i 4UdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z e e j j ZddlmZddlmZmZmZddlmZmZmZmZmZmZddlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%dd l&m'Z'm(Z(e d Gd d Z)e d GddZ*de+fdZ,de-de-dzfdZ.de-de/fdZ0de-de/fdZ1de-de2de/fdZ3de+e-fdZ4de5e-de-dzde+e-ddfdZ6dde+e-de/de5e-fdZ7dde+dzde/de5fd Z8 dde+dzde5e*fd!Z9d"e:de5e:fd#Z;d"e:d$e-de/fd%Z<dd&e/de=e/e/ffd'Z> dd&e/d)e=e:d*fde?e:e:ffd+Z@d,e?e:e:fde-dzfd-ZAdd&e/de-dzfd.ZBde?dzfd/ZCde-dzde?dzfd0ZDddd1d2d&e/d3e-dzd4e2de/fd5ZEd,e?e:e:fde/fd6ZFd7ejGde/fd8ZHdd&e/de/fd9ZIdd&e/ddfd:ZJdd&e/d3e-dzde/fd;ZKde/fd<ZLdd&e/de)fd=ZMd>d?de=e-d*fe5e-zd@e-dzde:fdAZNdBe)ddfdCZOddDZPddEZQ ddFe/de+dzde/de-fdGZRde/fdHZSde/fdIZTddJlUmVZVmWZWmXZXde/fdKZYdd&e/de/fdLZZde/fdMZ[de/fdNZ\de/fdOZ]de/fdPZ^dQZ_dRZ`de:fdSZaddTe:dzde:fdUZbde:fdVZcdd&e/de fdWZdGdXdYeeZfGdZd[eeZgde fd\Zhde fd]Zide/fd^Zjdd_Zkdd4e2de/fdaZld dbdce/ddfddZmdee:dfe:dge:ddfdhZndd&e/de5e:fdiZodd&e/de5e:fdjZpddkdle5e:d&e/dejqfdmZrdd&e/de:fdnZsde5e:fdoZtde/fdpZudqZve=e:d*fewdr<dsZxe=e:d*fewdt<de5e=e/e ffduZyde5e=e:e e/ffdvZzde/fdwZ{ddxZ| ddye/dze/de=e-e5e ffd{Z}dd|Z~d}e:ddfd~Zdde:dzde=e:e:e:ffdZde de:dzfdZde:dzfdZde:dzfdZddFe/de=e:dze/ffdZde=e/dze:ffdZddZde fdZde fdZde dzfdZde:fdZde de5e:de5e:fdZde5e:de5e:fdZde:de:de:fdZde:de:fdZdd&e/de:dzde:fdZde:de:fdZde:de:fdZdd&e/de/fdZdd&e/de/fdZddee:de:dzddfdZddZdd&e/de/fdZdd&e/de/fdZd}e:ddfdZde2fdZddFe/d&e/de:dzfdZdd&e/fdZdd}e:d&e/ddfdZdd&e/fdZdd&e/fdZdd&e/fdZdde/d&e/de/fdZde:fdZde:fdZde:fdZde/fdZde/fdZddFe/fdZdZdZdZdd4e2de2dzde/fdZdZdde/fdZde:dzde/fdZde/fdZddZdde-de/de/fdZddddgdŢddd ddȜdddd dd̜dddddȜgdМddddgdբddd ddȜdddd dd̜dddddȜgdМddddgdddd ddȜddd ddȜdddd dd̜gdМddddgddddddȜddd ddȜdddddȜdddd dd̜dddddȜgdМddddgddddddȜddd ddȜdddd dd̜dddddȜdddd dȜgdМd d d d ddddddddddgddddddȜddd ddȜdddddȜd d!dd"dȜd#d$dd d%d̜gdМd&d'dÐd(gd)d(d*dd+dȜd,d-d d.dȜd/d0dd1dȜd2d3dd d4d̜d5d6dd7dȜgdМd8d9dӐd:gd;d:dd?d d@dȜgdМdAdBdCdDgdEdDdFddGdȜdHdId dJdȜdKdLddMdȜdNdOddPdȜdQdRdd dSd̜dTdUddVdȜgdМdWdXdӐdYgdZdYd[dd\dȜd]d^d d_dȜd`dRdd dad̜dbdUddVdȜgdМdcdddӐdegdfdedgddhdȜdidjd dkdȜdldmddndȜdodpd dqdȜdrdsd dtdȜdudvddwdȜdxdRdd dyd̜gdМdzd{dӐd|dd}d~dӐdgddddddȜddd ddȜdddd dd̜dddddȜgdМddddgddddddȜddd ddȜdddd dd̜dddddȜgdМddddgdddFdddȜddId ddȜgdМgZde5e?fdZde?de:fdZde5e:fdZde?fdZdZdZdZdZdZdZde/fdZde/fdZdZdZdZdZde:fdZde?ddfdZÐdZĐdZŐdZdS(zu Gateway subcommand for hermes CLI. Handles: hermes gateway [run|start|stop|restart|status|install|uninstall|setup] N) dataclass)Path) terminate_pid)%DEFAULT_GATEWAY_RESTART_DRAIN_TIMEOUT!GATEWAY_SERVICE_RESTART_EXIT_CODEparse_restart_drain_timeout) get_env_valueget_hermes_home is_managed managed_errorread_raw_configsave_env_value) print_header print_info print_success print_warning print_errorprompt prompt_choice prompt_yes_no)ColorscolorT)frozenceZdZUeed<dZeed<dZeed<dZe e dfed<dZ edzed <e d efd Z e d efd ZdS) GatewayRuntimeSnapshotmanagerFservice_installedservice_running. gateway_pidsN service_scopereturnc8|jpt|jSN)rboolr selfs 7/home/piyush/.hermes/hermes-agent/hermes_cli/gateway.pyrunningzGatewayRuntimeSnapshot.running7s#>tD,='>'>>c.|jo|jo|j Sr$)rr)rr&s r(has_process_service_mismatchz3GatewayRuntimeSnapshot.has_process_service_mismatch;s%S$,St?S;SSr*)__name__ __module__ __qualname__str__annotations__rr%rr tupleintr!propertyr)r,rr*r(rr/s LLL#t###!OT!!!$&L%S/&&& $M3:$$$ ????X?TdTTTXTTTr*rc.eZdZUeed<eed<eed<dS)ProfileGatewayProcessprofilepathpidN)r-r.r/r0r1rr3rr*r(r6r6@s+ LLL JJJ HHHHHr*r6r"c t}tr,ddgdgfD]#} tj|gdzddd}|jD]}|}|r|dds4|d} tj|d |d d gzddd}t|j}|dkr| |#ttj f$rYwxYw#ttj f$rY!wxYwtr t}tjd d |gddd}|jdkr|jD]w}|}t#|dkrN|d|krB t|d}|dkr| |g#t$rYswxYwxn#ttj f$rYnwxYw|S)aoReturn PIDs currently managed by systemd or launchd gateway services. Used to avoid killing freshly-restarted service processes when sweeping for stale manual gateway processes after a service restart. Relies on the service manager having committed the new PID before the restart command returns (true for both systemd and launchd in practice). systemctl--user)z list-unitszhermes-gateway*z--plainz --no-legend --no-pagerTcapture_outputtexttimeoutr.serviceshowz--property=MainPID--value launchctllist)setsupports_systemd_services subprocessrunstdoutstrip splitlinessplitendswithr3add ValueErrorTimeoutExpiredFileNotFoundErroris_macosget_launchd_label returncodelen) pids scope_argsresultlinepartssvcrDr9labels r(_get_service_pidsrbFsD!""'2[MB  J #"J"J"JJ#'dA #M//11<<>>D JJLLE !a(9(9*(E(E! (C )~&&#*> *KK+/dA    "$+"3"3"5"56677 HHSMMM& (AB &z'@A    zz %''E^fe,#$F A%%"M//11<<>>!!D JJLLE5zzQ58u+<+<!"%eAh--C"Qww $ )!!! D!!:#<=    D  KsnBD-.A DD-D(%D-'D((D--EEBH1.0HH1 H,)H1+H,,H11I  I r9c |dkrdS tjddddt|gddd }n#ttjf$rYdSwxYw|jd krdS|j}|sdS t| d }n#t$rYdSwxYw|d kr|ndS) z@Return the parent PID for ``pid``, or ``None`` when unavailable.Nps-ozppid=z-pTr>r?r) rLrMr0rVrUrYrNrOr3rPrT)r9r]raw parent_pids r(_get_parent_pidrjs  axxt 4$C 1     z8 9tt At -    C t))"-335566 tt#a::T1s!*5AA=9B77 CC target_pidc|dkrdStj}t}|r8||vr4||krdS||t |pd}|r||v4dS)zHReturn True when ``target_pid`` is this process or one of its ancestors.rFT)osgetpidrJrSrj)rkr9seens r(#_is_pid_ancestor_of_current_processrps~Qu )++CUUD (#T// *  4  c""'a (#T// 5r*cttdsdSt|sdS tj|tjn#t ttf$rYdSwxYwdS)z@Ask a running gateway ancestor to restart itself asynchronously.SIGUSR1FT) hasattrsignalrprmkillrrProcessLookupErrorPermissionErrorOSError)r9s r(_request_gateway_self_restartrysx 69 % %u .s 3 3u V^$$$$  9uu 4sA A%$A% drain_timeoutcttdsdS|dkrdS tj|tjn$#t $rYdSt tf$rYdSwxYwddl}| t|dz}| |kr` tj|dn#t $rYdSt $rYnwxYw| d| |k`dS)a~Send SIGUSR1 to a gateway PID and wait for it to exit gracefully. SIGUSR1 is wired in gateway/run.py to ``request_restart(via_service=True)`` which drains in-flight agent runs (up to ``agent.restart_drain_timeout`` seconds), then exits with code 75. Both systemd (``Restart=always`` + ``RestartForceExitStatus=75``) and launchd (``KeepAlive.SuccessfulExit = false``) relaunch the process after the graceful exit. This is the drain-aware alternative to ``systemctl restart`` / ``SIGTERM``, which SIGKILL in-flight agents after a short timeout. Args: pid: Gateway process PID (systemd MainPID, launchd PID, or bare process PID). drain_timeout: Seconds to wait for the process to exit after sending SIGUSR1. Should be slightly larger than the gateway's ``agent.restart_drain_timeout`` to allow the drain loop to finish cleanly. Returns: True if the PID was signalled and exited within the timeout. False if SIGUSR1 couldn't be sent or the process didn't exit in time (caller should fall back to a harder restart path). rrFrTNg??) rsrtrmrurrrvrwrxtime monotonicmaxsleep)r9rz_timedeadlines r(_graceful_restart_via_sigusr1rsI2 69 % %u axxu V^$$$$ tt W %uu  3}c#:#::H //  h & &  GCOOOO!   44    D   C //  h & & 5s/A A"A"!A"'B== C CCct}tj}tdD]6}||t |}| |dks||vrn|}7|S)ahReturn the set of PIDs in the current process's ancestor chain. Walks from the current PID up to PID 1 (init) so that process-table scans never match the calling CLI process or any of its parents. This prevents ``hermes gateway status`` from falsely counting the ``hermes`` CLI that invoked it as a running gateway instance (see #13242). @Nr)rJrmrnrangerSrj) ancestorsr9_parents r(_get_ancestor_pidsrsu%%I )++C 2YY c %% >Vq[[Fi,?,? E r*r[ exclude_pidsc||dkrdS|tjks||vs||vrdS||dS)Nr)rmrnappend)r[r9rs r(_append_unique_pidrsT {cQhh bikkSL00C4KKKKr*F all_profilesc |tz}g}gd}ttt }|r|dnddtdt ffd } trtj gdddd d d }|j d ks|j gSd|j dD]}| }| dr|tddC| drq|tdd}tfd|Dr=|s |r0 t!|t#||n#t$$rYnwxYwdʐnptj gdddd }|j d krgS|j dD]-}| } | rd| vrd} d | dd} t| dkr1 t#| d } | d n#t$$rd} YnwxYw| s| } t| d krL| dr2t#| d} d| d d | t fd|Dr|s | rt!|| |/n#t*tjf$rgcYSwxYw|S)a Best-effort process-table scan for gateway PIDs. This supplements the profile-scoped PID file so status views can still spot a live gateway when the PID file is stale/missing, and ``--all`` sweeps can discover gateways outside the current profile. )hermes_cli.main gatewayzhermes_cli.main --profilezhermes_cli.main -phermes_cli/main.py gatewayzhermes_cli/main.py --profilezhermes_cli/main.py -pzhermes gatewaygateway/run.pyrgcommandr"cdrd|vp d|vpd|vSd|vsd|vrdSd|vr d|vrdSdS)N --profile z-p z HERMES_HOME=z -p FTr)r current_homecurrent_profile_names r(_matches_current_profilez4_scan_gateway_pids.._matches_current_profile&s  3133w></-//7:<0,00G;  7 " "f&7&75 W $ $)F )F)Fg)U)U5tr*)wmicprocessgetzProcessId,CommandLinez /FORMAT:LISTTutf-8ignore )r@rAencodingerrorsrBrN z CommandLine=z ProcessId=c3 K|]}|vV dSr$r).0p current_cmds r( z%_scan_gateway_pids..Gs(>>1 +>>>>>>r*)rez-Aewwrfz pid=,command=r?greprdrI c3 K|]}|vV dSr$r)rpatternrs r(rz%_scan_gateway_pids..ps(BBgw')BBBBBBr*)rr0r resolve _profile_argrQr% is_windowsrLrMrYrNrO startswithrZanyrr3rTisdigitjoinrxrU)rrr[patternscurrent_profile_argrr]r^pid_strstrippedr9r_ aux_partsrrrrs @@@@r(_scan_gateway_pidsr s "4"6"66LD   H((002233L&|44>QY.4466r::WY # $       A <<> @^SSS#  F A%%)> K ++D11 % %zz||??>22 %"&s>':':';';">>>X>>>>>!$!(@(@(M(M!!.tS\\<PPPP)!!! D!"$K % ^:::# F  A%%  ++D11 @ @::<<6X#5#5 tQ//u::??#!%(mm"'(%###"#; ( 0 0I9~~**y|/C/C/E/E*!)A,//"%((9RSS>":":;BBBBBBBBB@ @$<$L$ B3L$?FL$ F+(L$*F++.L$A%L$IL$ I-*L$,I--B6L$$L?>L?c8t|p t}g}|s1 ddlm}t|||n#t$rYnwxYwt D]}t|||t ||D]}t||||S)aFind PIDs of running gateway processes. Args: exclude_pids: PIDs to exclude from the result (e.g. service-managed PIDs that should not be killed during a stale-process sweep). all_profiles: When ``True``, return gateway PIDs across **all** profiles (the pre-7923 global behaviour). ``hermes update`` needs this because a code update affects every profile. When ``False`` (default), only PIDs belonging to the current Hermes profile are returned. rget_running_pidr)rJgateway.statusrr Exceptionrbr)rr_excluder[rr9s r(find_gateway_pidsrzs<(355))HD   6 6 6 6 6 6 t__%6%6 A A A A    D  ""004h////!(FFF004h//// KsA AAct|p t}g} ddlm}ddlm}n#t $r|cYSwxYwt}|D]~} ||jdz d}n#t $rY%wxYw||dks||vs||vr:|||t|j |j||S) zDReturn running gateway PIDs mapped to Hermes profiles via PID files.rr) list_profiles gateway.pidF cleanup_staleN)r7r8r9) rJrrhermes_cli.profilesrrr8rSrr6name)rr processesrrror7r9s r(find_profile_gateway_processesrs7<(355))H-/I2222225555555 UUD =??bb !/',">eTTTCC    H  ;#((cXoo   .w|',\_```aaaa s . ==A11 A>=A>r7ctddg}|dkr|d|g|gd|S)Nz-mzhermes_cli.maindefaultz --profile)gatewayrMz --replace)get_python_pathextend)r7argss r(_gateway_run_args_for_profilersU   t%6 7D) ['*+++KK///000 Kr*old_pidc4|dkrdStjd} tjt jd|t|gt|tj tj dn#t$rYdSwxYwdS)zDRelaunch a manually-run profile gateway after its current PID exits.rFaV import os import subprocess import sys import time pid = int(sys.argv[1]) cmd = sys.argv[2:] deadline = time.monotonic() + 120 while time.monotonic() < deadline: try: os.kill(pid, 0) except ProcessLookupError: break except PermissionError: pass time.sleep(0.2) subprocess.Popen( cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True, ) z-cT)rNstderrstart_new_session) textwrapdedentrOrLPopensys executabler0rDEVNULLrx)r7rwatchers r('launch_detached_profile_gateway_restartrs!