eiZUdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z ddlmZmZmZmZmZejeZejdkZejdZiZeeefed<ehd Zddl Z dd l!m"Z"m#Z#dd l$m%Z%d Z&d d dddZ'deefdZ(de)fdZ*deefdZ+defdZ,ddedefdZ-ddefdZ.dee/fdZ0ddl1m2Z2de fdZ3de fdZ4de fdZ5dZ6de)fd Z7d!Z8d"e ddfd#Z9d$Z:d"e fd%Z;id&d'd(id)gd*id+d,gd-d.d/d0d1d'd2d3d4d5d6id7d8d9d2d:d;dgd?d@dAdBdCgdDidEdFdGdBdHdBdIdJdKdLdMdNdOd@gdPd@dQdRdSdTdPdPd@d'dUdVdWdPidX dYd@dZd[d\d]d^d_d`d`dadbd@dcdddedfdgdhdiidjd'd@gdkdld'd'dmdndodpdqd2d'd'd'dSidTdrd2d'd'd'dsidtd2d'd'd'dSidtd2d'd'd'dTid1dud2d'd'd'dTidtd2d'd'd'dTidtd2d'd'd'dTidtd2d'd'd'dTidtdvdwidxdPdydzd{d|d}d~ddPddPddPdddd@ddPdddddddd@ddPdidddidddiidddPiddddiddddddddddddddd'd'dddddd@d8dd'dd&did&diddddSdPd@dddddddddddidd@d@ddd'ddd'd'd'd'd@dZdd'd1dJd@dPdœ dd'dgd@dPddPdƜdidd'dd@d'd'd@d@id'dʜdiddiiddiiddiidd0ddҜgiidPidPd@d@ddd@dPggd՜d֜d@ddלddiddd1dۜd@ddidޜddPidPd.d@dddiiddZeefed<iZ?idddddPdd@dddddd@ddgdd@dddddd@dd@dddddd@dd@ddddddPdd@dddddd@dd@ddddddPdd@ddd d d d@dd@dd d dddPdd@dddddd@dd@dddddd@dd@dddddd@dd@ddddddPdd@dddddd@dd@dddd ddPdd@dd!d"d#dd@dd@dd$d%d%d&d@dd@did'd(d)ddPdd@dd*d+d+d,d@dd@dd-d.d/ddPdd@dd0d1d2d3d@dd@dd4d5d6ddPdd@dd7d8d9d:d@dd@dd;d<d=ddPdd@dd>d?d@dAd@ddBdCdDdEd'dPddBdFdGdHdId@ddBdJdKdLd'dPdd@ddMdNdOddPdd@ddPdQdRdSdPdd@ddTdUdVdSd@dd@ddWdXdYddPdd@ddZd[d\d]d@dd@dd^d_d`ddPdd@didadbdcd]d@dd@ddddedfddPdd@ddgdhdidjd@ddBdkdldmddPdd@ddndodpdqd@dd@ddrdsdtddPdd@ddudvdwdxd@ddBdydzd{ddPdd@dd|d}d~ddPdd@ddddddPdd@dddddd@ddBdddddPdd@dddddddgd@ddddddddgd@ddddddddgd@dddddddPdd@ddddddPdd@didddddPdd@ddddddPdd@dddddd@dd@dddddgdd@ddddddddgd@ddddddddgdPddddddddgd@dddddddgdPddddddddgdPddddÐdĐdŐdgd@dddǐdȐdɐdgdˢd@ddd̐d͐dΐdϐdАdgd@ddddҐdӐdԐdՐdgd@ddddאdؐdd@ddBdڐdېdܐdd@ddBdސdߐddd@ddBdddddgd@ddidddddddddd@ddBdddddPddBddddPddddddd@ddBdddddPddBdddddPddBddddd@ddBddddd@ddBd d d d dPddBd dddd@ddBdddddPddBdddddPddBdddddPddBdddddPddBddddd@ddBd d!d"ddPddBid#d$d%ddPddBd&d'd(ddPdd@dd)d*d+ddPdd@dd,d-d.ddPdd@dd/d0d1ddPdd@dd2d3d4dd@dd@dd5d6d7d8dPddBd9d:d;dd@ddBd<d=d>ddPddBd?d@dAdddBdCdDdEddFdGdHdId@dddJdKdLdddMdNdOdddPdQdRdddSdTdUdddVdWdXddidYdZd[ddd\d]d^ddPdd@dd_d`daddPdd@ddbdcdddd@dd@ddedfdgddPdd@ddhdidjddPdd@ddkdldmddPdd@ddndodpddPdd@ddqdrdsdd@dd@ddtdudvddPddBdwdxdyddPddBdzd{d|dd@ddBd}d~ddd@ddBdddddPddBdddddPddBdddddPddBdddddPddBdddddPddBiZ@dϐde)deeeeffdZAde/defdZBdeeeeffdZCdeeeeffdZDd'ddededeeeeffdZEdedeeeeffdZF dАdeeeefdeeeeffdZG dd&ededeeeeefdeeeefdee>f dZHdee>e>ffdZIhdZJhdZKhdZLe GddZMdАdeeeefdedfdZNdАdeeeefddfdZOdАdeeeefddfdZPdҐde)de)deeeffdZQde/de/de/fdZRdZSdZTdАdZUdeeefdeeeffdZVdeeefdeeeffdZWdeeeffdZXdeeeffdZYdZZdZ[dZ\deeeffdZ]deeeffdZ^de_de_fdZ`de>fdZadededefdZbdedefdZcdede)fdZddАdefd„ZedАdÄZfdАdefdĄZgdededeeeffdńZhde>fdƄZidedeefdDŽZjdedefdȄZkdɄZldʄZmdedefd˄Znd̄ZodS(a Configuration management for Hermes Agent. Config files are stored in ~/.hermes/ for easy access: - ~/.hermes/config.yaml - All settings (model, toolsets, terminal, etc.) - ~/.hermes/.env - API keys and secrets This module provides: - hermes config - Show current configuration - hermes config edit - Open config in editor - hermes config set - Set a specific value - hermes config wizard - Re-run setup wizard N) dataclass)Path)DictAnyOptionalListTupleWindowsz^[A-Za-z_][A-Za-z0-9_]*$_LAST_EXPANDED_CONFIG_BY_PATH>B QQ_APP_ID QQ_STT_MODEL TERMINAL_ENV WECOM_BOT_ID WECOM_SECRET WEIXIN_TOKEN FEISHU_APP_ID WHATSAPP_MODEOPENAI_API_KEYQQ_STT_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENMATRIX_PASSWORDOPENAI_BASE_URLQQ_HOME_CHANNELQQ_STT_BASE_URLSIGNAL_HTTP_URLWEIXIN_BASE_URLMATRIX_DEVICE_IDMATRIX_HOME_ROOMQQ_ALLOWED_USERSQQ_CLIENT_SECRETTERMINAL_SSH_KEYWEIXIN_DM_POLICYWHATSAPP_ENABLEDANTHROPIC_API_KEYFEISHU_APP_SECRETMATRIX_ENCRYPTIONTERMINAL_SSH_PORTWEIXIN_ACCOUNT_IDDINGTALK_CLIENT_IDFEISHU_ENCRYPT_KEYMATRIX_AUTO_THREADQQBOT_HOME_CHANNELQQ_ALLOW_ALL_USERSMATRIX_RECOVERY_KEYQQ_MARKDOWN_SUPPORTWECOM_CALLBACK_HOSTWECOM_CALLBACK_PORTWEIXIN_CDN_BASE_URLWEIXIN_GROUP_POLICYWEIXIN_HOME_CHANNELBLUEBUBBLES_PASSWORDDISCORD_HOME_CHANNELQQ_HOME_CHANNEL_NAMESIGNAL_ALLOWED_USERSWECOM_CALLBACK_TOKENWEIXIN_ALLOWED_USERSMATTERMOST_REPLY_MODETELEGRAM_HOME_CHANNELBLUEBUBBLES_SERVER_URLDINGTALK_CLIENT_SECRETMATRIX_REQUIRE_MENTIONQQ_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_IDWEIXIN_ALLOW_ALL_USERSMATTERMOST_HOME_CHANNELQQBOT_HOME_CHANNEL_NAMEWECOM_CALLBACK_AGENT_IDWEIXIN_HOME_CHANNEL_NAMEFEISHU_VERIFICATION_TOKENMATRIX_FREE_RESPONSE_ROOMSSIGNAL_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_SECRETWEIXIN_GROUP_ALLOWED_USERSWECOM_CALLBACK_ENCODING_AES_KEY)Colorscolor)DEFAULT_SOUL_MD)true1yesHomebrewNixOS)brewhomebrewnixnixosreturnctjdd}|r:|}|tvrdSt ||Stdz }|rdSdS)z7Return the package manager owning this install, if any.HERMES_MANAGEDrUz.managedN) osgetenvstriplower_MANAGED_TRUE_VALUES_MANAGED_SYSTEM_NAMESgetget_hermes_homeexists)raw normalizedmanaged_markers 3/home/div/.hermes/hermes-agent/hermes_cli/config.pyget_managed_systemrkQs )$b ) ) / / 1 1C :YY[[ - - -7$((S999$&&3Nw 4c"tduS)aCheck if Hermes is running in package-manager-managed mode. Two signals: the HERMES_MANAGED env var (set by the systemd service), or a .managed marker file in HERMES_HOME (set by the NixOS activation script, so interactive shells also see it). Nrkrlrj is_managedrp`s   t ++rlcBt}|dkrdS|dkrdSdS)z;Return the preferred upgrade command for a managed install.rTzbrew upgrade hermes-agentrUzsudo nixos-rebuild switchNrn)managed_systems rjget_managed_update_commandrsjs4'))N##**  ** 4rlc"tpdS)z C C Crlmodify configurationcVtt|tjdS)z+Print user-friendly error for managed mode.fileN)printrzsysstderr)rws rj managed_errorrs&  ( (sz::::::rlctjddkrdSddlm}|rdSt dz } i}t |d5}|D]q}|}d|vrW|d sB| d\}}}|||<r dddn #1swxYwYn#t$rYdSwxYw|d d }|d d } |dd} |dd} || | | dS)aRead container mode metadata from HERMES_HOME/.container-mode. Returns a dict with keys: backend, container_name, exec_user, hermes_bin or None if container mode is not active, we're already inside the container, or HERMES_DEV=1 is set. The .container-mode file is written by the NixOS activation script when container.enable = true. It tells the host CLI to exec into the container instead of running locally. HERMES_DEVrRNr) is_containerz.container-moder=#backenddockercontainer_namez hermes-agent exec_userhermes hermes_binz /data/current-package/bin/hermes)rrrr) r^environrdhermes_constantsrreopenr` startswith partitionFileNotFoundError) rcontainer_mode_fileinfoflinekey_valuerrrrs rjget_container_exec_infors z~~l##s**t------|~~t)++.??  %s + + 6q 6 6zz||$;;ts';';;$(NN3$7$7MCE(- D%  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 tthhy(++GXX.??Nh//I,(JKKJ(   s7 C*A5C C*C""C*%C"&C** C87C8rec$tdz S)zGet the main config file path.z config.yamlrrorlrjget_config_pathrs   } ,,rlc$tdz S)z&Get the .env file path (for API keys).z.envrrorlrj get_env_pathrs   v %%rlcbttjjS)z'Get the project installation directory.)r__file__parentresolverorlrjget_project_rootrs >> ' / / 1 11rlc6trdS tjdd}|rt |dnd}n#t $rd}YnwxYw tj||dS#ttf$rYdSwxYw)uMSet directory to owner-only access (0700 by default). No-op on Windows. Skipped in managed mode — the NixOS module sets group-readable permissions (0750) so interactive users in the hermes group can share state with the gateway service. The mode can be overridden via the HERMES_HOME_MODE environment variable (e.g. HERMES_HOME_MODE=0701) for deployments where a web server (nginx, caddy, etc.) needs to traverse HERMES_HOME to reach a served subdirectory. The execute-only bit on a directory permits cd-through without exposing directory listings. NHERMES_HOME_MODEr]i) rpr^rrdr`int ValueErrorchmodOSErrorNotImplementedError)pathmode_strmodes rj _secure_dirrs||:>>"4b99??AA#+6s8Q   t ( )     s$AA A('A(,BBBctjdstjdrdStjdrdS t dd5}|}dddn #1swxYwYd|vsd |vsd |vrdSn#ttf$rYnwxYwd S) a3Detect if we're running inside a Docker/Podman/LXC container. When Hermes runs in a container with volume-mounted config files, forcing 0o600 permissions breaks multi-process setups where the gateway and dashboard run as different UIDs or the volume mount requires broader permissions. HERMES_CONTAINERHERMES_SKIP_CHMODTz /.dockerenvz/proc/1/cgrouprNrlxckubepodsF) r^rrdrrfrreadrIOError)rcgroup_contents rj _is_containerrs z~~())RZ^^>#d)) $ $ " HT5 ! ! ! ! ! " " ( )     sAA%%A:9A:homec|dz }|rdS|tdt|dS)zISeed a default SOUL.md into HERMES_HOME if the user doesn't have one yet.zSOUL.mdNutf-8encoding)rf write_textrPr)r soul_paths rj_ensure_default_soul_mdr#sRy I 7;;;rlct}trStjd} t |tj|dS#tj|wxYw|ddt |dD]-}||z }|ddt |.t|dS)a Ensure ~/.hermes directory structure exists with secure permissions. In managed mode (NixOS), dirs are created by the activation script with setgid + group-writable (2770). We skip mkdir and set umask(0o007) so any files created (e.g. SOUL.md) are group-writable (0660). T)parentsexist_okcronsessionslogsmemoriesN)rerpr^umask_ensure_hermes_home_managedmkdirrr)r old_umasksubdirds rjensure_hermes_homer,s   D|| &HUOO  ' - - - HY     BHY     4$ ///D>  Fv A GGD4G 0 0 0 NNNN%%%%%s AA-c|std|ddD]-}||z }|st|d.t|dS)zPManaged-mode variant: verify dirs exist (activation creates them), seed SOUL.md.z HERMES_HOME z7 does not exist. Run 'sudo nixos-rebuild switch' first.rN)is_dir RuntimeErrorr)rrrs rjrrDs ;;==  54 5 5 5   ; 6Mxxzz 999   D!!!!!rlmodelr] providersfallback_providerscredential_pool_strategiestoolsetsz hermes-cliagentZi<autoi) max_turnsgateway_timeoutrestart_drain_timeoutapi_max_retries service_tiertool_use_enforcementgateway_timeout_warninggateway_notify_intervalterminalrlocal modal_modecwd.timeoutenv_passthroughshell_init_filesauto_source_bashrcT docker_image*nikolaik/python-nodejs:python3.11-nodejs20docker_forward_env docker_envsingularity_image3docker://nikolaik/python-nodejs:python3.11-nodejs20 modal_image daytona_image container_cpucontainer_memoryicontainer_diskicontainer_persistentF)docker_volumesdocker_mount_cwd_to_workspacepersistent_shellbrowserx must_respondi,managed_persistence) inactivity_timeoutcommand_timeoutrecord_sessionsallow_private_urlsauto_local_for_private_urlscdp_url dialog_policydialog_timeout_scamofox checkpoints2)enabled max_snapshotsfile_read_max_charsi tool_outputiPi) max_bytes max_linesmax_line_length compression?皙?)r threshold target_ratioprotect_last_nprompt_caching cache_ttl5mbedrocki)rprovider_filterrefresh_intervalasyncdisabled)guardrail_identifierguardrail_versionstream_processing_modetrace)region discovery guardrail auxiliary)providerrbase_urlapi_keyr extra_bodydownload_timeoutih)r4rr5r6rr7)r4rr5r6rr7max_concurrency)vision web_extractrsession_search skills_hubapprovalmcptitle_generationdisplaycompact personalitykawaiiresume_displayfullbusy_input_mode interruptbell_on_completeshow_reasoning streamingfinal_response_markdownr` inline_diffs show_costskindefaultuser_message_preview) first_lines last_linesinterim_assistant_messagestool_progress_commandtool_progress_overridestool_preview_length platforms dashboardthemeprivacy redact_piittsedgevoicezen-US-AriaNeuralpNInz6obpgDQGcFmaJgBeleven_multilingual_v2)voice_idmodel_idzgpt-4o-mini-ttsalloy)rr`eveeni]i)rclanguage sample_ratebit_ratezvoxtral-mini-tts-2603z$c69964a6-ab8b-4f8a-9465-ec0925096ec8)rrczneuphonic/neutts-air-q4-ggufcpu) ref_audioref_textrdevice)r4r_ elevenlabsopenaixaimistralneuttssttbase)rrhz whisper-1zvoxtral-mini-latest)rr4rrprrzctrl+bg@) record_keymax_recording_secondsauto_tts beep_enabledsilence_thresholdsilence_duration human_delayoffi i )rmin_msmax_mscontextengine compressormemoryii_)memory_enableduser_profile_enabledmemory_char_limituser_char_limitr4 delegationiX) rr4r5r6inherit_mcp_toolsetsmax_iterationschild_timeout_secondsreasoning_effortmax_concurrent_childrenmax_spawn_depthorchestrator_enabledsubagent_auto_approveprefill_messages_fileskills ) external_dirs template_vars inline_shellinline_shell_timeoutguard_agent_createdhonchotimezonediscord)require_mentionfree_response_channelsallowed_channels auto_thread reactionschannel_promptsserver_actionswhatsapptelegramrslack mattermostmanualdeny)rr cron_modetirith)rdomains shared_files)rredact_secretstirith_enabled tirith_pathtirith_timeouttirith_fail_openwebsite_blocklist) wrap_responsemax_parallel_jobsrprojectINFO)level max_size_mb backup_countzAhttps://hermes-agent.nousresearch.com/docs/api/model-catalog.json)rurl ttl_hoursr force_ipv4) auto_pruneretention_daysvacuum_after_prunemin_interval_hoursseen) approvalscommand_allowlistquick_commandshookshooks_auto_accept personalitiessecurityrcode_executionlogging model_catalognetworkr onboarding_config_version)FIRECRAWL_API_KEYBROWSERBASE_API_KEYBROWSERBASE_PROJECT_IDFAL_KEYVOICE_TOOLS_OPENAI_KEYELEVENLABS_API_KEY)r$rWHATSAPP_ALLOWED_USERSSLACK_BOT_TOKENSLACK_APP_TOKENSLACK_ALLOWED_USERSTAVILY_API_KEYTERMINAL_MODAL_MODE)rrr ENV_VARS_BY_VERSION NOUS_BASE_URLzNous Portal base URL overridez.Nous Portal base URL (leave empty for default)r4) descriptionpromptrpasswordcategoryadvancedOPENROUTER_API_KEYz>OpenRouter API key (for vision, web scraping helpers, and MoA)zOpenRouter API keyzhttps://openrouter.ai/keysvision_analyzemixture_of_agents)rrrrtoolsrrGOOGLE_API_KEYzAlibaba Cloud DashScope API key (Qwen + multi-provider models)zDashScope API Keyz-https://modelstudio.console.alibabacloud.com/DASHSCOPE_BASE_URLzGCustom DashScope base URL (default: coding-intl OpenAI-compat endpoint)zDashScope Base URLHERMES_QWEN_BASE_URLzBQwen Portal base URL override (default: https://portal.qwen.ai/v1)z.Qwen Portal base URL (leave empty for default)HERMES_GEMINI_CLIENT_IDzfGoogle OAuth client ID for google-gemini-cli (optional; defaults to Google's public gemini-cli client)uKGoogle OAuth client ID (optional — leave empty to use the public default)z1https://console.cloud.google.com/apis/credentialsHERMES_GEMINI_CLIENT_SECRETz;Google OAuth client secret for google-gemini-cli (optional)z%Google OAuth client secret (optional)HERMES_GEMINI_PROJECT_IDz@GCP project ID for paid Gemini tiers (free tier auto-provisions)z;GCP project ID for Gemini OAuth (leave empty for free tier)OPENCODE_ZEN_API_KEYz=OpenCode Zen API key (pay-as-you-go access to curated models)zOpenCode Zen API keyzhttps://opencode.ai/authOPENCODE_ZEN_BASE_URLzOpenCode Zen base URL overridez/OpenCode Zen base URL (leave empty for default)OPENCODE_GO_API_KEYzOllama Cloud API key (ollama.com — cloud-hosted open models)zOllama Cloud API keyzhttps://ollama.com/settingsOLLAMA_BASE_URLz?Ollama