu / Lark?FNz : !!4lAFF'/1}}))+ i ' ' J K K K h i i i k l l l+_===4 222333 GGGN Ln^_``JQ/999-r222-..._```` q/888-r222CDDDD/999 2 A=[`aaaiijmoqrr -y999*+++ GGG>MDmUVWWIA~~,f555DEEEE,j999,--- GGGMX]^^^L?,l;;;=|==>>> GGG2333$F$$%%%$F$$%%%)'X''((((())sO5B<< C$CC$* C55'E E(D??EAI I8I33I8cNtttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}|d krQ d d lm }|}n.#t$r!ttd YdSwxYw|std|sttdtdttdd}|stddStdd}|stddS||dd}td|dtd|d|dd}tgd} td| d } | d krtdd|rVtt d |d!dr#td"|t d#|n!td"dntd"dt d$td%n| d&kr0tdd'td"dtd(nY|pd} td)| dd*d} tddtd"| t d+|rEtt d,|d-dr"td.|t d/|ngttd0d} | rFtd.| t d/| tt d1td2|ddS)3uIInteractive setup for QQ Bot — scan-to-configure or manual credentials.u' ─── 🐧 QQ Bot Setup ───r>r?zQQ Bot is already configured.z Reconfigure QQ Bot?FNz3Scan QR code to add bot automatically (recommended)rz& How would you like to set up QQ Bot?rrz QQ Bot setup cancelled.rz: Go to https://q.qq.com to register a QQ Bot application.z< Note your App ID and App Secret from the application page.rru2 Skipped — QQ Bot won't work without an App ID.rTu6 Skipped — QQ Bot won't work without an App Secret.r)rr user_openidrrr)rrzOnly allow listed user OpenIDsrQQ_ALLOW_ALL_USERSrz Add yourself (z) to the allow list?r@z Allow list set to rr rdr z$ Open DM access enabled for QQ Bot.z( Allowed user OpenIDs (comma-separated)rrz Use your QQ user ID (rrArz8 Home channel OpenID (for cron/notifications, or empty)u🐧 QQ Bot configured!r)rrrrr rrrgateway.platforms.qqbotrrrrrrOrrr)rrrrrrrrrrrrrrs r( _setup_qqbotr Os GGG %96; G GHHH#K00O#$677O? 56664e<<  F GGG=7NGYZ[[JKQ  ; ; ; ; ; ;%+--KK     GGG 5 6 6 6 FF  U S T T T  i OPPPQRRR  U333  N O O O FNT:::   R S S S F!'*BRBRBTBTeghh ; H 5666%{?'CDDD//-44K GGGN Ln^_``JQ+W555  3 GGGQ QQQSWXX 71;???B[BBCCCC126666 -r 2 2 2-..._```` q+V444)2...<====#)r E}_deeemmnqsuvv +W555)9555*+++ K  V;VVVX\ ] ] B / = = = @;@@ A A A Xchiii  K /1C1C1E1E F F F I<3E3E3G3GII J J J GGG+,,,3K13344444s3C'C/.C/c2 ddl}tttdtjt d}t d}|r1|r/tt dtddsdSt|jd rt d ntd td td tdtdtdttdtdtdtttd|pd} td|d p|}n'#ttf$rtdYdSwxYwtd ddl}||ddd}|jdkrt dn*td |jd!td"dsdSnB#t&$r5}td#|d$|td%d&sYd}~dSYd}~nd}~wwxYwt)d|ttd'td(|pd)} td*|rd+|d,nd)d$ } | s|} n'#ttf$rtdYdSwxYw| st+d-dSt)d| ttd.td/t d0pd)} | p| } td1| d p| } n'#ttf$rtdYdSwxYwt)d0| ttd2drttd3t d4pd)} td5| pd6d p| pd6}n'#ttf$rtdYdSwxYwt)d4|tt d7td8|td9| td:td;t d4rdz'Interactive setup for Signal messenger.rNu' ─── 📡 Signal Setup ───rr_zSignal is already configured.z Reconfigure Signal?Fz signal-clizsignal-cli found on PATH.zsignal-cli not found on PATH.z7 Signal requires signal-cli