||uo 2 egg3 6 ^T7CLL b;XY`;a;a b%%"      uu 4sAB BBsystemc6t|}t|}|s|dfS tdt g|ddd}n #t t jf$r|dfcYSwxYw||j dkfS)NrF is-activeTrrr@rArBactive) _select_systemd_scopeget_systemd_unit_pathexists_run_systemctlget_service_name RuntimeErrorrLrUrNrO)rselected_system unit_existsr]s r(_probe_systemd_service_runningrs+F33O'???FFHHK &%% & *,, -"     *3 4&&&%%%%& FM//11X= ==s"AA98A9 ActiveStateSubStateResultExecMainStatusMainPID properties.c t|} tdtddd|g|ddd}n$#tt jtf$ricYSwxYw|jdkriSi}|j D]7}d |vr| d d \}}| ||<8|S) zCReturn selected ``systemctl show`` properties for the gateway unit.rDr=z --property,Trrr=rd) rrrrrrLrUrxrYrNrPrQrO)rrrr]parsedr^keyvalues r(_read_systemd_unit_propertiesrs,F33O ""$$  #     *3W = A F ((**$$ d?? ZZQ'' Ukkmms Ms8A A+*A+propsc t|ddpd}n#ttf$rYdSwxYw|dkr|ndS)Nr0r)r3r TypeErrorrT)rr9s r(_systemd_main_pid_from_propsrsb%))Is++2s33 z "tt''33t#s %(==c<tt|SNr)rrrs r(_systemd_main_pidr&s '(EV(T(T(T U UUr*cz ddlm}|}n#t$rYdSwxYwt|tr|ndS)Nrread_runtime_status)rrr isinstancedict)rstates r(_read_gateway_runtime_statusr *sd666666##%% ttud++ 5555s  !!c|sdSt}|sdS t|ddpd}n#ttf$rYdSwxYw||kr|ndS)Nr9r)r r3rrrT)r9r  state_pids r(_gateway_runtime_status_for_pidr 4s t ( * *E t %++0q11 z "tt$$55$.s%>AAgN@)r previous_pidrBrrBc Pddl}t}t|}||z}d}||krt |}|dd} |dd} d} ddlm} | } n#t$rd} YnwxYw| st|} | d kr| r|| |krt| } | pid }|d krtd |d | ddS|dkr3| pidpd}td|d| d|dS|std|d| dd}| dkr| dkr| dVt|rt|dS| d||ktd|dt!|d|rdndd |sd!ndd"|d# dS)$zFWait for the gateway service to become active after a restart handoff.rNFrrrrrr gateway_stater)✓ z service restarted (PID )Tstartup_failed exit_reasonzstartup failed⚠ z service process restarted (PID z), but gateway startup failed: ⏳ z service process started (PID z!); waiting for gateway runtime... activating auto-restartrdrIz& service did not become active within zs. Check status: sudo z1hermes gateway status Check logs: journalctl --user -u z -l --since '2 min ago')r}r_service_scope_label capitalizer~rrrrrrr printr_systemd_unit_is_start_limited_print_systemd_start_limit_waitr3)rrrBr}r` scope_labelrprinted_runtime_waitr active_state sub_statenew_pidr runtime_staterreasons r(!_wait_for_systemd_service_restartr(AsKKK   C&v..99;;K~~')H  ..  X % %-V<<<yy33 IIj"--   6 6 6 6 6 6%o''GG   GGG  :2599G 8 # # 0L0G|4K4K ? H H !.!4" 9 9/ J J  I--PPPgPPPQQQ4 $444+1r66}EEYIYF~~~g~~v|~~ 5+0vvvGvvvwww+/( < ' 'I,G,G JJqMMM  )% 0 0  +6 : : : :5 1 K ..  X % %N  g{ g g#g,, g g&,477" g g7=&Eii2 g gJM g g g 5s%B66 CCc|dd}|dd}|dkp|dkS)Nrrrstart-limit-hit)rlower)rr]r$s r(rr~sW YYx $ $ * * , ,F *b))//11I & & H)7H*HHr*excc8g}dD]c}t||d}|st|tr|d}|t |dd|}d|vpd|vpd|vS)N)rrNoutputreplace)rrr*z"start request repeated too quicklyz start-limit)getattrrbytesdecoderr0rr+)r,r_attrrrAs r($_systemd_error_indicates_start_limitr4sE.!!T4((   eU # # 3LL L22E SZZ    99U   ! ! # #DT! ! /4 7 ! D r*c<tt|Sr)rrrs r(!_systemd_service_is_start_limitedr6s )*Gv*V*V*V W WWr*cTt}t|}|rdnd}|rdnd}|rdnd}td|dtd td |rd ndd |td |d|td|d|ddS)N --systemrz systemctl zsystemctl --user z journalctl zjournalctl --user rz0 service is temporarily rate-limited by systemd.zC systemd is refusing another immediate start after repeated exits.z7 Wait for the start-limit window to expire, then run: rhermes gateway restartz& Or clear the failed state manually: reset-failed z Check logs: rz -l --since '5 min ago')rrrr)rr`r! scope_flagsystemctl_prefixjournal_prefixs r(r r s   C&v..99;;K &.BJ'-F||3F&,F]]2FN N N N NOOO OPPP BvD]GG[] B Bu B BCCC W3C W WRU W WXXX J> J Jc J J JKKKKKr*ct|}|sdS ddlm}n#t$rYdSwxYw|pi}|dsdS|dd}|dd}|d d}|d d}|d kr&|d kr t d t ||S|dkr|ttks|dkrt} t| } t d| dtd| g|ddtd| g|ddt ||SdS)zARecover a planned service restart that is stuck in systemd state.rFrrrestart_requestedrrrrrrruG⏳ Service restart already pending — waiting for systemd relaunch...rrfailedz exit-codeu&↻ Clearing failed state for pending z service restart... reset-failedrcheckrBstartZ)rrrrrrr(r0rrrrr+r) rrrrr&r#r$exec_main_statusr]r`r!s r( _recover_pending_systemd_restartrIs ) 8 8 8E u6666666 uu('))/RM   0 1 1u99]B//L *b))Iyy!1266 YYx $ $F|## ^(C(C WXXX0%    xC ABBBB [   *622==??  _{7H7H7J7J___``` S !      cN     1%    5s  ++ctsdS tjddt gddd}n#tj$rYdSwxYw|jdkS)NFrFrGTrr?r)get_launchd_plist_pathrrLrMrXrUrY)r]s r(_probe_launchd_service_runningrLs ! # # * * , ,u &"3"5"5 6      $uu   !!s'A AAc^tt}trtd|Sddlm}t r|rtd|StrZt|\}}t|}td|dt| ||| Str>td t t|d Std |S) zBReturn a unified view of gateway liveness for the current profile.zTermux / manual process)rr r) is_containerzdocker (foreground)rz systemd (r)rrrr r!launchdzmanual process)r2r is_termuxrhermes_constantsrNis_linuxrKrrrrrWrKrL)rr rNrrr!s r(get_gateway_runtime_snapshotrSso*,,--L{{ %-%    .-----zz llnn %)%    !""  +IQW+X+X+X(*?;; %. ...3?KKKRRTT+%%     zz %466==??:<<%#      " !   r*rHlimitrUc|d|d|Dn d|D}|(t||kr|dd|S)Nc8g|]}|dkt|Srr0rr9s r( z(_format_gateway_pids..s#<<.s/W|W|W|ehtwz{t{t{X[\_X`X`t{t{t{r*z..., )rZrr)r[rUrendereds r(_format_gateway_pidsr_sr@E@Q<.2s0   yG## ###r*NzOther profiles:u ✓ z<16su — PID )rrdrrr7r9r)rdother_processesprocrfs @r($_print_other_profiles_gateway_statusri's ??????))++    577     F     # C CD A4<AAAtxAA B B B B C C      s,A5AA55 BBc2 ddlm}m}n #t$rt dYdSwxYw|}|st ddS|}t d|D]}|jrdnd}|j}|j|kr|d z }d |d |d g}|jrG dd lm}||j dz d} | r| d| n%#t$rYnwxYw| dt d |dS)zList all profiles and their gateway running status. Provides a single-command overview of every known profile and whether its gateway is currently running, so multi-profile users don't have to check each profile individually. r)rrdzUnable to list profiles.NzNo profiles found.z Gateways:u✓u✗z (current) rz<24srrFrzPID z not runningu — ) rrrdrrgateway_runningrrrr8rr) rrdprofilesrfprofmarkerrar_rr9s r( _gateway_listrpAsNNNNNNNNN  ()))}H  "###%%''G +##.9E  9   \ !E+f++u+++,   ( ::::::%odi-&?uUUU/LL...     LL ' ' ' gll5!!""""!##s ((5C CCforcec t||}d}|D]m} t|||dz }#t$rY&t$rt d|YCt $r}t d|d|Yd}~fd}~wwxYw|S) aKill any running gateway processes. Returns count killed. Args: force: Use the platform's force-kill mechanism instead of graceful terminate. exclude_pids: PIDs to skip (e.g. service-managed PIDs that were just restarted and should not be killed). all_profiles: When ``True``, kill across all profiles. Passed through to :func:`find_gateway_pids`. )rrrrqrd"⚠ Permission denied to kill PID zFailed to kill PID : N)rrrvrwrrx)rqrrr[killedr9r,s r(kill_gateway_processesrwis ,\ R R RD F 6 6 6 #U + + + + aKFF!    D > > > r)r)degradedstarting initializingF)rrNrOr+rrLrUrx)rr]statuss r(rrs  !    $$&&,,..LLL *3W =uusAAA&%A&cNtdrdStdrdSdS)zDReturn True when a container exposes working user or system systemd.FrTrrr*r(_container_systemd_operationalrs75)))t4(((t 5r*ctrtrdStjddSt rt St rtSdS)NFr;T)rRrPshutilwhichrrrNrrr*r(rKrKsh ::u |K  (u xx*')))~~0-/// 4r*c"tjdkS)Ndarwinrrrr*r(rWrWs <8 ##r*c"tjdkS)Nwin32rrr*r(rrs <7 ""r*zhermes-gatewayz5Hermes Agent Gateway - Messaging Platform Integrationc:ddl}ddl}ddlm}t }|}||krdS|dz } ||}|j}t|dkr$| d|dr|dSn#t$rYnwxYw| t| ddS) aDerive a service-name suffix from the current HERMES_HOME. Returns ``""`` for the default root, the profile name for ``/profiles/``, or a short hash for any other path. Works correctly in Docker (HERMES_HOME=/opt/data) and standard deployments. rNget_default_hermes_rootrrmrd^[a-z0-9][a-z0-9_-]{0,63}$)hashlibrerQrr r relative_tor_rZmatchrTsha256r0encode hexdigest)rrrhomer profiles_rootrelr_s r(_profile_suffixrs'NNN III888888    $ $ & &D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?8O       >>#d))**,, - - 7 7 9 9"1" ==s+AB?? C  C  hermes_homecddl}ddlm}t|pt t }|}||krdS|dz } ||}|j}t|dkr'| d|dr d|dSn#t$rYnwxYwdS) aReturn ``--profile `` only when HERMES_HOME is a named profile. For ``~/.hermes/profiles/``, returns ``"--profile "``. For the default profile or hash-based custom paths, returns the empty string. Args: hermes_home: Optional explicit HERMES_HOME path. Defaults to the current ``get_hermes_home()`` value. Should be passed when generating a service definition for a different user (e.g. system service). rNrrrmrdrr) rrQrrr0r rrr_rZrrT)rrrrrrrr_s r(rrsIII888888  5s?#4#455 6 6 > > @ @D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?*a** *      2sAC C'&C'cHt}|stStd|S)aDerive a systemd service name scoped to this HERMES_HOME. Default ``~/.hermes`` returns ``hermes-gateway`` (backward compatible). Profile ``~/.hermes/profiles/coder`` returns ``hermes-gateway-coder``. Any other HERMES_HOME appends a short hash for uniqueness. -)r _SERVICE_BASEsuffixs r(rr.s1  F  & &f & &&r*ct}|rtd|dz Stjdz dz dz |dz S)N/etc/systemd/systemrC.configsystemduser)rrr)rrs r(rr<s[   D ?)**->->->>> 9;; "Y . 7T:K:K:K KKr*ceZdZdZdS)UserSystemdUnavailableErrora#Raised when ``systemctl --user`` cannot reach the user D-Bus session. Typically hit on fresh RHEL/Debian SSH sessions where linger is disabled and no user@.service is running, so ``/run/user/$UID/bus`` never exists. Carries a user-facing remediation message in ``args[0]``. N)r-r.r/__doc__rr*r(rrCsr*rceZdZdZdefdZdS)SystemScopeRequiresRootErrora'Raised when a system-scope gateway operation is attempted as non-root. System-scope units live in ``/etc/systemd/system/`` and require root for install / uninstall / start / stop / restart via ``systemctl``. The previous behavior was ``sys.exit(1)`` which blew past the wizard's ``except Exception`` guards and dumped the user at a bare shell prompt with no guidance. Raising a typed exception lets callers that can recover (the setup wizard) print actionable remediation instead, while ``gateway_command`` still exits 1 with the same message for the direct CLI path. ``args[0]`` carries the user-facing message, ``args[1]`` the action name. ``str(e)`` returns only the message (not the tuple repr) so format strings like ``f"Failed: {e}"`` render cleanly. r"c.|jr |jdndS)Nrr)rr&s r(__str__z$SystemScopeRequiresRootError.__str__]s#y0ty||b0r*N)r-r.r/rr0rrr*r(rrLs9 1111111r*rctjdpdtj}t |dz S)zIReturn the expected per-user D-Bus socket path (regardless of existence).XDG_RUNTIME_DIR /run/user/busrmenvironrgetuidrxdgs r(_user_dbus_socket_pathras; *..* + + I/IBIKK/I/IC 99u r*ctjdpdtj}t |dz dz S)zJReturn the per-user systemd private socket path (regardless of existence).rrrprivaterrs r(!_user_systemd_private_socket_pathrgs@ *..* + + I/IBIKK/I/IC 99y 9 ,,r*ctptS)a6Return True when user-scope systemd has a reachable control socket. Some distros expose only the per-user systemd private socket even when the D-Bus session bus socket is absent. ``systemctl --user`` can still work in that configuration, so preflight checks must treat either socket as valid. )rrrrr*r(_user_systemd_socket_readyrms4 " # # * * , , \0Q0S0S0Z0Z0\0\\r*ctj}dtjvr5d|}t|r|tjd<dtjvr]tjdd|}t|dz }|rd|tjd<dSdSdS)aEnsure DBUS_SESSION_BUS_ADDRESS and XDG_RUNTIME_DIR are set for systemctl --user. On headless servers (SSH sessions), these env vars may be missing even when the user's systemd instance is running (via linger). Without them, ``systemctl --user`` fails with "Failed to connect to bus: No medium found". We detect the standard socket path and set the vars so all subsequent subprocess calls inherit them. rrDBUS_SESSION_BUS_ADDRESSrz unix:path=N)rmrrrrr)uid runtime_dir xdg_runtimebus_paths r(_ensure_user_systemd_envrws )++C **(3((    # # % % 8,7BJ( )!33jnn%68JS8J8JKK  $$u, ??   M5L(5L5LBJ1 2 2 2 43 M Mr*@cddl}||z}||krKtrtdS|d||kKtS)a3Poll for the user systemd runtime socket(s), up to ``timeout`` seconds. Linger-enabled user@.service can take a second or two to spawn its control socket(s) after ``loginctl enable-linger`` runs. Returns True once either the user D-Bus socket or the per-user systemd private socket exists. rNTg?)r}r~rrr)rBr}rs r(_wait_for_user_dbus_socketrsKKK~~')H ..  