eiUdZddlZddlZddlZddlZddlZddlZddlmZddl m Z e e j j ZddlmZddlmZmZmZddlmZmZmZmZmZmZddlmZmZmZm Z m!Z!m"Z"m#Z#m$Z$dd l%m&Z&m'Z'ed Gd d Z(de)fdZ*de+de+dzfdZ,de+de-fdZ.de+de-fdZ/de+de0de-fdZ1de2e+de+dzde)e+ddfdZ3dde)e+de-de2e+fdZ4dde)dzde-de2fdZ5dde-de6e-e-ffdZ7 dde-d!e6e8d"fde9e8e8ffd#Z:ddd$d%de-d&e+dzd'e0de-fd(Z;dde-d&e+dzde-fd)Zd,d-de6e+d"fe2e+zd.e+dzde8fd/Z?d0e(ddfd1Z@ dd2e-de)dzde-de+fd3ZAde-fd4ZBde-fd5ZCdd6lDmEZEmFZFmGZGde-fd7ZHdde-de-fd8ZIde-fd9ZJde-fd:ZKde-fd;ZLde-fd<ZMd=ZNd>ZOde8fd?ZPdd@e8dzde8fdAZQde8fdBZRdde-de fdCZSGdDdEeTZUde fdFZVddGZWdd'e0de-fdIZXd dJdKe-ddfdLZYdMe8dNe8dOe8ddfdPZZdde-de2e8fdQZ[dde-de2e8fdRZ\ddSdTe2e8de-dej]fdUZ^dde-de8fdVZ_de2e8fdWZ`de-fdXZadYZbe6e8d"fecdZ<d[Zde6e8d"fecd\<de2e6e-e ffd]Zede2e6e8e e-ffd^Zfde-fd_Zgdd`Zh ddae-dbe-de6e+e2e ffdcZidddZjdee8ddfdfZkddge8dzde6e8e8e8ffdhZldie de8dzfdjZmde8dzfdkZnde8dzfdlZodd2e-de6e8dze-ffdmZpde6e-dze8ffdnZqddoZrde fdpZsde fdqZtde dzfdrZude8fdsZvdte due2e8de2e8fdvZwdwe8dxe8de8fdyZxdxe8de8fdzZydde-dge8dzde8fd{Zzd|e8de8fd}Z{d|e8de8fd~Z|dde-de-fdZ}dde-de-fdZ~ddMe8de8dzddfdZddZdde-de-fdZde0fdZdd2e-de-dge8dzfdZdde-fdZdde-fdZdde-fdZdde-fdZdde-de-de-fdZde8fdZde8fdZde8fdZde-fdZde-fdZdd2e-fdZdZdZdZdd'e0de0dzde-fdZdZdde-fdZdde+de-de-fdZddddgdddd dddddd dddddddgdddddgdddd dddddd dddddddgdddddgdddd ddddd dddddd ddgdddddgd̢dddddddd ddddddddddd dddddddgdddddgdޢdddddddd dddddd ddddddddddddgdddddddddddddddgddddddddd dddddddddddddddd ddgdddddgd dd dd dd d d ddddddddddd dddddddgdddddgddddddddd d dgdd!d"d#d$gd%d$d&dd'dd(d)d d*dd+d,dd-dd.d/dd0dd1d2dd d3dd4d5dd6dgdd7d8dd9gd:d9d;ddd d?dd@d2dd dAddBd5dd6dgddCdDddEgdFdEdGddHddIdJd dKddLdMddNddOdPd dQddRdSd dTddUdVddWddXd2dd dYdgddZd[dd\dd]d^dd_gd`d_daddbddcddd deddfdgdd dhddidjddkdgddldmdndogdpdodqddrddsdtd duddvdwdd dxddydzdd{dgdgZd|e9de8fd}Zde2e8fd~Zd|e9fdZdZdZdZdZdZde-fdZde-fdZdZdZdZdZdZdZdZdS(zu Gateway subcommand for hermes CLI. Handles: hermes gateway [run|start|stop|restart|status|install|uninstall|setup] N) dataclass)Path) terminate_pid)%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUT!GATEWAY_SERVICE_RESTART_EXIT_CODEparse_restart_drain_timeout) get_env_valueget_hermes_home is_managed managed_errorread_raw_configsave_env_value) print_header print_info print_success print_warning print_errorprompt prompt_choice prompt_yes_no)ColorscolorT)frozenceZdZUeed<dZeed<dZeed<dZe e dfed<dZ edzed <e d efd Z e d efd ZdS) GatewayRuntimeSnapshotmanagerFservice_installedservice_running. gateway_pidsN service_scopereturnc8|jpt|jSN)rboolr selfs 4/home/div/.hermes/hermes-agent/hermes_cli/gateway.pyrunningzGatewayRuntimeSnapshot.running6s#>tD,='>'>>c.|jo|jo|j Sr$)rr)rr&s r(has_process_service_mismatchz3GatewayRuntimeSnapshot.has_process_service_mismatch:s%S$,St?S;SSr*)__name__ __module__ __qualname__str__annotations__rr%rr tupleintr!propertyr)r,rr*r(rr.s LLL#t###!OT!!!$&L%S/&&& $M3:$$$ ????X?TdTTTXTTTr*rr"c t}tr,ddgdgfD]#} tj|gdzddd}|jD]}|}|r|dds4|d} tj|d |d d gzddd}t|j}|dkr| |#ttj f$rYwxYw#ttj f$rY!wxYwtr t}tjd d |gddd}|jdkr|jD]w}|}t#|dkrN|d|krB t|d}|dkr| |g#t$rYswxYwxn#ttj f$rYnwxYw|S)aoReturn PIDs currently managed by systemd or launchd gateway services. Used to avoid killing freshly-restarted service processes when sweeping for stale manual gateway processes after a service restart. Relies on the service manager having committed the new PID before the restart command returns (true for both systemd and launchd in practice). systemctl--user)z list-unitszhermes-gateway*z--plainz --no-legend --no-pagerTcapture_outputtexttimeoutr.serviceshowz--property=MainPID--value launchctllist)setsupports_systemd_services subprocessrunstdoutstrip splitlinessplitendswithr3add ValueErrorTimeoutExpiredFileNotFoundErroris_macosget_launchd_label returncodelen) pids scope_argsresultlinepartssvcr?pidlabels r(_get_service_pidsr^>sD!""'2[MB  J #"J"J"JJ#'dA #M//11<<>>D JJLLE !a(9(9*(E(E! (C )~&&#*> *KK+/dA    "$+"3"3"5"56677 HHSMMM& (AB &z'@A    zz %''E^fe,#$F A%%"M//11<<>>!!D JJLLE5zzQ58u+<+<!"%eAh--C"Qww $ )!!! D!!:#<=    D  KsnBD-.A DD-D(%D-'D((D--EEBH1.0HH1 H,)H1+H,,H11I  I r\c |dkrdS tjddddt|gddd }n#ttjf$rYdSwxYw|jd krdS|j}|sdS t| d }n#t$rYdSwxYw|d kr|ndS) z@Return the parent PID for ``pid``, or ``None`` when unavailable.Nps-ozppid=z-pTr9r:r) rGrHr0rQrPrTrIrJr3rKrO)r\rXraw parent_pids r(_get_parent_pidrf}s  axxt 4$C 1     z8 9tt At -    C t))"-335566 tt#a::T1s!*5AA=9B77 CC target_pidc|dkrdStj}t}|r8||vr4||krdS||t |pd}|r||v4dS)zHReturn True when ``target_pid`` is this process or one of its ancestors.rFT)osgetpidrErNrf)rgr\seens r(#_is_pid_ancestor_of_current_processrls~Qu )++CUUD (#T// *  4  c""'a (#T// 5r*cttdsdSt|sdS tj|tjn#t ttf$rYdSwxYwdS)z@Ask a running gateway ancestor to restart itself asynchronously.SIGUSR1FT) hasattrsignalrlrikillrnProcessLookupErrorPermissionErrorOSError)r\s r(_request_gateway_self_restartrusx 69 % %u .s 3 3u V^$$$$  9uu 4sA A%$A% drain_timeoutcttdsdS|dkrdS tj|tjn$#t $rYdSt tf$rYdSwxYwddl}| t|dz}| |kr` tj|dn#t $rYdSt $rYnwxYw| d| |k`dS)aSend SIGUSR1 to a gateway PID and wait for it to exit gracefully. SIGUSR1 is wired in gateway/run.py to ``request_restart(via_service=True)`` which drains in-flight agent runs (up to ``agent.restart_drain_timeout`` seconds), then exits with code 75. Both systemd (``Restart=on-failure`` + ``RestartForceExitStatus=75``) and launchd (``KeepAlive.SuccessfulExit = false``) relaunch the process after the graceful exit. This is the drain-aware alternative to ``systemctl restart`` / ``SIGTERM``, which SIGKILL in-flight agents after a short timeout. Args: pid: Gateway process PID (systemd MainPID, launchd PID, or bare process PID). drain_timeout: Seconds to wait for the process to exit after sending SIGUSR1. Should be slightly larger than the gateway's ``agent.restart_drain_timeout`` to allow the drain loop to finish cleanly. Returns: True if the PID was signalled and exited within the timeout. False if SIGUSR1 couldn't be sent or the process didn't exit in time (caller should fall back to a harder restart path). rnFrTNg??) rorprirqrnrrrsrttime monotonicmaxsleep)r\rv_timedeadlines r(_graceful_restart_via_sigusr1rsI2 69 % %u axxu V^$$$$ tt W %uu  3}c#:#::H //  h & &  GCOOOO!   44    D   C //  h & & 5s/A A"A"!A"'B== C CCrV exclude_pidsc||dkrdS|tjks||vs||vrdS||dS)Nr)rirjappend)rVr\rs r(_append_unique_pidrsT {cQhh bikkSL00C4KKKKr*F all_profilescT g}gd}ttt}|r|dnddtdt ffd } t rtjgdddd }|j d krgSd|j d D]}| }| d r|td dC| drq|tdd}tfd|Dr=|s |r0 t|t!||n#t"$rYnwxYwdʐnptjgdddd }|j d krgS|j d D]-}| } | rd| vrd} d | dd} t| dkr1 t!| d } | d n#t"$rd} YnwxYw| s| } t| d krL| dr2t!| d} d| d d | t fd|Dr|s | rt|| |/n#t(tjf$rgcYSwxYw|S)a Best-effort process-table scan for gateway PIDs. This supplements the profile-scoped PID file so status views can still spot a live gateway when the PID file is stale/missing, and ``--all`` sweeps can discover gateways outside the current profile. )hermes_cli.main gatewayzhermes_cli.main --profilezhermes_cli.main -phermes_cli/main.py gatewayzhermes_cli/main.py --profilezhermes_cli/main.py -pzhermes gatewaygateway/run.pyrccommandr"cdrd|vp d|vpd|vSd|vsd|vrdSd|vr d|vrdSdS)N --profile z-p z HERMES_HOME=z -p FTr)r current_homecurrent_profile_names r(_matches_current_profilez4_scan_gateway_pids.._matches_current_profiles  3133w></-//7:<0,00G;  7 " "f&7&75 W $ $)F )F)Fg)U)U5tr*)wmicprocessgetzProcessId,CommandLinez /FORMAT:LISTT r:r z CommandLine=Nz ProcessId=c3 K|]}|vV dSr$r).0p current_cmds r( z%_scan_gateway_pids..%s(>>1 +>>>>>>r*)raz-Aewwrbz pid=,command=grepr`rD c3 K|]}|vV dSr$r)rpatternrs r(rz%_scan_gateway_pids..Ns(BBgw')BBBBBBr*)r0r resolve _profile_argrLr% is_windowsrGrHrTrIrJ startswithrUanyrr3rOisdigitjoinrtrP)rrrVpatternscurrent_profile_argrrXrYpid_strstrippedr\rZ aux_partsrrrrs @@@@r(_scan_gateway_pidsrsD   H((002233L&|44>QY.4466r::WY # $       ? <<< @^SSS# F  A%% K ++D11 % %zz||??>22 %"&s>':':';';">>>X>>>>>!$!(@(@(M(M!!.tS\\<PPPP)!!! D!"$K % ^:::# F  A%%  ++D11 @ @::<<6X#5#5 tQ//u::??#!%(mm"'(%###"#; ( 0 0I9~~**y|/C/C/E/E*!)A,//"%((9RSS>":":;BBBBBBBBB@ @$<$td t t|d Std |S) zBReturn a unified view of gateway liveness for the current profile.zTermux / manual process)rr r) is_containerzdocker (foreground)rz systemd (r)rrrr r!launchdzmanual process)r2r is_termuxrhermes_constantsris_linuxrFrrrrrRrr)rr rrrrs r(get_gateway_runtime_snapshotr"so*,,--L{{ %-%    .-----zz llnn %)%    !""  +IQW+X+X+X(*?;; %. ...3?KKKRRTT+%%     zz %466==??:<<%#      " !   