Cloud base URL override (default: https://ollama.com/v1)z)Ollama base URL (leave empty for default)XIAOMI_API_KEYzhXiaomi MiMo API key for MiMo models (mimo-v2.5-pro, mimo-v2.5, mimo-v2-pro, mimo-v2-omni, mimo-v2-flash)zXiaomi MiMo API Keyzhttps://platform.xiaomimimo.comXIAOMI_BASE_URLzFXiaomi MiMo base URL override (default: https://api.xiaomimimo.com/v1)z)Xiaomi base URL (leave empty for default) AWS_REGIONz?AWS region for Bedrock API calls (e.g. us-east-1, eu-central-1)z AWS RegionzIhttps://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html AWS_PROFILEzFAWS named profile for Bedrock authentication (from ~/.aws/credentials)z AWS ProfileAZURE_FOUNDRY_API_KEYz0Azure Foundry API key for custom Azure endpointszAzure Foundry API Keyzhttps://ai.azure.com/AZURE_FOUNDRY_BASE_URLzLAzure Foundry base URL (set via 'hermes model' for endpoint-specific config)zAzure Foundry base URL EXA_API_KEYz1Exa API key for AI-native web search and contentsz Exa API keyzhttps://exa.ai/ web_searchr;tool)rrrrrrPARALLEL_API_KEYz5Parallel API key for AI-native web search and extractzParallel API keyzhttps://parallel.ai/rz-Firecrawl API key for web search and scrapingzFirecrawl API keyzhttps://firecrawl.dev/FIRECRAWL_API_URLz6Firecrawl API URL for self-hosted instances (optional)z)Firecrawl API URL (leave empty for cloud)FIRECRAWL_GATEWAY_URLzQExact Firecrawl tool-gateway origin override for Nous Subscribers only (optional)z9Firecrawl gateway URL (leave empty to derive from domain)TOOL_GATEWAY_DOMAINzShared tool-gateway domain suffix for Nous Subscribers only, used to derive vendor hosts, e.g. nousresearch.com -> firecrawl-gateway.nousresearch.comzTool-gateway domain suffixTOOL_GATEWAY_SCHEMEzShared tool-gateway URL scheme for Nous Subscribers only, used to derive vendor hosts (`https` by default, set `http` for local gateway testing)zTool-gateway URL schemeTOOL_GATEWAY_USER_TOKENzuExplicit Nous Subscriber access token for tool-gateway requests (optional; otherwise read from the Hermes auth store)zTool-gateway user tokenz;Tavily API key for AI-native web search, extract, and crawlzTavily API keyzhttps://app.tavily.com/home)rr; web_crawlruUBrowserbase API key for cloud browser (optional — local browser works without this)zBrowserbase API keyzhttps://browserbase.com/browser_navigate browser_clickruCBrowserbase project ID (optional — only needed for cloud browser)zBrowserbase project IDBROWSER_USE_API_KEYuUBrowser Use API key for cloud browser (optional — local browser works without this)zBrowser Use API keyzhttps://browser-use.com/FIRECRAWL_BROWSER_TTLz@Firecrawl browser session TTL in seconds (optional, default 300)zBrowser session TTL (seconds))rrrrr CAMOFOX_URLzYCamofox browser server URL for local anti-detection browsing (e.g. http://localhost:9377)zCamofox server URLz)https://github.com/jo-inc/camofox-browserrz FAL API key for image generationz FAL API keyzhttps://fal.ai/image_generateTINKER_API_KEYzTinker API key for RL trainingzTinker API keyz/https://tinker-console.thinkingmachines.ai/keys)rl_start_trainingrl_check_statusrl_stop_training WANDB_API_KEYz0Weights & Biases API key for experiment trackingz WandB API keyzhttps://wandb.ai/authorizerl_get_resultsr*z?OpenAI API key for voice transcription (Whisper) and OpenAI TTSz&OpenAI API Key (for Whisper STT + TTS)z$https://platform.openai.com/api-keysvoice_transcription openai_ttsz4ElevenLabs API key for premium text-to-speech voiceszElevenLabs API keyzhttps://elevenlabs.io/MISTRAL_API_KEYz7Mistral API key for Voxtral TTS and transcription (STT)zMistral API keyzhttps://console.mistral.ai/ GITHUB_TOKENzCGitHub token for Skills Hub (higher API rate limits, skill publish)z GitHub Tokenz"https://github.com/settings/tokensHONCHO_API_KEYz.Honcho API key for AI-native persistent memoryzHoncho API keyzhttps://app.honcho.devhoncho_contextHONCHO_BASE_URLz=Base URL for self-hosted Honcho instances (no API key needed)z,Honcho base URL (e.g. http://localhost:8000))rrrTELEGRAM_BOT_TOKENz"Telegram bot token from @BotFatherzTelegram bot tokenzhttps://t.me/BotFather messagingTELEGRAM_ALLOWED_USERSzSComma-separated Telegram user IDs allowed to use the bot (get ID from @userinfobot)z+Allowed Telegram user IDs (comma-separated)zhttps://t.me/userinfobotTELEGRAM_PROXYzaProxy URL for Telegram connections (overrides HTTPS_PROXY). Supports http://, https://, socks5://zTelegram proxy URL (optional))rrrrDISCORD_BOT_TOKENz'Discord bot token from Developer PortalzDiscord bot tokenz+https://discord.com/developers/applicationsDISCORD_ALLOWED_USERSz7Comma-separated Discord user IDs allowed to use the botz*Allowed Discord user IDs (comma-separated)DISCORD_REPLY_TO_MODEzDiscord reply threading mode: 'off' (no reply references), 'first' (reply on first message only, default), 'all' (reply on every chunk)z"Discord reply mode (off/first/all)rzSlack bot token (xoxb-). Get from OAuth & Permissions after installing your app. Required scopes: chat:write, app_mentions:read, channels:history, groups:history, im:history, im:read, im:write, users:read, files:read, files:writezSlack Bot Token (xoxb-...)zhttps://api.slack.com/appsruSlack app-level token (xapp-) for Socket Mode. Get from Basic Information → App-Level Tokens. Also ensure Event Subscriptions include: message.im, message.channels, message.groups, app_mentionzSlack App Token (xapp-...)MATTERMOST_URLz3Mattermost server URL (e.g. https://mm.example.com)zMattermost server URLzhttps://mattermost.com/deploy/MATTERMOST_TOKENz-Mattermost bot token or personal access tokenzMattermost bot tokenMATTERMOST_ALLOWED_USERSz:Comma-separated Mattermost user IDs allowed to use the botz-Allowed Mattermost user IDs (comma-separated)MATTERMOST_REQUIRE_MENTIONzaRequire @mention in Mattermost channels (default: true). Set to false to respond to all messages.zRequire @mention in channels!MATTERMOST_FREE_RESPONSE_CHANNELSzJComma-separated Mattermost channel IDs where bot responds without @mentionz+Free-response channel IDs (comma-separated)MATRIX_HOMESERVERz7Matrix homeserver URL (e.g. https://matrix.example.org)zMatrix homeserver URLz%https://matrix.org/ecosystem/servers/MATRIX_ACCESS_TOKENz3Matrix access token (preferred over password login)zMatrix access tokenMATRIX_USER_IDz)Matrix user ID (e.g. @hermes:example.org)zMatrix user ID (@user:server)MATRIX_ALLOWED_USERSzLComma-separated Matrix user IDs allowed to use the bot (@user:server format)z)Allowed Matrix user IDs (comma-separated)r@zZRequire @mention in Matrix rooms (default: true). Set to false to respond to all messages.z&Require @mention in rooms (true/false)rIzCComma-separated Matrix room IDs where bot responds without @mentionz(Free-response room IDs (comma-separated)r,z@Auto-create threads for messages in Matrix rooms (default: true)z)Auto-create threads in rooms (true/false)rzNStable Matrix device ID for E2EE persistence across restarts (e.g. HERMES_BOT)z)Matrix device ID (stable across restarts)r/uMatrix recovery key for cross-signing verification after device key rotation (from Element: Settings → Security → Recovery Key)zMatrix recovery