running as an HTTP daemon.z Install options:zF Linux: download from https://github.com/AsamK/signal-cli/releasesz# macOS: brew install signal-cliz) Docker: bbernhard/signal-cli-rest-apiz; After installing, link your account and start the daemon:z$ signal-cli link -n "HermesAgent"zA signal-cli --account +YOURNUMBER daemon --http 127.0.0.1:8080z8 Enter the URL where signal-cli HTTP daemon is running.zhttp://127.0.0.1:8080z HTTP URL [z]: z Setup cancelled.z Testing connection...rz /api/v1/checkrrz! signal-cli daemon is reachable!z# signal-cli responded with status .z Continue anyway?z Could not reach signal-cli at r2z8 Save this URL anyway? (you can start signal-cli later)Tz9 Enter your Signal account phone number in E.164 format.z Example: +15551234567rz Account numberz []z Account number is required.rzB Enter phone numbers or UUIDs of allowed users (comma-separated).SIGNAL_ALLOWED_USERSz Allowed users [z< Enable group messaging? (disabled by default for security)z0 Enter group IDs to allow, or * for all groups.SIGNAL_GROUP_ALLOWED_USERSz Group IDs [*zSignal configured!z URL: z Account: z0 DM auth: via SIGNAL_ALLOWED_USERS + DM pairingz Groups: r[r)rNrrrrr rrrOrrinputrOEOFErrorrhttpxrrW status_coderrr)rN existing_urlr default_urlurlr*resprdefault_accountrjexisting_alloweddefault_allowedrexisting_groupsgroupss r( _setup_signalr5sMMM GGG %96; G GHHH !233L$%566( 56664e<<  F GGGv|L!! 122225666LMMM'((([\\\8999>??? PQQQ;<<<VWWW  GGGIJJJ9"9K3;33344::<<K  ' ( $%%% ()))  yyCJJsOO:::DyII  s " " = > > > > S@PSSS T T T !5u==  CCCCCDDDWY]^^  FFFFF      $c*** GGGJKKK()))&,"Oao+]+B+B+B+B+B[]aaabbhhjj &%G ' ( $%%% 3444#W--- GGGHIIISTTT$%;<<B&1'O@O@@@AAGGII\_ ' ( $%%%)7333 GGGSUZ[[ = EFFF'(DEEK F?+AcFFFGGMMOOiSbifiFF+,    ( ) ) ) FF  3V<<< GGG&'''&W&&'''ABBBf7S)T)TdIIZdffgggggsa>'F&& G  G A4I J%JJ1L L-,L-'N== O! O!+Q-- RRrcddlm}|j|j|j|j|j|j|jtttttttd|S)zResolve the interactive setup function for a built-in platform key. Late-bound to avoid a circular import with ``hermes_cli.setup`` (which imports from this module for the remaining bespoke flows). r)setup)rrrrrr8webhooksrtr r6rr!r(r=) hermes_clir7_setup_telegram_setup_discord _setup_slack _setup_matrix_setup_mattermost_setup_bluebubbles_setup_webhooksr5rrrrrr r)r_ss r(_builtin_setup_fnrB,sp '&&&&&&$"*,&##   c#hhr*c |d}||j|dSt|d}| |dS|drt|dS|d|d}|dd}t t t d|d |d t j|r|jng}|r&td d |ntd |d|d|drtd|ddSdS)a?Run the interactive setup flow for a single platform. Dispatch order: 1. Plugin-provided ``setup_fn`` on the registry entry. 