X % % % ' '  $ & & &4 3 ..  X % % & ' ''r*)auto_enable_lingerrc2ttrdSddl}|}t \}}|dur9t drdSt |ddtjd |rtj d r tj d d |gddd d }|j dkrFt drtd|ddSt |ddt |jp|jp d|j }t |d|d| n0#t&$r#}t |d|dd| Yd}~nd}~wwxYwt |d|pddd| dS)a9Ensure ``systemctl --user`` will reach the user-scope systemd instance. No-op when the user D-Bus socket or per-user systemd private socket is already there (the common case on desktops and linger-enabled servers). On fresh SSH sessions where both are missing: * If linger is already enabled, wait briefly for user@.service to spawn the socket. * If linger is disabled and ``auto_enable_linger`` is True, try ``loginctl enable-linger $USER`` (works as non-root when polkit permits it, otherwise needs sudo). * If the socket is still missing afterwards, raise :class:`UserSystemdUnavailableError` with a precise remediation message. Callers should treat the exception as a terminal condition for user-scope systemd operations and surface the message to the user. NrTrrBzGUser systemd control sockets are missing even though linger is enabled.z systemctl start user@zC.service (may require sudo; try again after the command succeeds))r'fix_hintloginctl enable-lingerFrCr@rArErB@u✓ Enabled linger for u — user D-Bus now availablez=Linger was enabled, but the user D-Bus socket did not appear.z` Log out and log back in, then re-run the command. Or reboot and run: systemctl --user start exit z#loginctl enable-linger was denied: z sudo loginctl enable-linger zloginctl enable-linger failed ().z%User D-Bus session is not available (zlinger disabled)rrgetpassgetuserget_systemd_linger_statusr_raise_user_systemd_unavailablermrrrrLrMrYrrrrNrOr)rrusernamelinger_enabled linger_detailr]detailr,s r(_preflight_user_systemdrs$!##NNN  H$=$?$?!NM %c 2 2 2  F' \M")++MMM     "fl:66"! ^_h7# F A%%-c:::[H[[[\\\F/Z\GWGYGY\\ mSv}S8S@Q8S8SZZ\\F +EVEED(DD     +    +@@@@D(DD          6$ 72!2 7 7 7=(<< sE E9E44E9rr'rc0|d|d}t|)zHBuild a user-facing error message and raise UserSystemdUnavailableError.zR systemctl --user cannot reach the user D-Bus session in this shell. To fix: z{ Alternative: run the gateway in the foreground (stays up until you exit / close the terminal): hermes gateway run)r)rr'rmsgs r(rrs:  ! !   ! ! ! &c * **r*c4|st|rdgnddgS)Nr;r<)rrs r(_systemctl_cmdrs, # """" ?K==h(??r*c|rdgnddgS)N journalctlr<rrs r(_journalctl_cmdr s# AL>>,)AAr*rrc tjt||zfi|S#t$rt ddwxYw)a%Run a systemctl command, raising RuntimeError if systemctl is missing. Defense-in-depth: callers are gated by ``supports_systemd_services()``, but this ensures any future caller that bypasses the gate still gets a clear error instead of a raw ``FileNotFoundError`` traceback. z)systemctl is not available on this systemN)rLrMrrVr)rrkwargss r(rrs_~nV44t;FFvFFF  7   s!$?c|rdndS)Nrrrrs r(rrs )886)r*cg}t}dD]X\}}t|}||vr|r*||||Y|S)N))Fr)Trr)rJrrrrS)scopes seen_pathsrra unit_paths r(get_installed_systemd_scopesr"s FEEJ<&& )888  " "       & MM% NN9 % % % Mr*c@ttdkS)Nrd)rZrrr*r(has_conflicting_systemd_unitsr/s +-- . . 22r*)zhermes.service_LEGACY_SERVICE_NAMES)rrrz hermes gateway z/hermes gateway _LEGACY_UNIT_EXECSTART_MARKERSc`dtjdz dz dz fdtdfgS)uReturn ``[(is_system, base_dir), ...]`` — directories to scan for legacy units. Factored out so tests can monkeypatch the search roots without touching real filesystem paths. FrrrTr)rrrr*r(_legacy_unit_search_pathsrDs<  i')3f<= t)**+ r*cNg}tD]\}}tD]}||z } |s|ddn#tt f$rYHwxYwt fdtDsm||||f|S)uReturn ``[(unit_name, unit_path, is_system)]`` for legacy Hermes gateway units. Detects unit files installed by older Hermes versions that used a different service name (e.g. ``hermes.service`` before the rename to ``hermes-gateway.service``). When both a legacy unit and the current ``hermes-gateway.service`` are active, they fight over the same bot token — the PR #5646 signal-recovery change turns this into a 30-second SIGTERM flap loop. Safety guards: * Explicit allowlist of legacy names (no globbing). Profile units such as ``hermes-gateway-coder.service`` and unrelated third-party ``hermes-*`` services are never matched. * ExecStart content check — only flag units that invoke our gateway entrypoint. A user-created ``hermes.service`` running an unrelated binary is left untouched. * Results are returned purely for caller inspection; this function never mutates or removes anything. rr)rrc3 K|]}|vV dSr$r)rrorAs r(rz,_find_legacy_hermes_units..os'SS&v~SSSSSSr*) rrr read_textrxrwrrr)results is_systembaserrrAs @r(_find_legacy_hermes_unitsrPs*-/G466 9 9 4) 9 9Dt I  '')) **GH*MM_-    SSSS4RSSSSS  NND)Y7 8 8 8 8 9 NsAAA'&A'c8ttS)z.s'BBB\Q66B1a&BBBr*c"g|] \}}}|||f Srrr s r(r[z.remove_legacy_hermes_units..s'@@@|q!V@QF@@@r*z$Legacy Hermes gateway unit(s) found:rrrkrru(dry-run — nothing removed)cg|]\}}}| Srrrrrs r(r[z.remove_legacy_hermes_units..+++Aq1+++r*zRemove these legacy units?Tz6Skipped. Run again with: hermes gateway migrate-legacycg|]\}}}| Srrrs r(r[z.remove_legacy_hermes_units..rr*stopFrGrDdisablerC) missing_oku ✓ Removed rdu ⚠ Could not remove ruN daemon-reloadz1System-scope legacy units require root to remove.z1 Re-run with: sudo hermes gateway migrate-legacyu5 legacy unit(s) still present — see messages above.zRemoved z legacy unit(s).)rrrrunlinkrxrrrmgeteuidrrrZr) r r r user_units system_unitsrr8rrremoved remainingers r(remove_legacy_hermes_unitsr ss(' ( (F  5666"u BBVBBBJ@@v@@@L GGG 0111!',,dI%16 *4**E***++++ GGG, -...++F+++++,=)EtLL, FGGG++F+++++GI! # # d # FD>%ub Q Q Q Q It,U%QS T T T T KK4K ( ( ( )4)) * * * qLGG& # # # 7D77A77 8 8 8   T " " " " " " " " #  O,U%QS T T T T T    D  :<<1   GGG M N N N J K K K' ' '4  &&&& '+ + + d+"FD>$eUWXXXX"It#4TXZ[[[[KK4K0001411222qLGG.+++?D??A??@@@$$T********+ 0UTVWWWWW     GGG<Y^^^____::::;;; I sV&AD>>F*E>>F F F+*F+AI22J7*J22J7;K KKc2t}t|dkrdSd|}td|dt dt dt dt dt d dS) NrIz + z5Both user and system gateway services are installed (rzF This is confusing and can make start/stop/status behavior ambiguous.zL Default gateway commands target the user service unless you pass --system.z Keep one of these:z hermes gateway uninstallz* sudo hermes gateway uninstall --system)rrZrrr)rrendered_scopess r($print_systemd_scope_conflict_warningr#s ) + +F 6{{Qjj((O]/]]]^^^WXXX]^^^%&&&-...;<<<< z||q* Gf G G G    r* run_as_usercDddl}ddl}ddl}|pOtjdp;tjdp'tjdp|}|std|dkr|std|dkrtdtd  | |}n%#t$r}td ||d}~wwxYw| |j j}|||jfS) Nr SUDO_USERUSERLOGNAMEz@Could not determine which user the gateway service should run asrootztRefusing to install the gateway system service as root; pass --run-as-user root to override (e.g. in LXC containers)z*Installing gateway service to run as root.zV This is fine for LXC/container environments but not recommended on bare-metal hosts.zUnknown user: )rgrppwdrmgetenvrrOrTrrgetpwnamKeyErrorgetgrgidpw_gidgr_namepw_dir)r'rr-r.r user_infor group_names r(_system_service_identityr8sYNNNJJJJJJwry55w69J9JwbiXaNbNbwfmfufufwfw~~AAH ][\\\6+PQQ Q6BCCCklll=LL** ===4(44551<=i.//7J Z!1 11s>C C6C11C6rc|sdS|dD]K}|dr4|ddd}|pdcSLdS)NrrzUser=rrd)rrrPrrQrO)rr^rs r(_read_systemd_user_from_unitr;s     t##W#55@@BB!! ??7 # # !JJsA&&q)//11E=D  ! 4r*c tjdtjdtjdfD]F}|rB|r.|dkr|cSGdS)Nr)r*r+r,)rmr/rO) candidates r(_default_system_service_userr>(si ,,bi.?.?9AUAUV%%  %** %y/@/@F/J/J??$$ $ $ $ 4r*cBtdgdd}dddd|S)Nz6 Choose how the gateway should run in the background:)zPUser service (no sudo; best for laptops/dev boxes; may need linger after logout)zGSystem service (starts on boot; requires sudo; still runs as your user)zSkip service install for nowrrrr)rrdrI)r)choices r("prompt_linux_gateway_install_scoperB/sD @   F(t , ,V 44r*ct}|dS|dkrt}tjdkrFt d|rt d|nt dt d|dfS|s; t d d }|pd }|rntd :t|d ||d fSt|d|d fS)NNFrrzY System service install requires sudo, so Hermes can't create it from this user session.zG After setup, run: sudo hermes gateway install --system --run-as-user zR After setup, run: sudo hermes gateway install --system --run-as-user z8 Then start it with: sudo hermes gateway start --systemFTz/ Run the system gateway service as which user?rr@z Enter a username.rqrr')rqr) rBr>rmrrrrrOrsystemd_install)rqrr's r( install_linux_gateway_from_setuprG<s- . 0 0E }{ 244 :<<1   u v v v qreprrssssoppp Q R R R%<  3 3$%V`bccc *0b7799 1222  3 eDkJJJJd{%.... $;r*ctrdStsdStjdsdSt jdpt jd}|sB ddl}|t jj }n#t$rYd SwxYw tj dd |d d gd d dd}n(#t$r}dt|fcYd}~Sd}~wwxYw|jdkr0|jp|jp d|j}d|pdfS|jpd}|dvrdS|dvrdS|pd}dd|fS)zReturn systemd linger status for the current user. Returns: (True, "") when linger is enabled. (False, "") when linger is disabled. (None, detail) when the status could not be determined. )Nznot supported in Termux)Nznot supported on this platformr)Nloginctl not foundr*r+rN)Nz could not determine current userz show-userz--property=LingerrETFrrrzloginctl query failedr>1yestrue)Tr>rnofalse)Frzzunexpected loginctl output: )rPrRrrrmr/r.getpwuidrpw_namerrLrMr0rYrrNrOr+)rr.r]rrrr^s r(rr[s{{/.. ::655 < # #*))y  8BIi$8$8H < < JJJ||BIKK008HH < < <;;; <  h0CY O     SVV|A-O6=O4OF If you want the gateway user service to survive logout, run:z# sudo loginctl enable-linger $USERN)rr)rrs r(print_systemd_linger_guidancerUs$=$?$?!NM GHHHHH 5  RSSS 899999 FmFFFGGG NOOO 344444r*czddl}t|tjjS)zReturn the real macOS user home for launchd artifacts. Profile-mode Hermes often sets ``HOME`` to a profile-scoped directory, but launchd user agents still live under the actual account home. rN)r.rrOrmrr5)r.s r(_launchd_user_homerWs0 JJJ  RY[[))0 1 11r*cdt}|rd|nd}tdz dz |dz S)uReturn the launchd plist path, scoped per profile. Default ``~/.hermes`` → ``ai.hermes.gateway.plist`` (backward compatible). Profile ``~/.hermes/profiles/coder`` → ``ai.hermes.gateway-coder.plist``. ai.hermes.gateway-ai.hermes.gatewayLibrary LaunchAgentsz.plist)rrW)rrs r(rKrKsI   F,2 K ( ( ( (8KD   ) +n <$ NNr*crtjtjkr/ttj}|r|St jd}|r%t|}|r|SdD]$}t|z }|r|cS%dS)abDetect the active virtualenv directory. Checks ``sys.prefix`` first (works regardless of the directory name), then ``VIRTUAL_ENV`` env var (covers uv-managed environments where sys.prefix == sys.base_prefix), then falls back to probing common directory names under PROJECT_ROOT. Returns ``None`` when no virtualenv can be found. VIRTUAL_ENV)z.venvvenvN) rprefix base_prefixris_dirrmrr PROJECT_ROOT)r_ _virtual_envr=s r(_detect_venv_dirres zS_$$CJ ;;== K :>>-00LL!! ;;== K' i' ;;== KKK  4r*ct}|Btr |dz dz }n|dz dz }|rt|StjS)NScriptsz python.exebinpython)rerrr0rr)r_ venv_pythons r(rrsh   D  << 2*\9KK,1K      ${## # >r*r path_entriesct|dz dz t|dz dz t|dz dz t|dz dz g}fd|DS)zKReturn user-local bin dirs that exist and aren't already in *path_entries*.z.localrhz.cargogoz .npm-globalc^g|])}|vt|'|*Sr)rr)rrrks r(r[z+_build_user_local_paths..s8 P P P!Ql%:%:tAww~~?O?O%:A%:%:%:r*rY)rrk candidatess ` r(_build_user_local_pathsrpsz D8Oe #$$ D8Oe #$$ D4K%    D= 5 ()) J Q P P Pz P P PPr*ctsgSg}tjddtjD],}|dr||-dD]L}tj |}|r4|tt|j MdD]8}t| r||9g}t|}|D]2}|r.