keyr>zOBlueBubbles server URL for iMessage integration (e.g. http://192.168.1.10:1234)zBlueBubbles server URLzhttps://bluebubbles.app/r6uJBlueBubbles server password (from BlueBubbles Server → Settings → API)zBlueBubbles server passwordBLUEBUBBLES_ALLOWED_USERSzJComma-separated iMessage addresses (email or phone) allowed to use the botz,Allowed iMessage addresses (comma-separated)BLUEBUBBLES_ALLOW_ALL_USERSz-Allow all BlueBubbles users without allowlistzAllow All BlueBubbles Usersr z.QQ Bot App ID from QQ Open Platform (q.qq.com)z QQ App IDzhttps://q.qq.com)rrrrr!z*QQ Bot Client Secret from QQ Open PlatformzQQ Client Secretr z2Comma-separated QQ user IDs allowed to use the botzQQ Allowed UsersrAz=Comma-separated QQ group IDs allowed to interact with the botzQQ Group Allowed Usersr.z4Allow all QQ users without an allowlist (true/false)zAllow All QQ Usersr-zMaximum tool-calling iterations per conversation (default: 90)zMax iterationsHERMES_TOOL_PROGRESSz=(deprecated) Use display.tool_progress in config.yaml insteadu.Tool progress (deprecated — use config.yaml)HERMES_TOOL_PROGRESS_MODEu.Progress mode (deprecated — use config.yaml)HERMES_PREFILL_MESSAGES_FILEzFPath to JSON file with ephemeral prefill messages for few-shot primingzPrefill messages file pathHERMES_EPHEMERAL_SYSTEM_PROMPTzOEphemeral system prompt injected at API-call time (never persisted to sessions)zEphemeral system prompt required_onlyc:g}tD]1\}}t|s|d|i|ddi2|sKtD]1\}}t|s|d|i|ddi2|S)z| Check which environment variables are missing. Returns list of dicts with var info for missing variables. name is_requiredTF)REQUIRED_ENV_VARSitems get_env_valueappendOPTIONAL_ENV_VARS)rZmissingvar_namers rjget_missing_env_varsres G,1133LL$X&& L NNFHJJmTJJ K K K Q/5577 Q QNHd ** QODO-OOPPP Nrlconfig dotted_keyc|d}|}|ddD];}||vs(t||tsi||<||}<|||d<dS)zSet a value at an arbitrarily nested dotted key path. Creates intermediate dicts as needed, e.g. ``_set_nested(c, "a.b.c", 1)`` ensures ``c["a"]["b"]["c"] == 1``. rN)split isinstancerddict)rfrgrpartscurrentparts rj _set_nestedrps   S ! !EGcrc    w  jT1B1BD&I&I GDM$-GE"Irlct}gddtdtdtffd t|S)z Check which config fields are missing or outdated (recursive). Walks the DEFAULT_CONFIG tree at arbitrary depth and reports any keys present in defaults but absent from the user's loaded config. r]defaultsrnprefixc`|D]\}}|dr|s|n|d|}||vr||d|dGt|tr;t||tr||||dS)NrrzNew config option: )rrPr)r_rrarkrlrd)rrrnrsr default_valuefull_key_checkrcs rjrwz)get_missing_config_fields.._checks"*.."2"2 > > C~~c"" "(?ss.?.?#.?.?H'!!#,#C#C#C   M400 >Z C@P@PRV5W5W >}gclH=== > >rl)r]) load_configrlrDEFAULT_CONFIG)rfrwrcs @@rjget_missing_config_fieldsrzsj]]FG > > > >c > > > > > > > F>6""" Nrlc ddlm}m}n#t$rgcYSwxYw|}|sgSt }g}|D]}|d|d}|d}|}d} |D](} t |tr| |vr || }|} &d} | )t | tr)| s| ||S)a3Return skill-declared config vars that are missing or empty in config.yaml. Scans all enabled skills for ``metadata.hermes.config`` entries, then checks which ones are absent or empty under ``skills.config.`` in the user's config.yaml. Returns a list of dicts suitable for prompting. r)discover_all_skill_config_varsSKILL_CONFIG_PREFIXrrN) agent.skill_utilsr|r} Exceptionrxrjrkrlrr`ra) r|r}all_varsrfrcvar storage_keyrmrnrros rjget_missing_skill_config_varsrs,YYYYYYYYY  .-//H  ]]F$&G  ,;;s5z;; !!#&&  D'4(( TW__!$- =Zs33=EKKMM= NN3    Ns   provider_keyentryrc  t|tsdSdddddddd }hd }|D]7\}}||vr.||vr*td |pd ||||||<8t ||z t |z }|r>td |pd dt|ddl m }d}dD]} | | } t| trd| rP| } || } | jr | jr| }n td|pd | | |sdSd} | d}t|tr)| r| } n(| r| } | sdS| |d}| }|r||d<| d}t|tr+| r| |d<| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| dp| d}t|tr+| r| |d<| d}t|tr|r||d<n&t|t r|rd|D|d<| d}t|t"r |dkr||d<| d}t|t"t$fr |dkr||d<|S)z>Return a runtime-compatible custom provider entry or ``None``.Nr6r5api_modekey_env default_modelcontext_lengthrate_limit_delay)apiKeybaseUrlapiModekeyEnv defaultModel contextLengthrateLimitDelay> apirr\rmodelsr6rrr5 transportrrrz[providers.%s: camelCase key '%s' auto-mapped to '%s' (use snake_case to avoid this warning)?z-providers.%s: unknown config keys ignored: %s, rurlparser])r5rruPproviders.%s: '%s' value '%s' is not a valid URL (no scheme or host) — skippedr\)r\r5rrrrci|];}t|t|+t|iz4_normalize_custom_provider_entry..~sO   *Q*<*< AB FFB   rl)rkrlr_loggerwarningsetkeysjoinsorted urllib.parserrdrr`schemenetloclistrfloat)rr_CAMEL_ALIASES _KNOWN_KEYScamelsnakeunknownrr5url_keyraw_url candidateparsedr\raw_namerhr6rr model_namerrrs rj _normalize_custom_provider_entryrs eT " "t'),&&NK ',,..(( u E>>e500 NN9#UE    !"ii ""G'30GMMOO0 '  9ii ""G'30GMMOO0 '  9yy$$> +(>(>H(C  2X^^%5%52!)!1!1 :7##Auyy'A'AJ*c""1z'7'7'9'91(..00 7 YYx F&$  F  % 8 FD ! ! f   &   8YY/00N.#&&6>A+=+='5 #$yy!344"S%L11:6F!6K6K)9 %& rlproviders_dictct|tsgSg}|D]:\}}t|t |}|||;|S)zMNormalize ``providers`` config entries into the legacy custom-provider shape.r)rkrlr_rrra)rcustom_providersrrrhs rj"providers_dict_to_custom_providersrsw nd + + -/$**,,00 U5e#c((SSS  !  # #J / / / rlc|t}gttdtttt fddffd }|d}|4t|tsgS|D]}|t|t|dD] }||S)ayReturn a deduplicated custom-provider view across legacy and v12+ config. ``custom_providers`` remains the on-disk legacy format, while ``providers`` is the newer keyed schema. Runtime and picker flows still need a single list-shaped view, but we should not materialise that compatibility layer back into config.yaml because it duplicates entries in UIs. NrrZc>|dSt|ddpd}t|ddpd}t|ddpdd}t|ddpd}|||f}|r|vrdS|r|r|vrdS||r||r|r|dSdSdS)Nrr]r\r5/r)rrdr`rarstripraadd) rrr\r5rpair compatibleseen_name_url_pairsseen_provider_keyss rj_append_if_newz7get_compatible_custom_providers.._append_if_news = F599^R88>B??EEGGMMOO 599VR((.B//5577==??uyyR006B77==??FFsKKQQSSEIIgr**0b117799??AAh&  L,>>> F  H ).context_length`` if present and valid. Returns ``None`` when no override applies. This is the single source of truth for custom-provider context overrides, used by: * ``AIAgent.__init__`` (startup resolution) * ``AIAgent.switch_model`` (mid-session ``/model`` switch) * ``hermes_cli.model_switch.resolve_display_context_length`` (``/model`` confirmation display) * ``gateway.run._format_session_info`` (``/info`` display) * ``agent.model_metadata.get_model_context_length`` (when custom_providers is threaded through) Before this helper existed, the lookup was duplicated in ``run_agent.py``'s startup path only; every other path (notably ``/model`` switch) fell back to the 128K default. See #15779. Nrr]rr5rrr) rrrdrkrrrlr TypeErrorr) rr5rrfrg target_urlr entry_urlr model_cfgraw_ctxctxs rj"get_custom_provider_context_lengthrs0 t D>vFF   D D D~tt**/00C&0d&;&;Css     D & - -t.b((--J t!%&&  YYz**0b88==  I33 8$$&$''  JJu%% )T**  -- 011 ?  