2. Built-in setup function matched by platform key. 3. ``_setup_standard_platform`` when the entry has a ``vars`` schema. 4. Env-var hint fallback for plugins that offer no setup helper. Bundled platform plugins (e.g. IRC) auto-load, so no plugin enable step is needed here. User-installed platform plugins under ~/.hermes/plugins/ must already be in ``plugins.enabled`` before they appear in this menu. rMNrrraru🔌rrrz( Set these env vars in ~/.hermes/.env: r(z Configure z( in config.yaml under gateway.platforms.rLr) rsetup_fnrBrrrrrrTrr)r@rWfnrarrequireds r(_configure_platformrGCs LL* + +E U^7  8E? + +B ~ ||F *** LL(5/ 2 2E LL& ) )E GGG %>u>>u>>> L LMMM%*2u!!HdSdii>Q>QSSTTTTb%bbQYZ_Q`bbccc||N##420223333344r*c$ trtddStttdtjttdtjttdtjttdtjttdtjttdtjtt }t}tr*trtttr*trtt|r|rtd n|rtd td d r trt!nt#rt%n#t&$rO}t)d t+|D]}td|Yd}~nPd}~wt.j$r}t)d|Yd}~n'd}~wwxYwnt3dt3d tt5dt7}d|D}|dt;d|t=|dz }|t=|krnt?||dt*dt@fd tC fdt7D}|rtttdtj"t }t}|rtdd r trtGn:t#rtIntKt3dn)#t&$rP}t)dt+|D]}td|Yd}~nd}~wt.j$r}t)d|Yd}~nd}~wwxYwn|rtd d r trt!nt#rt%nR#t&$rP}t)d!t+|D]}td|Yd}~nd}~wt.j$r}t)d"|Yd}~nd}~wwxYwnttst#rtrd#nd$}tMrd%nd&} td'|d(| d)d rQ d} d*} trtOd*+\} } ntQd*+d } t| rtd,d r trt!| d-k.nt%n#t&$rO}t)d!t+|D]}td|Yd}~n1d}~wt.j$r}t)d"|Yd}~nd}~wwxYwnO#t.j$r,}t)d/|t3d0Yd}~nd}~wwxYwt3d1trt3d2t3d3ntMr=t3d4t3d5t3d6t3d7ntSr@d8d9l*m+} t3d:t3d5t3d;| d<ntdS)?z│ Press Ctrl+C at any time to exit. │rz)Gateway service is installed and running.z-Gateway service is installed but not running.z Start it now?Tu1 Failed to start — user systemd not reachable:rz Failed to start: z%Gateway service is not installed yet.z.sR   z A AAgJ A A+;A+>+> A A A   r*DonezSelect a platform to configure:rdrJr"c|}|dkp)|dp|d S)Nr] partiallyzplugin disabled)rr)rJss r( _is_progressz#gateway_setup.._is_progresssK LLNN ! ! /||K(( /||-..  r*c3HK|]}t|VdSr$rJ)rrrOs r(rz gateway_setup..sG./ %a(())r*u──────────────────────────────────────────────────────────z) Restart the gateway to pick up changes?zStart manually: hermes gatewayu0 Restart failed — user systemd not reachable:z Restart failed: z Start the gateway service?u. Start failed — user systemd not reachable:z Start failed: rprz. (note: services may not survive WSL restarts)rz Install the gateway as a z service?z% (runs in background, starts on boot)Fr0z Start the service now?rrz Install failed: z. You can try manually: hermes gateway installz/ You can install later: hermes gateway installzA Or as a boot-time service: sudo hermes gateway install --systemz+ Or run in foreground: hermes gateway runz* WSL detected but systemd is not running.z' Run in foreground: hermes gateway runz< For persistence: tmux new -s hermes 'hermes gateway run'zM To enable systemd: add systemd=true to /etc/wsl.conf, then 'wsl --shutdown'rrz/ Termux does not use systemd/launchd services.zR Or start it manually in the background (best effort): nohup hermes gateway run >z/logs/gateway.log 2>&1 &z1 Service install not supported on this platform.z?No platforms configured. Run 'hermes gateway setup' when ready.),r r rrrMAGENTArrrKrrrrrrrrrWrrsrr0rPrLrrrrXrrrZrGr%rDIMrrr=rArrrrr)rrrr^rU menu_itemsrany_configured platform_namewsl_noteinstalled_scope did_installrrOs @r( gateway_setuprYmsW ||)*** GGG %DFLFT U UVVV %RTZTb c cddd %DFLFT U UVVV %QSYSa b bccc %PRXR` a abbb %DFLFT U UVVV GGG-//)++O ""'D'F'F,...  ""'>'@'@!### S_SABBBB SEFFF *D 1 1 7 7,..$!OOOOZZ$!OOO. ' ' 'OPPPFF--//''D+t++&&&&'''''0 7 7 75!5566666666 7 7 :;;;QRRR/ *+++"$$       &!!!@*cR\oo`aNabb S^^ # # If-...!/. S T    3A3C3CNVV  eJ ++,,,133-// M JH$OO : :022E'))))!E')))),..."#CDDD2+++ RSSS #A 1 1 3 3++k4kk****+++++!4::: 8Q 8 899999999: := J;TBB 8 8022(%!(%2+++ PQQQ #A 1 1 3 3++k4kk****+++++!4888 61 6 6777777778 8 GGG(**. Jhjj. J-F-H-H W i OUxx_KK]_ "G}"G"GW_"G"G"GIMNNNU*.&+ 466/;[bg;h;h;h8O[[+%8888*.K& D=9SUY+Z+Z D D#<#>#>!4$1H9T$U$U$U$U$U$1OOO#>777 +,\ ] ] ],/FF,=,=,?,?!7!7D$)+t++$6$6$6$6!7!7!7!7!7#-#@DDD +,Bq,B,B C C C C C C C CD%8UUU#$<$<$<==="#STTTTTTTTUPQQQ022h"#fgggLMMMM JGHHHDEEEYZZZjkkkk;;JLLLLLLPQQQHIII Utxtxtztz U U UVVVVRSSSHIIII TUUU GGGGGs*9H$$ J&.AI88J& J!!J&AQ S#AR..SSS59T00 V4:AVV4V//V4!A\3:1Z,+\3, \.6A\;\3\.\)$\3)\..\33].!]))].c t|S#t$rd}tdt|D]}t d|t jdYd}~dSd}~wwxYw)zHandle gateway subcommands.zUser systemd not reachable:rrdN)_gateway_command_innerrsrr0rPrrr)rrr^s r(gateway_commandr\s%d+++ & 1222FF%%''  D +t++      s A?AA::A?c 2!t|dd}||dkrGt|dd}t|dd}t|dd}t|||dS|d krtdS|d krgtrt d dSt|d d}t|d d}t|dd}t r2t dt dtjdtr]tr;tdtdtdt t|||dStrt|dStr~t dt dt dt t dt dt dtjddSt!r}t dt dt t dt dt t d tjddSt d!t d"tjddS|d#krAtrt d$dSt|d d}t r2t d%t d&tjdtrt#|'dStrt%dSt!r`t d(t d)t t d*t d+tjddSt d,tjddS|d-kr"t|d d}t|d.d}|r6t'd/0} | r$t d1| d2t)d3d45t r2t d6t dtjdtrt+|'dStrt-dStrt d7t d8t t dt dt dt t d9tjddSt!r}t d:t d;t t d<t d=t t d>tjddSt d,tjddS|d?kr]t|d.d} t|d d}| rd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYwt'd/0} | | rdndz} | rt d@| dAdSt dBdSd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYw| s0t=rt dCdSt dDdSt d@t?dEdS|dFkr)d} t|d d}t|d.d} d}| rd}trmt/d's"t/d/'r) t3|'d/}nj#t4j$rYnYwxYwtrGt9r' t;d/}n#t4j$rYnwxYwt'd/0} | |rdndz} | rt d@| dAt)d3d45t