||vr*||||3|S)avReturn WSL Windows interop PATH entries for generated systemd units. WSL shells normally inherit Windows PATH entries such as ``/mnt/c/WINDOWS/System32``. systemd user services do not, so gateway tools that call ``powershell.exe``/``cmd.exe`` work in a terminal but fail in the background service unless we persist the relevant entries at install time. PATHrz/mnt/)zpowershell.exezcmd.exez explorer.exezwsl.exe)z/mnt/c/WINDOWS/system32z/mnt/c/WINDOWSz/mnt/c/WINDOWS/System32/Wbemz//mnt/c/WINDOWS/System32/WindowsPowerShell/v1.0/z /mnt/c/WINDOWS/System32/OpenSSH/)rrmrrrQpathseprrrrr0rrrrJrS)rkroentryrresolvedr]ros r(_build_wsl_interop_pathsrvs\ 88 J++11"*==%%   G $ $ %   e $ $ $N:: < ++  :   c$x.."788 9 9 9%% ;;     %   e $ $ $F |  D!!  !U$&& HHUOOO MM% Mr*r8target_home_dirctj}t|} ||}t t||z S#t $rt |cYSwxYw)aZRemap *path* from the current user's home to *target_home_dir*. If *path* lives under ``Path.home()`` the corresponding prefix is swapped to *target_home_dir*; otherwise the path is returned unchanged. /root/.hermes/hermes-agent -> /home/alice/.hermes/hermes-agent /opt/hermes -> /opt/hermes (kept as-is) Note: this function intentionally does NOT resolve symlinks. A venv's ``bin/python`` is typically a symlink to the base interpreter (e.g. a uv-managed CPython at ``~/.local/share/uv/python/.../python3.11``); resolving that symlink swaps the unit's ``ExecStart`` to a bare Python that has none of the venv's site-packages, so the service crashes on the first ``import``. Keep the symlinked path so the venv activates its own environment. Lexical expansion only via ``expanduser``. )rr expanduserrr0rT)r8rwrrrelatives r(_remap_path_for_userr{s"9;;L T A==..4((83444 1vv s3A**BBcnt}tjdz }t|dz }||krt |S ||}t ||z S#t $rt |cYSwxYw)uRemap the current HERMES_HOME to the equivalent under a target user's home. When installing a system service via sudo, get_hermes_home() resolves to root's home. This translates it to the target user's equivalent path: /root/.hermes → /home/alice/.hermes /root/.hermes/profiles/coder → /home/alice/.hermes/profiles/coder /opt/custom-hermes → /opt/custom-hermes (kept as-is) z.hermes)r rrrr0rrT)rwcurrent_hermescurrent_defaulttarget_defaultrzs r(_hermes_home_for_target_userr,s%&&..00Ny{{Y.7799O/**Y6N((>"""#!--o>>>H,--- ###>"""""#s1&BB43B4ct}tt}t}|rt|nttdz }|rt|dz nttdz dz }ttdz dz }||g}t jd} | rLtt | j} | |vr| | gd} ttpd} td| d z} |rIt|\}}t}t|}t!|}t!|}t!|}t!|}t!|}fd |D}|t%t ||t'||| d |}d t*d |d|d|d|rd|ndd|dd|d|d|d|d|dt,d| dStt/}t|}|t%t j||t'||| d |}d t*d|d|rd|ndd|d|d|d|dt,d| dS) Nr_rh node_modules.binnode)z/usr/local/sbinz/usr/local/binz /usr/sbinz/usr/binz/sbinz/binr<rCc0g|]}t|Sr)r{)rrhome_dirs r(r[z)generate_systemd_unit..ks$PPPa,Q99PPPr*:z[Unit] Description=zm After=network-online.target Wants=network-online.target StartLimitIntervalSec=0 [Service] Type=simple User=z Group=z ExecStart=z -m hermes_cli.mainrrz( gateway run --replace WorkingDirectory=z Environment="HOME=z" Environment="USER=z" Environment="LOGNAME=z" Environment="PATH=z" Environment="VIRTUAL_ENV=z" Environment="HERMES_HOME=z\" Restart=always RestartSec=60 RestartMaxDelaySec=300 RestartSteps=5 RestartForceExitStatus=zV KillMode=mixed KillSignal=SIGTERM ExecReload=/bin/kill -USR1 $MAINPID TimeoutStopSec=zT StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target zr After=network-online.target Wants=network-online.target StartLimitIntervalSec=0 [Service] Type=simple ExecStart=z Environment="PATH=zQ StandardOutput=journal StandardError=journal [Install] WantedBy=default.target )rr0rcrerrrrrrr3_get_restart_drain_timeoutrr8rrr{rrprvrSERVICE_DESCRIPTIONrr r)rr' python_path working_dir detected_venvvenv_dirvenv_binnode_binrk resolved_noderesolved_node_dircommon_bin_paths_drain_timeoutrestart_timeoutrr7r profile_arg sane_pathrs @r(generate_systemd_unitrFsl!##Kl##K$&&M%2Rs=!!!L6>???()))&&I       AL+S+<{+<+<+K|]}|VdSr$)rstrip)rr^s r(rz0_normalize_service_definition..s*IItT[[]]IIIIIIr*)rrOrP)rAs r(_normalize_service_definitionrs7 99IItzz||/F/F/H/HIII I IIr*cdddl}t|}|dd||jS)a`Normalize launchd plist text for staleness checks. The generated plist intentionally captures a broad PATH assembled from the invoking shell so user-installed tools remain reachable under launchd. That makes raw text comparison unstable across shells, so ignore the PATH payload when deciding whether the installed plist is stale. rNz,(PATH\s*)(.*?)()z\1__HERMES_PATH__\3)flags)rrsubS)rAr normalizeds r('_normalize_launchd_plist_for_comparisonrsCIII.t44J 667d   r*ct|}|sdS|d}|rt|nd}t ||}t |t |kS)NrFrr:rr')rrrr;rr)rr installed expected_userexpecteds r(systemd_unit_is_currentrs%V444I     u##W#55I?EO0;;;4M$F NNNH ( 3 37TU]7^7^ ^^r*cLt|}|rt|rdS|rt|nd}|t ||dt dg|dd td t|d dS) zMRewrite the installed systemd unit when the generated definition has changed.rFNrrr:rTrCrDu↻ Updated gateway z7 service definition to match the current Hermes install) rrrr; write_textrrrr)rrrs r(refresh_systemd_unit_if_neededrs%V444I     !8!G!G!Gu?EO0;;;4M .f-XXXcjkkkO$V4LLLL v!5f!=!= v v vwww 4r*rcZttd|rtd|ttdtd|ttdtdtdtdS)NuI⚠ Linger not enabled — gateway may stop when you close this terminal.z Auto-enable failed: z1 On headless servers (VPS, cloud instances) run:z sudo loginctl enable-linger  Then restart the gateway:z systemctl --user restart rC)rr)rrs r(_print_linger_enable_warningrs GGG UVVV 1 /v//000 GGG =>>> 7X 7 7888 GGG '((( F*:*<*< F F FGGG GGGGGr*ctstsdSddl}|}t d|}|rt ddSt\}}|durt ddStj dst||pddSt d tj dd |gddd d }n5#t$r(}t|t|Yd}~dSd}~wwxYw|jdkrt d dS|jp|jp d|j}t||p|dS)z@Enable linger when possible so the user gateway survives logout.Nrz/var/lib/systemd/linger/rRTrrIz5Enabling linger so the gateway survives SSH logout...rFrCru8✓ Linger enabled — gateway will persist after logoutr)rPrRrrrrrrrrrrLrMrr0rYrrNrO)rr linger_filerrr]rrs r(_ensure_linger_enabledrs{{(**NNN  H<(<<==K GHHH$=$?$?!NM GHHH < # #$X}/T@TUUU ABBB  ( 3     $Xs1vv666A HIIImKv}K0K8I0K0K R R T TF 6+B]CCCCCs C)) D3DDc|rdStdo"td S)NTrF)rrrs r(rr sM t  - - - 4 4 6 6 k?T\a?b?b?b?i?i?k?k;kkr*cTtjdkrdSt|S)aTrue when the setup wizard is about to trigger a system-scope operation as a non-root user. Replicates the decision ``_select_systemd_scope`` makes inside ``systemd_start`` / ``systemd_restart`` / ``systemd_stop`` so the wizard can detect the dead-end BEFORE prompting, rather than letting ``SystemScopeRequiresRootError`` propagate out and leave the user staring at a bare shell. rFr)rmrrrs r($_system_scope_wizard_would_need_rootr&s+ z||qu  / / //r*ct}td|dtdtd|d|dkrtd|nG|dkrtd |n.|d krtd |ntd |d |tdtdtdtddS)zPrint actionable remediation when the wizard skips a system-scope prompt because the user isn't root. Keeps the wizard flowing instead of aborting. u2Gateway is installed as a system-wide service — z requires root.z Options:z 1. z it this time:rFz sudo systemctl start rz sudo systemctl stop restartz sudo systemctl restart z sudo systemctl rzC 2. Switch to a per-user service (recommended for personal use):z/ sudo hermes gateway uninstall --systemz hermes gateway installz hermes gateway startN)rrrr)r$r`s r(_print_system_scope_remediationr5s>   C #  # # #|<**,,<<<=== 9C99:::: 6  83889999 9  ;c;;<<<<||+> h hDTDVDV h h hiii GGG !6yAA  > rBFrCrDrGr@u-⚠ Graceful restart did not complete within zs; forcing a service restart...T)rr&rrrrrrrrrrrrrr(r6r3rLCalledProcessErrorr4r rI)rrr9r!r`rzr,s r(systemd_restartrsz "6 * *F "(3333!!!y8888"&1111...... /   ?0???C *622==??   244  O[OOcOOOPPP (ma.? @ @  %      C       1SQQQ 0???   +C PQ@Q>>>    *cJJJJ'vCHHH )++,   #3#5#56vT[]^^^^^  ( / 4 4 8Yag8h8h8h  +6 : : : : FFFFF  &V#FFFFFFs<"E88G/F=<F==G !H//I9>/I43I44I9deepfullc 2 t|}t|}|rdnd}|s*tdtd|rdndd|dSt rt tt rttt|s7tdtd|rdndd |d td td g}|r| d t||ddtdtg|ddd}|j }|dkr3tdt|dnKtdt|dtd|rdndd||rt!|nd}|rtd|t#} | r4ttd| D]} td| t%|} | dd} | dd} | dd}| d d}| d!kr| d"krtd#nt)| rNtd$td%|rdndd |td&|sd'ndd(tnw| d)krW|t+t,kr?td*td+|sd'ndd(td,|rdndd|n| d)kr|rtd-||rtd.nX|rt/nGt1\}}|durtd/n"|durtd0td1|rottd2t3|d3td4d5d gz}|r| d t5j|d6dSdS)7Nrr8rrrrru4⚠ Installed gateway service definition is outdatedr9z # auto-refreshes the unitrr=z-lFr)rr@rBrTrrrz gateway service is runningu✗ z gateway service is stoppedrrRecent gateway health:rkrrrrrruA ⏳ Restart pending: systemd is waiting to relaunch the gatewayuB ⏳ Restart pending: systemd is temporarily rate-limiting startsz, Run after the start-limit window expires: z" Or clear it manually: systemctl rr:rAu@ ⚠ Planned restart is stuck in systemd failed state (exit 75)z Run: systemctl z && u ⚠ Systemd unit result: uB✓ System service starts at boot without requiring systemd lingerrRrSrT Recent logs:z-uz-n20r)rrrrrr#rrrrrrrNrOrrr;_runtime_health_linesrrrr0rrUrrrLrM)rrrrr; status_cmdr]rr runtime_linesr^ unit_propsr#r$rH result_coderrlog_cmds r(systemd_statusr! s "6 * *F%V444I &.BJ      4555 U61rUUUUVVV$&&,...   !###  "& 1 1 1 DEEE p61rpppppqqq ,.. =J  $  &(()  F] " "F  [)&11<<>>[[[\\\\ [)&11<<>>[[[\\\ S61rSSzSSTTTAGQ29===TO: 888999)++M  &'''!  D +t++    .f===J>>-44Lz2..I!~~&6;;..2..K|## ^(C(C QRRRR ' 3 3; RSSS z=VWWTVzznxzz{{{ uF3R99PRuuaqasasuuvvvv  ! !&6#>_:`:`&`&` PQQQ d6"A))rddP`PbPbddsyiBhoho@BddXbdd e e e e  ! !k ! 9K99::: > RSSSS >%''''577 T ! ! K L L L L u $ $ V W W W < = = = ,  n!&))T3C3E3EtTS_,``  ! NN4 w++++++ ,,r*c0t}|rd|ndS)z5Return the launchd service label, scoped per profile.rYrZ)rrs r(rXrX s'   F,2 K ( ( ( (8KKr*c.dtjS)Nzgui/)rmrrr*r(_launchd_domainr s ")++  r*ct}tt}tt}tdz }|ddt }t|}t}|rt|dz nttdz dz }|rt|nttdz }ttdz dz } || g} tj d} | rLtt| j } | | vr| | d t| d t"jd d d Dz} d |dddg}|r0|D]}| d |d|gdd|}d|d|d|d| d|d|d|d|dS)NlogsTrrhr_rrrrcg|]}||Srrrrs r(r[z*generate_launchd_plist.. s&]&]&]Q[\&]q&]&]&]r*rrrzz z-mz hermes_cli.main)zgatewayzrunz--replacez z Label z? ProgramArguments z? WorkingDirectory zf EnvironmentVariables PATH z9 VIRTUAL_ENV z9 HERMES_HOME z RunAtLoad KeepAlive SuccessfulExit StandardOutPath zH/gateway.log StandardErrorPath z-/gateway.error.log )rr0rcr rrrXrrerrrrrrrfromkeysrmrrrQr)rrrlog_dirrarrrrr priority_dirsrrr prog_argspart prog_args_xmls r(generate_launchd_plistr s!##Kl##Ko''//1122K&(G MM$M...   E{++K %&&M-:bs=5()))LSYDY\aDa@b@bH%2Rs=!!!L6???<<<<<< =ttvv = = =>>>>>r*c&t}t}tjddt d|gdd|r&|td|tddS) NrFrrFrGrru✓ Service uninstalled)rKrXrLrMrrrrrs r(launchd_uninstallr$ s'))J   ENK/@/@,J,J5,J,JKSXbdeeee+ )Z))*** #$$$$$r*c t}t}|std|jdd|tdtj ddtt|gdd tj dd td |gdd td dSt tj dd td |gdd n#tj $r}|jd vrtdtj ddtt|gdd tj dd td |gdd Yd}~nd}~wwxYwtd dS)Nu:↻ launchd plist missing; regenerating service definitionTrrr:rFrrCr kickstartru✓ Service startedrHqu:↻ launchd job was unloaded; reloading service definition)rKrXrrrrrrrLrMrr0rrrY)rrars r( launchd_startr / s'))J   E      JKKKt<<<466III [/2C2CS__U]akmnnnn [_5F5F2P2P2P2PQY]gijjjj #$$$#%%%k [_5F5F2P2P2P2PQY]gijjjjj  (kkk +D**F;9A8F66F;ctt}td|} ddlm}m}|d}| ||n#t $rYnwxYw t jdd|gdd n'#t j$r}|j d vrnYd}~nd}~wwxYwtd d tddS)NrrrFrrFrTrGrr $@rrB force_afteru✓ Service stopped) rXrrrrzrrLrMrrY_wait_for_gateway_exitr)ratargetrrzr9rs r( launchd_stoprH s   E!! + +E + +F MMMMMMMMoE222 ? % %c * * *       Y7tRPPPPP  ( <8 # #   DDDD 4S9999      s)!A AAA11B BBrrrc4ddl}ddlm}||z}|||znd}d}||kr|}|dS|`|s^||krF t |dt d|dn#t ttf$rYdSwxYwd}| d ||k|}|t d|d |d dSdS) uWait for the gateway process (by saved PID) to exit. Uses the PID from the gateway.pid file — not launchd labels — so this works correctly when multiple gateway instances run under separate HERMES_HOME directories. Args: timeout: Total seconds to wait before giving up. force_after: Seconds of graceful waiting before escalating to force-kill. rNrFTrsu⚠ Gateway PID z& did not exit gracefully; sent SIGKILLg333333?z still running after us — restart may fail) r}rrr~rrrvrwrxr) rBrr}rrforce_deadline force_sentr9 remaining_pids r(rr` slKKK......