g,,CC:&    H  77JJJ  4s& A.AA EE/.E/ct}|dd}tdd}||fS)zS Check config version. Returns (current_version, latest_version). rrr)rxrdry)rfrnlatests rjcheck_config_versionr sA ]]Fjj*A..G    11 5 5F F?rl>rrrrrAgatewayrrrr3rrrfallback_modelrrrr>r\rrr6rr5rr>r6rr5rc2eZdZUdZeed<eed<eed<dS) ConfigIssuez$A detected config structure problem.severitymessagehintN)__name__ __module__ __qualname____doc__r__annotations__rorlrjrr1 s1..MMM LLL IIIIIrlrc t|2 t}n"#t$rtdddgcYSwxYwg}|d}|t |t r|tdddt |t r!t|n t}|tz}|r5|tdd t|d d nt |trt|D]\}}t |t s>|tdd |d t|jddX|ds(|tdd |dd|ds(|tdd |dd|d}|t |t s:|tddt|jdnt|rr|ds$|tddd|ds$|tdddt |t r.d|vr*d|pivr$|tddd |d}|r&|s$|tdd!d"|D]V} | d#r| t vr5| tvr,|tdd$| d%d&| d'W|S)(a"Validate config.yaml structure and return a list of detected issues. Catches common YAML formatting mistakes that produce confusing runtime errors (like "Unknown provider") instead of clear diagnostics. Can be called with a pre-loaded config dict, or will load from disk. NerrorzCould not load config.yamlz+Run 'hermes setup' to create a valid configruOcustom_providers is a dict — it must be a YAML list (items prefixed with '-')zeChange to: custom_providers: - name: my-provider base_url: https://... api_key: ...rzRoot-level keys z( look like custom_providers entry fieldszLThese should be indented under a '- name: ...' list entry, not at root levelzcustom_providers[z] is not a dict (got )z1Each entry should have at minimum: name, base_urlr\z] is missing 'name' fieldz#Add a name, e.g.: name: my-providerr5z] is missing 'base_url' fieldzDAdd the API endpoint URL, e.g.: base_url: https://api.example.com/v1rzAfallback_model should be a dict with 'provider' and 'model', got zZChange to: fallback_model: provider: openrouter model: anthropic/claude-sonnet-4r4uHfallback_model is missing 'provider' field — fallback will be disabledz/Add: provider: openrouter (or another provider)ruEfallback_model is missing 'model' field — fallback will be disabledz8Add: model: anthropic/claude-sonnet-4 (or another model)zGfallback_model appears inside custom_providers instead of at root levelzDMove fallback_model to the top level of config.yaml (no indentation)u[custom_providers defined but no 'model' section — Hermes won't know which provider to useziAdd a model section: model: provider: custom default: your-model-name base_url: https://...rzRoot-level key 'uW' looks misplaced — should it be under 'model:' or inside a 'custom_providers' entry?zMove 'z' under the appropriate section)rxrrrdrkrlrarr_CUSTOM_PROVIDER_LIKE_FIELDSrr enumeratetyperr_KNOWN_ROOT_KEYS) rfissuescpcp_keys suspiciousirfbrrs rjvalidate_config_structurer: s~ w ]]FF w w w)EGtuuv v v v w!#F & ' 'B ~ b$  (  MM+a%   )32t(<(<Gc"''))nnn#%%G #??J  kcvj'9'9cccb D ! ! %bMM  5!%..MM+![A[[DKKDX[[[K## yy((MM+!HAHHH=## yy,,MM+!LALLL^## $ % %B ~"d##  MM+gTXY[T\T\Tegg7     66*%%  k^E 66'??  k[N"d 0 > >CSXZX`^`CaCa k  U R      7##I  )   k  i (      >>#     & & &32N+N+N MM+3====    Ms 22cT t|}n#t$rYdSwxYw|sdSdg}|D]1}|jdkrdnd}|d|d|j2|dt jd |d zdS) zPrint config structure warnings to stderr at startup. Called early in CLI and gateway init so users see problems before they hit cryptic "Unknown provider" errors. Prints nothing if config is healthy. Nu3⚠ Config issues detected in config.yaml:ru ✗u ⚠  z2 Run 'hermes doctor' for fix suggestions.  ) rrrrarrrwriter)rfrlinescimarkers rjprint_config_warningsr s*622   H IE11)+)?)?%%EY /&//2://0000 LLKLLLJTYYu%%./////s   ctjd}tjd}|! t}n#t$rYdSwxYw|di}t |t r|ddnd}|dv}g}|r|d|d |r|s|d |d |rtjd d }|d d|d|d|dtj d |dzdSdS)uWarn if MESSAGING_CWD or TERMINAL_CWD is set in .env instead of config.yaml. These env vars are deprecated — the canonical setting is terminal.cwd in config.yaml. Prints a migration hint to stderr. MESSAGING_CWD TERMINAL_CWDNrrr)rrrr]u ⚠ MESSAGING_CWD=u& found in .env — this is deprecated.u ⚠ TERMINAL_CWD= HERMES_HOMEz ~/.hermesru/⚠ Deprecated .env settings detected:zN Move to config.yaml instead: terminal:\n cwd: /your/project/pathz' Then remove the old entries from z /.envrr) r^rrdrxrrkrlrainsertrrrr)rf messaging_cwdterminal_cwd_env terminal_cfg config_cwdconfig_has_explicit_cwdr hint_paths rjwarn_deprecated_cwd_env_varsr s JNN?33Mz~~n55 ~  ]]FF    FF ::j"--L1;L$1O1OX!!%---UXJ(0HHE   #- # # #    7   #1A # # #    4JNN=+>>  QOPPP  >     P P P P    5))F233333 4 4sA AA interactivequietc *Mgggd} t}|r|std|dn#t$rYnwxYwt\}}|dkrFt }|di}t |tsi}d|vrtd}td} |r7| d vr!d |d<|d  d n| r_| d vrI| |d<|d  d| dn d|d<|d  d||d<t||std|d|dkrt }d|vrtj dd} | r]| rI| |d<|d  d| dn d|d<|d  dt||s|dpd} td| |dkrD td} | r!tdd|stdn#t$rYnwxYw|dkrt }|d } t | t r| r|d!i}t |tsi}d"}| D]}t |ts|d#d}|d$dp|d%dpd}|d&d}|sv| d'd(d)dd*d}d+|vr|d+d(}d+|v|d(}|sE d"d,lm}||}|jpd-d.d(}n#t$rd/|}YnwxYw||vr|d(|}d0|i}|r||d#<|r |d1vr||d&<|d2r |d2|d3<|d4r |d4|d5<|||<|d6z }|d"kr||d!<|d d7t||sqtd8|d9t!|| d7D]3}||}td:|d;|d0d4|d|d?:#t$rYFwxYw|d@kr]t/}|dAi}t |tr#d2|vr|d2}|dBdC}t }|dAi}|d2d7|dDvrShdE} || vrJ|dCi}!t |!trd2|!vr|dCi}"||"d2<nJ||i}#t |#trd2|#vr||i}$||$d2<||dA<t||stdF|dGkrt/}|di}t |tsi}dH|vrEdI|dH<||d<|d  dJt||stdK|dLkrEt/}|di}t |tsi}|dM}%t |%tr|%r|dNi}&t |&tsi}&|%D]#\}'}(|'|&vri|&|'<d|&|'vr |(|&|'d<$|&|dN<||d<t||sCdOdP|%D})tdQ|)|d  dR|dSkrt/}|dTi}*t |*tr|*dUd7}+|*dVd7},|*dWd7}-g}.|+rt7|+r}|dXi}/|/dTi}0|0d2sn+tSdt||>rPt||dv |n9tSdt|Cdu|:d}>|>r=t|:|>|dv |:tdw|:tOntdt_}E|Er{t }|ED]U}F|Fd}|Fd}Gta|||G|d  ||std|d|GV||d<t|n(||kr"t }||d<t|tc}H|Hr*|r'|s$tdtM|Hd|HD]=}<|<dd}Itd|t tSd }Dn#tZt\f$rd}DYnwxYw|DdvrTtt } d"dl2m3}Jn#t$rd}JYnwxYw|HD] }<|<dd}G|Grd|Gd*nd}KtSdt||>s|Grt7|G}>|>r[|Jd.||d  |n<|dx dy| from .env (no longer used — config.yaml is source of truth)rtr4r)r local_command>base.entiny.enlarge-v1large-v2large-v3small.en medium.enlarge-v3-turbodistil-large-v2distil-large-v3distil-small.endistil-medium.endistil-large-v3.5rutinylargesmallturbomediumu; ✓ Migrated legacy stt.model to provider-specific configrUTz1display.interim_assistant_messages=true (default)u3 ✓ Added display.interim_assistant_messages=truerWrYrc3*K|]\}}|d|VdS)rNro)rprs rj z!migrate_config.. s0$R$RDAqZZAZZ$R$R$R$R$R$Rrlu> ✓ Migrated tool_progress_overrides → display.platforms: z9display.platforms (migrated from tool_progress_overrides)r summary_modelsummary_providersummary_base_urlr3model=)r]rr provider=z base_url=u@ ✓ Migrated compression.summary_* → auxiliary.compression: u/ ✓ Removed unused compression.summary_* keyspluginsrr+z plugin.yamlz plugin.ymlz$plugins.enabled (opt-in allow-list, z grandfathered)u( ✓ Plugins now opt-in: grandfathered z( existing plugin(s) into plugins.enabledum ✓ Plugins now opt-in: no existing plugins to grandfather. Use `hermes plugins enable ` to activate.zConfig version:  → rZu0 ⚠️ Missing required environment variables:u • rz Let's configure them now: z Get your key at: rrrru ✓ Saved rzSkipped z - some features may not workFch|] }|d S)r\rorvs rj z!migrate_config..p s555Aai555rlcRg|]#}|dv |d!|$S)r\rrd)rr<required_namess rj z"migrate_config..q sC V9N * *1553D3D * * * *rlc\g|])}t|s|tv|t|f*Sro)r`rb)rr\s rjrAz"migrate_config..| sK    && ,03D+D+D$T* ++D+D+Drl z$ new optional key(s) in this update:u • u — z Configure new keys? [y/N]: n)yrSz (Enter to skip): z1 Set later with: hermes config set rrPu ✓ Added  = rz! skill setting(s) not configured:skillrz (from skill: z# Configure skill settings? [y/N]: )r}z skills.configz (default: u — skill 'rz' may ask for it later)4sanitize_env_filerrrrxrdrkrlr`rara save_configr^r_r`save_env_valuerreplacerrhostnamepoprread_raw_config setdefaultr_rrrrerriterdirrfryaml safe_loadr\lenregetpassinputrangeupdaterEOFErrorKeyboardInterruptrzrprr~r})Nrrresultsfixes current_ver latest_verrfrA old_enabledold_modeold_tz tz_display old_token custom_listrmigrated_countrold_nameold_urlold_keyrrr new_entryepdead_varold_valrgraw_stt legacy_modelr4rt _local_models raw_local local_cfg raw_provider provider_cfg old_overridesrYplatrmigratedcomps_model s_provider s_base_url migrated_keysauxaux_comp plugins_cfgr+ disabled_set grandfathereduser_plugins_dirchild manifest_file_mfmanifestr\ missing_envrrTrmissing_optional new_var_namesver new_and_unsetranswermissing_configfieldrPmissing_skill_config skill_namer} default_hintrr@sN @rjmigrate_configr sCCG !