i!3UdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z mZmZmZmZejdkZejdZehdZddlZdd lmZmZdd lmZd Zd d d d dZdee fdZ!de"fdZ#dee fdZ$de fdZ%dde de fdZ&dde fdZ'dee(fdZ)ddl*m+Z+de fdZ,de fdZ-de fdZ.dZ/de"fdZ0d Z1d!e ddfd"Z2d#Z3d!e fd$Z4id%d&d'id(gd)id*d+gd,d-d.d/d&d0d1d2d3d4id5d6d7d0d8d9d:d;dd?gd@idAdBdCd>dDd>dEdFdGdHdIdJdKdLdMgdNdOdPdLidQdRdSdOdOdTdOidUdVdLdWdXdYdZd[dLd\d]d^d_d`d&dLgdadbd&d&dcdddedfdgdOdhdiidjdkd0d&d&d&dRdSdld0d&d&d&dmdnd0d&d&d&dRdnd0d&d&d&dSdnd0d&d&d&dSdnd0d&d&d&dSdnd0d&d&d&dSdnd0d&d&d&dSdndodpdOdqdrdsdOdOdOdLdOdtdLdOididudvdwdtidxdydOiidzd{d|d}id~dddddddddddddd&d&ddddddLd6dd&dd%did%didd|ddRdOdddddddddddiddLdLddd&ddd&d&d&d&dWd&ddd&ddgididd&ddLd&d&dLdLiddiddiiddiiddiiddd/dgiidLdLdddLdOggddddLiddddddOiddZ5gd¢ddggdŢdgdgdȜZ6e e7ee fe8d<iZ9idddddOddLdΜdddddLddgddLd՜dddddLddLdΜdddddLddLdΜdddddOddLdΜdddddLddLdΜdddddOddLdΜdddddLddLdΜdddddLddLdΜdddddLddLdΜdddddOddLdΜdddddLddLdΜdddddOddLdΜdddddLddLdΜdddddLddLdΜdddddOddLdΜdddddLddLdΜidddddOddLdΜdd d d dLddLdΜd d dddOddLdΜdddddLd͐ddddd&dOd͐ddddddLd͐ddddd&dOddLdΜddd ddOddLdΜd!d"d#d$dOddLdΜd%d&d'd$dLddLdΜd(d)d*ddOddLdΜd+d,d-d.dLddLdΜd/d0d1ddOddLdΜd2d3d4d.dLddLdΜd5d6d7ddOddLdΜd8d9d:d;dLd͐dd<d=d>ddOddLdΜid?d@dAdBdLddLdΜdCdDdEddOddLdΜdFdGdHdIdLd͐ddJdKdLddOddLdΜdMdNdOdPdOddLdΜdQdRdSddOddLdΜdTdUdVdWdXdYgdLdZd[d\d]d^d_dXdYgdLdZd[d`dadbdcdXdYgdLdZd[dddedfddOdZdLdΜdgdhdiddOdZdLdΜdjdkdlddOdZdLdΜdmdndoddOdZdLdΜdpdqdrddLdZdLdΜdƐdsdtdugdvdLdZd[dwdxdydzd{d|gdLdZd[d}d~ddzd{d|gdOdZd[iddddd{d|gdLdZd[dddd{d|gdOdZdddddd{d|gdOdZd[dddddgdLdZd[ddddgddLdZd[ddddddgdLdZd[dÐdddddgdLdZd[dĐddddLdZddddddLdZddddddLdZddddddgdLdZd[ddddZddddddLdddddddOddddddOddddÐdĐddLdddƐdǐdddOddidɐdʐdddOddd̐d͐dΐddLdddАdѐdҐddLdddӐdԐdՐddOdddאdؐdddLdddڐdېdddOdddݐdސdddOdddddddOdddddddOdddddddLdddddddOdddddddOdddddddOddLdΜdddddOddLdΜdddddOddLdΜdddddOddLdΜdddddLddLdΜidddddOdddddddLdddddddOddd d d ddd d ddddddddLddddddddddddddddddddddd d!d"ddd#d$d%ddd&d'd(ddOddLdΜd)d*d+ddOddLdΜd,d-d.ddLddLdΜd/d0d1ddOddLdΜd2d3d4ddOddLdΜd5d6ddOddLdΜd7d8ddOddLdΜd9d:ddLddLdΜd;dddOddd?d@ddLdddAdBddLdCddDdEddOdCddFdGddOdCddFdHddOdCddIdJddOdCddKdLddOdCddM Z:ddNe"dee e effdOZ;dPe(dQe fdRZd&dUdVedWe dee e effdXZ?dYedee e effdZZ@ ddPee e efdee e effd[ZAdee7e7ffd\ZBhd]ZChd^ZDhd_ZEe Gd`daZFddPee e efdedafdbZGddPee e efddfdcZHddPee e efddfddZIddee"dfe"de e effdgZJde(dhe(de(fdiZKdjZLdPe e efde e effdkZMdPe e efde e effdlZNde e effdmZOde e effdnZPdoZQdpZRdqZSdPe e effdrZTde e e ffdsZUdteVdeVfduZWde7fdvZXdwe dxe de fdyZYdwe dxe fdzZZdwe de"fd{Z[ddxe fd|Z\dd}Z]ddxe fd~Z^dwe dxe de e effdZ_de7fdZ`dwe dee fdZadwe de fdZbdZcdZddwe dxe fdZedZfdS(a Configuration management for Hermes Agent. Config files are stored in ~/.hermes/ for easy access: - ~/.hermes/config.yaml - All settings (model, toolsets, terminal, etc.) - ~/.hermes/.env - API keys and secrets This module provides: - hermes config - Show current configuration - hermes config edit - Open config in editor - hermes config set - Set a specific value - hermes config wizard - Re-run setup wizard N) dataclass)Path)DictAnyOptionalListTupleWindowsz^[A-Za-z_][A-Za-z0-9_]*$>@ QQ_APP_ID QQ_STT_MODEL TERMINAL_ENV WECOM_BOT_ID WECOM_SECRET WEIXIN_TOKEN FEISHU_APP_ID WHATSAPP_MODEOPENAI_API_KEYQQ_STT_API_KEYSIGNAL_ACCOUNTANTHROPIC_TOKENMATRIX_PASSWORDOPENAI_BASE_URLQQ_HOME_CHANNELQQ_STT_BASE_URLSIGNAL_HTTP_URLWEIXIN_BASE_URLMATRIX_DEVICE_IDMATRIX_HOME_ROOMQQ_ALLOWED_USERSQQ_CLIENT_SECRETTERMINAL_SSH_KEYWEIXIN_DM_POLICYWHATSAPP_ENABLEDANTHROPIC_API_KEYFEISHU_APP_SECRETMATRIX_ENCRYPTIONTERMINAL_SSH_PORTWEIXIN_ACCOUNT_IDDINGTALK_CLIENT_IDFEISHU_ENCRYPT_KEYMATRIX_AUTO_THREADQQ_ALLOW_ALL_USERSMATRIX_RECOVERY_KEYQQ_MARKDOWN_SUPPORTWECOM_CALLBACK_HOSTWECOM_CALLBACK_PORTWEIXIN_CDN_BASE_URLWEIXIN_GROUP_POLICYWEIXIN_HOME_CHANNELBLUEBUBBLES_PASSWORDDISCORD_HOME_CHANNELQQ_HOME_CHANNEL_NAMESIGNAL_ALLOWED_USERSWECOM_CALLBACK_TOKENWEIXIN_ALLOWED_USERSMATTERMOST_REPLY_MODETELEGRAM_HOME_CHANNELBLUEBUBBLES_SERVER_URLDINGTALK_CLIENT_SECRETMATRIX_REQUIRE_MENTIONQQ_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_IDWEIXIN_ALLOW_ALL_USERSMATTERMOST_HOME_CHANNELWECOM_CALLBACK_AGENT_IDWEIXIN_HOME_CHANNEL_NAMEFEISHU_VERIFICATION_TOKENMATRIX_FREE_RESPONSE_ROOMSSIGNAL_GROUP_ALLOWED_USERSWECOM_CALLBACK_CORP_SECRETWEIXIN_GROUP_ALLOWED_USERSWECOM_CALLBACK_ENCODING_AES_KEY)Colorscolor)DEFAULT_SOUL_MD)true1yesHomebrewNixOS)brewhomebrewnixnixosreturnctjdd}|r:|}|tvrdSt ||Stdz }|rdSdS)z7Return the package manager owning this install, if any.HERMES_MANAGEDrRz.managedN) osgetenvstriplower_MANAGED_TRUE_VALUES_MANAGED_SYSTEM_NAMESgetget_hermes_homeexists)raw normalizedmanaged_markers 9/home/agentuser/.hermes/hermes-agent/hermes_cli/config.pyget_managed_systemrhLs )$b ) ) / / 1 1C :YY[[ - - -7$((S999$&&3Nw 4c"tduS)aCheck if Hermes is running in package-manager-managed mode. Two signals: the HERMES_MANAGED env var (set by the systemd service), or a .managed marker file in HERMES_HOME (set by the NixOS activation script, so interactive shells also see it). Nrhrirg is_managedrm[s   t ++ricBt}|dkrdS|dkrdSdS)z;Return the preferred upgrade command for a managed install.rQzbrew upgrade hermes-agentrRzsudo nixos-rebuild switchNrk)managed_systems rgget_managed_update_commandrpes4'))N##**  ** 4ric"tpdS)z C C Crimodify configurationcVtt|tjdS)z+Print user-friendly error for managed mode.fileN)printrwsysstderr)rts rg managed_errorrs&  ( (sz::::::rictjddkrdSddlm}|rdSt dz } i}t |d5}|D]q}|}d|vrW|d sB| d\}}}|||<r dddn #1swxYwYn#t$rYdSwxYw|d d }|d d } |dd} |dd} || | | dS)aRead container mode metadata from HERMES_HOME/.container-mode. Returns a dict with keys: backend, container_name, exec_user, hermes_bin or None if container mode is not active, we're already inside the container, or HERMES_DEV=1 is set. The .container-mode file is written by the NixOS activation script when container.enable = true. It tells the host CLI to exec into the container instead of running locally. HERMES_DEVrONr) is_containerz.container-moder=#backenddockercontainer_namez hermes-agent exec_userhermes hermes_binz /data/current-package/bin/hermes)rrrr) r[environrahermes_constantsrrbopenr] startswith partitionFileNotFoundError) rcontainer_mode_fileinfoflinekey_valuerrrrs rgget_container_exec_infors z~~l##s**t------|~~t)++.??  %s + + 6q 6 6zz||$;;ts';';;$(NN3$7$7MCE(- D%  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 tthhy(++GXX.??Nh//I,(JKKJ(   s7 C*A5C C*C""C*%C"&C** C87C8rbc$tdz S)zGet the main config file path.z config.yamlrrlrirgget_config_pathrs   } ,,ric$tdz S)z&Get the .env file path (for API keys).z.envrrlrirg get_env_pathrs   v %%ricbttjjS)z'Get the project installation directory.)r__file__parentresolverlrirgget_project_rootrs >> ' / / 1 11ric6trdS tjdd}|rt |dnd}n#t $rd}YnwxYw tj||dS#ttf$rYdSwxYw)uMSet directory to owner-only access (0700 by default). No-op on Windows. Skipped in managed mode — the NixOS module sets group-readable permissions (0750) so interactive users in the hermes group can share state with the gateway service. The mode can be overridden via the HERMES_HOME_MODE environment variable (e.g. HERMES_HOME_MODE=0701) for deployments where a web server (nginx, caddy, etc.) needs to traverse HERMES_HOME to reach a served subdirectory. The execute-only bit on a directory permits cd-through without exposing directory listings. NHERMES_HOME_MODErZi) rmr[rrar]int ValueErrorchmodOSErrorNotImplementedError)pathmode_strmodes rg _secure_dirrs||:>>"4b99??AA#+6s8Q   t ( )     s$AA A('A(,BBBctjdstjdrdStjdrdS t dd5}|}dddn #1swxYwYd|vsd |vsd |vrdSn#ttf$rYnwxYwd S) a3Detect if we're running inside a Docker/Podman/LXC container. When Hermes runs in a container with volume-mounted config files, forcing 0o600 permissions breaks multi-process setups where the gateway and dashboard run as different UIDs or the volume mount requires broader permissions. HERMES_CONTAINERHERMES_SKIP_CHMODTz /.dockerenvz/proc/1/cgrouprNrlxckubepodsF) r[rrarrcrreadrIOError)rcgroup_contents rg _is_containerrs z~~())RZ^^>#d)) $ $ " HT5 ! ! ! ! ! " " ( )     sAA%%A:9A:homec|dz }|rdS|tdt|dS)zISeed a default SOUL.md into HERMES_HOME if the user doesn't have one yet.zSOUL.mdNutf-8encoding)rc write_textrMr)r soul_paths rg_ensure_default_soul_mdrsRy I 7;;;rict}trStjd} t |tj|dS#tj|wxYw|ddt |dD]-}||z }|ddt |.t|dS)a Ensure ~/.hermes directory structure exists with secure permissions. In managed mode (NixOS), dirs are created by the activation script with setgid + group-writable (2770). We skip mkdir and set umask(0o007) so any files created (e.g. SOUL.md) are group-writable (0660). T)parentsexist_okcronsessionslogsmemoriesN)rbrmr[umask_ensure_hermes_home_managedmkdirrr)r old_umasksubdirds rgensure_hermes_homer's   D|| &HUOO  ' - - - HY     BHY     4$ ///D>  Fv A GGD4G 0 0 0 NNNN%%%%%s AA-c|std|ddD]-}||z }|st|d.t|dS)zPManaged-mode variant: verify dirs exist (activation creates them), seed SOUL.md.z HERMES_HOME z7 does not exist. Run 'sudo nixos-rebuild switch' first.rN)is_dir RuntimeErrorr)rrrs rgrr?s ;;==  54 5 5 5   ; 6Mxxzz 999   D!!!!!rimodelrZ providersfallback_providerscredential_pool_strategiestoolsetsz hermes-cliagentZi<autoiiX) max_turnsgateway_timeoutrestart_drain_timeout service_tiertool_use_enforcementgateway_timeout_warninggateway_notify_intervalterminalrlocal modal_modecwd.timeoutenv_passthrough docker_image*nikolaik/python-nodejs:python3.11-nodejs20docker_forward_env docker_envsingularity_image3docker://nikolaik/python-nodejs:python3.11-nodejs20 modal_image daytona_image container_cpucontainer_memoryicontainer_diskicontainer_persistentTdocker_volumesdocker_mount_cwd_to_workspaceFpersistent_shellbrowserxmanaged_persistence)inactivity_timeoutcommand_timeoutrecord_sessionsallow_private_urlscamofox checkpoints2)enabled max_snapshotsfile_read_max_charsi compression?皙?)r  threshold target_ratioprotect_last_nbedrocki)r provider_filterrefresh_intervalasyncdisabled)guardrail_identifierguardrail_versionstream_processing_modetrace)region discovery guardrailsmart_model_routing)r max_simple_charsmax_simple_words cheap_model auxiliary)providerrbase_urlapi_keyrdownload_timeoutih)r'rr(r)r)vision web_extractr session_search skills_hubapprovalmcpflush_memoriesdisplaykawaiifull interruptdefault)compact personalityresume_displaybusy_input_modebell_on_completeshow_reasoning streaming inline_diffs show_costskininterim_assistant_messagestool_progress_commandtool_progress_overridestool_preview_length platforms dashboardthemeprivacy redact_piittsedgevoicezen-US-AriaNeuralpNInz6obpgDQGcFmaJgBeleven_multilingual_v2)voice_idmodel_idzgpt-4o-mini-ttsalloy)rrLeveeni]i)rOlanguage sample_ratebit_ratezvoxtral-mini-tts-2603z$c69964a6-ab8b-4f8a-9465-ec0925096ec8)rrOzneuphonic/neutts-air-q4-ggufcpu) ref_audioref_textrdevice)r'rK elevenlabsopenaixaimistralneuttssttbase)rrTz whisper-1zvoxtral-mini-latest)r r'rr\r^zctrl+bg@) record_keymax_recording_secondsauto_ttssilence_thresholdsilence_duration human_delayoffi i )rmin_msmax_mscontextengine compressormemoryii_)memory_enableduser_profile_enabledmemory_char_limituser_char_limitr' delegation)rr'r(r)max_iterationsreasoning_effortprefill_messages_fileskills external_dirshonchotimezonediscord)require_mentionfree_response_channelsallowed_channels auto_thread reactionschannel_promptswhatsapptelegramrslack mattermost approvalsmanual)rrtirith)r domains shared_files)redact_secretstirith_enabled tirith_pathtirith_timeouttirith_fail_openwebsite_blocklist wrap_responseINFO)level max_size_mb backup_count force_ipv4)command_allowlistquick_commands personalitiessecurityrloggingnetwork_config_version)FIRECRAWL_API_KEYBROWSERBASE_API_KEYBROWSERBASE_PROJECT_IDFAL_KEYVOICE_TOOLS_OPENAI_KEYELEVENLABS_API_KEY)r#rWHATSAPP_ALLOWED_USERSSLACK_BOT_TOKENSLACK_APP_TOKENSLACK_ALLOWED_USERSTAVILY_API_KEYTERMINAL_MODAL_MODE)rr ENV_VARS_BY_VERSION NOUS_BASE_URLzNous Portal base URL overridez.Nous Portal base URL (leave empty for default)r') descriptionprompturlpasswordcategoryadvancedOPENROUTER_API_KEYz>OpenRouter API key (for vision, web scraping helpers, and MoA)zOpenRouter API keyzhttps://openrouter.ai/keysvision_analyzemixture_of_agents)rrrrtoolsrrGOOGLE_API_KEYzAlibaba Cloud