~~')H9D9Pdnn&&44VZNJ ..  X % %o ;4  ": "$..:J:Jn:\:\ c....TTTTUUUU&A   tt J 3 ..  X % %"$O%%M  dddWdddeeeu 4s$B''CCc t}td|}t}ddlm} |}| t |rt ddS|[ t|dn#tttf$rd}YnwxYw|'t|d}|st d|d d tj d d d |gddt ddS#tj$r}|jdvrt dt!}tj d dtt#|gddtj d d |gddt dYd}~dSd}~wwxYw)Nrrru✓ Service restart requestedFrsru"⚠ Gateway drain timed out after z.0fus — forcing launchd restartrFr z-kTrGru✓ Service restartedr u'↻ launchd job was unloaded; reloadingrrC)rXrrrrryrrrvrwrxrrLrMrrYrKr0)rarrzrr9exitedrrs r(launchd_restartr s   E!! + +E + +F.00M......'o ?rJonrKrL)r0rOr+)rs r( _truthy_envr$ s2 u{   ! ! # # ) ) + +/I IIr*cpttdkotdz dz S)Nz /opt/hermesdockerz entrypoint.sh)r0rcis_filerr*r(_is_official_docker_checkoutr( s6 L]* B H $ 6 ? ? A Ar*chttdrtjdkrdSttjdrdSt sdSt dtdtdtdtj d dS) zLRefuse gateway startup when the official Docker privilege drop was bypassed.rrNHERMES_ALLOW_ROOT_GATEWAYzLRefusing to run the Hermes gateway as root inside the official Docker image.z The image entrypoint normally drops privileges to the 'hermes' user. If you override entrypoint in Docker Compose, include /opt/hermes/docker/entrypoint.sh before the Hermes command.zy Running the gateway as root can leave root-owned files in $HERMES_HOME and break later non-root dashboard/gateway runs.zM Set HERMES_ALLOW_ROOT_GATEWAY=1 only if you intentionally accept this risk.rd) rsrmrr$r/r(rrrrrr*r(#_guard_official_docker_root_gatewayr+ s 2y ! !RZ\\Q%6%629899:: ' ) )V  F   H YZZZHQKKKKKr*verbosequietr/cttjdt t t r" tdn#t$rYnwxYwddl m }tdtdtdtdtd td t|rd n|} tj ||| }n #t$rtd Yd SwxYw|stjdd Sd S)aRun the gateway in foreground. Args: verbose: Stderr log verbosity count added on top of default WARNING (0=WARNING, 1=INFO, 2+=DEBUG). quiet: Suppress all stderr log output. replace: If True, kill any existing gateway instance before starting. This prevents systemd restart loops when the old process hasn't fully exited yet. rFr) start_gateway┌─────────────────────────────────────────────────────────┐u@│ ⚕ Hermes Gateway Starting... │├─────────────────────────────────────────────────────────┤u@│ Messaging platforms + cron scheduler │u?│ Press Ctrl+C to stop │└─────────────────────────────────────────────────────────┘N)r/ verbosityz Gateway stopped.rd)r+rr8insertr0rcrKrr gateway.runr/rasynciorMKeyboardInterruptr)r,r-r/r/r3successs r( run_gatewayr9 s()))HOOAs<(()))!""  *% 8 8 8 8 8    D *))))) ~ LMMM ~ LMMM KLLL ~ GGG*7I+mmGyQQQRR  "###   s$A!! A.-A.&DD#"D#telegramTelegramu📱TELEGRAM_BOT_TOKEN)z'1. Open Telegram and message @BotFatherz92. Send /newbot and follow the prompts to create your botz)3. Copy the bot token BotFather gives youuQ4. To find your user ID: message @userinfobot — it replies with your numeric IDz Bot tokenz/Paste the token from @BotFather (step 3 above).)rrpasswordhelpTELEGRAM_ALLOWED_USERSz"Allowed user IDs (comma-separated)z%Paste your user ID from step 4 above.)rrr= is_allowlistr>TELEGRAM_HOME_CHANNELzVHome channel ID (for cron/notification delivery, or empty to set later with /set-home)zPFor DMs, this is your user ID. You can set it later by typing /set-home in chat.)rraemoji token_varsetup_instructionsvarsdiscordDiscordu💬DISCORD_BOT_TOKEN) uH1. Go to https://discord.com/developers/applications → New Applicationu32. Go to Bot → Reset Token → copy the bot tokenuH3. Enable: Bot → Privileged Gateway Intents → Message Content Intentz!4. Invite the bot to your server:u2 OAuth2 → URL Generator → check BOTH scopes:z - botz< - applications.commands (required for slash commands!)zE Bot Permissions: Send Messages, Read Message History, Attach Filesz6 Copy the URL and open it in your browser to invite.z?5. Get your user ID: enable Developer Mode in Discord settings,u) then right-click your name → Copy IDz"Paste the token from step 2 above.DISCORD_ALLOWED_USERSz/Allowed user IDs or usernames (comma-separated)z%Paste your user ID from step 5 above.DISCORD_HOME_CHANNELuDRight-click a channel → Copy Channel ID (requires Developer Mode).slackSlacku💼SLACK_BOT_TOKEN)uG1. Go to https://api.slack.com/apps → Create New App → From Scratchu:2. Enable Socket Mode: Settings → Socket Mode → EnableuR Create an App-Level Token with scope: connections:write → copy xapp-... tokenuD3. Add Bot Token Scopes: Features → OAuth & Permissions → ScopeszL Required: chat:write, app_mentions:read, channels:history, channels:read,zU groups:history, im:history, im:read, im:write, users:read, files:read, files:writeuC4. Subscribe to Events: Features → Event Subscriptions → Enablez= Required events: message.im, message.channels, app_mentionz2 Optional: message.groups (for private channels)u> ⚠ Without message.channels the bot will ONLY work in DMs!uI5. Install to Workspace: Settings → Install App → copy xoxb-... tokenz56. Reinstall the app after any scope or event changesuJ7. Find your user ID: click your profile → three dots → Copy member IDz/8. Invite the bot to channels: /invite @YourBotzBot Token (xoxb-...)z&Paste the bot token from step 3 above.SLACK_APP_TOKENzApp Token (xapp-...)z,Paste the app-level token from step 4 above.SLACK_ALLOWED_USERSz'Paste your member ID from step 7 above.matrixMatrixu🔐MATRIX_ACCESS_TOKEN)zX1. Works with any Matrix homeserver (self-hosted Synapse/Conduit/Dendrite or matrix.org)z@2. Create a bot user on your homeserver, or use your own accountuN3. Get an access token: Element → Settings → Help & About → Access TokenzI Or via API: curl -X POST https://your-server/_matrix/client/v3/login \zK -d '{"type":"m.login.password","user":"@bot:server","password":"..."}'zL4. Alternatively, provide user ID + password and Hermes will log in directlyzT5. For E2EE: set MATRIX_ENCRYPTION=true (requires pip install 'mautrix[encryption]')zN6. To find your user ID: it's @username:your-server (shown in Element profile)MATRIX_HOMESERVERz0Homeserver URL (e.g. https://matrix.example.org)z@Your Matrix homeserver URL. Works with any self-hosted instance.z8Access token (leave empty to use password login instead)zMPaste your access token, or leave empty and provide user ID + password below.MATRIX_USER_IDu5User ID (@bot:server — required for password login)z4Full Matrix user ID, e.g. @hermes:matrix.example.orgMATRIX_ALLOWED_USERSz4Allowed user IDs (comma-separated, e.g. @you:server)z.Matrix user IDs who can interact with the bot.MATRIX_HOME_ROOMzSHome room ID (for cron/notification delivery, or empty to set later with /set-home)zLRoom ID (e.g. !abc123:server) for delivering cron results and notifications. mattermost MattermostMATTERMOST_TOKEN)uC1. In Mattermost: Integrations → Bot Accounts → Add Bot AccountuE (System Console → Integrations → Bot Accounts must be enabled)z:2. Give it a username (e.g. hermes) and copy the bot tokenuK3. Works with any self-hosted Mattermost instance — enter your server URLuA4. To find your user ID: click your avatar (top-left) → Profileu8 Your user ID is displayed there — click it to copy.uI ⚠ This is NOT your username — it's a 26-character alphanumeric ID.uL5. To get a channel ID: click the channel name → View Info → copy the IDMATTERMOST_URLz(Server URL (e.g. https://mm.example.com)z@Your Mattermost server URL. Works with any self-hosted instance.z&Paste the bot token from step 2 above.MATTERMOST_ALLOWED_USERSz*Your Mattermost user ID from step 4 above.MATTERMOST_HOME_CHANNELz@Channel ID where Hermes delivers cron results and notifications.MATTERMOST_REPLY_MODEuTReply mode — 'off' for flat messages, 'thread' for threaded replies (default: off)zFoff = flat channel messages, thread = replies nest under your message.whatsappWhatsAppu📲WHATSAPP_ENABLED)rrarBrCrtSignalu📡SIGNAL_HTTP_URLemailEmailu📧 EMAIL_ADDRESS)z61. Use a dedicated email account for your Hermes agentz82. For Gmail: enable 2FA, then create an App Password atz, https://myaccount.google.com/apppasswordszH3. For other providers: use your email password or app-specific passwordz-4. IMAP must be enabled on your email accountz Email addressz;The email address Hermes will use (e.g., hermes@gmail.com).EMAIL_PASSWORDz Email password (or app password)z;For Gmail, use an App Password (not your regular password).EMAIL_IMAP_HOSTz IMAP hostzBe.g., imap.gmail.com for Gmail, outlook.office365.com for Outlook.EMAIL_SMTP_HOSTz SMTP hostz?e.g., smtp.gmail.com for Gmail, smtp.office365.com for Outlook.EMAIL_ALLOWED_USERSz'Allowed sender emails (comma-separated)z3Only emails from these addresses will be processed.smsz SMS (Twilio)TWILIO_ACCOUNT_SID)z51. Create a Twilio account at https://www.twilio.com/zH2. Get your Account SID and Auth Token from the Twilio Console dashboardz93. Buy or configure a phone number capable of sending SMSz+4. Set up your webhook URL for inbound SMS:uF Twilio Console → Phone Numbers → Active Numbers → your numberu` → Messaging → A MESSAGE COMES IN → Webhook → https://your-server:8080/webhooks/twiliozTwilio Account SIDz&Found on the Twilio Console dashboard.TWILIO_AUTH_TOKENzTwilio Auth Tokenz8Found on the Twilio Console dashboard (click to reveal).TWILIO_PHONE_NUMBERz5Twilio phone number (E.164 format, e.g. +15551234567)z)The Twilio phone number to send SMS from.SMS_ALLOWED_USERSz5Allowed phone numbers (comma-separated, E.164 format)z9Only messages from these phone numbers will be processed.SMS_HOME_CHANNELzDHome channel phone number (for cron/notification delivery, or empty)z>Phone number to deliver cron job results and notifications to.dingtalkDingTalkDINGTALK_CLIENT_ID)u=1. Go to https://open-dev.dingtalk.com → Create ApplicationzQ2. Under 'Credentials', copy the AppKey (Client ID) and AppSecret (Client Secret)z.3. Enable 'Stream Mode' under the bot settingsz54. Add the bot to a group chat or message it directlyzAppKey (Client ID)z6The AppKey from your DingTalk application credentials.DINGTALK_CLIENT_SECRETzAppSecret (Client Secret)z9The AppSecret from your DingTalk application credentials.feishuz Feishu / Larku🪽 FEISHU_APP_ID)zJ1. Go to https://open.feishu.cn/ (or https://open.larksuite.com/ for Lark)z32. Create an app and copy the App ID and App Secretz(3. Enable the Bot capability for the appz<4. Choose WebSocket (recommended) or Webhook connection modez55. Add the bot to a group chat or message it directlyz?6. Restrict access with FEISHU_ALLOWED_USERS for production usezApp IDz-The App ID from your Feishu/Lark application.FEISHU_APP_SECRETz App Secretz1The App Secret from your Feishu/Lark application. FEISHU_DOMAINu+Domain — feishu or lark (default: feishu)z@Use 'feishu' for Feishu China, or 'lark' for Lark international.FEISHU_CONNECTION_MODEu=Connection mode — websocket or webhook (default: websocket)zCwebsocket is recommended unless you specifically need webhook mode.FEISHU_ALLOWED_USERSz,Allowed user IDs (comma-separated, or empty)z;Restrict which Feishu/Lark users can interact with the bot.FEISHU_HOME_CHANNELz/Home chat ID (optional, for cron/notifications)z0Chat ID for scheduled results and notifications.wecomzWeCom (Enterprise WeChat) WECOM_BOT_ID)u?1. Go to WeCom Admin Console → Applications → Create AI Botz=2. Copy the Bot ID and Secret from the bot's credentials pageu?3. The bot connects via WebSocket — no public endpoint neededz>4. Add