r*rClimitrc|d|d|Dn d|D}|(t||kr|dd|S)Nc8g|]}|dkt|Srr0rr\s r( z(_format_gateway_pids..Ns#<<.Ns/W|W|W|ehtwz{t{t{X[\_X`X`t{t{t{r*z..., )rUrr)rVrrendereds r(_format_gateway_pidsrMsr@E@Q< > > /profiles/``, or a short hash for any other path. Works correctly in Docker (HERMES_HOME=/opt/data) and standard deployments. rNget_default_hermes_rootrprofilesr`^[a-z0-9][a-z0-9_-]{0,63}$)hashlibrerr6r r relative_torZrUmatchrOsha256r0encode hexdigest)r:r;r6homedefault profiles_rootrelrZs r(_profile_suffixrEs'NNN III888888    $ $ & &D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?8O       >>#d))**,, - - 7 7 9 9"1" ==s+AB?? C  C  hermes_homecddl}ddlm}t|pt t }|}||krdS|dz } ||}|j}t|dkr'| d|dr d|dSn#t$rYnwxYwdS) aReturn ``--profile `` only when HERMES_HOME is a named profile. For ``~/.hermes/profiles/``, returns ``"--profile "``. For the default profile or hash-based custom paths, returns the empty string. Args: hermes_home: Optional explicit HERMES_HOME path. Defaults to the current ``get_hermes_home()`` value. Should be passed when generating a service definition for a different user (e.g. system service). rNr5rr7r`r8r) r;rr6rr0r rr<rZrUr=rO)rFr;r6rArBrCrDrZs r(rrsIII888888  5s?#4#455 6 6 > > @ @D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?*a** *      2sAC C'&C'cHt}|stStd|S)aDerive a systemd service name scoped to this HERMES_HOME. Default ``~/.hermes`` returns ``hermes-gateway`` (backward compatible). Profile ``~/.hermes/profiles/coder`` returns ``hermes-gateway-coder``. Any other HERMES_HOME appends a short hash for uniqueness. -)rE _SERVICE_BASEsuffixs r(rrs1  F  & &f & &&r*ct}|rtd|dz Stjdz dz dz |dz S)N/etc/systemd/systemr>.configsystemduser)rrrA)rnames r(rr+s[   D ?)**->->->>> 9;; "Y . 7T:K:K:K KKr*ceZdZdZdS)UserSystemdUnavailableErrora#Raised when ``systemctl --user`` cannot reach the user D-Bus session. Typically hit on fresh RHEL/Debian SSH sessions where linger is disabled and no user@.service is running, so ``/run/user/$UID/bus`` never exists. Carries a user-facing remediation message in ``args[0]``. N)r-r.r/__doc__rr*r(rTrT2sr*rTctjdpdtj}t |dz S)zIReturn the expected per-user D-Bus socket path (regardless of existence).XDG_RUNTIME_DIR /run/user/bus)rienvironrgetuidr)xdgs r(_user_dbus_socket_pathr];s; *..* + + I/IBIKK/I/IC 99u r*ctj}dtjvr5d|}t|r|tjd<dtjvr]tjdd|}t|dz }|rd|tjd<dSdSdS)aEnsure DBUS_SESSION_BUS_ADDRESS and XDG_RUNTIME_DIR are set for systemctl --user. On headless servers (SSH sessions), these env vars may be missing even when the user's systemd instance is running (via linger). Without them, ``systemctl --user`` fails with "Failed to connect to bus: No medium found". We detect the standard socket path and set the vars so all subsequent subprocess calls inherit them. rWrXDBUS_SESSION_BUS_ADDRESSrYz unix:path=N)rir[rZrrr)uid runtime_dir xdg_runtimebus_paths r(_ensure_user_systemd_envrdAs )++C **(3((    # # % % 8,7BJ( )!33jnn%68JS8J8JKK  $$u, ??   M5L(5L5LBJ1 2 2 2 43 M Mr*@cbddl}||z}||kr]trt dS|d||k]tS)zPoll for the user D-Bus socket to appear, up to ``timeout`` seconds. Linger-enabled user@.service can take a second or two to spawn the socket after ``loginctl enable-linger`` runs. Returns True once the socket exists. rNTg?)ryrzr]rrdr|)r=ryr~s r(_wait_for_user_dbus_socketrgWs KKK~~')H ..  X % % ! # # * * , ,  $ & & &4 3 ..  X % % " # # * * , ,,r*)auto_enable_lingerrhcZtt}|rdSddl}|}t \}}|dur9t drdSt|ddtj d |rtj d r tj d d |gddd d }|jdkrFt drtd|ddSt|ddt! |jp|jp d|j}t|d|d| n0#t($r#}t|d|dd| Yd}~nd}~wwxYwt|d|pddd| dS)aEnsure ``systemctl --user`` will reach the user D-Bus session bus. No-op when the bus socket is already there (the common case on desktops and linger-enabled servers). On fresh SSH sessions where the socket is missing: * If linger is already enabled, wait briefly for user@.service to spawn the socket. * If linger is disabled and ``auto_enable_linger`` is True, try ``loginctl enable-linger $USER`` (works as non-root when polkit permits it, otherwise needs sudo). * If the socket is still missing afterwards, raise :class:`UserSystemdUnavailableError` with a precise remediation message. Callers should treat the exception as a terminal condition for user-scope systemd operations and surface the message to the user. NrTrer=z;User D-Bus socket is missing even though linger is enabled.z systemctl start user@zC.service (may require sudo; try again after the command succeeds))reasonfix_hintloginctl enable-lingerFrr;r<rr=@u✓ Enabled linger for u — user D-Bus now availablez=Linger was enabled, but the user D-Bus socket did not appear.z` Log out and log back in, then re-run the command. Or reboot and run: systemctl --user start exit z#loginctl enable-linger was denied: z sudo loginctl enable-linger zloginctl enable-linger failed ().z%User D-Bus session is not available (zlinger disabled)rdr]rgetpassgetuserget_systemd_linger_statusrg_raise_user_systemd_unavailablerir[r-r.rGrHrTrrstderrrIrJr) rhrcrsusernamelinger_enabled linger_detailrXdetailrs r(_preflight_user_systemdr|hs$%''HNNN  H$=$?$?!NM %c 2 2 2  F' PM")++MMM     "fl:66"! ^_h7# F A%%-c:::[H[[[\\\F/Z\GWGYGY\\ mSv}S8S@Q8S8SZZ\\F +EVEED(DD     +    +@@@@D(DD          6$ 72!2 7 7 7=(<< s0E F *FF rxrkrlc0|d|d}t|)zHBuild a user-facing error message and raise UserSystemdUnavailableError.zR systemctl --user cannot reach the user D-Bus session in this shell. To fix: z{ Alternative: run the gateway in the foreground (stays up until you exit / close the terminal): hermes gateway run)rT)rxrkrlmsgs r(rvrvs:  ! !   ! ! ! &c * **r*c4|st|rdgnddgS)Nr6r7)rdrs r(_systemctl_cmdrs, # """" ?K==h(??r*c|rdgnddgS)N journalctlr7rrs r(_journalctl_cmdrs# AL>>,)AAr*rargsc tjt||zfi|S#t$rt ddwxYw)a%Run a systemctl command, raising RuntimeError if systemctl is missing. Defense-in-depth: callers are gated by ``supports_systemd_services()``, but this ensures any future caller that bypasses the gate still gets a clear error instead of a raw ``FileNotFoundError`` traceback. z)systemctl is not available on this systemN)rGrHrrQr)rrkwargss r(rrs_~nV44t;FFvFFF  7   s!$?c|rdndS)NrrQrrs r(rrs )886)r*cg}t}dD]X\}}t|}||vr|r*||||Y|S)N))FrQ)Trr)rErrrrN)scopes seen_pathsrr] unit_paths r(get_installed_systemd_scopesrs FEEJ<&& )888  " "       & MM% NN9 % % % Mr*c@ttdkS)Nr`)rUrrr*r(has_conflicting_systemd_unitsrs +-- . . 22r*)zhermes.service_LEGACY_SERVICE_NAMES)rrrz hermes gateway z/hermes gateway _LEGACY_UNIT_EXECSTART_MARKERSc`dtjdz dz dz fdtdfgS)uReturn ``[(is_system, base_dir), ...]`` — directories to scan for legacy units. Factored out so tests can monkeypatch the search roots without touching real filesystem paths. FrOrPrQTrN)rrArr*r(_legacy_unit_search_pathsrs<  i')3f<= t)**+ r*cNg}tD]\}}tD]}||z } |s|ddn#tt f$rYHwxYwt fdtDsm||||f|S)uReturn ``[(unit_name, unit_path, is_system)]`` for legacy Hermes gateway units. Detects unit files installed by older Hermes versions that used a different service name (e.g. ``hermes.service`` before the rename to ``hermes-gateway.service``). When both a legacy unit and the current ``hermes-gateway.service`` are active, they fight over the same bot token — the PR #5646 signal-recovery change turns this into a 30-second SIGTERM flap loop. Safety guards: * Explicit allowlist of legacy names (no globbing). Profile units such as ``hermes-gateway-coder.service`` and unrelated third-party ``hermes-*`` services are never matched. * ExecStart content check — only flag units that invoke our gateway entrypoint. A user-created ``hermes.service`` running an unrelated binary is left untouched. * Results are returned purely for caller inspection; this function never mutates or removes anything. utf-8ignore)encodingerrorsc3 K|]}|vV dSr$r)rmarkerr<s r(rz,_find_legacy_hermes_units..9s'SS&v~SSSSSSr*) rrr read_textrtrsrrr)results is_systembaserRrr<s @r(_find_legacy_hermes_unitsrs*-/G466 9 9 4) 9 9Dt I  '')) **GH*MM_-    SSSS4RSSSSS  NND)Y7 8 8 8 8 9 NsAAA'&A'c8ttS)z.qs'BBB\Q66B1a&BBBr*c"g|] \}}}|||f Srrrs r(rz.remove_legacy_hermes_units..rs'@@@|q!V@QF@@@r*z$Legacy Hermes gateway unit(s) found:rrQ rru(dry-run — nothing removed)cg|]\}}}| Srrrrrs r(rz.remove_legacy_hermes_units..}+++Aq1+++r*zRemove these legacy units?Tz6Skipped. Run again with: hermes gateway migrate-legacycg|]\}}}| Srrrs r(rz.remove_legacy_hermes_units..rr*stopFrrdisabler) missing_oku ✓ Removed r`u ⚠ Could not remove rN daemon-reloadz1System-scope legacy units require root to remove.z1 Re-run with: sudo hermes gateway migrate-legacyu5 legacy unit(s) still present — see messages above.zRemoved z legacy unit(s).)rrrrunlinkrtrrrigeteuidrrrUr) rrr user_units system_unitsrRrrrremoved remainingers r(remove_legacy_hermes_unitsrXss(' ( (F  5666"u BBVBBBJ@@v@@@L GGG 0111!',,dI%16 *4**E***++++ GGG, -...