##  Q Q OuOOO P P P      344KQ**Y++'4(( G ' ) )'(>??K$%@AAH V{00226JJJ+0('../lmmmm Vhnn...@@+3>>+;+;('../{HXHX/{/{/{||||+0('../TUUU 'F9      b`goF^``aaaQ V # #Y0"55F W&,,.. W%+\\^^z"'../b6<<>>/b/b/bcccc%'z"'../UVVV     L#J/C3C JjJJKKKQ %&788I V0"555VTUUU    D Rjj!344 k4 ( (9 E[9 E#ZZ R88Nnd33 $!#N$) $) $!%.. 99VR00))J33Quyy7K7KQr))Ir22nn&&,,..66sC@@HHbQQYYZ]_abbckk++dC00Cckkiinn;;999999!)'!2!2%<*EEc3OO$;;;:.::;.(( 33>33C"G, 1(0If%3w.OOO+2Ii(99W%%@16wIo.99Z((?-2:->Ik*&/s#!#!!&4{# -t444F###EeNeeefff#N$7$7$9$9::N?;K;KLEE+C0CCCub0A0ACCDDDD R5  H '11y"8R000 ywxwwwxxx    R''%$$ gt $ $% VG););"7+L{{:w77H ]]F**UB''C GGGT " " "555!!!  =00!( GR 8 8I%i66:':R:R$'NN7B$?$? -9 '* '{{8R88 !,559 9T9T#&>>(B#?#?L,8L)F5M     VTUUUR ""**Y++'4(( G 'w 6 648G0 1 'F9  N # * *+^ _ _ _     MKLLLR ""**Y++'4(( G $=>> mT * * h} h K44Ii..  +1133 < < dy((&(IdO")D/997;IdOO4#,GK 'F9      c99$R$RM>-<<||G,,=(+G (:(:(<(>-<<||J//C8<< 3K3Kv3U3U+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Cc*oo3355 C'' R88>>-<<||J//C+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Q 3z7MQ[Qg(,}%F###Q$Q{aeajajkxayay{{||||OPPPR ""jj++ +t,, K K ' '"z266<"Hh-- x==L(*M ##2#4#4y#@ #**,,3!'(8(@(@(B(B!C!C33$||~~%$(- (= ,3355A,1L,@M,3355%$*!%m!4!4E+/>#+>+>+D"EEEEEEEEEEEEEEE(***')HHH*'||F33Auz<//$%,,T2222 # # # "  #&3K " +F9      N # * *Zs=7I7IZZZ     X}--XXX J Z ???:??@@@'T:::KA5A ABBB A AC ?CK??3}+=?? @ @ @ @{ -...  Cwwu~~ :8CJ88999wwz"" >(>S](>(>(>??43x=44455;;== bs6{E222 $++CK8882S[223333 #**+`c&k+`+`+`aaa GGGG,%@@@9DO555555#%%N# EEM[1_j1n55??044S"==>>>>#K#KU#K  }--    K Q]++QQQ R R R+ K K dIIIDHH]B,G,GIIJJJJ GGG >??EEGGMMOO/0    %%"/JD$xxDB488M4#@#@BBCCCADKAABBBBB488M4#@#@BBCCCxx ++a& '0aTXXh5M5M0a0a0a b b %&W488Hd+C+C&W&W&W X X ^ ^ ` `5&tU333 ,33D9993T33444GGGG"IJJJ/00N# 8 8E,CI&G W - - - N # * *3 / / / 86S66W66777%/ !F z ! !$. !F 9::$G $GE$G QS-..QQQRRR' _ _C)44J ]SZ]]c-.@]]PZ]]] ^ ^ ^ ^  @AAGGIIOOQQFF+,   FFF  \ ! ! GGG ]]F 6AAAAAAA 6 6 6&5### 6+  '')R00;BJ7W7777 B3x=B,BBBCCIIKK))LLE%8"G"G3u:"G"GK U;;;N+223u:>>>?U????@@@@J'..h3u:hh3777C;P;Phhh      E F F F Ns%/ <<=2J00 J=<J=.Q11RR!6W W%$W%>Bvu u5 u u u u u  v uvu:v v&%v&C3ADDADDADO3AO<O<APPAPP7AP>P> AQ Q AQ overridec|}|D]X\}}||vrJt||tr/t|trt |||||<S|||<Y|S)aRecursively merge *override* into *base*, preserving nested defaults. Keys in *override* take precedence. If both values are dicts the merge recurses, so a user who overrides only ``tts.elevenlabs.voice_id`` will keep the default ``tts.elevenlabs.model_id`` intact. )copyr_rkrl _deep_merge)rurresultrrs rjrr sYY[[Fnn&&  U 6MM6#;-- 5$'' &fSk599F3KKF3KK Mrlct|trtjdd|St|trd|DSt|t r d|DS|S)aRecursively expand ``${VAR}`` references in config values. Only string values are processed; dict keys, numbers, booleans, and None are left untouched. Unresolved references (variable not in ``os.environ``) are kept verbatim so callers can detect them. z \${([^}]+)}ctj|d|dS)Nrr)r^rrdgroup)rs rjz"_expand_env_vars.. s*bjnnQWWQZZ<<rlc4i|]\}}|t|Sro_expand_env_vars)rkr<s rjrz$_expand_env_vars.. s'???41a#A&&???rlc,g|]}t|Sror)ritems rjrAz$_expand_env_vars.. s!7774 &&777rl)rkrresubrlr_r)objs rjrr s#s v  < <    #t@??399;;????#t87737777 Jrlct|tsdSi}|D]V}t|tr(t|dtsdS|d}||vrdS|||<W|S)zHReturn a name-indexed dict only when all items have unique string names.Nr\)rkrrlrdr)r_indexedrr\s rj_items_by_unique_namer s eT " "tG$%% Z8H8H#-N-N 44F| 7??44 Nrlct|trfttrQtjdr<|krSttr|krSt |krS|St|t r6tt r!fd|DSt|trqttr\t|}tt|fd|DSfdt|DS|S)aRestore raw ``${VAR}`` templates when a value is otherwise unchanged. ``load_config()`` expands env refs for runtime use. When a caller later persists that config after modifying some unrelated setting, keep the original on-disk template instead of writing the expanded plaintext secret back to ``config.yaml``. Prefer preserving the raw template when ``current`` still matches either the value previously returned by ``load_config()`` for this config path or the current environment expansion of ``raw``. This handles env-var rotation between load and save while still treating mixed literal/template string edits as caller-owned once their rendered value diverges. z \${[^}]+}c i|]T\}}|t||ttr|ndUSN)_preserve_env_ref_templatesrdrkrl)rrrloaded_expandedrgs rjrz/_preserve_env_ref_templates..5 sr   U , ,6,M,MW##C(((SW   rlNc g|]c}t||d(|dnddS)r\N)rrd)rrloaded_by_name raw_by_names rjrAz/_preserve_env_ref_templates..G s{  ,OODHHV$4$455.O s    t (#c#hh..E Dot449>_AUAU9U9U &&       rl) rkrrsearchrrlr_rrr)rnrgrcurrent_by_namerrs `` @@rjrr s'3JsC$8$8RY|UX=Y=Y c>>J os + + ?0J0JJ C G + +J'4   ZT%:%:      &mmoo     '4   ZT%:%: 088+C00 .??  &;+B $         )11     NrlcjtfddD}|sStd}t|ts |rd|ini}|d<dD]I}|}|r||s|||<|dJS)uMove stale root-level provider/base_url into model section. Some users (or older code) placed ``provider:`` and ``base_url:`` at the config root instead of inside ``model:``. These root-level keys are only used as a fallback when the corresponding ``model.*`` key is empty — they never override an existing ``model.provider`` or ``model.base_url``. After migration the root-level keys are removed so they can't cause confusion on subsequent loads. c3BK|]}|VdSrr?)rrrfs rjr/z-_normalize_root_model_keys..h s-CCQ6::a==CCCCCCrl)r4r5rrPN)anyrlrdrkrM)rfhas_rootrrroot_vals` rj_normalize_root_model_keysr] sCCCC*BCCCCCH  &\\F JJw  E eT " " &+3E""w'::c??  "EIIcNN "!E#J 3 Mrlct|}t|dpi}d|vrd|vr |d|d<d|vrtdd|d<||d<|dd|S)z;Normalize legacy root-level max_turns into agent.max_turns.rrN)rlrdryrM)rf agent_configs rj_normalize_max_turns_configr{ s &\\F 7++1r22LfL!@!@$*;$7 [!,&&$27$;K$H [!"F7O JJ{D!!! Mrlc t}|r?t|d5}tj|picdddS#1swxYwYn#t $rYnwxYwiS)aORead ~/.hermes/config.yaml as-is, without merging defaults or migrating. Returns the raw YAML dict, or ``{}`` if the file doesn't exist or can't be parsed. Use this for lightweight config reads where you just need a single value and don't want the overhead of ``load_config()``'s deep-merge + migration pipeline. rrN)rrfrrQrRr) config_pathrs rjrNrN s %''      /kG444 /~a((.B / / / / / / / / / / / / / / / /      Is43A$A A$AA$A A$$ A10A1ctt}tjt}|r t |d5}tj|pi}dddn #1swxYwYd|vr_t| dpi}| d |d|d<||d<| ddt||}n)#t$r}td|Yd}~nd}~wwxYwtt!|}t#|}tj|t$t'|<|S)z.Load configuration from ~/.hermes/config.yaml.rrNrrz Warning: Failed to load config: )rrrdeepcopyryrfrrQrRrlrdrMrrrrrrr r)rrfr user_configagent_user_configerhexpandeds rjrxrx s!##K ]> * *F: :kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6k))$()A)A)GR$H$H!$((55=5@5M%k2'8 G$ T222 55FF : : : 8Q88 9 9 9 9 9 9 9 9 :,,G,O,OPPJ ++H6:mH6M6M!