the bot to a group chat or message it directly in WeComz>5. Restrict access with WECOM_ALLOWED_USERS for production usezBot IDz"The Bot ID from your WeCom AI Bot. WECOM_SECRETSecretz"The secret from your WeCom AI Bot.WECOM_ALLOWED_USERSz5Restrict which WeCom users can interact with the bot.WECOM_HOME_CHANNELwecom_callbackzWeCom Callback (Self-Built App)WECOM_CALLBACK_CORP_ID)uG1. Go to WeCom Admin Console → Applications → Create Self-Built AppzC2. Note the Corp ID (top of admin console) and create a Corp SecretzM3. Under Receive Messages, configure the callback URL to point to your serverzD4. Copy the Token and EncodingAESKey from the callback configurationuN5. The adapter runs an HTTP server — ensure the port is reachable from WeComzG6. Restrict access with WECOM_CALLBACK_ALLOWED_USERS for production usezCorp IDzYour WeCom enterprise Corp ID.WECOM_CALLBACK_CORP_SECRETz Corp Secretz+The secret for your self-built application.WECOM_CALLBACK_AGENT_IDzAgent IDz,The Agent ID of your self-built application.WECOM_CALLBACK_TOKENzCallback Tokenz1The Token from your WeCom callback configuration.WECOM_CALLBACK_ENCODING_AES_KEYzEncoding AES Keyz:The EncodingAESKey from your WeCom callback configuration.WECOM_CALLBACK_PORTz$Callback server port (default: 8645)z"Port for the HTTP callback server.WECOM_CALLBACK_ALLOWED_USERSz5Restrict which WeCom users can interact with the app.weixinzWeixin / WeChatWEIXIN_ACCOUNT_ID bluebubbleszBlueBubbles (iMessage)BLUEBUBBLES_SERVER_URL) zF1. Install BlueBubbles on a Mac that will act as your iMessage server:z https://bluebubbles.app/uG2. Complete the BlueBubbles setup wizard — sign in with your Apple IDuD3. In BlueBubbles Settings → API, note the Server URL and passwordz84. The server URL is typically http://:1234z<5. Hermes connects via the BlueBubbles REST API and receivesz( incoming messages via a local webhookzJ6. To authorize users, use DM pairing: hermes pairing generate bluebubblesuD Share the code — the user sends it via iMessage to get approvedz6BlueBubbles server URL (e.g. http://192.168.1.10:1234)u.The URL shown in BlueBubbles Settings → API.BLUEBUBBLES_PASSWORDzBlueBubbles server passwordu3The password shown in BlueBubbles Settings → API.BLUEBUBBLES_ALLOWED_USERSz]Pre-authorized phone numbers or iMessage IDs (comma-separated, or leave empty for DM pairing)u_Optional — pre-authorize specific users. Leave empty to use DM pairing instead (recommended).BLUEBUBBLES_HOME_CHANNELzKHome channel (phone number or iMessage ID for cron/notifications, or empty)zFPhone number or Apple ID to deliver cron results and notifications to.qqbotzQQ Botu🐧 QQ_APP_ID)z,1. Register a QQ Bot application at q.qq.comz<2. Note your App ID and App Secret from the application pagez;3. Enable the required intents (C2C, Group, Guild messages)z'4. Configure sandbox or publish the botz QQ Bot App IDz!Your QQ Bot App ID from q.qq.com.QQ_CLIENT_SECRETzQQ Bot App Secretz%Your QQ Bot App Secret from q.qq.com.QQ_ALLOWED_USERSzCAllowed user OpenIDs (comma-separated, leave empty for open access)u9Optional — restrict DM access to specific user OpenIDs.QQBOT_HOME_CHANNELz. s---Qa---r*c i|] }|d| S)rrrs r( z"_all_platforms.. s - - -aah - - -r*)platform_registryr)rrarBrC install_hint_registry_entry)hermes_cli.pluginsrrloggerdebug _PLATFORMSgateway.platform_registryr all_entriesrrrarB required_envr)rr platformsby_keyrrts r(_all_platformsr siS777777 SSS NPQRRRRRRRRS.-*---I - -9 - - -F??????? #..00    :   :[[272DL+A.."!.$        s$ A=A#A** A98A9rc|d}|d}|jH ddlm}|d}t ||}n#t $rd}YnwxYw|s5 t |}n#t $rd}YnwxYw|rdnd S|d d }|sd St|}|d krK|rG|d kr/tdz dz dz }| rdSdSd S|ddkrtd}|r|rdS|s|rdSd S|ddkrYtd} td} td} t|| | | grdSt|| | | grdSd S|ddkr^td} td} |s| r2| r0td}|r|dvrd nd }d|S|s| s| rdSd S|dd!krtd"}|r|rdS|s|rdSd S|rdSd S)#zReturn a plain-text status string for a platform. Returns uncolored text so it can safely be embedded in curses menu items (ANSI codes break width calculation). rNFr)PlatformConfigT)enabled configurednot configuredrCrr`rLr^sessionz creds.jsonzconfigured + pairedzenabled, not pairedrrtSIGNAL_ACCOUNTzpartially configuredrcrfrgrhrPrSMATRIX_PASSWORDMATRIX_ENCRYPTION)rLrJrKz + E2EEr WEIXIN_TOKEN) r is_connectedgateway.configrr%rcheck_fnr r+r rallr)rrtrr syntheticrCval session_fileaccountr.imapsmtp homeserverr=e2eertokens r(_platform_statusr sk LL* + +E     ) #999999*N4888 !%"4"4Y"?"?@@  # # #"  # # #!%.."2"233  # # #"  #)?||/?? ["--I    " "C&&&  )399;;&((*,,z9IE TL""$$ -,,((||Eh&& 011  7 <  *' *))||Eg%%,--.//.// S$% & & < S$% & & *))||Eh&&"#677  !233  )8 ) ) !455D"&W4::<<;O+O+OYYUWF((( (  *( *j *))||Eh&&n--  5 <  *% *)) |  s#4A A&%A&,!B BBc ddlm}n#t$rgcYSwxYw|}|sgSg}|d}|d}|d}|d}|dipi}|D]P\}} | dd kr2| d pd } |d |d | Q|dkr|r|d|nZ|dkr4|rdnd} t |pd} |d| d| dn |dkr|r|d||S)z>>> * $ $/?ZM&Q'' SSS5SSSTTTT ) # # # ?+??@@@ Ls  c " |d}|d}|d}tttd|d|dtj|d}|r%t|D]}t d|t |}|r6tt|d td |d d sd Sd }|dD]}tt d|dt |d} | r|d|krt d| |drt dt dt dtd|dd } | r%| dd} d|dvrg} | dD]} | } | dr=| dr(| dd} |  dr | dd } | r| | d| } t)|d| td | }n}tgd!}t+d"|d#}|d$kr t)d%d&t-d'n4|d#krtd(t d)nt d*btd|d|d+d } | r0t)|d| td,|d|d|krt-d-|d.d St d/|d0}t |}|rm|sk|d1kre| dd$ }|r6td2|d3d4r"t)||td5|tt|d|d6d S)7z2Interactive setup for Telegram, Discord, or Slack.rBrarC ─── r Setup ───rDrkz is already configured. Reconfigure ?FNrEr>rz Current: r@7 The gateway DENIES all users by default for security.z7 Enter user IDs to create an allowlist, or leave emptyz- and you'll be asked about open access next.rr=rDISCORDrz<@>z<@!zuser:r>7 Saved — only these users can interact with the bot.)/Enable open access (anyone can message the bot)XUse DM pairing (unknown users request access, you approve with 'hermes pairing approve')7Skip for now (bot will deny all users until configured)+ How should unauthorized users be handled?rdrGATEWAY_ALLOW_ALL_USERSrL2 Open access enabled — anyone can use your bot!B DM pairing mode — users will receive a code to request access.8 Approve with: hermes pairing approve 9 Skipped — configure later with 'hermes gateway setup'r=z Saved u Skipped — z won't work without this.z Skipped (can configure later) _HOME_CHANNELr;z Use your user ID () as the home channel?T Home channel set to z configured!)rrrCYANrrr rrrr/rQrOrrRlstriprr+rrrrrupper)rrBrarC instructionsr^existing_tokenallowed_val_setvarexistingrcleanedr_raccess_choices access_idxhome_varhome_valfirst_ids r(_setup_standard_platformrF s W E W E%I GGG %>u>>u>>> L LMMM<< 455L$   $ $D {D{{ # # # #"9--N 7778886e666>>  FO9:9: %F %%&&& V--  1F y00 /X// 0 0 0 77> " "'  P Q Q Q P Q Q Q F G G G/H //%@@@E! \--R00F ++E&}}S11..!iikk>>$//@CLL4E4E@"%**U"3"3":":3"?"?C99;;11'::*"%abb'C.!LL---!hhuooGs6{G444WXXX")""" ++XZhjkll ??"# > > GGGU00U00011111r*cTddlm}ddl}||dS)z-Delegate to the existing WhatsApp setup flow.r) cmd_whatsappN)hermes_cli.mainrargparse Namespace)rrs r(_setup_whatsappr s?,,,,,,OOOL##%%&&&&&r*c`tdtD}t|dS)z0Configure Email via the standard platform setup.c32K|]}|ddk|VdS)rrcNrrs r(rz_setup_email.. s0GG1U8w3F3F!3F3F3F3FGGr*Nnextrr)email_platforms r( _setup_emailr s2GGZGGGGGN^,,,,,r*c`tdtD}t|dS)z7Configure SMS (Twilio) via the standard platform setup.c32K|]}|ddk|VdS)rrjNrrs r(rz_setup_sms.. s0CCa5U1B1B1B1B1B1BCCr*Nr) sms_platforms r( _setup_smsr s2CC:CCCCCL\*****r*c ddlm}m}m}m}t dt D}|d}|d}tttd|d|dtj td }|r1t||d |d |d |d dsdSt|dddgd}|dkr ddl m } n6#t$r)} |d| dt|Yd} ~ dSd} ~ wwxYw| } | |dt|dS| \} } t!d | t!d| t!ddt||d|ddSt|td rt!dddSdS)uHConfigure DingTalk — QR scan (recommended) or manual credential entry.r)rrrrc32K|]}|ddk|VdS)rrpNrrs r(rz"_setup_dingtalk.. s0MM1ah*6L6LQ6L6L6L6LMMr*rBrarrrrrz# is already configured (Client ID: rrrFNz Choose setup methodzCQR Code Scan (Recommended, auto-obtain Client ID and Client Secret)z*Manual Input (Client ID and Client Secret)r@)dingtalk_qr_authz! QR auth module failed to load (z ), falling back to manual input.z3 QR auth incomplete, falling back to manual input.rsDINGTALK_ALLOW_ALL_USERSrLz configured via QR scan!)hermes_cli.setuprrrrrrrrrrr hermes_cli.dingtalk_authrr|rr)rrrrdingtalk_platformrBrarmethodrr,r] client_id client_secrets r(_setup_dingtalkr sMM MMMMM g &E g &E GGG %>u>>u>>> L LMMM122H  OO8OOOPPP}6e666>>  F GGG ] Q 8  F{{  A A A A A A A    Mccccc d d d $%6 7 7 7 FFFFF  "!## > MO P P P $%6 7 7 7 F#) =+Y777/???16:::  @@@@@AAAAA !!2333 - . . ? 5v > > > > > ? ?sC%% D/DDctttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw| |}nT#t$r!ttdYdSt$r}td|d}Yd}~nd}~wwxYw|r;|dd}|dd}t d|r|stdd}d}|r|sttdtdtdtdtt!dd}|stddSt!dd}|stddSt#d|t#d|ttdtd t!d!d} | r6| d"d} t#d#| t d$ntgd%} td&| d'} | d kr0t#d(d)t#d*d+td,nj| d'kr/t#d(d-t d.td/n5| d0kr t#d(d1td2ntd3ttd4t!d5d} | r"t#d6| t d7| tt d8dS)9uHInteractive setup for WeCom — scan QR code or manual credential input.u: ─── 💬 WeCom (Enterprise WeChat) Setup ───r|r}zWeCom is already configured.z Reconfigure WeCom?FNzDScan QR code to obtain Bot ID and Secret automatically (recommended)z)Enter existing Bot ID and Secret manuallyz% How would you like to set up WeCom?r)qr_scan_for_bot_infoz WeCom QR scan import failed: z WeCom setup cancelled.z QR scan failed: bot_idrsecretu5 ✔ QR scan successful! Bot ID and Secret obtained.z9 QR scan did not complete. Continuing with manual input.uQ 1. Go to WeCom Application → Workspace → Smart Robot -> Create smart robotsz 2. Select API Modez? 3. Copy the Bot ID and Secret from the bot's credentials infouA 4. The bot connects via WebSocket — no public endpoint neededz Bot IDru0 Skipped — WeCom won't work without a Bot ID.z SecretTu0 Skipped — WeCom won't work without a Secret.rz8 Enter user IDs to create an allowlist, or leave empty.z. Allowed user IDs (comma-separated, or empty)rrr)rrDisable direct messagesrrrdWECOM_DM_POLICYopenrrLrpairingrrrIdisabled Direct messages disabled.rz2 Chat ID for scheduled results and notifications.1 Home chat ID (optional, for cron/notifications)rru💬 WeCom configured!)rrrrr rrrgateway.platforms.wecomrrrr7rrrrrr/)existing_bot_idexisting_secretmethod_choices method_idxrrrr, credentialsallowedrrrrs r( _setup_wecomr! s GGG %Lfk Z Z[[[#N33O#N33O? 45553U;;  F GGGN3NFXYZZJ F FQ ( D D D D D D D ( ( ( ?#?? @ @ @#'  ( + #2244 $   8999 # # #8388999"  # W$266$266UVVV V  R S S SFF  fggg)***TUUUVWWW  U333  L M M M F T222  L M M M F>6***>6*** GGGHIIIIJJJEPUVVVGT//#r**,g666OPPPP     ##PR`bcdd ?? ,f 5 5 5 4f = = = N O O O O 1__ ,i 8 8 8 ^ _ _ _ Q R R R R 1__ ,j 9 9 9 7 8 8 8 8 R S S S GGGCDDD EPU V V VD 7+T2225t55666 GGG*+++++s65B<< C$CC$* C55'E E(EEc`tdtD}t|dS)z2Configure Yuanbao via the standard platform setup.c32K|]}|ddk|VdS)rrNrrs r(rz!_setup_yuanbao..ms0KK!QuX5J5JA5J5J5J5JKKr*Nr)yuanbao_platforms r(_setup_yuanbaor%ks4KKzKKKKK-.....r*ctrDtdp!tdStr t SdS)z6Check if the gateway is installed as a system service.FrT)rKrrrWrKrr*r(_is_service_installedr'qst ""1$E22299;;j?T\`?a?a?a?h?h?j?jj 1%''..000 5r*c\trtd}td}|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYw|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYwdStritrI tj dd tgddd }|jd kS#tj $rYdSwxYwtt!d kS) z2Check if the gateway service is currently running.FrTrrrrrFrGr?r)rKrrrrrNrOrrLrUrWrKrMrXrYrZr)user_unit_existssystem_unit_existsr]s r(_is_service_runningr+zs  ""#0>>>EEGG2$???FFHH   ' "2"4"45 D"=&&((H4445 *";<       ' "2"4"454=&&((H4445 *";<    u .007799 ^f&7&9&9:#$F$) )(   55   "" # #a ''s6?BB21B28?C::DD1E99F  F c tttdtjtt dt dt dt dt d}t d}|r1|r/tt dtd d sd S d d lm }m }n9#t$r,}td|t dYd }~d Sd }~wwxYw|s tdt dd Sttddst dd Sd d l } |j|tt!