++F+++++,=)EtLL, FGGG++F+++++GI! # # d # FD>%ub Q Q Q Q It,U%QS T T T T KK4K ( ( ( )4)) * * * qLGG& # # # 7D77A77 8 8 8   T " " " " " " " " #  O,U%QS T T T T T    D  :<<1   GGG M N N N J K K K' ' '4  &&&& '+ + + d+"FD>$eUWXXXX"It#4TXZ[[[[KK4K0001411222qLGG.+++?D??A??@@@$$T********+ 0UTVWWWWW     GGG<Y^^^____::::;;; I sV&AD>>F*E>>F F F+*F+AI22J7*J22J7;K KKc2t}t|dkrdSd|}td|dt dt dt dt dt d dS) NrDz + z5Both user and system gateway services are installed (rrzF This is confusing and can make start/stop/status behavior ambiguous.zL Default gateway commands target the user service unless you pass --system.z Keep one of these:z hermes gateway uninstallz* sudo hermes gateway uninstall --system)rrUrrr)rrendered_scopess r($print_systemd_scope_conflict_warningrs ) + +F 6{{Qjj((O]/]]]^^^WXXX]^^^%&&&-...;<<<<C C6C11C6rc|sdS|dD]K}|dr4|ddd}|pdcSLdS)NrrzUser=rr`)rrrKrrLrJ)rrYrs r(_read_systemd_user_from_unitrs     t##W#55@@BB!! ??7 # # !JJsA&&q)//11E=D  ! 4r*c tjdtjdtjdfD]F}|rB|r.|dkr|cSGdS)Nrrrr)rirrJ) candidates r(_default_system_service_userrsi ,,bi.?.?9AUAUV%%  %** %y/@/@F/J/J??$$ $ $ $ 4r*cBtdgdd}dddd|S)Nz6 Choose how the gateway should run in the background:)zPUser service (no sudo; best for laptops/dev boxes; may need linger after logout)zGSystem service (starts on boot; requires sudo; still runs as your user)zSkip service install for nowrrBrQr)rr`rD)r)choices r("prompt_linux_gateway_install_scopersD @   F(t , ,V 44r*ct}|dS|dkrt}tjdkrFt d|rt d|nt dt d|dfS|s; t d d }|pd }|rntd :t|d ||d fSt|d|d fS)NNFrrzY System service install requires sudo, so Hermes can't create it from this user session.zG After setup, run: sudo hermes gateway install --system --run-as-user zR After setup, run: sudo hermes gateway install --system --run-as-user z8 Then start it with: sudo hermes gateway start --systemFTz/ Run the system gateway service as which user?rrz Enter a username.r rr)r r) rrrirrrrrJrsystemd_install)r rrs r( install_linux_gateway_from_setuprs- . 0 0E }{ 244 :<<1   u v v v qreprrssssoppp Q R R R%<  3 3$%V`bccc *0b7799 1222  3 eDkJJJJd{%.... $;r*ctrdStsdStjdsdSt jdpt jd}|sB ddl}|t jj }n#t$rYd SwxYw tj dd |d d gd d dd}n(#t$r}dt|fcYd}~Sd}~wwxYw|jdkr0|jp|jp d|j}d|pdfS|jpd}|dvrdS|dvrdS|pd}dd|fS)zReturn systemd linger status for the current user. Returns: (True, "") when linger is enabled. (False, "") when linger is disabled. (None, detail) when the status could not be determined. )Nznot supported in Termux)Nznot supported on this platformrm)Nloginctl not foundrrrN)Nz could not determine current userz show-userz--property=Lingerr@TFrrorqzloginctl query failedr>1yestrue)Tr>0nofalse)Frzzunexpected loginctl output: )rrr-r.rirrgetpwuidr[pw_namerrGrHr0rTrwrIrJr)rxrrXrr{rrs r(ruru#s{{/.. ::655 < # #*))y  8BIi$8$8H < < JJJ||BIKK008HH < < <;;; <  h0CY O     SVV|A-O6=O4OF If you want the gateway user service to survive logout, run:z# sudo loginctl enable-linger $USERN)rur)ryrzs r(print_systemd_linger_guidancerTs$=$?$?!NM GHHHHH 5  RSSS 899999 FmFFFGGG NOOO 344444r*czddl}t|tjjS)zReturn the real macOS user home for launchd artifacts. Profile-mode Hermes often sets ``HOME`` to a profile-scoped directory, but launchd user agents still live under the actual account home. rN)rrrrir[r)rs r(_launchd_user_homeras0 JJJ  RY[[))0 1 11r*cdt}|rd|nd}tdz dz |dz S)uReturn the launchd plist path, scoped per profile. Default ``~/.hermes`` → ``ai.hermes.gateway.plist`` (backward compatible). Profile ``~/.hermes/profiles/coder`` → ``ai.hermes.gateway-coder.plist``. ai.hermes.gateway-ai.hermes.gatewayLibrary LaunchAgentsz.plist)rEr)rLrRs r(rrlsI   F,2 K ( ( ( (8KD   ) +n <$ NNr*crtjtjkr/ttj}|r|St jd}|r%t|}|r|SdD]$}t|z }|r|cS%dS)abDetect the active virtualenv directory. Checks ``sys.prefix`` first (works regardless of the directory name), then ``VIRTUAL_ENV`` env var (covers uv-managed environments where sys.prefix == sys.base_prefix), then falls back to probing common directory names under PROJECT_ROOT. Returns ``None`` when no virtualenv can be found. VIRTUAL_ENV)z.venvvenvN) rprefix base_prefixris_dirrirZr PROJECT_ROOT)r _virtual_envrs r(_detect_venv_dirrvs zS_$$CJ ;;== K :>>-00LL!! ;;== K' i' ;;== KKK  4r*ct}|Btr |dz dz }n|dz dz }|rt|StjS)NScriptsz python.exebinpython)rrrr0r executable)r venv_pythons r(get_python_pathrsh   D  << 2*\9KK,1K      ${## # >r*rA path_entriesct|dz dz t|dz dz t|dz dz t|dz dz g}fd|DS)zKReturn user-local bin dirs that exist and aren't already in *path_entries*.z.localr z.cargogoz .npm-globalc^g|])}|vt|'|*Sr)rr)rrrs r(rz+_build_user_local_paths..s8 P P P!Ql%:%:tAww~~?O?O%:A%:%:%:r*r)rAr candidatess ` r(_build_user_local_pathsrsz D8Oe #$$ D8Oe #$$ D4K%    D= 5 ()) J Q P P Pz P P PPr*rtarget_home_dirctj}t|} ||}t t||z S#t $rt |cYSwxYw)aZRemap *path* from the current user's home to *target_home_dir*. If *path* lives under ``Path.home()`` the corresponding prefix is swapped to *target_home_dir*; otherwise the path is returned unchanged. /root/.hermes/hermes-agent -> /home/alice/.hermes/hermes-agent /opt/hermes -> /opt/hermes (kept as-is) Note: this function intentionally does NOT resolve symlinks. A venv's ``bin/python`` is typically a symlink to the base interpreter (e.g. a uv-managed CPython at ``~/.local/share/uv/python/.../python3.11``); resolving that symlink swaps the unit's ``ExecStart`` to a bare Python that has none of the venv's site-packages, so the service crashes on the first ``import``. Keep the symlinked path so the venv activates its own environment. Lexical expansion only via ``expanduser``. )rrA expanduserr<r0rO)rrrrrelatives r(_remap_path_for_userrs"9;;L T A==..4((83444 1vv s3A**BBcnt}tjdz }t|dz }||krt |S ||}t ||z S#t $rt |cYSwxYw)uRemap the current HERMES_HOME to the equivalent under a target user's home. When installing a system service via sudo, get_hermes_home() resolves to root's home. This translates it to the target user's equivalent path: /root/.hermes → /home/alice/.hermes /root/.hermes/profiles/coder → /home/alice/.hermes/profiles/coder /opt/custom-hermes → /opt/custom-hermes (kept as-is) z.hermes)r rrrAr0r<rO)rcurrent_hermescurrent_defaulttarget_defaultrs r(_hermes_home_for_target_userrs%&&..00Ny{{Y.7799O/**Y6N((>"""#!--o>>>H,--- ###>"""""#s1&BB43B4c^t}tt}t}|rt|nttdz }|rt|dz nttdz dz }ttdz dz }||g}t jd} | rLtt | j} | |vr| | gd} ttpd} td| d z} |r't|\}}t}t|}t!|}t!|}t!|}t!|}t!|}fd |D}|t%t ||| d |}d t(d |d|d|d|rd|ndd|dd|d|d|d|d|dt*d| dStt-}t|}|t%t j||| d |}d t(d|d|rd|ndd|d|d|d|dt*d| dS) Nrr  node_modules.binnode)z/usr/local/sbinz/usr/local/binz /usr/sbinz/usr/binz/sbinz/binr<rc0g|]}t|Sr)r)rrhome_dirs r(rz)generate_systemd_unit.. s$PPPa,Q99PPPr*:z[Unit] Description=z After=network-online.target Wants=network-online.target StartLimitIntervalSec=600 StartLimitBurst=5 [Service] Type=simple User=z Group=z ExecStart=z -m hermes_cli.mainrrz( gateway run --replace WorkingDirectory=z Environment="HOME=z" Environment="USER=z" Environment="LOGNAME=z" Environment="PATH=z" Environment="VIRTUAL_ENV=z" Environment="HERMES_HOME=z:" Restart=on-failure RestartSec=30 RestartForceExitStatus=zV KillMode=mixed KillSignal=SIGTERM ExecReload=/bin/kill -USR1 $MAINPID TimeoutStopSec=zT StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target zc After=network.target StartLimitIntervalSec=600 StartLimitBurst=5 [Service] Type=simple ExecStart=z Environment="PATH=zQ StandardOutput=journal StandardError=journal [Install] WantedBy=default.target )rr0rrr-r.rrparentrr3_get_restart_drain_timeoutr{rrrrextendrrSERVICE_DESCRIPTIONrr rA)rr python_path working_dir detected_venvvenv_dirvenv_binnode_binr resolved_noderesolved_node_dircommon_bin_paths_drain_timeoutrestart_timeoutrxrrF profile_arg sane_pathr%s @r(generate_systemd_unitr8s2!##Kl##K$&&M%2Rs=!!!L6K|]}|VdSr$)rstrip)rrYs r(rz0_normalize_service_definition..Qs*IItT[[]]IIIIIIr*)rrJrK)r<s r(_normalize_service_definitionr<Ps7 99IItzz||/F/F/H/HIII I IIr*cdddl}t|}|dd||jS)a`Normalize launchd plist text for staleness checks. The generated plist intentionally captures a broad PATH assembled from the invoking shell so user-installed tools remain reachable under launchd. That makes raw text comparison unstable across shells, so ignore the PATH payload when deciding whether the installed plist is stale. rNz,(PATH\s*)(.