#k"2"23 Os= C>A?3 C>?BC>BA6C>> D$DD$u # ── Security ────────────────────────────────────────────────────────── # API keys, tokens, and passwords are redacted from tool output by default. # Set to false to see full values (useful for debugging auth issues). # tirith pre-exec scanning is enabled by default when the tirith binary # is available. Configure via security.tirith_* keys or env vars # (TIRITH_ENABLED, TIRITH_BIN, TIRITH_TIMEOUT, TIRITH_FAIL_OPEN). # # security: # redact_secrets: false # tirith_enabled: true # tirith_path: "tirith" # tirith_timeout: 5 # tirith_fail_open: true u # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 uv # ── Security ────────────────────────────────────────────────────────── # API keys, tokens, and passwords are redacted from tool output by default. # Set to false to see full values (useful for debugging auth issues). # # security: # redact_secrets: false # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 c trtddSddlm}t t }t t|}|}t tt}|r6t||t t|}g}| di}|r| d| t| di}|r?t|t r*| dr| d s| t"||||rd |nd t'|t)j|tt|<dS) z,Save configuration to ~/.hermes/config.yaml.zsave configurationNratomic_yaml_writerrrr4rr]) extra_content)rprutilsrrrrrrNrr rdrra_SECURITY_COMMENTrkrl_FALLBACK_COMMENTrrrr) rfrrcurrent_normalizedrh raw_existingrmsecrs rjrIrI s||*+++''''''!##K34OPV4W4WXX#J-.I/J[J[.\.\]]L 0   ) - -c+.>.> ? ?   E ..R ( (C (#''*++3 &''' (" - -B (ZD))("&&2D2D(PW( &'''(-7bggennn4 6:mDV6W6W!#k"2"2333rlc t}i}|rtrdddni}t|fi|5}|}dddn #1swxYwYt |}|D]}|}|rn|dsYd|vrU|d\}}} | d||<|S)aLoad environment variables from ~/.hermes/.env. Sanitizes lines before parsing so that corrupted files (e.g. concatenated KEY=VALUE pairs on a single line) are handled gracefully instead of producing mangled values such as duplicated bot tokens. See #8908. rrKrerrorsNrrz"') rrf _IS_WINDOWSr readlines_sanitize_env_linesr`rr) env_pathenv_varsopen_kwr raw_linesrrrrrs rjload_envr( sM~~HH CALSw)<<>((   ! # #  " " "$S%9%9::O#O44 2 2301AO8L8L0L0Loa!e,,RUV^R_R_C(..002$$TD[111  2   X_ - - - - rlc6t}|sdStrdddni}trddini}t|fi|5}|}dddn #1swxYwYt |}||krdSt t|t|z }|dkrVtdt||D}|t t|t|z z }tj t|j dd \}} tj|d fi|5}|||tj|dddn #1swxYwYtj||n5#t*$r( tj|n#t.$rYnwxYwwxYwt1||S) zRead, sanitize, and rewrite ~/.hermes/.env in place. Returns the number of lines that were fixed (concatenation splits + placeholder removals). Returns 0 when no changes are needed. rrrKrrNc3,K|]\}}||k dVdS)rNro)rabs rjr/z$sanitize_env_file.. s*KK$!QAFFAFFFFKKrl.tmp.env_dirsuffixrsw)rrfrrrrabsrSsumziptempfilemkstemprrr^fdopen writelinesflushfsyncfilenorK BaseExceptionunlinkrr) rread_kwwrite_kwroriginal_linesrr[fdtmp_paths rjrHrHx s ~~H ??  q. s(::DKKK::::::rlNrz ... and morer]z The non-ASCII characters have been stripped automatically. If authentication fails, re-copy the key from the provider's dashboard. r}) encodeUnicodeEncodeErrorrordradecoderrrSrr)rr bad_charsrchrs rj_check_non_ascii_credentialr  sc  W      I5!!JJ2 r77S==   H1HHHH#b''HHHH I I I WX 66==gFFI      ))::IbqbM::: : :  ; "%Y!!3!3    =  W  WZ     s  &&ctrtd|dSt|st d||dddd}t ||}tt}trddd ni}trd dini}g}| rHt|fi|5}| }dddn #1swxYwYt|}d }t|D]>\}} | |d r|d |d||<d }n?|sH|r+|dds|dxxdz cc<||d |dt'jt+|jdd\} } d} | r= t/j|j} n#t4$rYnwxYw t7j| dfi|5}|||t7j| dddn #1swxYwYt7j| || ' t7j!|| n#t4$rYnwxYwn5#tD$r( t7j#| n#t4$rYnwxYwwxYwtI||t6j%|<dS)z)Save or update a value in ~/.hermes/.env.zset N#Invalid environment variable name: rr] rrKrrFrTrirrrr)&rpr_ENV_VAR_NAME_REmatchrrKr rrrrfrrrrr`rendswithrarrrrstatS_IMODEst_moderr^rrrrrrrrrr) rrrrrrrfoundrrrr original_modes rjrJrJ s(||lSll###  ! !# & &HFsFFGGG MM$ # # + +D" 5 5E 'U 3 3E~~H=HO7i888RG(3; G$$H E+ ( & &g & & "!KKMME " " " " " " " " " " " " " " "$E** EU##4 ::<< " "c999 - - )))))E!HE E  )  r++D11  "III III ''e'''(((#HO(<(.)s:RRR$tzz||/F/F#yyy/Q/QRRRRrlrrrr)!rprrrrrrfr^rrMrrrrrSrrrrrrrrrrrrrrKrrrr) rrrrrr new_linesrrrrs ` rjremove_env_valuers\ ||ooo&&&u  ! !# & &HFsFFGGG~~H ??   sD!!!u>#  % ' '#BJsO QJE h  3"*#4#4 3 QJE Lrlc|tjvrtj|St}||S)z/Get a value from ~/.hermes/.env or environment.)r^rrrd)rrs rjr`r`s: bjz#zzH <<  rlc|stdtjSt|dkrdS|dddz|ddzS)zRedact an API key for display. (not set)rz***Nr...)rOrNDIMrS)rs rj redact_keyr4sO .[&*--- 3xx"}}u rr7U?SX %%rlc jt}tttdtjttdtjttdtjtttdtjtjtdt tdttdttttdtjtjgd }|D]7\}}t|}td |d d t|8d dl m }|}td dd d t|tttdtjtjtd| ddtd| di dtddtttdtjtj| di}td| ddtd| ddrdnd td!| d"drdnd t| d#it r| d#ini}| d$d%} | d&d%} td'| d(| d)tttd*tjtj| d+i} td,| d-d.td/| d0d1td2| d3d4d5| d-d6kr(td7| d8d9nj| d-d:kr(td;| dkrLtd?| d@d9tdA} tdB| rdCndDn| d-dEkrLtdF| dGd9tdH} tdI| rdCndDn_| d-dJkrFtdK}tdL}tdM|pdDtdN|pdDtttdOtjtj| dPdQ}|rtdR|n*tdRtdStjtttdTtjtj| dUi}| dVdW}tdX|rdYndZ|rtd[| d\d]d^zd_d`tda| dbdcd^zd_ddtde| dfdgdh| dii dUi}| ddQpdj}td|| dkdl}|r|dlkrtdm|| dii}| dni| doidp}t%dq|D}|rtttdrtjtj|D]\}}| dkdl}| ddQ}|dlks|rIds|g}|r|dt|td |dud dv|tttdwtjtjtdx}tdy}tdz|rdCntd{tjtd||rdCntd{tj d d}lm} m}!| }"|"r|!|"}#tttd~tjtj|"D]}$|$d}%|# |%dQ}|$ ddQ}&|rt5|ntdDtj}'td |%dd |'d td|&dtjn#t6$rYnwxYwtttdtjttdtjttdtjttdtjtdS)zDisplay current configuration.u┌─────────────────────────────────────────────────────────┐u@│ ⚕ Hermes Configuration │u└─────────────────────────────────────────────────────────┘u ◆ Pathsz Config: z Secrets: z Install: u ◆ API Keys) )r OpenRouter)rzOpenAI (STT/TTS))rExa)rParallel)r Firecrawl)rTavily)r Browserbase)r$z Browser Use)rFALrz<14rr)get_anthropic_key Anthropicu ◆ Modelz Model: rznot setz Max turns: rru ◆ DisplayrAz Personality: rCrDz Reasoning: rJFonr~z Bell: rIrQrSrRrTz User preview: first z line(s), last z line(s)u ◆ Terminalrz Backend: rrz Working dir: rrz Timeout: rrsrz Docker image: rr singularityz Image: rrmodalz Modal image: rMODAL_TOKEN_IDz Modal token: configuredr0daytonaz Daytona image: rDAYTONA_API_KEYz API key: sshTERMINAL_SSH_HOSTTERMINAL_SSH_USERz SSH host: z SSH user: u ◆ Timezonerr]z Timezone: r u◆ Context CompressionrrTz Enabled: rSr z Threshold: r!rdz.0f%z Target ratio: r"rz% of threshold preservedz Protect last: r#r z messagesr3z(auto)r4rz Provider: r:r;)Visionz Web extractc3vK|]4}|dddkp|ddV5dS)r4rrr]Nr?)rts rjr/zshow_config.. s\  j&!!V+AquuWb/A/Arlu ◆ Auxiliary Models (overrides)r5r412sru◆ Messaging Platformsr5r9z Telegram: znot configuredz Discord: )r|resolve_skill_config_valuesu◆ Skill SettingsrrGz<20s[]u────────────────────────────────────────────────────────────z+ hermes config edit # Edit config filez! hermes config set z+ hermes setup # Run setup wizardN)rxrrOrNCYANBOLDrrrr`r4hermes_cli.authr=rdryrkrlr3rvaluesr_rarr~r|rPrr)(rfrenv_keyr\rr=anthropic_valuerAump ump_firstump_lastr modal_token daytona_keyssh_hostssh_usertzrr _aux_comp_sm comp_providerr3 aux_tasks has_overrideslabeltask_cfgprovmdlrmtelegram_token discord_tokenr|rP skill_varsresolvedrrr display_vals( rj show_configros ]]F GGG %DFLFQ R RSSS %RTZT_ ` `aaa %DFLFQ R RSSS GGG % V[&+ 6 6777 0_.. 0 0111 -\^^ - -... 1-// 1 1222 GGG % V[ 9 9:::   D33 g&& 14111j//112222111111''))O >{ > > >O! >??? GGG % V[&+ 6 6777 =VZZ;; = =>>> mVZZ4488nU\F]^iFjkk m mnnn GGG % v{FK 8 8999jjB''G CW[[AA C CDDD VW[[1A5%I%ITTTu V VWWW XW[[1CU%K%KVTTQV X XYYY5? Lbdf@g@gim5n5n v'++,b 1 1 1tvC q))Iww|Q''H O9 O OX O O OPPP GGG % V[ 9 9:::zz*b))H ?X\\)W== ? ?