DashScope API key (Qwen + multi-provider models)zDashScope API Keyz-https://modelstudio.console.alibabacloud.com/DASHSCOPE_BASE_URLzGCustom DashScope base URL (default: coding-intl OpenAI-compat endpoint)zDashScope Base URLHERMES_QWEN_BASE_URLzBQwen Portal base URL override (default: https://portal.qwen.ai/v1)z.Qwen Portal base URL (leave empty for default)HERMES_GEMINI_CLIENT_IDzfGoogle OAuth client ID for google-gemini-cli (optional; defaults to Google's public gemini-cli client)uKGoogle OAuth client ID (optional — leave empty to use the public default)z1https://console.cloud.google.com/apis/credentialsHERMES_GEMINI_CLIENT_SECRETz;Google OAuth client secret for google-gemini-cli (optional)z%Google OAuth client secret (optional)HERMES_GEMINI_PROJECT_IDz@GCP project ID for paid Gemini tiers (free tier auto-provisions)z;GCP project ID for Gemini OAuth (leave empty for free tier)OPENCODE_ZEN_API_KEYz=OpenCode Zen API key (pay-as-you-go access to curated models)zOpenCode Zen API keyzhttps://opencode.ai/authOPENCODE_ZEN_BASE_URLzOpenCode Zen base URL overridez/OpenCode Zen base URL (leave empty for default)OPENCODE_GO_API_KEYzOllama Cloud API key (ollama.com — cloud-hosted open models)zOllama Cloud API keyzhttps://ollama.com/settingsOLLAMA_BASE_URLz?Ollama Cloud base URL override (default: https://ollama.com/v1)z)Ollama base URL (leave empty for default)XIAOMI_API_KEYzNXiaomi MiMo API key for MiMo models (mimo-v2-pro, mimo-v2-omni, mimo-v2-flash)zXiaomi MiMo API Keyzhttps://platform.xiaomimimo.comXIAOMI_BASE_URLzFXiaomi MiMo base URL override (default: https://api.xiaomimimo.com/v1)z)Xiaomi base URL (leave empty for default) AWS_REGIONz?AWS region for Bedrock API calls (e.g. us-east-1, eu-central-1)z AWS RegionzIhttps://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-regions.html AWS_PROFILEzFAWS named profile for Bedrock authentication (from ~/.aws/credentials)z AWS Profile EXA_API_KEYz1Exa API key for AI-native web search and contentsz Exa API keyzhttps://exa.ai/ web_searchr,tool)rrrrrrPARALLEL_API_KEYz5Parallel API key for AI-native web search and extractzParallel API keyzhttps://parallel.ai/rz-Firecrawl API key for web search and scrapingzFirecrawl API keyzhttps://firecrawl.dev/FIRECRAWL_API_URLz6Firecrawl API URL for self-hosted instances (optional)z)Firecrawl API URL (leave empty for cloud)FIRECRAWL_GATEWAY_URLzQExact Firecrawl tool-gateway origin override for Nous Subscribers only (optional)z9Firecrawl gateway URL (leave empty to derive from domain)TOOL_GATEWAY_DOMAINzShared tool-gateway domain suffix for Nous Subscribers only, used to derive vendor hosts, e.g. nousresearch.com -> firecrawl-gateway.nousresearch.comzTool-gateway domain suffixTOOL_GATEWAY_SCHEMEzShared tool-gateway URL scheme for Nous Subscribers only, used to derive vendor hosts (`https` by default, set `http` for local gateway testing)zTool-gateway URL schemeTOOL_GATEWAY_USER_TOKENzuExplicit Nous Subscriber access token for tool-gateway requests (optional; otherwise read from the Hermes auth store)zTool-gateway user tokenz;Tavily API key for AI-native web search, extract, and crawlzTavily API keyzhttps://app.tavily.com/home)rr, web_crawlruUBrowserbase API key for cloud browser (optional — local browser works without this)zBrowserbase API keyzhttps://browserbase.com/browser_navigate browser_clickruCBrowserbase project ID (optional — only needed for cloud browser)zBrowserbase project IDBROWSER_USE_API_KEYuUBrowser Use API key for cloud browser (optional — local browser works without this)zBrowser Use API keyzhttps://browser-use.com/FIRECRAWL_BROWSER_TTLz@Firecrawl browser session TTL in seconds (optional, default 300)zBrowser session TTL (seconds))rrrrr CAMOFOX_URLzYCamofox browser server URL for local anti-detection browsing (e.g. http://localhost:9377)zCamofox server URLz)https://github.com/jo-inc/camofox-browserrz FAL API key for image generationz FAL API keyzhttps://fal.ai/image_generateTINKER_API_KEYzTinker API key for RL trainingzTinker API keyz/https://tinker-console.thinkingmachines.ai/keys)rl_start_trainingrl_check_statusrl_stop_training WANDB_API_KEYz0Weights & Biases API key for experiment trackingz WandB API keyzhttps://wandb.ai/authorizerl_get_resultsrz?OpenAI API key for voice transcription (Whisper) and OpenAI TTSz&OpenAI API Key (for Whisper STT + TTS)z$https://platform.openai.com/api-keysvoice_transcription openai_ttsz4ElevenLabs API key for premium text-to-speech voiceszElevenLabs API keyzhttps://elevenlabs.io/MISTRAL_API_KEYz7Mistral API key for Voxtral TTS and transcription (STT)zMistral API keyzhttps://console.mistral.ai/ GITHUB_TOKENzCGitHub token for Skills Hub (higher API rate limits, skill publish)z GitHub Tokenz"https://github.com/settings/tokensHONCHO_API_KEYz.Honcho API key for AI-native persistent memoryzHoncho API keyzhttps://app.honcho.devhoncho_contextHONCHO_BASE_URLz=Base URL for self-hosted Honcho instances (no API key needed)z,Honcho base URL (e.g. http://localhost:8000))rrrTELEGRAM_BOT_TOKENz"Telegram bot token from @BotFatherzTelegram bot tokenzhttps://t.me/BotFather messagingTELEGRAM_ALLOWED_USERSzSComma-separated Telegram user IDs allowed to use the bot (get ID from @userinfobot)z+Allowed Telegram user IDs (comma-separated)zhttps://t.me/userinfobotTELEGRAM_PROXYzaProxy URL for Telegram connections (overrides HTTPS_PROXY). Supports http://, https://, socks5://zTelegram proxy URL (optional))rrrrDISCORD_BOT_TOKENz'Discord bot token from Developer PortalzDiscord bot tokenz+https://discord.com/developers/applicationsDISCORD_ALLOWED_USERSz7Comma-separated Discord user IDs allowed to use the botz*Allowed Discord user IDs (comma-separated)DISCORD_REPLY_TO_MODEzDiscord reply threading mode: 'off' (no reply references), 'first' (reply on first message only, default), 'all' (reply on every chunk)z"Discord reply mode (off/first/all)rzSlack bot token (xoxb-). Get from OAuth & Permissions after installing your app. Required scopes: chat:write, app_mentions:read, channels:history, groups:history, im:history, im:read, im:write, users:read, files:read, files:writezSlack Bot Token (xoxb-...)zhttps://api.slack.com/appsruSlack app-level token (xapp-) for Socket Mode. Get from Basic Information → App-Level Tokens. Also ensure Event Subscriptions include: message.im, message.channels, message.groups, app_mentionzSlack App Token (xapp-...)MATTERMOST_URLz3Mattermost server URL (e.g. https://mm.example.com)zMattermost server URLzhttps://mattermost.com/deploy/MATTERMOST_TOKENz-Mattermost bot token or personal access tokenzMattermost bot tokenMATTERMOST_ALLOWED_USERSz:Comma-separated Mattermost user IDs allowed to use the botz-Allowed Mattermost user IDs (comma-separated)MATTERMOST_REQUIRE_MENTIONzaRequire @mention in Mattermost channels (default: true). Set to false to respond to all messages.zRequire @mention in channels!MATTERMOST_FREE_RESPONSE_CHANNELSzJComma-separated Mattermost channel IDs where bot responds without @mentionz+Free-response channel IDs (comma-separated)MATRIX_HOMESERVERz7Matrix homeserver URL (e.g. https://matrix.example.org)zMatrix homeserver URLz%https://matrix.org/ecosystem/servers/MATRIX_ACCESS_TOKENz3Matrix access token (preferred over password login)zMatrix access tokenMATRIX_USER_IDz)Matrix user ID (e.g. @hermes:example.org)zMatrix user ID (@user:server)MATRIX_ALLOWED_USERSzLComma-separated Matrix user IDs allowed to use the bot (@user:server format)z)Allowed Matrix user IDs (comma-separated)r>zZRequire @mention in Matrix rooms (default: true). Set to false to respond to all messages.z&Require @mention in rooms (true/false)rFzCComma-separated Matrix room IDs where bot responds without @mentionz(Free-response room IDs (comma-separated)r+z@Auto-create threads for messages in Matrix rooms (default: true)z)Auto-create threads in rooms (true/false)rzNStable Matrix device ID for E2EE persistence across restarts (e.g. HERMES_BOT)z)Matrix device ID (stable across restarts)r-uMatrix recovery key for cross-signing verification after device key rotation (from Element: Settings → Security → Recovery Key)zMatrix recovery keyr<zOBlueBubbles server URL for iMessage integration (e.g. http://192.168.1.10:1234)zBlueBubbles server URLzhttps://bluebubbles.app/r4uJBlueBubbles server password (from BlueBubbles Server → Settings → API)zBlueBubbles server passwordBLUEBUBBLES_ALLOWED_USERSzJComma-separated iMessage addresses (email or phone) allowed to use the botz,Allowed iMessage addresses (comma-separated)BLUEBUBBLES_ALLOW_ALL_USERSz-Allow all BlueBubbles users without allowlistzAllow All BlueBubbles Usersr z.QQ Bot App ID from QQ Open Platform (q.qq.com)z QQ App IDzhttps://q.qq.com)rrrrr z*QQ Bot Client Secret from QQ Open PlatformzQQ Client Secretrz2Comma-separated QQ user IDs allowed to use the botzQQ Allowed Usersr?z=Comma-separated QQ group IDs allowed to interact with the botzQQ Group Allowed Usersr,z4Allow all QQ users without an allowlist (true/false)zAllow All QQ UsersrzMaximum tool-calling iterations per conversation (default: 90)zMax iterationsz=(deprecated) Use display.tool_progress in config.yaml insteadu.Tool progress (deprecated — use config.yaml)u.Progress mode (deprecated — use config.yaml)zFPath to JSON file with ephemeral prefill messages for few-shot primingzPrefill messages file pathzOEphemeral system prompt injected at API-call time (never persisted to sessions)zEphemeral system prompt) API_SERVER_MODEL_NAMEGATEWAY_PROXY_URLGATEWAY_PROXY_KEYWEBHOOK_ENABLED WEBHOOK_PORTWEBHOOK_SECRET SUDO_PASSWORDHERMES_MAX_ITERATIONSHERMES_TOOL_PROGRESSHERMES_TOOL_PROGRESS_MODEHERMES_PREFILL_MESSAGES_FILEHERMES_EPHEMERAL_SYSTEM_PROMPT required_onlyc:g}tD]1\}}t|s|d|i|ddi2|sKtD]1\}}t|s|d|i|ddi2|S)z| Check which environment variables are missing. Returns list of dicts with var info for missing variables. name is_requiredTF)REQUIRED_ENV_VARSitems get_env_valueappendOPTIONAL_ENV_VARS)r%missingvar_namers rgget_missing_env_varsr0s G,1133LL$X&& L NNFHJJmTJJ K K K Q/5577 Q QNHd ** QODO-OOPPP Nriconfig dotted_keyc|d}|}|ddD];}||vs(t||tsi||<||}<|||d<dS)zSet a value at an arbitrarily nested dotted key path. Creates intermediate dicts as needed, e.g. ``_set_nested(c, "a.b.c", 1)`` ensures ``c["a"]["b"]["c"] == 1``. rN)split isinstanceradict)r1r2rpartscurrentparts rg _set_nestedr;s   S ! !EGcrc    w  jT1B1BD&I&I GDM$-GE"Irict}gddtdtdtffd t|S)z Check which config fields are missing or outdated (recursive). Walks the DEFAULT_CONFIG tree at arbitrary depth and reports any keys present in defaults but absent from the user's loaded config. rZdefaultsr9prefixc`|D]\}}|dr|s|n|d|}||vr||d|dGt|tr;t||tr||||dS)NrrzNew config option: )rr6r)r*rr,r6r7ra)r=r9r>r default_valuefull_key_checkr.s rgrBz)get_missing_config_fields.._checks"*.."2"2 > > C~~c"" "(?ss.?.?#.?.?H'!!#,#C#C#C   M400 >Z C@P@PRV5W5W >}gclH=== > >ri)rZ) load_configr7rDEFAULT_CONFIG)r1rBr.s @@rgget_missing_config_fieldsrEsj]]FG > > > >c > > > > > > > F>6""" Nric ddlm}m}n#t$rgcYSwxYw|}|sgSt }g}|D]}|d|d}|d}|}d} |D](} t |tr| |vr || }|} &d} | )t | tr)| s| ||S)a3Return skill-declared config vars that are missing or empty in config.yaml. Scans all enabled skills for ``metadata.hermes.config`` entries, then checks which ones are absent or empty under ``skills.config.`` in the user's config.yaml. Returns a list of dicts suitable for prompting. r)discover_all_skill_config_varsSKILL_CONFIG_PREFIXrrN) agent.skill_utilsrGrH ExceptionrCr5r6r7rr]r,) rGrHall_varsr1r.var storage_keyr8r9rr:s rgget_missing_skill_config_varsrNs,YYYYYYYYY  .-//H  ]]F$&G  ,;;s5z;; !!#&&  D'4(( TW__!$- =Zs33=EKKMM= NN3    Ns   provider_keyentryrPctt|tsdSd}dD]V}||}t|tr*|r|}nW|sdSd}|d}t|tr)|r|}n(|r|}|sdS||d}|}|r||d<|d}t|tr+|r||d<|d} t| tr+| r| |d<|d p|d } t| tr+| r| |d <|d p|d } t| tr+| r| |d <|d } t| tr| r| |d <|d} t| t r | dkr| |d<|d}t|t t fr |dkr||d<|S)z>Return a runtime-compatible custom provider entry or ``None``.NrZ)apirr(r')r'r(rPr)key_envapi_mode transportr default_modelmodelscontext_lengthrrate_limit_delay)r6r7rarr]rfloat)rQrPr(url_keyraw_urlr'raw_namerer)rTrU model_namerXrYrZs rg _normalize_custom_provider_entryr`s' eT " "tH-))G$$ gs # #   }}H E t Dyy  H(C  $X^^%5%5$~~     $!!