*?)()z\1__HERMES_PATH__\3)flags)r;r<subS)r<r; normalizeds r('_normalize_launchd_plist_for_comparisonrBTsCIII.t44J 667d   r*ct|}|sdS|d}|rt|nd}t ||}t |t |kS)NrFrrrr)rrrrr8r<)rr installed expected_userexpecteds r(systemd_unit_is_currentrHgs%V444I     u##W#55I?EO0;;;4M$F NNNH ( 3 37TU]7^7^ ^^r*cLt|}|rt|rdS|rt|nd}|t ||dt dg|dd td t|d dS) zMRewrite the installed systemd unit when the generated definition has changed.rFNrDrrrTrru↻ Updated gateway z7 service definition to match the current Hermes install) rrrHr write_textr8rrr)rrrFs r(refresh_systemd_unit_if_neededrKss%V444I     !8!G!G!Gu?EO0;;;4M .f-XXXcjkkkO$V4LLLL v!5f!=!= v v vwww 4r*r{cZttd|rtd|ttdtd|ttdtdtdtdS)NuI⚠ Linger not enabled — gateway may stop when you close this terminal.z Auto-enable failed: z1 On headless servers (VPS, cloud instances) run:z sudo loginctl enable-linger  Then restart the gateway:z systemctl --user restart r>)rr)rxr{s r(_print_linger_enable_warningrNs GGG UVVV 1 /v//000 GGG =>>> 7X 7 7888 GGG '((( F*:*<*< F F FGGG GGGGGr*ctstsdSddl}|}t d|}|rt ddSt\}}|durt ddStj dst||pddSt d tj dd |gddd d }n5#t$r(}t|t|Yd}~dSd}~wwxYw|jdkrt d dS|jp|jp d|j}t||p|dS)z@Enable linger when possible so the user gateway survives logout.Nrz/var/lib/systemd/linger/rTrmrz5Enabling linger so the gateway survives SSH logout...rnFrrou8✓ Linger enabled — gateway will persist after logoutrq)rrrsrtrrrrur-r.rNrGrHrr0rTrwrIrJ)rsrx linger_fileryrzrXrr{s r(_ensure_linger_enabledrQs{{(**NNN  H<(<<==K GHHH$=$?$?!NM GHHH < # #$X}/T@TUUU ABBB  ( 3     $Xs1vv666A HIIImKv}K0K8I0K0K R R T TF 6+B]CCCCCs C)) D3DDc|rdStdo"td S)NTrF)rrrs r(rrsM t  - - - 4 4 6 6 k?T\a?b?b?b?i?i?k?k;kkr*c8tjdd}|sct}t |t r|dini}t|dt}t|S)z?Return the configured gateway restart drain timeout in seconds.HERMES_RESTART_DRAIN_TIMEOUTragentrestart_drain_timeout) rirrJr isinstancedictrr0rr)rdcfg agent_cfgs r(r(r(s )2B 7 7 = = ? ?C  ,6sD,A,AICGGGR(((r  MM')N     's + ++r*c|rtdtrXtttt ddrt dtt |}|rdnd}|r|st|std t|d |t|td tg|dd tdt| ddStd|tddS|jddtdt|d||t#||dtdg|dd td tg|dd ttdt| dttdtd|rdndd|dtd|rdndd|d td|rd!nd"d#td$t|r$t%|}|rtd%|nt't)tdS)&Ninstallz,Remove the legacy unit(s) before installing?TF)rr --systemru↻ Repairing outdated z systemd service at: enablerrrz service definition updatedService already installed at: Use --force to reinstallparentsexist_okz Installing z systemd service to: rDrrrz service installed and enabled! Next steps:rrhermes gateway startz! # Start the servicezhermes gateway statusz # Check statusrzjournalctl --userz -u z -f # View logsConfigured to run as: )rrrrrrrrrHrrKrrrr'mkdirrJr8rrQr)r rrr scope_flagconfigured_users r(rrsg 4(333   !###  G N N  &5 9 9 9 9 GGG%V444I &.BJ % &f555  j,@,H,Hjj_hjj k k k *& 9 9 9 9 H&6&8&89&PT^` a a a a _-f55@@BB___ ` ` ` F :y::;;; ())) 4$777 V,V44 V V9 V VWWW .f+VVVahiiiO$V4LLLLH.001&VXYYYY GGG [%f--88:: [ [ [\\\ GGG - k&(wwb k kj k k klll f&(wwb f fz f f fggg hv>||+> h hDTDVDV h h hiii GGG !6yAA  > >[[[\\\\ [)&11<<>>[[[\\\ S61rSSzSSTTTAGQ29===TO: 888999)++M  &'''!  D +t++    .f===J>>-44Lz2..I!~~&6;;..2..K|## ^(C(C QRRRR  ! !&6#>_:`:`&`&` PQQQ d6"A))rddP`PbPbddsyiBhoho@BddXbdd e e e e  ! !k ! 9K99::: > RSSSS >%''''577 T ! ! K L L L L u $ $ V W W W < = = = ,  n!&))T3C3E3EtTS_,``  ! NN4 w++++++ ,,r*c0t}|rd|ndS)z5Return the launchd service label, scoped per profile.rr)rErKs r(rSrSs'   F,2 K ( ( ( (8KKr*c.dtjS)Nzgui/)rir[rr*r(_launchd_domainrs ")++  r*ct}tt}tt}tdz }|ddt }t|}t}|rt|dz nttdz dz }|rt|nttdz }ttdz dz } || g} tj d} | rLtt| j } | | vr| | d t| d t"jd d d Dz} d |dddg}|r0|D]}| d |d|gdd|}d|d|d|d| d|d|d|d|dS)NlogsTrar rr r!r"r&cg|]}||Srrrrs r(rz*generate_launchd_plist..s&]&]&]Q[\&]q&]&]&]r*PATHrzz z-mz hermes_cli.main)zgatewayzrunz--replacez z Label z? ProgramArguments z? WorkingDirectory zf EnvironmentVariables PATH z9 VIRTUAL_ENV z9 HERMES_HOME z RunAtLoad KeepAlive SuccessfulExit StandardOutPath zH/gateway.log StandardErrorPath z-/gateway.error.log )rr0rr rrgrSrrr-r.rr'rrrXfromkeysrirZrrLr))r+r,rFlog_dirr]r6r-r/r.r0 priority_dirsr1r2r7 prog_argspart prog_args_xmls r(generate_launchd_plistrs!##Kl##Ko''//1122K&(G MM$M...   E{++K %&&M-:bs=5()))LSYDY\aDa@b@bH%2Rs=!!!L6???<<<<<< =ttvv = = =>>>>>r*c&t}t}tjddt d|gdd|r&|td|tddS) NrArrFrrrlu✓ Service uninstalled)rrSrGrHrrrrrs r(launchd_uninstallrns'))J   ENK/@/@,J,J5,J,JKSXbdeeee+ )Z))*** #$$$$$r*c t}t}|std|jdd|tdtj ddtt|gdd tj dd td |gdd td dSt tj dd td |gdd n#tj $r}|jd vrtdtj ddtt|gdd tj dd td |gdd Yd}~nd}~wwxYwtd dS)Nu:↻ launchd plist missing; regenerating service definitionTrarrrArrr kickstartru✓ Service startedrCqu:↻ launchd job was unloaded; reloading service definition)rrSrrr'rgrJrrGrHrr0rCalledProcessErrorrT)rr]rs r( launchd_startrys'))J   E      JKKKt<<<466III [/2C2CS__U]akmnnnn [_5F5F2P2P2P2PQY]gijjjj #$$$#%%%k [_5F5F2P2P2P2PQY]gijjjjj  (kkk +D**F;9A8F66F;ct}td|} tjdd|gddn'#tj$r}|jdvrnYd}~nd}~wwxYwt dd td dS) NrrArTrrr$@rpr= force_afteru✓ Service stopped)rSrrGrHrrT_wait_for_gateway_exitr)r]targetrs r( launchd_stoprs   E!! + +E + +F  Y7tRPPPPP  ( <8 # #   DDDD 4S9999      s>A" AA"rrprc4ddl}ddlm}||z}|||znd}d}||kr|}|dS|`|s^||krF t |dt d|dn#t ttf$rYdSwxYwd}| d ||k|}|t d|d |d dSdS) uWait for the gateway process (by saved PID) to exit. Uses the PID from the gateway.pid file — not launchd labels — so this works correctly when multiple gateway instances run under separate HERMES_HOME directories. Args: timeout: Total seconds to wait before giving up. force_after: Seconds of graceful waiting before escalating to force-kill. rNrFTru⚠ Gateway PID z& did not exit gracefully; sent SIGKILLg333333?z still running after us — restart may fail) ryrrrzrrrrrsrtr|) r=rryrr~force_deadline force_sentr\ remaining_pids r(rrslKKK......~~')H9D9Pdnn&&44VZNJ ..  X % %o ;4  ": "$..:J:Jn:\:\ c....TTTTUUUU&A   tt J 3 ..  X % %"$O%%M  dddWdddeeeu 4s$B''CCc t}td|}t}ddlm} |}| t |rt ddS|[ t|dn#tttf$rd}YnwxYw|'t|d}|st d|d d tj d d d |gddt ddS#tj$r}|jdvrt dt!}tj d dtt#|gddtj d d |gddt dYd}~dSd}~wwxYw)Nrrru✓ Service restart requestedFrru"⚠ Gateway drain timed out after z.0fus — forcing launchd restartrArz-kTrru✓ Service restartedru'↻ launchd job was unloaded; reloadingrr)rSrr(rrrurrrrrsrtrrGrHrrTrr0)r]rrvrr\exitedrrs r(launchd_restartrs   E!! + +E + +F.00M......'o ? ⚠ Without message.channels the bot will ONLY work in DMs!uI5. Install to Workspace: Settings → Install App → copy xoxb-... tokenz56. Reinstall the app after any scope or event changesuJ7. Find your user ID: click your profile → three dots → Copy member IDz/8. Invite the bot to channels: /invite @YourBotzBot Token (xoxb-...)z&Paste the bot token from step 3 above.SLACK_APP_TOKENzApp Token (xapp-...)z,Paste the app-level token from step 4 above.SLACK_ALLOWED_USERSz'Paste your member ID from step 7 above.matrixMatrixu🔐MATRIX_ACCESS_TOKEN)zX1. Works with any Matrix homeserver (self-hosted Synapse/Conduit/Dendrite or matrix.org)z@2. Create a bot user on your homeserver, or use your own accountuN3. Get an access token: Element → Settings → Help & About → Access TokenzI Or via API: curl -X POST https://your-server/_matrix/client/v3/login \zK -d '{"type":"m.login.password","user":"@bot:server","password":"..."}'zL4. Alternatively, provide user ID + password and Hermes will log in directlyzT5. For E2EE: set MATRIX_ENCRYPTION=true (requires pip install 'mautrix[encryption]')zN6. To find your user ID: it's @username:your-server (shown in Element profile)MATRIX_HOMESERVERz0Homeserver URL (e.g. https://matrix.example.org)z@Your Matrix homeserver URL. Works with any self-hosted instance.z8Access token (leave empty to use password login instead)zMPaste your access token, or leave empty and provide user ID + password below.MATRIX_USER_IDu5User ID (@bot:server — required for password login)z4Full Matrix user ID, e.g. @hermes:matrix.example.orgMATRIX_ALLOWED_USERSz4Allowed user IDs (comma-separated, e.g. @you:server)z.Matrix user IDs who can interact with the bot.MATRIX_HOME_ROOMzSHome room ID (for cron/notification delivery, or empty to set later with /set-home)zLRoom ID (e.g. !abc123:server) for delivering cron results and notifications. mattermost MattermostMATTERMOST_TOKEN)uC1. In Mattermost: Integrations → Bot Accounts → Add Bot AccountuE (System Console → Integrations → Bot Accounts must be enabled)z:2. Give it a username (e.g. hermes) and copy the bot tokenuK3. Works with any self-hosted Mattermost instance — enter your server URLuA4. To find your user ID: click your avatar (top-left) → Profileu8 Your user ID is displayed there — click it to copy.uI ⚠ This is NOT your username — it's a 26-character alphanumeric ID.uL5. To get a channel ID: click the channel name → View Info → copy the IDMATTERMOST_URLz(Server URL (e.g. https://mm.example.com)z@Your Mattermost server URL. Works with any self-hosted instance.z&Paste the bot token from step 2 above.MATTERMOST_ALLOWED_USERSz*Your Mattermost user ID from step 4 above.MATTERMOST_HOME_CHANNELz@Channel ID where Hermes delivers cron results and notifications.MATTERMOST_REPLY_MODEuTReply mode — 'off' for flat messages, 'thread' for threaded replies (default: off)zFoff = flat channel messages, thread = replies nest under your message.whatsappWhatsAppu📲WHATSAPP_ENABLED)rr]rrrpSignalu📡SIGNAL_HTTP_URLemailEmailu📧 EMAIL_ADDRESS)z61. Use a dedicated email account for your Hermes agentz82. For Gmail: enable 2FA, then create an App Password atz, https://myaccount.google.com/apppasswordszH3. For other providers: use your email password or app-specific passwordz-4. IMAP must be enabled on your email accountz Email addressz;The email address Hermes will use (e.g., hermes@gmail.com).EMAIL_PASSWORDz Email password (or app password)z;For Gmail, use an App Password (not your regular password).EMAIL_IMAP_HOSTz IMAP hostzBe.g., imap.gmail.com for Gmail, outlook.office365.com for Outlook.EMAIL_SMTP_HOSTz SMTP hostz?e.g., smtp.gmail.com for Gmail, smtp.office365.com for Outlook.EMAIL_ALLOWED_USERSz'Allowed sender emails (comma-separated)z3Only emails from these addresses will be processed.smsz SMS (Twilio)TWILIO_ACCOUNT_SID)z51. Create a Twilio account at https://www.twilio.com/zH2. Get your Account SID and Auth Token from the Twilio Console dashboardz93. Buy or configure a phone number capable of sending SMSz+4. Set up your webhook URL for inbound SMS:uF Twilio Console → Phone Numbers → Active Numbers → your numberu` → Messaging → A MESSAGE COMES IN → Webhook → https://your-server:8080/webhooks/twiliozTwilio Account SIDz&Found on the Twilio Console dashboard.TWILIO_AUTH_TOKENzTwilio Auth Tokenz8Found on the Twilio Console dashboard (click to reveal).TWILIO_PHONE_NUMBERz5Twilio phone number (E.164 format, e.g. +15551234567)z)The Twilio phone number to send SMS from.SMS_ALLOWED_USERSz5Allowed phone numbers (comma-separated, E.164 format)z9Only messages from these phone numbers will be processed.SMS_HOME_CHANNELzDHome channel phone number (for cron/notification delivery, or empty)z>Phone number to deliver cron job results and notifications to.dingtalkDingTalkDINGTALK_CLIENT_ID)u=1. Go to https://open-dev.dingtalk.com → Create ApplicationzQ2. Under 'Credentials', copy the AppKey (Client ID) and AppSecret (Client Secret)z.3. Enable 'Stream Mode' under the bot settingsz54. Add the bot to a group chat or message it directlyzAppKey (Client ID)z6The AppKey from your DingTalk application credentials.DINGTALK_CLIENT_SECRETzAppSecret (Client Secret)z9The AppSecret from your DingTalk application credentials.feishuz Feishu / Larku🪽 FEISHU_APP_ID)zJ1. Go to https://open.feishu.cn/ (or https://open.larksuite.com/ for Lark)z32. Create an app and copy the App ID and App Secretz(3. Enable the Bot capability for the appz<4. Choose WebSocket (recommended) or Webhook connection modez55. Add the bot to a group chat or message it directlyz?6. Restrict access with FEISHU_ALLOWED_USERS for production usezApp IDz-The App ID from your Feishu/Lark application.FEISHU_APP_SECRETz App Secretz1The App Secret from your Feishu/Lark application. FEISHU_DOMAINu+Domain — feishu or lark (default: feishu)z@Use 'feishu' for Feishu China, or 'lark' for Lark international.FEISHU_CONNECTION_MODEu=Connection mode — websocket or webhook (default: websocket)zCwebsocket is recommended unless you specifically need webhook mode.FEISHU_ALLOWED_USERSz,Allowed user IDs (comma-separated, or empty)z;Restrict which Feishu/Lark users can interact with the bot.FEISHU_HOME_CHANNELz/Home chat ID (optional, for cron/notifications)z0Chat ID for scheduled results and notifications.wecomzWeCom (Enterprise WeChat) WECOM_BOT_ID)u?1. Go to WeCom Admin Console → Applications → Create AI Botz=2. Copy the Bot ID and Secret from the bot's credentials pageu?3. The bot connects via WebSocket — no public endpoint neededz>4. Add the bot to a group chat or message it directly in WeComz>5. Restrict access with WECOM_ALLOWED_USERS for production usezBot IDz"The Bot ID from your WeCom AI Bot. WECOM_SECRETSecretz"The secret from your WeCom AI Bot.WECOM_ALLOWED_USERSz5Restrict which WeCom users can interact with the bot.WECOM_HOME_CHANNELwecom_callbackzWeCom Callback (Self-Built App)WECOM_CALLBACK_CORP_ID)uG1. Go to WeCom Admin Console → Applications → Create Self-Built AppzC2. Note the Corp ID (top of admin console) and create a Corp SecretzM3. Under Receive Messages, configure the callback URL to point to your serverzD4. Copy the Token and EncodingAESKey from the callback configurationuN5. The adapter runs an HTTP server — ensure the port is reachable from WeComzG6. Restrict access with WECOM_CALLBACK_ALLOWED_USERS for production usezCorp IDzYour WeCom enterprise Corp ID.WECOM_CALLBACK_CORP_SECRETz Corp Secretz+The secret for your self-built application.WECOM_CALLBACK_AGENT_IDzAgent IDz,The Agent ID of your self-built application.WECOM_CALLBACK_TOKENzCallback Tokenz1The Token from your WeCom callback configuration.WECOM_CALLBACK_ENCODING_AES_KEYzEncoding AES Keyz:The EncodingAESKey from your WeCom callback configuration.WECOM_CALLBACK_PORTz$Callback server port (default: 8645)z"Port for the HTTP callback server.WECOM_CALLBACK_ALLOWED_USERSz5Restrict which WeCom users can interact with the app.weixinzWeixin / WeChatWEIXIN_ACCOUNT_ID bluebubbleszBlueBubbles (iMessage)BLUEBUBBLES_SERVER_URL) zF1. Install BlueBubbles on a Mac that will act as your iMessage server:z https://bluebubbles.app/uG2. Complete the BlueBubbles setup wizard — sign in with your Apple IDuD3. In BlueBubbles Settings → API, note the Server URL and passwordz84. The server URL is typically http://:1234z<5. Hermes connects via the BlueBubbles REST API and receivesz( incoming messages via a local webhookzJ6. To authorize users, use DM pairing: hermes pairing generate bluebubblesuD Share the code — the user sends it via iMessage to get approvedz6BlueBubbles server URL (e.g. http://192.168.1.10:1234)u.The URL shown in BlueBubbles Settings → API.BLUEBUBBLES_PASSWORDzBlueBubbles server passwordu3The password shown in BlueBubbles Settings → API.BLUEBUBBLES_ALLOWED_USERSz]Pre-authorized phone numbers or iMessage IDs (comma-separated, or leave empty for DM pairing)u_Optional — pre-authorize specific users. Leave empty to use DM pairing instead (recommended).BLUEBUBBLES_HOME_CHANNELzKHome channel (phone number or iMessage ID for cron/notifications, or empty)zFPhone number or Apple ID to deliver cron results and notifications to.qqbotzQQ Botu🐧 QQ_APP_ID)z,1. Register a QQ Bot application at q.qq.comz<2. Note your App ID and App Secret from the application pagez;3. Enable the required intents (C2C, Group, Guild messages)z'4. Configure sandbox or publish the botz QQ Bot App IDz!Your QQ Bot App ID from q.qq.com.QQ_CLIENT_SECRETzQQ Bot App Secretz%Your QQ Bot App Secret from q.qq.com.QQ_ALLOWED_USERSzCAllowed user OpenIDs (comma-separated, leave empty for open access)u9Optional — restrict DM access to specific user OpenIDs.QQBOT_HOME_CHANNELz>>> * $ $/?ZM&Q'' SSS5SSSTTTT ) # # # ?+??@@@ Ls  c " |d}|d}|d}tttd|d|dtj|d}|r%t|D]}t d|t |}|r6tt|d td |d d sd Sd }|dD]}tt d|dt |d} | r|d|krt d| |drt dt dt dtd|dd } | r%| dd} d|dvrg} | dD]} | } | dr=| dr(| dd} |  dr | dd } | r| | d| } t)|d| td | }n}tgd!}t+d"|d#}|d$kr t)d%d&t-d'n4|d#krtd(t d)nt d*btd|d|d+d } | r0t)|d| td,|d|d|krt-d-|d.d St d/|d0}t |}|rm|sk|d1kre| dd$ }|r6td2|d3d4r"t)||td5|tt|d|d6d S)7z2Interactive setup for Telegram, Discord, or Slack.rr]r ─── r Setup ───rrz is already configured. Reconfigure ?FNrrrRz Current: r7 The gateway DENIES all users by default for security.z7 Enter user IDs to create an allowlist, or leave emptyz- and you'll be asked about open access next.rrrDISCORDrz<@>z<@!zuser:r97 Saved — only these users can interact with the bot.)