@@@ 7X\\%55 7 7888 ;X\\)R88 ; ; ;<<<||I(** mn>j!k!kmmnnnn i M 1 1 {.ACx!y!y{{|||| i G + + lm=i!j!jllmmm#$455  O!M+OOPPPP i I - - o(,,@l"m"mooppp#$566  O!M+OOPPPP i E ) ) !455 !455 :!8[::;;; :!8[::;;; GGG % V[ 9 9::: J # #B H %%%&&&& F'7!D!DFFGGG GGG %)6; D DEEE**]B//Kooi..G 9g7UU4 9 9::: 6 Pd!C!Cc!IPPPPQQQ j!F!F!Ljjjjkkk Q1A2!F!FQQQRRRJJ{B//33M2FF mmGR((4H &&&'''! j&99  6]f44 4]44 5 5 5 ;++I }}Xr22 }}]B77I!!##M <  e6 V[QQRRR(00 < >H GGG %,fk6;GG H H H! ] ]%j S"-- WWWb11 ,1Uc%jjju[&*7U7U [3[[[k[[U;Lz;L;L;Lfj5Y5Y[[\\\\       GGG % FJ ' '((( %=vz J JKKK %3VZ @ @AAA %=vz J JKKK GGGGGs2C8m++ m87m8c(trtddSt}|s&t t t d|tjdptjd}|s"dD]}ddl }| |r|}n |s#t dt d |dSt d |d |d tj |t|gdS) z"Open config file in user's editor.zedit configurationNzCreated EDITORVISUAL)nanovimvicodenotepadrz#No editor found. Config file is at:rzOpening  in r1)rprrrfrIryrr^r_shutilwhich subprocessrunr)reditorcmdrys rj edit_configr>sE||*+++!##K     (N### &&&'''Yx 7BIh$7$7F ;  C MMM||C      3444  ;  !!! 1[ 1 1f 1 1 1222NFC ,,-.....rlc^trtddSgd}||vsN|ds'|drEt ||t d|dtdSt}i}| rS t|d 5}tj |pi}dddn #1swxYwYn#t$ri}YnwxYw|d }|}|dd D];}||vs(t||t"si||<||}<|d vrd }nu|dvrd}n\|rt)|}n8|d ddrt-|}|||d <t/ddlm} | ||ddddddddddddd d!d"d#d$} || vr#t | |t5|t d|d%|d|dS)&zSet a configuration value.zset configuration valuesN)rrr%rrrrrrrrr rrrr$rr5r9rHrIr"rSrrr1r2r,r()_API_KEY_TOKEN TERMINAL_SSHu✓ Set rxrrrri)rQrSr?T)rr r~Fr]rrr) sort_keysrrTERMINAL_DOCKER_IMAGETERMINAL_SINGULARITY_IMAGETERMINAL_MODAL_IMAGETERMINAL_DAYTONA_IMAGE&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACErTERMINAL_TIMEOUTTERMINAL_SANDBOX_DIRTERMINAL_PERSISTENT_SHELLTERMINAL_CONTAINER_CPUTERMINAL_CONTAINER_MEMORYTERMINAL_CONTAINER_DISKTERMINAL_CONTAINER_PERSISTENT)zterminal.backendzterminal.modal_modezterminal.docker_imagezterminal.singularity_imagezterminal.modal_imagezterminal.daytona_imagez&terminal.docker_mount_cwd_to_workspacez terminal.cwdzterminal.timeoutzterminal.sandbox_dirzterminal.persistent_shellzterminal.container_cpuzterminal.container_memoryzterminal.container_diskzterminal.container_persistentrF)rprupperrrrJrrrrfrrQrRrrjrkrdrlraisdigitrrKrrrrr) rrapi_keysrrrrmrnror_config_to_env_syncs rjset_config_valuer^sR||0111   H yy{{h#))++"6"67M"N"NRUR[R[R]R]RhRhiwRxRxsyy{{E*** 222,..22333 "##KK kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6   KKK  IIcNNEGcrc    w  jT1B1BD&I&I GDM$- {{}}--- 0 0 0 E  sB " " * * , ,e GE"I''''''k;%@@@@ +4!8&B 6":2Z&. 6%@":%@#<)H" !!!*3/U<<< 5S 5 5U 5 5 5 566666s62D2D& D2&D**D2-D*.D22 EEc  t|dd}||dkrtdS|dkrtdS|dkrt|dd}t|dd}|r|mtdttd td td td t jd t ||dS|dkrttdS|dkrttdS|dkrtttdtj tj ttd}t}t\}}|s?|s=||kr7ttdtjtdS||krtd|d||r tdt#|dd|D}d|D} |r=tdt#|d|D]} td| d| rztdt#| d | D]W} | d!g} | r!d"d#| dd$d%nd&} td| d| Xtt)d'd(} t| d)s| d*r'ttd+tj| d,rCt| d,D],}ttd-|tj-tdS|d.krtttd/tj tj tt\}}||krtd|d0n.ttd|d|d1tjtttd2tj t,D]O}t/|rtd3|$ttd4|d5tjPtttd6tj t2D]\}}t/|rtd3|'|d!g} | r dd#| dd$nd&} ttd7|| tjt}|rUtttd8t#|d9tjtd:tdStd;|ttd<td=td>td?td@tdAtdBtdCt jd dS)DzHandle config subcommands.config_commandNshoweditrrrz&Usage: hermes config set z Examples:z3 hermes config set model anthropic/claude-sonnet-4z+ hermes config set terminal.backend dockerz0 hermes config set OPENROUTER_API_KEY sk-or-...rrzenv-pathmigrateu*🔄 Checking configuration for updates...Fr9u ✓ Configuration is up to date!z Config version: r8rCz1 new config option(s) will be added with defaultsc<g|]}|d|S)r]r?r;s rjrAz"config_command..s)KKK!aeeM6J6JKAKKKrlcfg|].}|d|d,|/S)r]rr?r;s rjrAz"config_command..sN   55'' 01j0A0A    rlu ⚠️ z required API key(s) missing:u • r\u ℹ️ z$ optional API key(s) not configured:rz (enables: rrRrr]T)rrrru✓ Configuration updated!ru ⚠️ checku📋 Configuration Statusu ✓z (update available)z Required:u ✓ u ✗ z (missing)z Optional:u ○ rz new config option(s) availablez+ Run 'hermes config migrate' to add themzUnknown config command: zAvailable commands:z4 hermes config Show current configurationz/ hermes config edit Open config in editorz6 hermes config set Set a config valuez; hermes config check Check for missing/outdated configz8 hermes config migrate Update config with new optionsz/ hermes config path Show config file pathz- hermes config env-path Show .env file path)getattrrorrrexitrrrrOrNrSrTrerzrGREENrSrdrrYELLOWr^r`REDrbr_r3)argssubcmdrrrrr\r]required_missingoptional_missingrr tools_strrZrrdrs rjrrsA T+T 2 2F ~6)) 6   5dE4((gt,, em : ; ; ; GGG +    G H H H ? @ @ @ D E E E HQKKKe$$$$$ 6   o     :   lnn 9    e@&+v{[[\\\ +??? 244"6"8"8 Z > kZ6O6O %:FLII J J J GGG F  # # E{EEEE F F F  a _^,,___ ` ` `KK{KKK  "     1 U%5!6!6UUU V V V' 1 1/#f+//0000  < \%5!6!6\\\ ] ] ]' < <,,EJRA$))E"1"I*>*>AAAAPR :#f+:y::;;;; !T???  ;  E7>#: E %4flCC D D D :  D GGG":. D De222FMBBCCCC  7    e/fkJJKKK "6"8"8 Z * $ $ 8{888 9 9 9 9 %^[^^z^^^`f`mnn o o o  eM6;//000) J JHX&& J+++,,,,e;x;;;VZHHIIII  eM6;//000/5577 K KNHdX&& K+++,,,,"-->CK:DIIeBQBi$8$8::: e>>  rl)rv)r{)Fr)NN)TF)prrrr^platformrrr{rr dataclassesrpathlibrtypingrrrrr getLoggerrrsystemrcompilerr rr frozensetrrQhermes_cli.colorsrNrOhermes_cli.default_soulrPrbrcrkboolrprsrurzrrlrrrerrrrrrrrrryrrr^rbrerprzrrrrrrr_VALID_CUSTOM_PROVIDER_FIELDSrrrrrrrrrrrrrNrxrr_COMMENTED_SECTIONSrIrrrrHr rJrr!r#r%r*r-r`r4rorrrrorlrjrs &       !!!!!!33333333333333  8 $ $ho9, 2:9::02tCH~222)6 ++++++++333333,     HSM    ,D,,,,HSM;C;;;; 3s8;;#;;;;*$****d-,,,,,-----&d&&&&2$2222   4t2   $$4&&&0"d"""",k  Rk k "k !" k   k     "$ !'$'$'O(( k `C7CfC sC 3 C 2C* B+CD dECF DGCH bICT bUCV RWCX CYCZ E[C^ _C` DaCb %cCd eCt*/ !ECCCak j! #'+ ( "5  kk Z[k j7kk JKk V Wk jTkk v! $  %'!#&-  wk f "                       wCCgk p5x & ;  E  %  U "7  U   ! !  %d!" #$ "2%& q'( R)qk ` a k k j ek k |   ' /0  '      ->  3   3  } k ~    [  *    k \  !$  ] k n o k F ,G k P   $!   Q k p  !%!$#$ $"'C""q k ~ R k H   " %5Ik H bIk PQk V"$Wk z{k J2Kk T 2Uk ^2_k k x $     " "  ,    R* e $#!)6  Uk k k hYXX "67EEE   --T#tCy.)P6B PW&+"$78P&U,7 'P6L"7 7PF;= GPV$& WPf.: gPvT&* wPFcA GPV[& WPf=  gPv=  wPF5A GPV0 . WPf:; gPv6(. wPF2-. GPPV<H WPf)$' gPv3< wPF8#( GPV2> WPf9+* gPv:F wPFD$7 GPT@% UPbW%> cPp`& qP@[B APP_B   QP`"T9B $$aPpYO !!qP@V() APP7C QPPP`U') aPp6B qP@ o&7 A PN K9 O P^ W(, _ Pn X= o P~ B'0  PL _= M P\ XZ ] Pl _ m P| I)& } PJ e* K P^ J  . _ Pn N$% . o P~ F%' .  PN O= O P^ jM _ PPPn o. o P~ j+  PN O+   O P^ T",;;; _ Pn n')$o6 o P~ \*)$o6  PNn')$o6 OP^Y1$o6 _Plr&:$o6 mP|9 "# }PL7"@MMM MP\I!+"$56 ]PlX:5'6 mP|M&' }PJP#, KPX\ 3 YPjG"'"# kPPPzV@{PH;&' IPVl?) WPdz1 ePp@%< qP~P> PLa6 MPZ\/+[PlG/+mP~L)/ PLF( MPZSA !![Ph!z0 ##iPv(c? **wPDP)6 EPRL' SP`B1 aPPPne= oP|s: }PL!\< ##MP\Y= ]Plg= mP|]' }PLh*) MPZc/ [Ph c@ ""iPv"F/$$wP@G! APLC$ MPXK$YPbV*cPlM&mPvU#wP@=(  APPPJT#KPTf0   UPdL2 ePtHE uPDA# EPTg# UPdu) ePtyQ uPD[. EPTk0 UPbJ  cPpt" qPFS! GPTW" UPhVB iPv VB ""wPD#_. %%EPPR%h+ ''SPPld38n9M,  #    4S#X#78"tDcN';""""Pqqq qqd38n qqqqh s tDcN?S    (,// T#s(^ $/ $sCx.////j8<'+ >> >>tDcN34> T#s(^ $ > c] >>>>B eCHo    "!!! WVV  wwhtCH~&>w$}J]wwwwt00(4S>":0d0000,*4*4$sCx.)A*4T*4*4*4*4ZlllDlT#s(^llll^ddt((   ====@tCH~$sCx.< S#X 4S>    "c3h$T#s(^: 0>#XS#X#X#X#X#XL$sCx.:0t00000f*3****Z%S%%%%%%PCCCCCCCL5#5$5555p$$c$$$$$$$$""#""""s34S>C,sx}&C&C&&&&c c c L///@T7#T7cT7T7T7T7vFFFFFrl