## t""J  %%''L2%1 >"ii ""G'30GMMOO0 '  9ii ""G'30GMMOO0 '  9yy$$> +(>(>H(C  2X^^%5%52!)!1!1 :7##Auyy'A'AJ*c""1z'7'7'9'91(..00 7 YYx F&$&F&% 8YY/00N.#&&6>A+=+='5 #$yy!344"S%L11:6F!6K6K)9 %& riproviders_dictct|tsgSg}|D]:\}}t|t |}|||;|S)zMNormalize ``providers`` config entries into the legacy custom-provider shape.rO)r6r7r*r`rr,)racustom_providersrrQres rg"providers_dict_to_custom_providersrd5sw nd + + -/$**,,00 U5e#c((SSS  !  # #J / / / ric|t}gttdtttt fddffd }|d}|4t|tsgS|D]}|t|t|dD] }||S)ayReturn a deduplicated custom-provider view across legacy and v12+ config. ``custom_providers`` remains the on-disk legacy format, while ``providers`` is the newer keyed schema. Runtime and picker flows still need a single list-shaped view, but we should not materialise that compatibility layer back into config.yaml because it duplicates entries in UIs. NrQrWc>|dSt|ddpd}t|ddpd}t|ddpdd}t|ddpd}|||f}|r|vrdS|r|r|vrdS||r||r|r|dSdSdS)NrPrZr'r(/r)rrar]r^rstripr,add) rQrPr'r(rpair compatibleseen_name_url_pairsseen_provider_keyss rg_append_if_newz7get_compatible_custom_providers.._append_if_newTs = F599^R88>B??EEGGMMOO 599VR((.B//5577==??uyyR006B77==??FFsKKQQSSEIIgr**0b117799??AAh&  L,>>> F  H )rrrorlr2gatewayrrr&rrtr fallback_modelrrcrr>r'rrXr)rUr(rYrZ>r)rUr(rZc2eZdZUdZeed<eed<eed<dS) ConfigIssuez$A detected config structure problem.severitymessagehintN)__name__ __module__ __qualname____doc__r__annotations__rlrirgrxrxs1..MMM LLL IIIIIrirxc t|2 t}n"#t$rtdddgcYSwxYwg}|d}|t |t r|tdddt |t r!t|n t}|tz}|r5|tdd t|d d nt |trt|D]\}}t |t s>|tdd |d t|jddX|ds(|tdd |dd|ds(|tdd |dd|d}|t |t s:|tddt|jdnt|rr|ds$|tddd|ds$|tdddt |t r.d|vr*d|pivr$|tddd |d}|r&|s$|tdd!d"|D]V} | d#r| t vr5| tvr,|tdd$| d%d&| d'W|S)(a"Validate config.yaml structure and return a list of detected issues. Catches common YAML formatting mistakes that produce confusing runtime errors (like "Unknown provider") instead of clear diagnostics. Can be called with a pre-loaded config dict, or will load from disk. NerrorzCould not load config.yamlz+Run 'hermes setup' to create a valid configrcuOcustom_providers is a dict — it must be a YAML list (items prefixed with '-')zeChange to: custom_providers: - name: my-provider base_url: https://... api_key: ...warningzRoot-level keys z( look like custom_providers entry fieldszLThese should be indented under a '- name: ...' list entry, not at root levelzcustom_providers[z] is not a dict (got )z1Each entry should have at minimum: name, base_urlr'z] is missing 'name' fieldz#Add a name, e.g.: name: my-providerr(z] is missing 'base_url' fieldzDAdd the API endpoint URL, e.g.: base_url: https://api.example.com/v1rvzAfallback_model should be a dict with 'provider' and 'model', got zZChange to: fallback_model: provider: openrouter model: anthropic/claude-sonnet-4r'uHfallback_model is missing 'provider' field — fallback will be disabledz/Add: provider: openrouter (or another provider)ruEfallback_model is missing 'model' field — fallback will be disabledz8Add: model: anthropic/claude-sonnet-4 (or another model)zGfallback_model appears inside custom_providers instead of at root levelzDMove fallback_model to the top level of config.yaml (no indentation)u[custom_providers defined but no 'model' section — Hermes won't know which provider to useziAdd a model section: model: provider: custom default: your-model-name base_url: https://...rzRoot-level key 'uW' looks misplaced — should it be under 'model:' or inside a 'custom_providers' entry?zMove 'z' under the appropriate section)rCrJrxrar6r7r,rokeys_CUSTOM_PROVIDER_LIKE_FIELDSsortedrp enumeratetyper|r_KNOWN_ROOT_KEYS) r1issuescpcp_keys suspiciousirQfb model_cfgrs rgvalidate_config_structurers~ w ]]FF w w w)EGtuuv v v v w!#F & ' 'B ~ b$  (  MM+a%   )32t(<(<Gc"''))nnn#%%G #??J  kcvj'9'9cccb D ! ! %bMM  5!%..MM+![A[[DKKDX[[[K## yy((MM+!HAHHH=## yy,,MM+!LALLL^## $ % %B ~"d##  MM+gTXY[T\T\Tegg7     66*%%  k^E 66'??  k[N"d 0 > >CSXZX`^`CaCa k  U R      7##I  )   k  i (      >>#     & & &32N+N+N MM+3====    Ms 22cR t|}n#t$rYdSwxYw|sdSddl}dg}|D]1}|jdkrdnd}|d|d|j2|d |jd |d zdS) zPrint config structure warnings to stderr at startup. Called early in CLI and gateway init so users see problems before they hit cryptic "Unknown provider" errors. Prints nothing if config is healthy. Nru3⚠ Config issues detected in config.yaml:ru ✗u ⚠  z2 Run 'hermes doctor' for fix suggestions.  ) rrJr}ryr,rzr~writejoin)r1rr}linescimarkers rgprint_config_warningsrs*622  JJJ H IE11)+)?)?%%EY /&//2://0000 LLKLLLJTYYu%%./////s   cddl}ddl}|jd}|jd}|! t }n#t $rYdSwxYw|di}t |tr|ddnd}|dv}g}|r|d |d |r|s|d |d |r|jd d } | dd|d|d| d|j d |dzdSdS)uWarn if MESSAGING_CWD or TERMINAL_CWD is set in .env instead of config.yaml. These env vars are deprecated — the canonical setting is terminal.cwd in config.yaml. Prints a migration hint to stderr. rN MESSAGING_CWD TERMINAL_CWDrrr)rrrrZu ⚠ MESSAGING_CWD=u& found in .env — this is deprecated.u ⚠ TERMINAL_CWD= HERMES_HOMEz ~/.hermesu/⚠ Deprecated .env settings detected:zN Move to config.yaml instead: terminal:\n cwd: /your/project/pathz' Then remove the old entries from z /.envrr) r[r}rrarCrJr6r7r,insertr~rr) r1r[r} messaging_cwdterminal_cwd_env terminal_cfg config_cwdconfig_has_explicit_cwdr hint_paths rgwarn_deprecated_cwd_env_varsr1s NNNNNNNJNN?33Mz~~n55 ~  ]]FF    FF ::j"--L1;L$1O1OX!!%---UXJ(0HHE   #- # # #    7   #1A # # #    4JNN=+>>  QOPPP  >     P P P P    5))F233333 4 4sA AA interactivequietc &Dgggd} t}|r|std|dn#t$rYnwxYwt\}}|dkrFt }|di}t |tsi}d|vrtd}td} |r7| d vr!d |d<|d  d n| r_| d vrI| |d<|d  d| dn d|d<|d  d||d<t||std|d|dkrt }d|vrtj dd} | r]| rI| |d<|d  d| dn d|d<|d  dt||s|dpd} td| |dkrD td} | r!tdd|stdn#t$rYnwxYw|dkrt }|d } t | t r| r|d!i}t |tsi}d"}| D]}t |ts|d#d}|d$dp|d%dpd}|d&d}|sv| d'd(d)dd*d}d+|vr|d+d(}d+|v|d(}|sE d"d,lm}||}|jpd-d.d(}n#t$rd/|}YnwxYw||vr|d(|}d0|i}|r||d#<|r |d1vr||d&<|d2r |d2|d3<|d4r |d4|d5<|||<|d6z }|d"kr||d!<|d d7t||sqtd8|d9t!