/Enable open access (anyone can message the bot)XUse DM pairing (unknown users request access, you approve with 'hermes pairing approve')7Skip for now (bot will deny all users until configured)+ How should unauthorized users be handled?r`rGATEWAY_ALLOW_ALL_USERSr2 Open access enabled — anyone can use your bot!B DM pairing mode — users will receive a code to request access.8 Approve with: hermes pairing approve 9 Skipped — configure later with 'hermes gateway setup'rz Saved u Skipped — z won't work without this.z Skipped (can configure later) _HOME_CHANNELrz Use your user ID () as the home channel?T Home channel set to z configured!)rrrCYANrrr rrrrrLrJrrMlstripr;rrrrrrupper)rrr]r instructionsrYexisting_tokenallowed_val_setvarexistingrcleanedrZr`access_choices access_idxhome_varhome_valfirst_ids r(_setup_standard_platformrk s W E W E%I GGG %>u>>u>>> L LMMM<< 455L$   $ $D {D{{ # # # #"9--N 7778886e666>>  FO9:9: %F %%&&& V--  1F y00 /X// 0 0 0 77> " "'  P Q Q Q P Q Q Q F G G G/H //%@@@E! \--R00F ++E&}}S11..!iikk>>$//@CLL4E4E@"%**U"3"3":":3"?"?C99;;11'::*"%abb'C.!LL---!hhuooGs6{G444WXXX")""" ++XZhjkll ??"# > > GGGU00U00011111r*cTddlm}ddl}||dS)z-Delegate to the existing WhatsApp setup flow.r) cmd_whatsappN)hermes_cli.mainrmargparse Namespace)rmros r(_setup_whatsapprqd s?,,,,,,OOOL##%%&&&&&r*c`tdtD}t|dS)z0Configure Email via the standard platform setup.c32K|]}|ddk|VdS)rrNrrs r(rz_setup_email..m s0GG1U8w3F3F!3F3F3F3FGGr*Nnext _PLATFORMSrk)email_platforms r( _setup_emailrxk s2GGZGGGGGN^,,,,,r*c`tdtD}t|dS)z7Configure SMS (Twilio) via the standard platform setup.c32K|]}|ddk|VdS)rrNrrs r(rz_setup_sms..s s0CCa5U1B1B1B1B1B1BCCr*Nrt) sms_platforms r( _setup_smsr|q s2CC:CCCCCL\*****r*c ddlm}m}m}m}m}t dtD}|d}|d}tttd|d|dtj td }|r1t||d |d |d |d dsdSt|dddgd} | dkr ddl m} n6#t$r)} |d| dt!|Yd} ~ dSd} ~ wwxYw| } | |dt!|dS| \} }t#d | t#d|t#ddt||d|ddSt!|td rt#dddSdS)uHConfigure DingTalk — QR scan (recommended) or manual credential entry.r)rrrrrc32K|]}|ddk|VdS)rrNrrs r(rz"_setup_dingtalk..} s0MM1ah*6L6LQ6L6L6L6LMMr*rr]rHrrIrz# is already configured (Client ID: rrrJrKFNz Choose setup methodzCQR Code Scan (Recommended, auto-obtain Client ID and Client Secret)z*Manual Input (Client ID and Client Secret)r)dingtalk_qr_authz! QR auth module failed to load (z ), falling back to manual input.z3 QR auth incomplete, falling back to manual input.rDINGTALK_ALLOW_ALL_USERSrz configured via QR scan!)hermes_cli.setuprrrrrrurvrrrr]r hermes_cli.dingtalk_authrrrkr)rrrrrdingtalk_platformrr]rdmethodrrrX client_id client_secrets r(_setup_dingtalkrw sMM MMMMM g &E g &E GGG %>u>>u>>> L LMMM122H  OO8OOOPPP}6e666>>  F GGG ] Q 8  F{{  A A A A A A A    Mccccc d d d $%6 7 7 7 FFFFF  "!## > MO P P P $%6 7 7 7 F#) =+Y777/???16:::  @@@@@AAAAA !!2333 - . . ? 5v > > > > > ? ?s C'' D1DDctttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw| |}nT#t$r!ttdYdSt$r}td|d}Yd}~nd}~wwxYw|r;|dd}|dd}t d|r|stdd}d}|r|sttdtdtdtdtt!dd}|stddSt!dd}|stddSt#d|t#d|ttdtd t!d!d} | r6| d"d} t#d#| t d$ntgd%} td&| d'} | d kr0t#d(d)t#d*d+td,nj| d'kr/t#d(d-t d.td/n5| d0kr t#d(d1td2ntd3ttd4t!d5d} | r"t#d6| t d7| tt d8dS)9uHInteractive setup for WeCom — scan QR code or manual credential input.u: ─── 💬 WeCom (Enterprise WeChat) Setup ───r r zWeCom is already configured.z Reconfigure WeCom?FNzDScan QR code to obtain Bot ID and Secret automatically (recommended)z)Enter existing Bot ID and Secret manuallyz% How would you like to set up WeCom?r)qr_scan_for_bot_infoz WeCom QR scan import failed: z WeCom setup cancelled.z QR scan failed: bot_idrsecretu5 ✔ QR scan successful! Bot ID and Secret obtained.z9 QR scan did not complete. Continuing with manual input.uQ 1. Go to WeCom Application → Workspace → Smart Robot -> Create smart robotsz 2. Select API Modez? 3. Copy the Bot ID and Secret from the bot's credentials infouA 4. The bot connects via WebSocket — no public endpoint neededz Bot IDrMu0 Skipped — WeCom won't work without a Bot ID.z SecretTu0 Skipped — WeCom won't work without a Secret.rLz8 Enter user IDs to create an allowlist, or leave empty.z. Allowed user IDs (comma-separated, or empty)rrrP)rQrRDisable direct messagesrSrTr`WECOM_DM_POLICYopenrUrrVpairingrWrXrDdisabled Direct messages disabled.rYz2 Chat ID for scheduled results and notifications.1 Home chat ID (optional, for cron/notifications)rr\u💬 WeCom configured!)rrrr]r rrrgateway.platforms.wecomrrrKeyboardInterruptrrrrrr)existing_bot_idexisting_secretmethod_choices method_idxrrrr credentialsallowedrerfrgrAs r( _setup_wecomr s GGG %Lfk Z Z[[[#N33O#N33O? 45553U;;  F GGGN3NFXYZZJ F FQ ( D D D D D D D ( ( ( ?#?? @ @ @#'  ( + #2244 $   8999 # # #8388999"  # W$266$266UVVV V  R S S SFF  fggg)***TUUUVWWW  U333  L M M M F T222  L M M M F>6***>6*** GGGHIIIIJJJEPUVVVGT//#r**,g666OPPPP     ##PR`bcdd ?? ,f 5 5 5 4f = = = N O O O O 1__ ,i 8 8 8 ^ _ _ _ Q R R R R 1__ ,j 9 9 9 7 8 8 8 8 R S S S GGGCDDD EPU V V VD 7+T2225t55666 GGG*+++++s65B<< C$CC$* C55'E E(EEctrDtdp!tdStr t SdS)z6Check if the gateway is installed as a system service.FrT)rFrrrRrrr*r(_is_service_installedr' st ""1$E22299;;j?T\`?a?a?a?h?h?j?jj 1%''..000 5r*c\trtd}td}|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYw|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYwdStritrI tj dd tgddd }|jd kS#tj $rYdSwxYwtt!d kS) z2Check if the gateway service is currently running.FrTrrrrrArBr:r)rFrrrrrIrJrrGrPrRrrHrSrTrUr)user_unit_existssystem_unit_existsrXs r(_is_service_runningr0 s  ""#0>>>EEGG2$???FFHH   ' "2"4"45 D"=&&((H4445 *";<       ' "2"4"454=&&((H4445 *";<    u .007799 ^f&7&9&9:#$F$) )(   55   "" # #a ''s6?BB21B28?C::DD1E99F  F c$ tttdtjtt dt dt dt dt d}t d}|r1|r/tt dtd d sd S d d lm }m }n9#t$r,}td|t dYd }~d Sd }~wwxYw|s tdt dd Sttddst dd Sd d l } |j|tt!}nS#t"$r!tt%dYd St$r}td|Yd }~d Sd }~wwxYw|st%dd S|dd}|dd}|dd} |dd} t)d|t)d|| rt)d| t)dt dpdtgd } t+d!| d } | d krOt)d"d#t)d$d%t)d&dt d't d(n| d)kr@t)d"d*t)d$d+t)d&dt%d,n| d-krj| pd} t-d.| d /d0d}t)d"d1t)d$d%t)d&|t d2n?t)d"d3t)d$d%t)d&dt%d4tgd5}t+d6|d }|d kr0t)d7d3t)d8dt d9n|d)kr0t)d7d*t)d8dt%d:nUt-d;dd /d0d}t)d7d1t)d8|t d<| rDttd=| d>dr"t)d?| t d@| tt dAt dB|| rt dC| d Sd S)Dz8Interactive setup for Weixin / WeChat personal accounts.u0 ─── 💬 Weixin / WeChat Setup ───z> 1. Hermes will open Tencent iLink QR login in this terminal.z0 2. Use WeChat to scan and confirm the QR code.zG 3. Hermes will store the returned account_id/token in ~/.hermes/.env.zL 4. This adapter supports native text, image, video, and document delivery.rr+zWeixin is already configured.z Reconfigure Weixin?FNr)check_weixin_requirementsqr_loginz Weixin adapter import failed: z1 Install gateway dependencies first, then retry.z> Missing dependencies: Weixin needs aiohttp and cryptography.z2 Install them, then rerun `hermes gateway setup`.z Start QR login now?Tz Cancelled.z Weixin setup cancelled.z QR login failed: z QR login did not complete. account_idrr4base_urluser_idWEIXIN_BASE_URLWEIXIN_CDN_BASE_URLz%https://novac2c.cdn.weixin.qq.com/c2c)%Use DM pairing approval (recommended)Allow all direct messagesOnly allow listed user IDsr+ How should direct messages be authorized?WEIXIN_DM_POLICYrWEIXIN_ALLOW_ALL_USERSrWEIXIN_ALLOWED_USERS DM pairing enabled.zY Unknown DM users can request access and you approve them with `hermes pairing approve`.r`rrz$ Open DM access enabled for Weixin.rDz+ Allowed Weixin user IDs (comma-separated)rMr allowlistz Weixin allowlist saved.rr)z!Disable group chats (recommended)zAllow all group chatsz Only allow listed group chat IDs$ How should group chats be handled?WEIXIN_GROUP_POLICYWEIXIN_GROUP_ALLOWED_USERS Group chats disabled.z All group chats enabled.z* Allowed group chat IDs (comma-separated)z Group allowlist saved.z Use your Weixin user ID (r[WEIXIN_HOME_CHANNELr\zWeixin configured!z Account ID: z User ID: )rrrr]rr rrgateway.platforms.weixinrrrrrrHr0r rrrrrrr)existing_accountrarrrrrrr4rrrfrg default_allowr group_choices group_idx allow_groupss r( _setup_weixinrZ sa GGG %BFK P PQQQ GGGOPPPABBBXYYY]^^^$%899">22NN 56664e<<  FPPPPPPPPP """NNN!gk((3/@/@+A+A"B"BCC  1222 /#//000 4555r22J OOGR ( (Ez2..Hooi,,G& 333>5)))4((333(-8M*N*N*yRyzzz GGGN Ln^_``JQ)9555/999-r222-...noooo q)6222/888-r222<==== q 2 H-bghhhppqtvxyy );777/999-y99912222):666/999-r2223444 GGGM DmUVWWIA~~,j9993R888,---- a,f5553R88823333JBY^___gghkmopp ,k:::3\BBB0111>  VwVVVX\ ] ] > 0' : : : <7<< = = = GGG&''', ,,---,***+++++,,s6C D%!D  D22F%%'G5 G5G00G5c* tttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw|^ |}nR#t$r!ttdYdSt$r}td|Yd}~nd}~wwxYw|rd}|std|s$ttdtdttdd}|stddStdd} | stddSddg} td| d } | dkrdnd} d} d dlm}||| | }|r*|d } t d!| pd"ntd#n)#t$r}td$|Yd}~nd}~wwxYw|| | d| d%}|d&}|d'} |d(d} |d)}|d } t%d|t%d| t%d*| |rd+}n`td,d-g}td.