}nS#t"$r!tt%dYd St$r}td|Yd }~d Sd }~wwxYw|st%dd S|dd}|dd}|dd} |dd} t)d|t)d|| rt)d| t)dt dpdtgd } t+d!| d } | d krOt)d"d#t)d$d%t)d&dt d't d(n| d)kr@t)d"d*t)d$d+t)d&dt%d,n| d-krj| pd} t-d.| d /d0d}t)d"d1t)d$d%t)d&|t d2n?t)d"d3t)d$d%t)d&dt%d4tt d5t d6t d7t d8t d9t d:gd;}t+d<|d }|d kr0t)d=d3t)d>dt d?n|d)kr0t)d=d*t)d>dt%d@nUt-dAdd /d0d}t)d=d1t)d>|t dB| rDttdC| dDdr"t)dE| t dF| tt dGt dH|| rt dI| d Sd S)Jz8Interactive setup for Weixin / WeChat personal accounts.u0 ─── 💬 Weixin / WeChat Setup ───z> 1. Hermes will open Tencent iLink QR login in this terminal.z0 2. Use WeChat to scan and confirm the QR code.zG 3. Hermes will store the returned account_id/token in ~/.hermes/.env.zL 4. This adapter supports native text, image, video, and document delivery.rrzWeixin is already configured.z Reconfigure Weixin?FNr)check_weixin_requirementsqr_loginz Weixin adapter import failed: z1 Install gateway dependencies first, then retry.z> Missing dependencies: Weixin needs aiohttp and cryptography.z2 Install them, then rerun `hermes gateway setup`.z Start QR login now?Tz Cancelled.z Weixin setup cancelled.z QR login failed: z QR login did not complete. account_idrrbase_urluser_idWEIXIN_BASE_URLWEIXIN_CDN_BASE_URLz%https://novac2c.cdn.weixin.qq.com/c2c)%Use DM pairing approval (recommended)Allow all direct messagesOnly allow listed user IDsr+ How should direct messages be authorized?WEIXIN_DM_POLICYrWEIXIN_ALLOW_ALL_USERSrNWEIXIN_ALLOWED_USERS DM pairing enabled.zY Unknown DM users can request access and you approve them with `hermes pairing approve`.rdrrLz$ Open DM access enabled for Weixin.rIz+ Allowed Weixin user IDs (comma-separated)rr allowlistz Weixin allowlist saved.rrzH Note: QR login connects an iLink bot identity (e.g. ...@im.bot), not azM scriptable personal WeChat account. Ordinary WeChat groups typically cannotzN invite an @im.bot identity, and iLink does not deliver ordinary-group eventszI to most bot accounts. The settings below only apply when iLink actuallyuO delivers group events for your account type — otherwise DM remains the onlyz, working channel regardless of this choice.)z!Disable group chats (recommended)zAllow all group chatsz Only allow listed group chat IDs$ How should group chats be handled?WEIXIN_GROUP_POLICYWEIXIN_GROUP_ALLOWED_USERS Group chats disabled.zM All group chats enabled (only takes effect if iLink delivers group events).z? Allowed group chat IDs (comma-separated, not member user IDs)zK Group allowlist saved (only takes effect if iLink delivers group events).z Use your Weixin user ID (rWEIXIN_HOME_CHANNELrzWeixin configured!z Account ID: z User ID: )rrrrrr rrgateway.platforms.weixinr-r.rrr6rMr0r r7rrrrrr/)existing_accountrr-r.r,r6rr/rr0r1rr default_allowr< group_choices group_idx allow_groupss r( _setup_weixinrHs GGG %BFK P PQQQ GGGOPPPABBBXYYY]^^^$%899">22NN 56664e<<  FPPPPPPPPP """NNN!gk((3/@/@+A+A"B"BCC  1222 /#//000 4555r22J OOGR ( (Ez2..Hooi,,G& 333>5)))4((333(-8M*N*N*yRyzzz GGGN Ln^_``JQ)9555/999-r222-...noooo q)6222/888-r222<==== q 2 H-bghhhppqtvxyy );777/999-y99912222):666/999-r2223444 GGGYZZZ^____```Z[[[`aaa=>>>M DmUVWWIA~~,j9993R888,---- a,f5553R888effff_acnsttt||~ACEFF ,k:::3\BBBcddd>  VwVVVX\ ] ] > 0' : : : <7<< = = = GGG&''', ,,---,***+++++,,s6C D%!D  D22F%%'G5 G5G00G5c* tttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw|^ |}nR#t$r!ttdYdSt$r}td|Yd}~nd}~wwxYw|rd}|std|s$ttdtdttdd}|stddStdd} | stddSddg} td| d } | dkrdnd} d} d dlm}||| | }|r*|d } t d!| pd"ntd#n)#t$r}td$|Yd}~nd}~wwxYw|| | d| d%}|d&}|d'} |d(d} |d)}|d } t%d|t%d| t%d*| |rd+}n`td,d-g}td.|d }|dkrd/nd+}|d/kr-td0td1td2t%d3|| r tt d4| tgd5}td6|d }|d kr?t%d7d8t%d9d:t d;td<n|dkr0t%d7d=t%d9d:td>nYt%d7d8|pd:}td?|dd@d:}t%d9|t dAtdBdCg}tdD|d }|d kr t%dEdFtdGnt%dEdHtdIttdJd}|r"t%dK|t dL|tt dMtdN|tdO| | rtdP| dSdS)QuMInteractive setup for Feishu / Lark — scan-to-create or manual credentials.u. ─── 🪽 Feishu / Lark Setup ───rurvz$Feishu / Lark is already configured.z Reconfigure Feishu / Lark?FNz : !!4lAFF'/1}}))+ i ' ' J K K K h i i i k l l l+_===4 222333 GGGN Ln^_``JQ/999-r222-..._```` q/888-r222CDDDD/999 2 A=[`aaaiijmoqrr -y999*+++ GGG>MDmUVWWIA~~,f555DEEEE,j999,--- GGGMX]^^^L?,l;;;=|==>>> GGG2333$F$$%%%$F$$%%%)'X''((((())sO5B<< C$CC$* C55'E E(D??EAI I8I33I8cNtttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}|d krQ d d lm }|}n.#t$r!ttd YdSwxYw|std|sttdtdttdd}|stddStdd}|stddS||dd}td|dtd|d|dd}tgd} td| d } | d krtdd|rVtt d |d!dr#td"|t d#|n!td"dntd"dt d$td%n| d&kr0tdd'td"dtd(nY|pd} td)| dd*d} tddtd"| t d+|rEtt d,|d-dr"td.|t d/|ngttd0d} | rFtd.| t d/| tt d1td2|ddS)3uIInteractive setup for QQ Bot — scan-to-configure or manual credentials.u' ─── 🐧 QQ Bot Setup ───rrzQQ Bot is already configured.z Reconfigure QQ Bot?FNz3Scan QR code to add bot automatically (recommended)rJz& How would you like to set up QQ Bot?rrKz QQ Bot setup cancelled.rMz: Go to https://q.qq.com to register a QQ Bot application.z< Note your App ID and App Secret from the application page.rNru2 Skipped — QQ Bot won't work without an App ID.rOTu6 Skipped — QQ Bot won't work without an App Secret.r)rTr  user_openidrTr rk)r4r5zOnly allow listed user OpenIDsr7QQ_ALLOW_ALL_USERSrNz Add yourself (z) to the allow list?rz Allow list set to r;r[rdrLz$ Open DM access enabled for QQ Bot.z( Allowed user OpenIDs (comma-separated)rr\z Use your QQ user ID (rrrz8 Home channel OpenID (for cron/notifications, or empty)u🐧 QQ Bot configured!r^)rrrrr rrrgateway.platforms.qqbotrLr7rrrrOrrr/)r`rrrrrLrTrUrkrrrDr<rhs r( _setup_qqbotrns GGG %96; G GHHH#K00O#$677O? 56664e<<  F GGG=7NGYZ[[JKQ  ; ; ; ; ; ;%+--KK     GGG 5 6 6 6 FF  U S T T T  i OPPPQRRR  U333  N O O O FNT:::   R S S S F!'*BRBRBTBTeghh ; H 5666%{?'CDDD//-44K GGGN Ln^_``JQ+W555  3 GGGQ QQQSWXX 71;???B[BBCCCC126666 -r 2 2 2-..._```` q+V444)2...<====#)r E}_deeemmnqsuvv +W555)9555*+++ K  V;VVVX\ ] ] B / = = = @;@@ A A A Xchiii  K /1C1C1E1E F F F I<3E3E3G3GII J J J GGG+,,,3K13344444s3C'C/.C/c2 ddl}tttdtjt d}t d}|r1|r/tt dtddsdSt|jd rt d ntd td td tdtdtdttdtdtdtttd|pd} td|d p|}n'#ttf$rtdYdSwxYwtd ddl}||ddd}|jdkrt dn*td |jd!td"dsdSnB#t&$r5}td#|d$|td%d&sYd}~dSYd}~nd}~wwxYwt)d|ttd'td(|pd)} td*|rd+|d,nd)d$ } | s|} n'#ttf$rtdYdSwxYw| st+d-dSt)d| ttd.td/t d0pd)} | p| } td1| d p| } n'#ttf$rtdYdSwxYwt)d0| ttd2drttd3t d4pd)} td5| pd6d p| pd6}n'#ttf$rtdYdSwxYwt)d4|tt d7td8|td9| td:td;t d4rdz'Interactive setup for Signal messenger.rNu' ─── 📡 Signal Setup ───rbrzSignal is already configured.z Reconfigure Signal?Fz signal-clizsignal-cli found on PATH.zsignal-cli not found on PATH.z7 Signal requires signal-cli running as an HTTP daemon.z Install options:zF Linux: download from https://github.com/AsamK/signal-cli/releasesz# macOS: brew install signal-cliz) Docker: bbernhard/signal-cli-rest-apiz; After installing, link your account and start the daemon:z$ signal-cli link -n "HermesAgent"zA signal-cli --account +YOURNUMBER daemon --http 127.0.0.1:8080z8 Enter the URL where signal-cli HTTP daemon is running.zhttp://127.0.0.1:8080z HTTP URL [z]: z Setup cancelled.z Testing connection...rz /api/v1/checkrrz! signal-cli daemon is reachable!z# signal-cli responded with status .z Continue anyway?z Could not reach signal-cli at ruz8 Save this URL anyway? (you can start signal-cli later)Tz9 Enter your Signal account phone number in E.164 format.z Example: +15551234567rz Account numberz []z Account number is required.rzB Enter phone numbers or UUIDs of allowed users (comma-separated).SIGNAL_ALLOWED_USERSz Allowed users [z< Enable group messaging? (disabled by default for security)z0 Enter group IDs to allow, or * for all groups.SIGNAL_GROUP_ALLOWED_USERSz Group IDs [*zSignal configured!z URL: z Account: z0 DM auth: via SIGNAL_ALLOWED_USERS + DM pairingz Groups: rr)rrrrrr rrrrrinputrOEOFErrorr7httpxrr status_coderrr)r existing_urlrC default_urlurlrxresprdefault_accountrexisting_alloweddefault_allowedr existing_groupsgroupss r( _setup_signalr@sMMM GGG %96; G GHHH !233L$%566( 56664e<<  F GGGv|L!! 122225666LMMM'((([\\\8999>??? PQQQ;<<<VWWW  GGGIJJJ9"9K3;33344::<<K  ' ( $%%% ()))  yyCJJsOO:::DyII  s " " = > > > > S@PSSS T T T !5u==  CCCCCDDDWY]^^  FFFFF      $c*** GGGJKKK()))&,"Oao+]+B+B+B+B+B[]aaabbhhjj &%G ' ( $%%% 3444#W--- GGGHIIISTTT$%;<<B&1'O@O@@@AAGGII\_ ' ( $%%%)7333 GGGSUZ[[ = EFFF'(DEEK F?+AcFFFGGMMOOiSbifiFF+,    ( ) ) ) FF  3V<<< GGG&'''&W&&'''ABBBf7S)T)TdIIZdffgggggsa>'F&& G  G A4I J%JJ1L L-,L-'N== O! O!+Q-- RRrcddlm}|j|j|j|j|j|j|jtttttttd|S)zResolve the interactive setup function for a built-in platform key. Late-bound to avoid a circular import with ``hermes_cli.setup`` (which imports from this module for the remaining bespoke flows). r)setup)r:rFrKrPrWrwebhooksrtr^rrprtr{r) hermes_clir_setup_telegram_setup_discord _setup_slack _setup_matrix_setup_mattermost_setup_bluebubbles_setup_webhooksrrrHrrir!rnr)r_ss r(_builtin_setup_fnrsp '&&&&&&$"*,&##   c#hhr*c |d}||j|dSt|d}| |dS|drt|dS|d|d}|dd}t t t d|d |d t j|r|jng}|r&td d |ntd |d|d|drtd|ddSdS)a?Run the interactive setup flow for a single platform. Dispatch order: 1. Plugin-provided ``setup_fn`` on the registry entry. 2. Built-in setup function matched by platform key. 3. ``_setup_standard_platform`` when the entry has a ``vars`` schema. 4. Env-var hint fallback for plugins that offer no setup helper. Bundled platform plugins (e.g. IRC) auto-load, so no plugin enable step is needed here. User-installed platform plugins under ~/.hermes/plugins/ must already be in ``plugins.enabled`` before they appear in this menu. rNrrErarBu🔌rrrz( Set these env vars in ~/.hermes/.env: r]z Configure z( in config.yaml under gateway.platforms.rrk) rsetup_fnrrrrrrrrr)rrtfnrarBrequireds r(_configure_platformrs LL* + +E U^7  8E? + +B ~ ||F *** LL(5/ 2 2E LL& ) )E GGG %>u>>u>>> L LMMM%*2u!!HdSdii>Q>QSSTTTTb%bbQYZ_Q`bbccc||N##420223333344r*cp trtddStttdtjttdtjttdtjttdtjttdtjttdtjtt }t}tr*trtttr*trtt|r|rtd na|r@td trtrt!d n"t#d d r trt%nt'rt)n#t*$rO}t-dt/|D]}td|Yd}~nd}~wt2$r+}t-d|t!d Yd}~nPd}~wt4j$r}t-d|Yd}~n'd}~wwxYwnt9dt9d tt;dt=}d|D}|dtAd|tC|dz }|tC|krntE||dt.dtFfd tI fdt=D}|rtttdtj%t }t}|rUtrtrt!dn*t#dd r trtMn:t'rtOntQt9dn#t*$rP}t-d t/|D]}td|Yd}~njd}~wt2$r,}t-d!|t!dYd}~n6d}~wt4j$r}t-d!|Yd}~n d}~wwxYwn|r6trtrt!d nt#d"d r trt%nt'rt)n#t*$rP}t-d#t/|D]}td|Yd}~n1d}~wt2$r,}t-d$|t!d Yd}~nd}~wt4j$r}t-d$|Yd}~nd}~wwxYwnttst'rtrd%nd&}tSrd'nd(} t#d)|d*| d+d rQ d} d,} trtUd,-\} } ntWd,-d } t| rt#d.d r trt%| d/k0nt)n#t*$rO}t-d#t/|D]}td|Yd}~n1d}~wt4j$r}t-d$|Yd}~nd}~wwxYwnO#t4j$r,}t-d1|t9d2Yd}~nd}~wwxYwt9d3trt9d4t9d5ntSr=t9d6t9d7t9d8t9d9ntYr@d:d;l-m.} t9d<t9d7t9d=| d>n│ Press Ctrl+C at any time to exit. │r2z)Gateway service is installed and running.z-Gateway service is installed but not running.rFz Start it now?Tu1 Failed to start — user systemd not reachable:rkz Failed to start: z%Gateway service is not installed yet.z.1sR   z A AAgJ A A+;A+>+> A A A   r*DonezSelect a platform to configure:rdrr"c|}|dkp)|dp|d S)Nr partiallyzplugin disabled)r+r)rss r( _is_progressz#gateway_setup.._is_progressBsK LLNN ! ! /||K(( /||-..  