|| d7D]3}||}td:|d;|d0d4|d|d?:#t$rYFwxYw|d@kr]t/}|dAi}t |tr#d2|vr|d2}|dBdC}t }|dAi}|d2d7|dDvrShdE} || vrJ|dCi}!t |!trd2|!vr|dCi}"||"d2<nJ||i}#t |#trd2|#vr||i}$||$d2<||dA<t||stdF|dGkrt/}|di}t |tsi}dH|vrEdI|dH<||d<|d  dJt||stdK|dLkrEt/}|di}t |tsi}|dM}%t |%tr|%r|dNi}&t |&tsi}&|%D]#\}'}(|'|&vri|&|'<d|&|'vr |(|&|'d<$|&|dN<||d<t||sCdOdP|%D})tdQ|)|d  dR|dSkrt/}|dTi}*t |*tr|*dUd7}+|*dVd7},|*dWd7}-g}.|+rt7|+r}|dXi}/|/dTi}0|0d2stQ|||>|d  ||std|d|>V||d<t|n(||kr"t }||d<t|tS}?|?r*|r'|s$tdttI|?d|?D]=}2|2dd}@tdv|2d}dw|2ded|@d*>t t=d };n#tJtLf$rdy};YnwxYw|;dzvrTtt } d"dl*m+}An#t$rd}AYnwxYw|?D] }2|2d~d}>|>rd|>d*nd}Bt=di|2dj|Bd;}4|4s|>rt7|>}4|4r[|Ad.|2d}}CtQ||C|4|d  |2d}tdl|2d}d|4n<|dm dn|2d}d|2dddt t|ntd||S)a< Migrate config to latest version, prompting for new required fields. Args: interactive: If True, prompt user for missing values quiet: If True, suppress output Returns: Dict with migration results: {"env_added": [...], "config_added": [...], "warnings": [...]} ) env_added config_addedwarningsu ✓ Repaired .env file (z corrupted entries fixed)rr2 tool_progressr!r")false0norirz;display.tool_progress=off (from HERMES_TOOL_PROGRESS=false))newallzdisplay.tool_progress=z! (from HERMES_TOOL_PROGRESS_MODE)rz#display.tool_progress=all (default)u- ✓ Migrated tool progress to config.yaml: rr{HERMES_TIMEZONErZz timezone=z (from HERMES_TIMEZONE)z$timezone= (empty, uses server-local)(server-local)u% ✓ Added timezone to config.yaml: ru8 ✓ Cleared ANTHROPIC_TOKEN from .env (no longer used) rcrrr'r(rr)r-(rz--)urlparseendpointrz endpoint-rS)zno-keyzno-key-requiredrZrrWrUrVrNu ✓ Migrated z) custom provider(s) to providers: sectionu → : ) LLM_MODEL OPENAI_MODELu ✓ Cleared u> from .env (no longer used — config.yaml is source of truth)r`r'r)r local_command>base.entiny.enlarge-v1large-v2large-v3small.en medium.enlarge-v3-turbodistil-large-v2distil-large-v3distil-small.endistil-medium.endistil-large-v3.5ratinylargesmallturbomediumu; ✓ Migrated legacy stt.model to provider-specific configrATz1display.interim_assistant_messages=true (default)u3 ✓ Added display.interim_assistant_messages=truerCrE, c3*K|]\}}|d|VdS)rNrl).0pms rg z!migrate_config..L s0$R$RDAqZZAZZ$R$R$R$R$R$Rriu> ✓ Migrated tool_progress_overrides → display.platforms: z9display.platforms (migrated from tool_progress_overrides)r  summary_modelsummary_providersummary_base_urlr&model=)rZrr provider=z base_url=u@ ✓ Migrated compression.summary_* → auxiliary.compression: u/ ✓ Removed unused compression.summary_* keyszConfig version:  → r%u0 ⚠️ Missing required environment variables:u • rz Let's configure them now: z Get your key at: rrrru ✓ Saved rzSkipped z - some features may not workFch|] }|d S)r'rlrvs rg z!migrate_config.. s555Aai555ricRg|]#}|dv |d!|$S)r'rra)rrrequired_namess rg z"migrate_config.. sC V9N * *1553D3D * * * *ric\g|])}t|s|tv|t|f*Srl)r+r-)rr's rgrz"migrate_config.. sK    && ,03D+D+D$T* ++D+D+Dri z$ new optional key(s) in this update:u • u — z Configure new keys? [y/N]: n)yrPz (Enter to skip): z1 Set later with: hermes config set rr6u ✓ Added  = rz! skill setting(s) not configured:skillunknownz (from skill: z# Configure skill settings? [y/N]: )rHz skills.configz (default: u — skill '?z' may ask for it later),sanitize_env_filer|rJrtrCrar6r7r+r^r, save_configr[r\r]save_env_valuerpreplace urllib.parserhostnamepoprread_raw_config setdefaultr*rrr0getpassinputrorangeupdaterrlenEOFErrorKeyboardInterruptrEr;rNrIrH)Errresultsfixes current_ver latest_verr1r2 old_enabledold_modeold_tz tz_display old_token custom_listramigrated_countrQold_nameold_urlold_keyrrparsed new_entryepdead_varold_valrdraw_stt legacy_modelr'r` _local_models raw_local local_cfg raw_provider provider_cfg old_overridesrEplatrmigratedcomps_model s_provider s_base_url migrated_keysauxaux_comp missing_envrLrrmissing_optional new_var_namesver new_and_unsetr'ranswermissing_configfieldr6missing_skill_config skill_namerH default_hintrMrsE @rgmigrate_configr5_sCCG !##  Q Q OuOOO P P P      344KQ**Y++'4(( G ' ) )'(>??K$%@AAH V{00226JJJ+0('../lmmmm Vhnn...@@+3>>+;+;('../{HXHX/{/{/{||||+0('../TUUU 'F9      b`goF^``aaaQ V # #Y0"55F W&,,.. W%+\\^^z"'../b6<<>>/b/b/bcccc%'z"'../UVVV     L#J/C3C JjJJKKKQ %&788I V0"555VTUUU    D Rjj!344 k4 ( (9 E[9 E#ZZ R88Nnd33 $!#N$) $) $!%.. 99VR00))J33Quyy7K7KQr))Ir22nn&&,,..66sC@@HHbQQYYZ]_abbckk++dC00Cckkiinn;;999999!)'!2!2%<*EEc3OO$;;;:.::;.(( 33>33C"G, 1(0If%3w.OOO+2Ii(99W%%@16wIo.99Z((?-2:->Ik*&/s#!#!!&4{# -t444F###EeNeeefff#N$7$7$9$9::N?;K;KLEE+C0CCCub0A0ACCDDDD R5  H '11y"8R000 ywxwwwxxx    R''%$$ gt $ $% VG););"7+L{{:w77H ]]F**UB''C GGGT " " "555!!!  =00!( GR 8 8I%i66:':R:R$'NN7B$?$? -9 '* '{{8R88 !,559 9T9T#&>>(B#?#?L,8L)F5M     VTUUUR ""**Y++'4(( G 'w 6 648G0 1 'F9  N # * *+^ _ _ _     MKLLLR ""**Y++'4(( G $=>> mT * * h} h K44Ii..  +1133 < < dy((&(IdO")D/997;IdOO4#,GK 'F9      c99$R$RM>-<<||G,,=(+G (:(:(<(>-<<||J//C8<< 3K3Kv3U3U+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Cc*oo3355 C'' R88>>-<<||J//C+.z??+@+@+B+BHZ(!(()AZ)A)ABBB Q 3z7MQ[Qg(,}%F###Q$Q{aeajajkxayay{{||||OPPPZ ???:??@@@'T:::KA5A ABBB A AC ?CK??3}+=?? @ @ @ @{ -...  Cwwu~~ :8CJ88999wwz"" >(>S](>(>(>??43x=44455;;== bs6{E222 $++CK8882S[223333 #**+`c&k+`+`+`aaa GGGG,%@@@9DO555555#%%N# EEM[1_j1n55??044S"==>>>>#K#KU#K  }--    K Q]++QQQ R R R+ K K dIIIDHH]B,G,GIIJJJJ GGG >??EEGGMMOO/0    %%"/JD$xxDB488M4#@#@BBCCCADKAABBBBB488M4#@#@BBCCCxx ++a& '0aTXXh5M5M0a0a0a b b %&W488Hd+C+C&W&W&W X X ^ ^ ` `5&tU333 ,33D9993T33444GGGG"IJJJ/00N# 8 8E,CI&G W - - - N # * *3 / / / 86S66W66777%/ !F z ! !$. !F 9::$G $GE$G QS-..QQQRRR' _ _C)44J ]SZ]]c-.@]]PZ]]] ^ ^ ^ ^  @AAGGIIOOQQFF+,   FFF  \ ! ! GGG ]]F 6AAAAAAA 6 6 6&5### 6+  '')R00;BJ7W7777 B3x=B,BBBCCIIKK))LLE%8"G"G3u:"G"GK U;;;N+223u:>>>?U????