|d }|dkrd/nd+}|d/kr-td0td1td2t%d3|| r tt d4| tgd5}td6|d }|d kr?t%d7d8t%d9d:t d;td<n|dkr0t%d7d=t%d9d:td>nYt%d7d8|pd:}td?|dd@d:}t%d9|t dAtdBdCg}tdD|d }|d kr t%dEdFtdGnt%dEdHtdIttdJd}|r"t%dK|t dL|tt dMtdN|tdO| | rtdP| dSdS)QuMInteractive setup for Feishu / Lark — scan-to-create or manual credentials.u. ─── 🪽 Feishu / Lark Setup ───rrz$Feishu / Lark is already configured.z Reconfigure Feishu / Lark?FNz : !!4lAFF'/1}}))+ i ' ' J K K K h i i i k l l l+_===4 222333 GGGN Ln^_``JQ/999-r222-..._```` q/888-r222CDDDD/999 2 A=[`aaaiijmoqrr -y999*+++ GGG>MDmUVWWIA~~,f555DEEEE,j999,--- GGGMX]^^^L?,l;;;=|==>>> GGG2333$F$$%%%$F$$%%%)'X''((((())sO5B<< C$CC$* C55'E E(D??EAI I8I33I8cZtttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d krU d d lm }|}n.#t$r!ttd YdSwxYw|rd}|std|sttdtdttdd}|stddStdd}|stddS||dd}td|dtd|d|dd} tgd} td| d } | d krtdd| rVtt d | d!dr#td"| t d#| n!td"dntd"dt d$td%n| d&kr0tdd'td"dtd(nY| pd} td)| dd*d} tddtd"| t d+| rEtt d,| d-dr"td.| t d/| ngttd0d}|rFtd.|t d/|tt d1td2|ddS)3uIInteractive setup for QQ Bot — scan-to-configure or manual credentials.u' ─── 🐧 QQ Bot Setup ───r!r"zQQ Bot is already configured.z Reconfigure QQ Bot?FNz3Scan QR code to add bot automatically (recommended)rz& How would you like to set up QQ Bot?rrz QQ Bot setup cancelled.Trz: Go to https://q.qq.com to register a QQ Bot application.z< Note your App ID and App Secret from the application page.rrMu2 Skipped — QQ Bot won't work without an App ID.ru6 Skipped — QQ Bot won't work without an App Secret.r)rr user_openidrrr)rrzOnly allow listed user OpenIDsrQQ_ALLOW_ALL_USERSrz Add yourself (z) to the allow list?r#z Allow list set to rrr`rz$ Open DM access enabled for QQ Bot.z( Allowed user OpenIDs (comma-separated)rrz Use your QQ user ID (r[r$r\z8 Home channel OpenID (for cron/notifications, or empty)u🐧 QQ Bot configured!r)rrrr]r rrrgateway.platforms.qqbotrrrrrrJrrr)rrrrrrrrrrrfrgrrrs r( _setup_qqbotr s GGG %96; G GHHH#K00O#$677O? 56664e<<  F GGG=7NGYZ[[JKGQ  ; ; ; ; ; ;%+--KK     GGG 5 6 6 6 FF   G U S T T T  i OPPPQRRR  U333  N O O O FNT:::   R S S S F!'*BRBRBTBTeghh ; H 5666%{?'CDDD//-44K GGGN Ln^_``JQ+W555  3 GGGQ QQQSWXX 71;???B[BBCCCC126666 -r 2 2 2-..._```` q+V444)2...<====#)r E}_deeemmnqsuvv +W555)9555*+++ K  V;VVVX\ ] ] B / = = = @;@@ A A A Xchiii  K /1C1C1E1E F F F I<3E3E3G3GII J J J GGG+,,,3K13344444s5C'C10C1c2 ddl}tttdtjt d}t d}|r1|r/tt dtddsdSt|jd rt d ntd td td tdtdtdttdtdtdtttd|pd} td|d p|}n'#ttf$rtdYdSwxYwtd ddl}||ddd}|jdkrt dn*td |jd!td"dsdSnB#t&$r5}td#|d$|td%d&sYd}~dSYd}~nd}~wwxYwt)d|ttd'td(|pd)} td*|rd+|d,nd)d$ } | s|} n'#ttf$rtdYdSwxYw| st+d-dSt)d| ttd.td/t d0pd)} | p| } td1| d p| } n'#ttf$rtdYdSwxYwt)d0| ttd2drttd3t d4pd)} td5| pd6d p| pd6}n'#ttf$rtdYdSwxYwt)d4|tt d7td8|td9| td:td;t d4rdz'Interactive setup for Signal messenger.rNu' ─── 📡 Signal Setup ───rr'zSignal is already configured.z Reconfigure Signal?Fz signal-clizsignal-cli found on PATH.zsignal-cli not found on PATH.z7 Signal requires signal-cli running as an HTTP daemon.z Install options:zF Linux: download from https://github.com/AsamK/signal-cli/releasesz# macOS: brew install signal-cliz) Docker: bbernhard/signal-cli-rest-apiz; After installing, link your account and start the daemon:z$ signal-cli link -n "HermesAgent"zA signal-cli --account +YOURNUMBER daemon --http 127.0.0.1:8080z8 Enter the URL where signal-cli HTTP daemon is running.zhttp://127.0.0.1:8080z HTTP URL [z]: z Setup cancelled.z Testing connection...rz /api/v1/checkrrjz! signal-cli daemon is reachable!z# signal-cli responded with status .z Continue anyway?z Could not reach signal-cli at rz8 Save this URL anyway? (you can start signal-cli later)Tz9 Enter your Signal account phone number in E.164 format.z Example: +15551234567rz Account numberz []z Account number is required.rLzB Enter phone numbers or UUIDs of allowed users (comma-separated).SIGNAL_ALLOWED_USERSz Allowed users [z< Enable group messaging? (disabled by default for security)z0 Enter group IDs to allow, or * for all groups.SIGNAL_GROUP_ALLOWED_USERSz Group IDs [*zSignal configured!z URL: z Account: z0 DM auth: via SIGNAL_ALLOWED_USERS + DM pairingz Groups: enabledr)r-rrrr]r rrr.rrinputrJEOFErrorrhttpxrr; status_coderrr)r- existing_urlr default_urlurlrresprdefault_accountr/existing_alloweddefault_allowedrexisting_groupsgroupss r( _setup_signalr sMMM GGG %96; G GHHH !233L$%566( 56664e<<  F GGGv|L!! 122225666LMMM'((([\\\8999>??? PQQQ;<<<VWWW  GGGIJJJ9"9K3;33344::<<K  ' ( $%%% ()))  yyCJJsOO:::DyII  s " " = > > > > S@PSSS T T T !5u==  CCCCCDDDWY]^^  FFFFF      $c*** GGGJKKK()))&,"Oao+]+B+B+B+B+B[]aaabbhhjj &%G ' ( $%%% 3444#W--- GGGHIIISTTT$%;<<B&1'O@O@@@AAGGII\_ ' ( $%%%)7333 GGGSUZ[[ = EFFF'(DEEK F?+AcFFFGGMMOOiSbifiFF+,    ( ) ) ) FF  3V<<< GGG&'''&W&&'''ABBBf7S)T)TdIIZdffgggggsa>'F&& G  G A4I J%JJ1L L-,L-'N== O! O!+Q-- RRctrtddStttdtjttdtjttdtjttdtjttdtjttdtjtt }t}tr*trtttr*trtt|r|rtd n|rtd td d r trt!nt#rt%n#t&$rO}t)d t+|D]}td|Yd}~nPd}~wt.j$r}t)d|Yd}~n'd}~wwxYwnt3dt3d tt5dg}t6D]2}t9|}||dd|d3|dt=d|t?|dz }|t?t6krnt6|}|ddkrtAn|ddkrtCn|ddkrtEn{|ddkrtGn`|ddkrtInE|ddkrtKn*|dd krtMntO|tQd!t6Dp&tSd"pd#*d$k} | rtttd%tj+t }t}|rtd&d r trtYn:t#rt[nt]t3d'n)#t&$rP}t)d(t+|D]}td|Yd}~nd}~wt.j$r}t)d)|Yd}~nd}~wwxYwn|rtd*d r trt!nt#rt%nR#t&$rP}t)d+t+|D]}td|Yd}~nd}~wt.j$r}t)d,|Yd}~nd}~wwxYwnttst#rtrd-nd.} t_rd/nd#} td0| d1| d2d rQ d} d3} trtad34\} } ntcd34d } t| rtd5d r trt!| d6k7nt%n#t&$rO}t)d+t+|D]}td|Yd}~n1d}~wt.j$r}t)d,|Yd}~nd}~wwxYwnO#t.j$r,}t)d8|t3d9Yd}~nd}~wwxYwt3d:trt3d;t3d<nt_r=t3d=t3d>t3d?t3d@nter@dAdBl3m4}t3dCt3d>t3dD|dEnntt3dGtdS)Hz│ Press Ctrl+C at any time to exit. │rz)Gateway service is installed and running.z-Gateway service is installed but not running.z Start it now?Tu1 Failed to start — user systemd not reachable:rz Failed to start: z%Gateway service is not installed yet.z.sQ U8z ! ! ]1[> * *++ ! ! ! !r*rrru──────────────────────────────────────────────────────────z) Restart the gateway to pick up changes?zStart manually: hermes gatewayu0 Restart failed — user systemd not reachable:z Restart failed: z Start the gateway service?u. Start failed — user systemd not reachable:z Start failed: rPrz. (note: services may not survive WSL restarts)z Install the gateway as a z service?z% (runs in background, starts on boot)Frz Start the service now?rrz Install failed: z. You can try manually: hermes gateway installz/ You can install later: hermes gateway installzA Or as a boot-time service: sudo hermes gateway install --systemz+ Or run in foreground: hermes gateway runz* WSL detected but systemd is not running.z' Run in foreground: hermes gateway runz< For persistence: tmux new -s hermes 'hermes gateway run'zM To enable systemd: add systemd=true to /etc/wsl.conf, then 'wsl --shutdown'rrz/ Termux does not use systemd/launchd services.zR Or start it manually in the background (best effort): nohup hermes gateway run >z/logs/gateway.log 2>&1 &z1 Service install not supported on this platform.z?No platforms configured. Run 'hermes gateway setup' when ready.)5r r rrrMAGENTArrrFrrrrrrrrorRrrTrr0rKrGrrrrvr5rrrUrqrrrrrrrkrr rDIMrtrrr rrrrr)rrrrY menu_itemsplatr)rrany_configured platform_namewsl_noteinstalled_scope did_installrs r( gateway_setupres8 ||)*** GGG %DFLFT U UVVV %RTZTb c cddd %DFLFT U UVVV %QSYSa b bccc %PRXR` a abbb %DFLFT U UVVV GGG-//)++O ""'D'F'F,...  ""'>'@'@!### S_SABBBB SEFFF *D 1 1 7 7,..$!OOOOZZ$!OOO. ' ' 'OPPPFF--//''D+t++&&&&'''''0 7 7 75!5566666666 7 7 :;;;QRRR / *+++  > >D%d++F   g<<6<<< = = = =&!!!@*cR\oo`aNabb S__ $ $ f% E?j ( (      e_ ( ( OOOO e_ ( ( OOOO e_ * *      e_ ( ( OOOO e_ ' ' NNNN e_ ' ' NNNN $X . . .A /FE * + + 1r 8 8 : :f D  VV  eJ ++,,,133-// M JH$OO : :022E'))))!E')))),..."#CDDD2+++ RSSS #A 1 1 3 3++k4kk****+++++!4::: 8Q 8 899999999: := J;TBB 8 8022(%!(%2+++ PQQQ #A 1 1 3 3++k4kk****+++++!4888 61 6 6777777778 8 GGG(**. Jhjj. J-F-H-H W i OUxx_KK]_ "G}"G"GW_"G"G"GIMNNNU*.