dGtrUt/d's"t/d/'rt+|'nMtr/t9rt-ntdHdStrot/d's"t/d/'r+d/} tA|'d/} nl#t4j$rYn[wxYwtrIt9r)d/} tCd/} n#t4j$rYnwxYw| sUtrtE\}}|d/urddl#}|$}t t dIt dJt t dK|t t dLt dMdS|rOt t dNt dOt dPtjdt=rt dCt)d3d45t dGtdHdSdS|dQkr=t|dRd}t|dSd}t|d d}tK|'}trgt/d's"t/d/'r#tM|||TtO|dStr@t9r tQ|tO|dStS|j*}|r4t dUdV+tYtZ|dWt dXt]}|r4t t dY|D]}t dZ|t t r t d[t d\dStr/t d]t d^t d_dSt d`t dat dbdSt dct]}|r4t t dY|D]}t dZ|t t ddt det rt dfdStr t dt ddSt dgt dhdS|dikrct|djd}t|dkd}tstst dldSt_| |mdSdS)nNr\rMrrrFr)rrr7rxz*install gateway service (managed by NixOS)r.rrz8Gateway service installation is not supported on Termux.zRun manually: hermes gatewayrdu?WSL detected — systemd services may not survive WSL restarts.z< Consider running in foreground instead: hermes gateway runzM Or use tmux/screen for persistence: tmux new -s hermes 'hermes gateway run'rz(WSL detected but systemd is not running.zIEither enable systemd (add systemd=true to /etc/wsl.conf and restart WSL)z&or run the gateway in foreground mode:zE hermes gateway run # direct foregroundzG tmux new -s hermes 'hermes gateway run' # persistent via tmuxzL nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # backgroundz=Service installation is not needed inside a Docker container.uVThe container runtime is your service manager — use Docker restart policies instead:zJ docker run --restart unless-stopped ... # auto-restart on crash/rebootz< docker restart # manual restartz&To run the gateway: hermes gateway runz4Service installation not supported on this platform.z Run manually: hermes gateway runrz,uninstall gateway service (managed by NixOS)zcGateway service uninstall is not supported on Termux because there is no managed service to remove.z*Stop manual runs with: hermes gateway stoprz>Service uninstall is not applicable inside a Docker container.z2To stop the gateway, stop or remove the container:z docker stop z docker rm zNot supported on this platform.rrfTru ✓ Killed z. stale gateway process(es) across all profilesrrrz\Gateway service start is not supported on Termux because there is no system service manager.z*WSL detected but systemd is not available.z+Run the gateway in foreground mode instead:z^To enable systemd: add systemd=true to /etc/wsl.conf and run 'wsl --shutdown' from PowerShell.z:Service start is not applicable inside a Docker container.z1The gateway runs as the container's main process.z: docker start # start a stopped containerz< docker restart # restart a running containerz/Or run the gateway directly: hermes gateway runru ✓ Stopped z( gateway process(es) across all profilesu✗ No gateway