@@@@J'..h3u:hh3777C;P;Phhh      E F F F Ns%/ <<=2J00 J=<J=.Q11RR!6W W%$W%#3{{-,{-F3AGGAG'G&AG'H AHH AH"H!AH"overridec|}|D]X\}}||vrJt||tr/t|trt |||||<S|||<Y|S)aRecursively merge *override* into *base*, preserving nested defaults. Keys in *override* take precedence. If both values are dicts the merge recurses, so a user who overrides only ``tts.elevenlabs.voice_id`` will keep the default ``tts.elevenlabs.model_id`` intact. )copyr*r6r7 _deep_merge)rar6resultrrs rgr9r9 sYY[[Fnn&&  U 6MM6#;-- 5$'' &fSk599F3KKF3KK Mrict|trtjdd|St|trd|DSt|t r d|DS|S)aRecursively expand ``${VAR}`` references in config values. Only string values are processed; dict keys, numbers, booleans, and None are left untouched. Unresolved references (variable not in ``os.environ``) are kept verbatim so callers can detect them. z \${([^}]+)}ctj|d|dS)Nrr)r[rragroup)rs rgz"_expand_env_vars..+ s*bjnnQWWQZZ<<ric4i|]\}}|t|Srl_expand_env_vars)rkrs rg z$_expand_env_vars../ s'???41a#A&&???ric,g|]}t|Srlr@)ritems rgrz$_expand_env_vars..1 s!7774 &&777ri)r6rresubr7r*rp)objs rgrArA! s#s v  < <    #t@??399;;????#t87737777 JricjtfddD}|sStd}t|ts |rd|ini}|d<dD]I}|}|r||s|||<|dJS)uMove stale root-level provider/base_url into model section. Some users (or older code) placed ``provider:`` and ``base_url:`` at the config root instead of inside ``model:``. These root-level keys are only used as a fallback when the corresponding ``model.*`` key is empty — they never override an existing ``model.provider`` or ``model.base_url``. After migration the root-level keys are removed so they can't cause confusion on subsequent loads. c3BK|]}|VdSNr)rrBr1s rgrz-_normalize_root_model_keys..@ s-CCQ6::a==CCCCCCri)r'r(rr6N)anyr7rar6r)r1has_rootrrroot_vals` rg_normalize_root_model_keysrO5 sCCCC*BCCCCCH  &\\F JJw  E eT " " &+3E""w'::c??  "EIIcNN "!E#J 3 Mrict|}t|dpi}d|vrd|vr |d|d<d|vrtdd|d<||d<|dd|S)z;Normalize legacy root-level max_turns into agent.max_turns.rrN)r7rarDr)r1 agent_configs rg_normalize_max_turns_configrRS s &\\F 7++1r22LfL!@!@$*;$7 [!,&&$27$;K$H [!"F7O JJ{D!!! Mric t}|r?t|d5}tj|picdddS#1swxYwYn#t $rYnwxYwiS)aORead ~/.hermes/config.yaml as-is, without merging defaults or migrating. Returns the raw YAML dict, or ``{}`` if the file doesn't exist or can't be parsed. Use this for lightweight config reads where you just need a single value and don't want the overhead of ``load_config()``'s deep-merge + migration pipeline. rrN)rrcryaml safe_loadrJ) config_pathrs rgrrd s %''      /kG444 /~a((.B / / / / / / / / / / / / / / / /      Is43A$A A$AA$A A$$ A10A1cddl}tt}|t}|r t |d5}tj|pi}dddn #1swxYwYd|vr_t| dpi}| d |d|d<||d<| ddt||}n)#t$r}td|Yd}~nd}~wwxYwtt!t#|S)z.Load configuration from ~/.hermes/config.yaml.rNrrrrz Warning: Failed to load config: )r8rrdeepcopyrDrcrrTrUr7rarr9rJr|rArOrR)r8rVr1r user_configagent_user_configes rgrCrCv sKKK!##K ]]> * *F: :kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6k))$()A)A)GR$H$H!$((55=5@5M%k2'8 G$ T222 55FF : : : 8Q88 9 9 9 9 9 9 9 9 : 67RSY7Z7Z[[ \ \\s=D!B8 DBD B A6D D) D$$D)u # ── Security ────────────────────────────────────────────────────────── # API keys, tokens, and passwords are redacted from tool output by default. # Set to false to see full values (useful for debugging auth issues). # tirith pre-exec scanning is enabled by default when the tirith binary # is available. Configure via security.tirith_* keys or env vars # (TIRITH_ENABLED, TIRITH_BIN, TIRITH_TIMEOUT, TIRITH_FAIL_OPEN). # # security: # redact_secrets: false # tirith_enabled: true # tirith_path: "tirith" # tirith_timeout: 5 # tirith_fail_open: true u  # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and api_key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 # # ── Smart Model Routing ──────────────────────────────────────────────── # Optional cheap-vs-strong routing for simple turns. # Keeps the primary model for complex work, but can route short/simple # messages to a cheaper model across providers. # # smart_model_routing: # enabled: true # max_simple_chars: 160 # max_simple_words: 28 # cheap_model: # provider: openrouter # model: google/gemini-2.5-flash u # ── Security ────────────────────────────────────────────────────────── # API keys, tokens, and passwords are redacted from tool output by default. # Set to false to see full values (useful for debugging auth issues). # # security: # redact_secrets: false # ── Fallback Model ──────────────────────────────────────────────────── # Automatic provider failover when primary is unavailable. # Uncomment and configure to enable. Triggers on rate limits (429), # overload (529), service errors (503), or connection failures. # # Supported providers: # openrouter (OPENROUTER_API_KEY) — routes to any model # openai-codex (OAuth — hermes auth) — OpenAI Codex # nous (OAuth — hermes auth) — Nous Portal # zai (ZAI_API_KEY) — Z.AI / GLM # kimi-coding (KIMI_API_KEY) — Kimi / Moonshot # kimi-coding-cn (KIMI_CN_API_KEY) — Kimi / Moonshot (China) # minimax (MINIMAX_API_KEY) — MiniMax # minimax-cn (MINIMAX_CN_API_KEY) — MiniMax (China) # # For custom OpenAI-compatible endpoints, add base_url and api_key_env. # # fallback_model: # provider: openrouter # model: anthropic/claude-sonnet-4 # # ── Smart Model Routing ──────────────────────────────────────────────── # Optional cheap-vs-strong routing for simple turns. # Keeps the primary model for complex work, but can route short/simple # messages to a cheaper model across providers. # # smart_model_routing: # enabled: true # max_simple_chars: 160 # max_simple_words: 28 # cheap_model: # provider: openrouter # model: google/gemini-2.5-flash crtrtddSddlm}t t }t t|}g}|di}|r|d| t|di}|r*|dr|d s| t||||rd |nd t|dS) z,Save configuration to ~/.hermes/config.yaml.zsave configurationNratomic_yaml_writerrrvr'rrZ) extra_content)rmrutilsr^rrrOrRrar,_SECURITY_COMMENT_FALLBACK_COMMENTrr)r1r^rVrer8secrs rgrr sG||*+++''''''!##K+,G,O,OPPJ E ..R ( (C (#''*++3 &''' (" - -B (bffZ(((RVVG__( &'''(-7bggennn4 ric t}i}|rtrdddni}t|fi|5}|}dddn #1swxYwYt |}|D]}|}|rn|dsYd|vrU|d\}}} | d||<|S)aLoad environment variables from ~/.hermes/.env. Sanitizes lines before parsing so that corrupted files (e.g. concatenated KEY=VALUE pairs on a single line) are handled gracefully instead of producing mangled values such as duplicated bot tokens. See #8908. rrrerrorsNrrz"') rrc _IS_WINDOWSr readlines_sanitize_env_linesr]rr) env_pathenv_varsopen_kwr raw_linesrrrrrs rgload_envrn sM~~HH CALSw)<<>((   ! # #  " " "$S%9%9::O#O44 2 2301AO8L8L0L0Loa!e,,RUV^R_R_C(..002$$TD[111  2   X_ - - - - ric6t}|sdStrdddni}trddini}t|fi|5}|}dddn #1swxYwYt |}||krdSt t|t|z }|dkrVtdt||D}|t t|t|z z }tj t|j dd \}} tj|d fi|5}|||tj|dddn #1swxYwYtj||n5#t*$r( tj|n#t.