&+ 466/;[bg;h;h;h8O[[+%8888*.K& D=9SUY+Z+Z D D#<#>#>!4$1H9T$U$U$U$U$U$1OOO#>777 +,\ ] ] ],/FF,=,=,?,?!7!7D$)+t++$6$6$6$6!7!7!7!7!7#-#@DDD +,Bq,B,B C C C C C C C CD%8UUU#$<$<$<==="#STTTTTTTTUPQQQ022h"#fgggLMMMM JGHHHDEEEYZZZjkkkk;;JLLLLLLPQQQHIII Utxtxtztz U U UVVVVRSSSHIIII TUUU GGGGGs)9H## J%-AI77J% J  J%7AU WAV%%W7WW,9X'' Z+1AY<<Z+Z&&Z+A`*11^#"`*# `%-A_72`*7`% ` `* `%%`**a%9!a  a%c t|S#t$rd}tdt|D]}t d|t jdYd}~dSd}~wwxYw)zHandle gateway subcommands.zUser systemd not reachable:rr`N)_gateway_command_innerrTrr0rKrrr)rrrYs r(gateway_commandr s%d+++ & 1222FF%%''  D +t++      s A?AA::A?c 2!t|dd}||dkrGt|dd}t|dd}t|dd}t|||dS|d krtdS|d krgtrt d dSt|d d}t|d d}t|dd}t r2t dt dtjdtr]tr;tdtdtdt t|||dStrt|dStr~t dt dt dt t dt dt dtjddSt!r}t dt dt t dt dt t d tjddSt d!t d"tjddS|d#krAtrt d$dSt|d d}t r2t d%t d&tjdtrt#|'dStrt%dSt!r`t d(t d)t t d*t d+tjddSt d,tjddS|d-kr"t|d d}t|d.d}|r6t'd/0} | r$t d1| d2t)d3d45t r2t d6t dtjdtrt+|'dStrt-dStrt d7t d8t t dt dt dt t d9tjddSt!r}t d:t d;t t d<t d=t t d>tjddSt d,tjddS|d?kr]t|d.d} t|d d}| rd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYwt'd/0} | | rdndz} | rt d@| dAdSt dBdSd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYw| s0t=rt dCdSt dDdSt d@t?dEdS|dFkr)d} t|d d}t|d.d} d}| rd}trmt/d's"t/d/'r) t3|'d/}nj#t4j$rYnYwxYwtrGt9r' t;d/}n#t4j$rYnwxYwt'd/0} | |rdndz} | rt d@| dAt)d3d45t dGtrUt/d's"t/d/'rt+|'nMtr/t9rt-ntdHdStrot/d's"t/d/'r+d/} tA|'d/} nl#t4j$rYn[wxYwtrIt9r)d/} tCd/} n#t4j$rYnwxYw| sUtrtE\}}|d/urddl#}|$}t t dIt dJt t dK|t t dLt dMdS|rOt t dNt dOt dPtjdt=rt dCt)d3d45t dGtdHdSdS|dQkr=t|dRd}t|dSd}t|d d}tK|'}trgt/d's"t/d/'r#tM|||TtO|dStr@t9r tQ|tO|dStS|j*}|r4t dUdV+tYtZ|dWt dXt]}|r4t t dY|D]}t dZ|t t r t d[t d\dStr/t d]t d^t d_dSt d`t dat dbdSt dct]}|r4t t dY|D]}t dZ|t t ddt det rt dfdStr t dt ddSt dgt dhdS|dikrct|djd}t|dkd}tstst dldSt_| |mdSdS)nNr rHrrrFr)rrsetupr\z*install gateway service (managed by NixOS)r rrz8Gateway service installation is not supported on Termux.zRun manually: hermes gatewayr`u?WSL detected — systemd services may not survive WSL restarts.z< Consider running in foreground instead: hermes gateway runzM Or use tmux/screen for persistence: tmux new -s hermes 'hermes gateway run'rz(WSL detected but systemd is not running.zIEither enable systemd (add systemd=true to /etc/wsl.conf and restart WSL)z&or run the gateway in foreground mode:zE hermes gateway run # direct foregroundzG tmux new -s hermes 'hermes gateway run' # persistent via tmuxzL nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # backgroundz=Service installation is not needed inside a Docker container.uVThe container runtime is your service manager — use Docker restart policies instead:zJ docker run --restart unless-stopped ... # auto-restart on crash/rebootz< docker restart # manual restartz&To run the gateway: hermes gateway runz4Service installation not supported on this platform.z Run manually: hermes gateway runrkz,uninstall gateway service (managed by NixOS)zcGateway service uninstall is not supported on Termux because there is no managed service to remove.z*Stop manual runs with: hermes gateway stoprz>Service uninstall is not applicable inside a Docker container.z2To stop the gateway, stop or remove the container:z docker stop z docker rm zNot supported on this platform.rr,Tru ✓ Killed z. stale gateway process(es) across all profilesrrprz\Gateway service start is not supported on Termux because there is no system service manager.z*WSL detected but systemd is not available.z+Run the gateway in foreground mode instead:z^To enable systemd: add systemd=true to /etc/wsl.conf and run 'wsl --shutdown' from PowerShell.z:Service start is not applicable inside a Docker container.z1The gateway runs as the container's main process.z: docker start # start a stopped containerz< docker restart # restart a running containerz/Or run the gateway directly: hermes gateway runru ✓ Stopped z( gateway process(es) across all profilesu✗ No gateway processes foundu$✓ Stopped gateway for this profileu'✗ No gateway running for this profilez servicerszStarting gateway...)ruB⚠ Cannot restart gateway as a service — linger is not enabled.zK The gateway user service requires linger to function on headless servers.z$ Run: sudo loginctl enable-linger rMz hermes gateway restartu#✗ Gateway service restart failed.zL The service definition exists, but the service manager did not recover it.z3 Fix the service, then retry: hermes gateway startr)rurv)rrvu✓ Gateway is running (PID: rrz- (Running manually, not as a system service)rxrz Termux note:z; Android may stop background jobs when Termux is suspendedz WSL note:zI The gateway is running in foreground/manual mode (recommended for WSL).z< Use tmux or screen for persistence across terminal closes.zTo install as a service:z hermes gateway installz& sudo hermes gateway install --systemu✗ Gateway is not runningz To start:z- hermes gateway run # Run in foregroundz^ nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # Best-effort background startz3 hermes gateway install # Install as user servicezM sudo hermes gateway install --system # Install as boot-time system servicezmigrate-legacyrrz@Legacy unit migration only applies to systemd-based Linux hosts.)rr)0getattrrrr r rrrrrFr rrrrRrrrmrrrrorrrrqrGrrrrrrtrrursrtrrr rrBr rmapr0r{r)rsubcmdrrrr rr start_allrstop_allservice_availabletotal restart_allservice_configuredservice_stopped linger_ok_detailrs _usernamerurvr rVr}rYrrs r(r r *sD T,d 3 3F~5$ 1--gu--$ 511G5'::::  <<  F G G G Fgu--x//dM488 ;;  L M M M 0 1 1 1 HQKKK $ & & xx _```YZZZjkkk %K P P P P P P ZZ  E " " " " " XX  < = = = ] ^ ^ ^ : ; ; ; GGG Y Z Z Z [ \ \ \ ` a a a HQKKKKK ^^  Q R R R j k k k GGG ^ _ _ _ P Q Q Q GGG : ; ; ; HQKKKKK H I I I 4 5 5 5 HQKKKKK ;   <<  H I I I Fx// ;;  w x x x > ? ? ? HQKKK $ & &  V , , , , , , ZZ        ^^  R S S S F G G G GGG - . . . + , , , HQKKKKK 3 4 4 4 HQKKKKK 7  x//D%//  F+>>>F FZFZZZ[[[&tEEEE ;;  p q q q 0 1 1 1 HQKKK $ & &   ( ( ( ( ( ( ZZ  OOOOO XX  > ? ? ? ? @ @ @ GGG Y Z Z Z [ \ \ \ ` a a a GGG r s s s HQKKKKK ^^  N O O O E F F F GGG N O O O P Q Q Q GGG C D D D HQKKKKK 3 4 4 4 HQKKKKK 6  4..x// , C % (** 0EU0S0S0S0Z0Z0\0\ `u~BaCaCaCaJaJaLaL  ////(,%%!4D  6 8 8 ? ? A A  NNN(,%%!4D+>>>F#4;aa!>>F?9aa:E VTUTTTUUU "4S A A A A ' ( ( ((** '0EU0S0S0S0Z0Z0\0\ '`u~BaCaCaCaJaJaLaL 'V,,,,, ' 6 8 8 ? ? A A 'A&&&& F $ & & ,A,O,O,O,V,V,X,X \qy}\~\~\~]F]F]H]H !%  v....$(!!0     ZZ 244;;== !%  !!!$(!!0    ! #(** %>%@%@" 7D(("NNN ' 1 1IGGG^___ghhhGGGLLLMMMGGG78886777F! ;<<<deeeKLLL $%% ><=== "4S A A A A ' ( ( (  " " " " " "A # #D 8  tVU++tVU++x///v>>> % & &0 k,A,O,O,O,V,V,X,X0 k\qy}\~\~\~]F]F]H]H0 k 4T : : : : +H 5 5 5 5 5 ZZ- k244;;==- k 4 +H 5 5 5 5 5-..D' kRdiiC6O6ORRRSSSEFFF 5 7 7  +GGG2333 -++k4kk****;; D.)))WXXXXXXXD+&&&efffXYYYYY45554555BCCCCC2333 5 7 7  +GGG2333 -++k4kk****k"""EFFF;;kz{{{{{XXkcdddhiiiiiOPPPijjjjj # # #$ 511dE5))(** 8::  T U U U F"3wHHHHHH $ #s[**[<;[<.\??]]*_==``aa$#a$?ee$#e$f''f98f9l$$l65l6*m;;n  n )Fr)Fr)FN)FNFr$)r"N)re)TF)FFN)FFF)rrp)rFF)rUrrir-rprGr dataclassesrpathlibr__file__r'rrrrgateway.restartrrrhermes_cli.configr r r r r rrrrrrrrrrhermes_cli.colorsrrrrEr^r3rfr%rlrufloatrrBrrrr2rr0rXrrrrrrr rrrrrrr r$r#r+rFrRrrJr*rErrrrrTr]rdrgr|rvrrCompletedProcessrrrrrr1rrrrrrrrrrrrrrurrrrrrrrr8r<rBrHrKrNrQrr(rrmrorqrtrrSrrrrrrrrrrrrrvr5r{rkrqrxr|rrrrrrrrrr r rr*r(r"s   !!!!!!tH~~$+3355 (((((( ,+++++++ $ T T T T T T T T<3<<<<~22t22222 C D     s t    3s353T3333lT#YS4Zs3xTXeeSXeTedSVieeeePC$JTVZ8>>4>E$*>>>&#%% %c3h% #s(^%%%%T# ,,, ,*, ,  ,,,,^33T3t3_c3333l " " " " "(((:P((((VTUuS#Xc:cDjY\J.DJJJJJLP05$cDj)-:=:#d####L,$,,,,=<<<<<<<<<-$----$" 4    $$$$$$#D####! M>>>>>6cDjC8 '# ' ' ' 'LL$L4LLLL, MMMM,-------";?TTT4T4TTTTn +c +c +S +UY + + + + @@4@DI@@@@ BBDBT#YBBBB7<   c t *Je    ***#**** d3i    3t3333*=uS#X<<<3c3h 4dDj(9#:    #4c4o(>#?####L----- 4444(___ _ 3T ?____D = = = =ST 22#*2c3PSm@T2222.DS4ZcDj 5C$J 5 5 5 5DU3:tCS=T>.;5c)9#:.;.;.;.;b 5 5 5 52D2222OOOOO$+B      Q$Qd3iQDIQQQQsSS4########4hh$hS4ZhSVhhhhTJJJJJJ##&__D_T____  4 D       3  d  d     (D(D(D(DVll$l4llll ,E , , , ,7 7 47 7 CRVJ7 7 7 7 tRRdRRRR" N N$ N N N NNNNNNN9P9PD9P9P9P9Pz\,\,\,t\,4\,\,\,\,FL3LLLL      VVVVVps$ssss(??4????6 % % %!!!2!!!"''E'ut|'VZ''''T'''@$G$G$G$G$G$GVL)   *[dF H H-9]kp!< > >-9Q_dg i i  ,(    )KT9 ; ;,8iw|!< > >,8P^c[ ] ]  %:&   "'2HVZ= ? ?&2HVZC E E*6Zhm!> @ @  +@*    )4ftyW Y Y*6pCd f f%1hv{K M M+7m|A!E G G(4IW\c e e  <'    &1[inW Y Y';D= ? ?/;_mr!A C C/;SafW Y Y,9O]b] _ _  <' & $   %UR T T%1SaeR T T&+5Y [ [&+5V X X*6_mr!J L L  6)   *5IW\= ? ?(4GUYO Q Q*6m|A@ B B(4ky~!P R R(3yHMU W W  8)   *5IW\M O O-9TbfP R R & $   %eD F F(LdH J J$0]kpW Y Y-9xGLZ \ \+7esx!R T T+6guzG I I <,#   $xU9 ; ;#xT9 ; ;*6drw!L N N*5ftyG I I  2 2-   .PU5 7 71]X\B D D.*RWC E E+7GUYH J J6BTbfQ S S*6\jo9 ; ;3?m|A!L N N @"( )-    .9q@EE G G+7TbfJ L L0=\jo!v x x0 >'3xGL!P R R*5sBGK M M  i k \ 2t22222j tCy    F_2t_2_2_2_2D'''--- +++ 8?8?8?vr,r,r,jt'(T'('('('(T|,|,|,~i)i)i)Xk5k5k5\ohohohdq q q p   HIHIHIHIHIr*