r*c3HK|]}t|VdSr$r)rrrs r(rz gateway_setup..JsG./ %a(())r*u──────────────────────────────────────────────────────────rz) Restart the gateway to pick up changes?zStart manually: hermes gatewayu0 Restart failed — user systemd not reachable:z Restart failed: z Start the gateway service?u. Start failed — user systemd not reachable:z Start failed: rrOz. (note: services may not survive WSL restarts)rz Install the gateway as a z service?z% (runs in background, starts on boot)Frsz Start the service now?rrz Install failed: z. You can try manually: hermes gateway installz/ You can install later: hermes gateway installzA Or as a boot-time service: sudo hermes gateway install --systemz+ Or run in foreground: hermes gateway runz* WSL detected but systemd is not running.z' Run in foreground: hermes gateway runz< For persistence: tmux new -s hermes 'hermes gateway run'zM To enable systemd: add systemd=true to /etc/wsl.conf, then 'wsl --shutdown'rrz/ Termux does not use systemd/launchd services.zR Or start it manually in the background (best effort): nohup hermes gateway run >z/logs/gateway.log 2>&1 &z1 Service install not supported on this platform.z?No platforms configured. Run 'hermes gateway setup' when ready.)/r r rrrMAGENTAr'r+rKrr#rrrrrrrrrWr rrr0rPrrLrrrrrrrZrr%rDIMrrr~rrGrrPrQr)rrrr^r menu_itemsrAany_configured platform_namewsl_noteinstalled_scope did_installrrs @r( gateway_setuprs ||)*** GGG %DFLFT U UVVV %RTZTb c cddd %DFLFT U UVVV %QSYSa b bccc %PRXR` a abbb %DFLFT U UVVV GGG-//)++O ""'D'F'F,...  ""'>'@'@!### S_SABBBB SEFFF $ & & 7+O+Q+Q 7 +G 4 4 4 4 ,d 3 3 7 7,..$!OOOOZZ$!OOO. ' ' 'OPPPFF--//''D+t++&&&&'''''/ 9 9 95!55666/888888880 7 7 75!5566666666 7! 7& :;;;QRRR/ *+++"$$       &!!!@*cR\oo`aNabb S^^ # # If-...!/. S T    3A3C3CN`V  eJ ++,,,133-// W J(** :/S/U/U :/ ::::JDQQ ::022E'))))!E')))),..."#CDDD2+++ RSSS #A 1 1 3 3++k4kk****+++++3??? 8Q 8 89993I>>>>>>>>!4::: 8Q 8 899999999:! :$B J(** 8/S/U/U 8/8888=tDD 8 8022(%!(%2+++ PQQQ #A 1 1 3 3++k4kk****+++++3=== 61 6 67773G<<<<<<<<!4888 61 6 6777777778 8 GGG(**. Jhjj. J-F-H-H W i OUxx_KK]_ "G}"G"GW_"G"G"GIMNNNU*.&+ 466/;[bg;h;h;h8O[[+%8888*.K& D=9SUY+Z+Z D D#<#>#>!4$1H9T$U$U$U$U$U$1OOO#>777 +,\ ] ] ],/FF,=,=,?,?!7!7D$)+t++$6$6$6$6!7!7!7!7!7#-#@DDD +,Bq,B,B C C C C C C C CD%8UUU#$<$<$<==="#STTTTTTTTUPQQQ022h"#fgggLMMMM JGHHHDEEEYZZZjkkkk;;JLLLLLLPQQQHIII Utxtxtztz U U UVVVVRSSSHIIII TUUU GGGGGs9I LAJ&& L3!KL+LLAS)) V!3AT>> V! !U22V!VV!'9X"" [,AY77 [!Z++[=[[Aa 1_a aA`&!a&a8a aaab(!bbc t|S#t$rd}tdt|D]}t d|t jdYd}~dSd}~wt$r;}t t|t jdYd}~dSd}~wwxYw)zHandle gateway subcommands.zUser systemd not reachable:rkrdN) _gateway_command_innerrrr0rPrrrr)rrr^s r(gateway_commandrs%d+++ & 1222FF%%''  D +t++      ' c!ff   s! CAA:: C0B==Cc t!t|dd}||dkrGt|dd}t|dd}t|dd}t|||dS|d krtdS|d krgtrt d dSt|d d}t|d d}t|dd}t r2t dt dtjdtr]tr;tdtdtdt t|||dStrt|dStr~t dt dt dt t dt dt dtjddSt!r}t dt dt t dt dt t d tjddSt d!t d"tjddS|d#krAtrt d$dSt|d d}t r2t d%t d&tjdtrt#|'dStrt%dSt!r`t d(t d)t t d*t d+tjddSt d,tjddS|d-kr"t|d d}t|d.d}|r6t'd/0} | r$t d1| d2t)d3d45t r2t d6t dtjdtrt+|'dStrt-dStrt d7t d8t t dt dt dt t d9tjddSt!r}t d:t d;t t d<t d=t t d>tjddSt d,tjddS|d?kr]t|d.d} t|d d}| rd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYwt'd/0} | | rdndz} | rt d@| dAdSt dBdSd} trmt/d's"t/d/'r) t3|'d/} nj#t4j$rYnYwxYwtrGt9r' t;d/} n#t4j$rYnwxYw| s0t=rt dCdSt dDdSt d@t?dEdS|dFkr)d} t|d d}t|d.d} d}| rd}trmt/d's"t/d/'r) t3|'d/}nj#t4j$rYnYwxYwtrGt9r' t;d/}n#t4j$rYnwxYwt'd/0} | |rdndz} | rt d@| dAt)d3d45t dGtrUt/d's"t/d/'rt+|'nMtr/t9rt-ntdHdStrot/d's"t/d/'r+d/} tA|'d/} nl#t4j$rYn[wxYwtrIt9r)d/} tCd/} n#t4j$rYnwxYw| sUtrtE\}}|d/urddl#}|$}t t dIt dJt t dK|t t dLt dMdS|rOt t dNt dOt dPtjdt=rt dCt)d3d45t dGtdHdSdS|dQkrHt|dRd}t|dSd}t|d d}tK|'}trgt/d's"t/d/'r#tM|||TtO|ntr@t9r tQ|tO|n2tS|j*}|r3t dUdV+tYtZ|dWt dXt]}|r4t t dY|D]}t dZ|t t r t d[t d\nStr/t d]t d^t d_nt d`t dat dbnt dct]}|r4t t dY|D]}t dZ|t t ddt det rt dfnKtrt dt dnt dgt dht_dS|dikrtadS|djkrct|dkd}t|dld}tstst dmdStc| |ndSdS)oNrrMr,rr-Fr/)r-r/rrz*install gateway service (managed by NixOS)rqrr'z8Gateway service installation is not supported on Termux.zRun manually: hermes gatewayrdu?WSL detected — systemd services may not survive WSL restarts.z< Consider running in foreground instead: hermes gateway runzM Or use tmux/screen for persistence: tmux new -s hermes 'hermes gateway run'rEz(WSL detected but systemd is not running.zIEither enable systemd (add systemd=true to /etc/wsl.conf and restart WSL)z&or run the gateway in foreground mode:zE hermes gateway run # direct foregroundzG tmux new -s hermes 'hermes gateway run' # persistent via tmuxzL nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # backgroundz=Service installation is not needed inside a Docker container.uVThe container runtime is your service manager — use Docker restart policies instead:zJ docker run --restart unless-stopped ... # auto-restart on crash/rebootz< docker restart # manual restartz&To run the gateway: hermes gateway runz4Service installation not supported on this platform.z Run manually: hermes gateway runrz,uninstall gateway service (managed by NixOS)zcGateway service uninstall is not supported on Termux because there is no managed service to remove.z*Stop manual runs with: hermes gateway stoprz>Service uninstall is not applicable inside a Docker container.z2To stop the gateway, stop or remove the container:z docker stop z docker rm zNot supported on this platform.rFrTru ✓ Killed z. stale gateway process(es) across all profilesrrrz\Gateway service start is not supported on Termux because there is no system service manager.z*WSL detected but systemd is not available.z+Run the gateway in foreground mode instead:z^To enable systemd: add systemd=true to /etc/wsl.conf and run 'wsl --shutdown' from PowerShell.z:Service start is not applicable inside a Docker container.z1The gateway runs as the container's main process.z: docker start # start a stopped containerz< docker restart # restart a running containerz/Or run the gateway directly: hermes gateway runru ✓ Stopped z( gateway process(es) across all profilesu✗ No gateway processes foundu$✓ Stopped gateway for this profileu'✗ No gateway running for this profilez servicerzStarting gateway...)r,uB⚠ Cannot restart gateway as a service — linger is not enabled.zK The gateway user service requires linger to function on headless servers.z$ Run: sudo loginctl enable-linger rz hermes gateway restartu#✗ Gateway service restart failed.zL The service definition exists, but the service manager did not recover it.z3 Fix the service, then retry: hermes gateway startrrr)rru✓ Gateway is running (PID: r]rz- (Running manually, not as a system service)rrkz Termux note:z; Android may stop background jobs when Termux is suspendedz WSL note:zI The gateway is running in foreground/manual mode (recommended for WSL).z< Use tmux or screen for persistence across terminal closes.zTo install as a service:z hermes gateway installz& sudo hermes gateway install --systemu✗ Gateway is not runningz To start:z- hermes gateway run # Run in foregroundz^ nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # Best-effort background startz3 hermes gateway install # Install as user servicezM sudo hermes gateway install --system # Install as boot-time system servicerGzmigrate-legacyr rKz@Legacy unit migration only applies to systemd-based Linux hosts.)r r )2r0r9rr r rPrrrrKrrrrFrWrrNrrrwrrr rrrrLrrKrr~rrrrrrrSrrbr!rGr rmapr0rrirpr )rsubcmdr,r-r/rqrr' start_allrvstop_allservice_availabletotal restart_allservice_configuredservice_stopped linger_ok_detailr _usernamerrr`r[rr^r rKs r(rrsU T,d 3 3F~5$ 1--gu--$ 511G5'::::  <<  F G G G Fgu--x//dM488 ;;  L M M M 0 1 1 1 HQKKK $ & & xx _```YZZZjkkk %K P P P P P P ZZ  E " " " " " XX  < = = = ] ^ ^ ^ : ; ; ; GGG Y Z Z Z [ \ \ \ ` a a a HQKKKKK ^^  Q R R R j k k k GGG ^ _ _ _ P Q Q Q GGG : ; ; ; HQKKKKK H I I I 4 5 5 5 HQKKKKK ;   <<  H I I I Fx// ;;  w x x x > ? ? ? HQKKK $ & &  V , , , , , , ZZ        ^^  R S S S F G G G GGG - . . . + , , , HQKKKKK 3 4 4 4 HQKKKKK 7  x//D%//  F+>>>F FZFZZZ[[[&tEEEE ;;  p q q q 0 1 1 1 HQKKK $ & &   ( ( ( ( ( ( ZZ  OOOOO XX  > ? ? ? ? @ @ @ GGG Y Z Z Z [ \ \ \ ` a a a GGG r s s s HQKKKKK ^^  N O O O E F F F GGG N O O O P Q Q Q GGG C D D D HQKKKKK 3 4 4 4 HQKKKKK 6  4..x// , C % (** 0EU0S0S0S0Z0Z0\0\ `u~BaCaCaCaJaJaLaL  ////(,%%!4D  6 8 8 ? ? A A  NNN(,%%!4D+>>>F#4;aa!>>F?9aa:E VTUTTTUUU "4S A A A A ' ( ( ((** '0EU0S0S0S0Z0Z0\0\ '`u~BaCaCaCaJaJaLaL 'V,,,,, ' 6 8 8 ? ? A A 'A&&&& F $ & & ,A,O,O,O,V,V,X,X \qy}\~\~\~]F]F]H]H !%  v....$(!!0     ZZ 244;;== !%  !!!$(!!0    ! #(** %>%@%@" 7D(("NNN ' 1 1IGGG^___ghhhGGGLLLMMMGGG78886777F! ;<<<deeeKLLL $%% ><=== "4S A A A A ' ( ( (  " " " " " "A # #D 8  tVU++tVU++x///v>>> % & &0 k,A,O,O,O,V,V,X,X0 k\qy}\~\~\~]F]F]H]H0 k 4T : : : : +H 5 5 5 5 ZZ- k244;;==- k 4 +H 5 5 5 5-..D' kRdiiC6O6ORRRSSSEFFF 5 7 7  +GGG2333 -++k4kk****;; D.)))WXXXXXXD+&&&efffXYYYY45554555BCCCC2333 5 7 7  +GGG2333 -++k4kk****k"""EFFF;;kz{{{{XXkcdddhiiiiOPPPijjj -..... 6   # # #$ 511dE5))(** 8::  T U U U F"3wHHHHHH $ #s[**[<;[<.\??]]*_==``aa$#a$?ee$#e$f''f98f9l$$l65l6*m;;n  n )FrDr$)Fr)FN)r"N)FNF)r)TF)FFN)FFF)rr)rFF)rr6rmrrtrLrr dataclassesrpathlibr__file__rrrcrrgateway.restartrrrhermes_cli.configr r r r r rrrrrrrrrrhermes_cli.colorsrrrr6rJrbr3rjr%rpryfloatrrrGrrrrr0rrr2rrrrrr r r(rrr4r6r rIrLrSr_rbrirprwr~rRrQrNrPrrrrrKrWrrrrrrrrrrrrrrrrrrrCompletedProcessrrrrrr1rrrrrr r#r&r8r;r>rBrGrrUrWrKrerrprvr{rrrrrrrrrrrrrFrrrrrrrXrrrrrrr rrrr!r$r(r+r9rrrrrrrrrr!r%r'r+rHrirnrrrrrrrr*r(rs   !!!!!!tH~~$+3355 (((((( ,+++++++ $ T T T T T T T T  $        <3<<<<~22t22222 C D     s t    3s353T3333lCH(T#YS4Zs3xTXkkSXkTkdSVikkkk\C$JTVZ: $*  2349)S)3)4))))X>>4>E$*>>>&#&& &c3h& #s(^&&&&R$S#X$3:$$$$VVdVsTzVVVV6dTk6666 /t /t / / / /# ::: :*: :  ::::zI$sCx.ITIIII j.KPT"XXdXtXXXX L LD LT L L L L33T3t3_c3333l " " " " "(((:P((((VTUuS#Xc:cDjY\J.DJJJJJ    4%#%#%#%#PLP05$cDj)-:=:)d))))X,$,,,,=<<<<<<<<<-$----$" 4    $$$$$$#D####! M>>>>>6cDjC8 '# ' ' ' 'LL$L4LLLL,11111<111* -4---- ]D]]]]MMMM,((((((($;?SSS4S4SSSSl +c +c +S +UY + + + + @@4@DI@@@@ BBDBT#YBBBB7<   c t *Je    ***#**** d3i    3t3333*=uS#X<<<3c3h 4dDj(9#:    #4c4o(>#?####L----- 4444(___ _ 3T ?____D = = = = S T    22#*2c3PSm@T2222.DS4ZcDj 5C$J 5 5 5 5DU3:tCS=T>.;5c)9#:.;.;.;.;b 5 5 5 52D2222OOOOO$+B      Q$Qd3iQDIQQQQ%49%c%%%%PsSS4########4mm$mS4ZmSVmmmm^JJJJJJ##&__D_T____  4 D       3  d  d     (D(D(D(DVll$l4llll 0 0 0$ 0 0 0 00C0D00004 ,E , , , ,7 7 47 7 CRVJ7 7 7 7 tRRdRRRR"sDT N N$ N N N N N N N N N N"KGKGDKGKGKGKG^`,`,`,t`,4`,`,`,`,NL3LLLL      VVVVVps$ssss(??4????6 % % %!!!2!!!0''E'ut|'VZ''''T'''@$G$G$G$G$G$GVJsTzJdJJJJd2........r)   *[dF H H-9]kp!< > >-9Q_dg i i  ,(    )KT9 ; ;,8iw|!< > >,8P^c[ ] ]  %:&   "'2HVZ= ? ?&2HVZC E E*6Zhm!> @ @  +@*    )4ftyW Y Y*6pCd f f%1hv{K M M+7m|A!E G G(4IW\c e e  <'    &1[inW Y Y';D= ? ?/;_mr!A C C/;SafW Y Y,9O]b] _ _  <' & $   %UR T T%1SaeR T T&+5Y [ [&+5V X X*6_mr!J L L  6)   *5IW\= ? ?(4GUYO Q Q*6m|A@ B B(4ky~!P R R(3yHMU W W  8)   *5IW\M O O-9TbfP R R & $   %eD F F(LdH J J$0]kpW Y Y-9xGLZ \ \+7esx!R T T+6guzG I I <,#   $xU9 ; ;#xT9 ; ;*6drw!L N N*5ftyG I I  2 2-   .PU5 7 71]X\B D D.*RWC E E+7GUYH J J6BTbfQ S S*6\jo9 ; ;3?m|A!L N N @"( )-    .9q@EE G G+7TbfJ L L0=\jo!v x x0 >'3xGL!P R R*5sBGK M M  0%   &uG I I)\tW Y Y W } | (T ((((VGtGGGGGT tCy    F_2t_2_2_2_2D'''--- +++ 8?8?8?vr,r,r,j/// t'(T'('('('(TB,B,B,Ji)i)i)Xh5h5h5Vohohohd3.'4$'44'4'4'4'4T} } } H*NININININIr*