processes foundu$✓ Stopped gateway for this profileu'✗ No gateway running for this profilez servicerzStarting gateway...)ruB⚠ Cannot restart gateway as a service — linger is not enabled.zK The gateway user service requires linger to function on headless servers.z$ Run: sudo loginctl enable-linger riz hermes gateway restartu#✗ Gateway service restart failed.zL The service definition exists, but the service manager did not recover it.z3 Fix the service, then retry: hermes gateway startrJrr)rru✓ Gateway is running (PID: r(rz- (Running manually, not as a system service)rrz Termux note:z; Android may stop background jobs when Termux is suspendedz WSL note:zI The gateway is running in foreground/manual mode (recommended for WSL).z< Use tmux or screen for persistence across terminal closes.zTo install as a service:z hermes gateway installz& sudo hermes gateway install --systemu✗ Gateway is not runningz To start:z- hermes gateway run # Run in foregroundz^ nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # Best-effort background startz3 hermes gateway install # Install as user servicezM sudo hermes gateway install --system # Install as boot-time system servicezmigrate-legacyrr z@Legacy unit migration only applies to systemd-based Linux hosts.)rr)0getattrrrYr r rrrrrKrArrrrWrrrrr5rrrrrrrLrrrr=rrrrrrrrr-rrGr rmapr0rr)rsubcmdrrrr.rr start_allr3stop_allservice_availabletotal restart_allservice_configuredservice_stopped linger_ok_detailr _usernamerrr+r[rr^rr s r(r[r[,sD T,d 3 3F~5$ 1--gu--$ 511G5'::::  <<  F G G G Fgu--x//dM488 ;;  L M M M 0 1 1 1 HQKKK $ & & xx _```YZZZjkkk %K P P P P P P ZZ  E " " " " " XX  < = = = ] ^ ^ ^ : ; ; ; GGG Y Z Z Z [ \ \ \ ` a a a HQKKKKK ^^  Q R R R j k k k GGG ^ _ _ _ P Q Q Q GGG : ; ; ; HQKKKKK H I I I 4 5 5 5 HQKKKKK ;   <<  H I I I Fx// ;;  w x x x > ? ? ? HQKKK $ & &  V , , , , , , ZZ        ^^  R S S S F G G G GGG - . . . + , , , HQKKKKK 3 4 4 4 HQKKKKK 7  x//D%//  F+>>>F FZFZZZ[[[&tEEEE ;;  p q q q 0 1 1 1 HQKKK $ & &   ( ( ( ( ( ( ZZ  OOOOO XX  > ? ? ? ? @ @ @ GGG Y Z Z Z [ \ \ \ ` a a a GGG r s s s HQKKKKK ^^  N O O O E F F F GGG N O O O P Q Q Q GGG C D D D HQKKKKK 3 4 4 4 HQKKKKK 6  4..x// , C % (** 0EU0S0S0S0Z0Z0\0\ `u~BaCaCaCaJaJaLaL  ////(,%%!4D  6 8 8 ? ? A A  NNN(,%%!4D+>>>F#4;aa!>>F?9aa:E VTUTTTUUU "4S A A A A ' ( ( ((** '0EU0S0S0S0Z0Z0\0\ '`u~BaCaCaCaJaJaLaL 'V,,,,, ' 6 8 8 ? ? A A 'A&&&& F $ & & ,A,O,O,O,V,V,X,X \qy}\~\~\~]F]F]H]H !%  v....$(!!0     ZZ 244;;== !%  !!!$(!!0    ! #(** %>%@%@" 7D(("NNN ' 1 1IGGG^___ghhhGGGLLLMMMGGG78886777F! ;<<<deeeKLLL $%% ><=== "4S A A A A ' ( ( (  " " " " " "A # #D 8  tVU++tVU++x///v>>> % & &0 k,A,O,O,O,V,V,X,X0 k\qy}\~\~\~]F]F]H]H0 k 4T : : : : +H 5 5 5 5 5 ZZ- k244;;==- k 4 +H 5 5 5 5 5-..D' kRdiiC6O6ORRRSSSEFFF 5 7 7  +GGG2333 -++k4kk****;; D.)))WXXXXXXXD+&&&efffXYYYYY45554555BCCCCC2333 5 7 7  +GGG2333 -++k4kk****k"""EFFF;;kz{{{{{XXkcdddhiiiiiOPPPijjjjj # # #$ 511dE5))(** 8::  T U U U F"3wHHHHHH $ #s[**[<;[<.\??]]*_==``aa$#a$?ee$#e$f''f98f9l$$l65l6*m;;n  n )Frr$)Fr)FN)FNF)r"N)r)TF)FFN)FFF)rr)rFF)rtrrmrNrtrLrr dataclassesrpathlibr__file__rDrr$rrgateway.restartrrrhermes_cli.configr r r r r rrrrrrrrrrhermes_cli.colorsrrrr6rJrbr3rjr%rpryfloatrrGrrrrr0rrr2rrtrrrrrr*r-r5r=rrrrrArErDrLrKrWrrjrFrerrrrrsr~rrrrrrrrCompletedProcessrrrrrr1rrrrrrrrrrrrrrrrrr&rr1r6r;rTrXr^rdrgrjrmrrErrrrrrrXrrrrrrrrrrrrrQrXrprrrrrrrrrrrrr r5rBrGrYr\r[rr*r(rss   !!!!!!tH~~$+3355 (((((( ,+++++++ $ T T T T T T T T  $        <3<<<<~22t22222 C D     s t    3s353T3333lT#YS4Zs3xTXggSXgTgdSViggggTC$JTVZ: $*  2349)S)3)4))))X>>4>E$*>>>&#%% %c3h% #s(^%%%%T# ,,, ,*, ,  ,,,,^33T3t3_c3333l " " " " "(((:P((((VTUuS#Xc:cDjY\J.DJJJJJLP05$cDj)-:=:#d####L,$,,,,=<<<<<<<<<-$----$" 4    $$$$$$#D####! M>>>>>6cDjC8 '# ' ' ' 'LL$L4LLLL, -4---- ]D]]]]MMMM,((((((($;?SSS4S4SSSSl +c +c +S +UY + + + + @@4@DI@@@@ BBDBT#YBBBB7<   c t *Je    ***#**** d3i    3t3333*=uS#X<<<3c3h 4dDj(9#:    #4c4o(>#?####L----- 4444(___ _ 3T ?____D = = = =ST 22#*2c3PSm@T2222.DS4ZcDj 5C$J 5 5 5 5DU3:tCS=T>.;5c)9#:.;.;.;.;b 5 5 5 52D2222OOOOO$+B      Q$Qd3iQDIQQQQsSS4########4kk$kS4ZkSVkkkkZJJJJJJ##&__D_T____  4 D       3  d  d     (D(D(D(DVll$l4llll ,E , , , ,7 7 47 7 CRVJ7 7 7 7 tRRdRRRR" N N$ N N N NNNNNNN9P9PD9P9P9P9Pz\,\,\,t\,4\,\,\,\,FL3LLLL      VVVVVps$ssss(??4????6 % % %!!!2!!!"''E'ut|'VZ''''T'''@$G$G$G$G$G$GVT)   *[dF H H-9]kp!< > >-9Q_dg i i  ,(    )KT9 ; ;,8iw|!< > >,8P^c[ ] ]  %:&   "'2HVZ= ? ?&2HVZC E E*6Zhm!> @ @  +@*    )4ftyW Y Y*6pCd f f%1hv{K M M+7m|A!E G G(4IW\c e e  <'    &1[inW Y Y';D= ? ?/;_mr!A C C/;SafW Y Y,9O]b] _ _  <' & $   %UR T T%1SaeR T T&+5Y [ [&+5V X X*6_mr!J L L  6)   *5IW\= ? ?(4GUYO Q Q*6m|A@ B B(4ky~!P R R(3yHMU W W  8)   *5IW\M O O-9TbfP R R & $   %eD F F(LdH J J$0]kpW Y Y-9xGLZ \ \+7esx!R T T+6guzG I I <,#   $xU9 ; ;#xT9 ; ;*6drw!L N N*5ftyG I I  2 2-   .PU5 7 71]X\B D D.*RWC E E+7GUYH J J6BTbfQ S S*6\jo9 ; ;3?m|A!L N N @"( )-    .9q@EE G G+7TbfJ L L0=\jo!v x x0 >'3xGL!P R R*5sBGK M M  0%   &uG I I)\tW Y Y W } | (T ((((VGtGGGGGT tCy    F_2t_2_2_2_2D'''--- +++ 8?8?8?vr,r,r,j/// t'(T'('('('(TB,B,B,Ji)i)i)Xh5h5h5Vohohohd3.'4$'44'4'4'4'4Tk k k d   HIHIHIHIHIr*