$rYnwxYwwxYwt1||S) zRead, sanitize, and rewrite ~/.hermes/.env in place. Returns the number of lines that were fixed (concatenation splits + placeholder removals). Returns 0 when no changes are needed. rrrrerNc3,K|]\}}||k dVdS)rNrl)rabs rgrz$sanitize_env_file..x s*KK$!QAFFAFFFFKKri.tmp.env_dirsuffixr>w)rrcrgrrhriabsrsumziptempfilemkstemprrr[fdopen writelinesflushfsyncfilenor BaseExceptionunlinkrr) rjread_kwwrite_kwroriginal_linesrtrfdtmp_paths rgrr_ s ~~H ??  q. s(::DKKK::::::rirz ... and morerZz The non-ASCII characters have been stripped automatically. If authentication fails, re-copy the key from the provider's dashboard. rz) encodeUnicodeEncodeErrorrordr,decoder}r|rrr~)rr bad_charsrchrtr}s rg_check_non_ascii_credentialr sl  W      I5!!JJ2 r77S==   H1HHHH#b''HHHH I I I WX 66==gFFIJJJ      ))::IbqbM::: : :  ; "%Y!!3!3    =  W  WZ     s  &&ctrtd|dSt|st d||dddd}t ||}tt}trddd ni}trd dini}g}| rHt|fi|5}| }dddn #1swxYwYt|}d }t|D]>\}} | |d r|d |d||<d }n?|sH|r+|dds|dxxdz cc<||d |dt'jt+|jdd\} } d} | r= t/j|j} n#t4$rYnwxYw t7j| dfi|5}|||t7j| dddn #1swxYwYt7j| || ' t7j!|| n#t4$rYnwxYwn5#tD$r( t7j#| n#t4$rYnwxYwwxYwtI||t6j%|<dS)z)Save or update a value in ~/.hermes/.env.zset N#Invalid environment variable name: rrZ rrrerFrTr4rrrr)&rmr_ENV_VAR_NAME_REmatchrrrrrrgrcrrhrirr]rendswithr,rrrrstatS_IMODEst_moderr[rrrrrrrrrr) rrrjrrrrfoundrrrr original_modes rgrr s(||lSll###  ! !# & &HFsFFGGG MM$ # # + +D" 5 5E 'U 3 3E~~H=HO7i888RG(3; G$$H E+ ( & &g & & "!KKMME " " " " " " " " " " " " " " "$E** EU##4 ::<< " "c999 - - )))))E!HE E  )  r++D11  "III III ''e'''(((#HO(<(. s:RRR$tzz||/F/F#yyy/Q/QRRRRrirrrr)!rmrrrrrrcr[rrrgrrhrirrrrrrrrrrrrrrrrrrr) rrjrrrr new_linesrrrrs ` rgremove_env_valuer s\ ||ooo&&&u  ! !# & &HFsFFGGG~~H ??   sD!!!u>#  % ' '#BJsO QJE h  3"*#4#4 3 QJE Lric|tjvrtj|St}||S)z/Get a value from ~/.hermes/.env or environment.)r[rrnra)rrks rgr+r+h s: bjz#zzH <<  ric|stdtjSt|dkrdS|dddz|ddzS)zRedact an API key for display. (not set)rz***Nr...)rLrKDIMr)rs rg redact_keyrw sO .[&*--- 3xx"}}u rr7U?SX %%ric dt}tttdtjttdtjttdtjtttdtjtjtdt tdttdttttdtjtjgd }|D]7\}}t|}td |d d t|8d dl m }|}td dd d t|tttdtjtjtd| ddtd| di dtddtttdtjtj| di}td| ddtd| ddrdnd td!| d"drdnd tttd#tjtj| d$i}td%| d&d'td(| d)d*td+| d,d-d.| d&d/kr(td0| d1d2nj| d&d3kr(td4| d5d6n)| d&d7krLtd8| d9d2td:} td;| rdkrLtd?| d@d2tdA} tdB| rd. s\  j&!!V+AquuWb/A/Ariu ◆ Auxiliary Models (overrides)rr12sru◆ Messaging Platformsrrz Telegram: znot configuredz Discord: )rGresolve_skill_config_valuesu◆ Skill Settingsrrz<20s[]u────────────────────────────────────────────────────────────z+ hermes config edit # Edit config filez! hermes config set z+ hermes setup # Run setup wizardN)rCr|rLrKCYANBOLDrrrr+rhermes_cli.authrrarDrrLvaluesr*r,rrIrGrrrJ)%r1renv_keyr'rranthropic_valuer2r modal_token daytona_keyssh_hostssh_usertzr r  _aux_comp_sm comp_providerr& aux_tasks has_overrideslabeltask_cfgprovmdlr8telegram_token discord_tokenrGr skill_varsresolvedrLrr3 display_vals% rg show_configr s~ ]]F GGG %DFLFQ R RSSS %RTZT_ ` `aaa %DFLFQ R RSSS GGG % V[&+ 6 6777 0_.. 0 0111 -\^^ - -... 1-// 1 1222 GGG % V[ 9 9:::   D33 g&& 14111j//112222111111''))O >{ > > >O! >??? GGG % V[&+ 6 6777 =VZZ;; = =>>> mVZZ4488nU\F]^iFjkk m mnnn GGG % v{FK 8 8999jjB''G CW[[AA C CDDD VW[[1A5%I%ITTTu V VWWW XW[[1CU%K%KVTTQV X XYYY GGG % V[ 9 9:::zz*b))H ?X\\)W== ? ?@@@ 7X\\%55 7 7888 ;X\\)R88 ; ; ;<<<||I(** mn>j!k!kmmnnnn i M 1 1 {.ACx!y!y{{|||| i G + + lm=i!j!jllmmm#$455  O!M+OOPPPP i I - - o(,,@l"m"mooppp#$566  O!M+OOPPPP i E ) ) !455 !455 :!8[::;;; :!8[::;;; GGG % V[ 9 9::: J # #B H %%%&&&& F'7!D!DFFGGG GGG %)6; D DEEE**]B//Kooi..G 9g7UU4 9 9::: 6 Pd!C!Cc!IPPPPQQQ j!F!F!Ljjjjkkk Q1A2!F!FQQQRRRJJ{B//33M2FF mmGR((4H &&&'''! j&99  6]f44 4]44 5 5 5 ;++I }}Xr22 }}]B77I!!##M <  e6 V[QQRRR(00 < >H GGG %,fk6;GG H H H! ] ]%j S"-- WWWb11 ,1Uc%jjju[&*7U7U [3[[[k[[U;Lz;L;L;Lfj5Y5Y[[\\\\       GGG % FJ ' '((( %=vz J JKKK %3VZ @ @AAA %=vz J JKKK GGGGGs/C8k(( k54k5c(trtddSt}|s&t t t d|tjdptjd}|s"dD]}ddl }| |r|}n |s#t dt d |dSt d |d |d tj |t|gdS) z"Open config file in user's editor.zedit configurationNzCreated EDITORVISUAL)nanovimvicodenotepadrz#No editor found. Config file is at:rzOpening  in r)rmrrrcrrDr|r[r\shutilwhich subprocessrunr)rVeditorcmdr s rg edit_configr" sE||*+++!##K     (N### &&&'''Yx 7BIh$7$7F ;  C MMM||C      3444  ;  !!! 1[ 1 1f 1 1 1222NFC ,,-.....ric^trtddSgd}||vsN|ds'|drEt ||t d|dtdSt}i}| rS t|d 5}tj |pi}dddn #1swxYwYn#t$ri}YnwxYw|d }|}|dd D];}||vs(t||t"si||<||}<|d vrd }nu|dvrd}n\|rt)|}n8|d ddrt-|}|||d <t/ddlm} | ||ddddddddddddd d!d"d#d$} || vr#t | |t5|t d|d%|d|dS)&zSet a configuration value.zset configuration valuesN)rrr$rrrrrrrrrrrrrrrrrrr!rrrrrrr)_API_KEY_TOKEN TERMINAL_SSHu✓ Set r rrrr4)rNrPrT)rrriFrZrrr]) sort_keysr rTERMINAL_DOCKER_IMAGETERMINAL_SINGULARITY_IMAGETERMINAL_MODAL_IMAGETERMINAL_DAYTONA_IMAGE&TERMINAL_DOCKER_MOUNT_CWD_TO_WORKSPACErTERMINAL_TIMEOUTTERMINAL_SANDBOX_DIRTERMINAL_PERSISTENT_SHELLTERMINAL_CONTAINER_CPUTERMINAL_CONTAINER_MEMORYTERMINAL_CONTAINER_DISKTERMINAL_CONTAINER_PERSISTENT)zterminal.backendzterminal.modal_modezterminal.docker_imagezterminal.singularity_imagezterminal.modal_imagezterminal.daytona_imagez&terminal.docker_mount_cwd_to_workspacez terminal.cwdzterminal.timeoutzterminal.sandbox_dirzterminal.persistent_shellzterminal.container_cpuzterminal.container_memoryzterminal.container_diskzterminal.container_persistentr)rmrupperrrrr|rrrcrrTrUrJr5r6rar7r^isdigitrrr[rr`r^r) rrapi_keysrVrYrr8r9r:r^_config_to_env_syncs rgset_config_valuer)B sR||0111   H yy{{h#))++"6"67M"N"NRUR[R[R]R]RhRhiwRxRxsyy{{E*** 222,..22333 "##KK kG444 6"nQ//52  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6   KKK  IIcNNEGcrc    w  jT1B1BD&I&I GDM$- {{}}--- 0 0 0 E  sB " " * * , ,e GE"I''''''k;%@@@@ +4!8&B 6":2Z&. 6%@":%@#<)H" !!!*3/U<<< 5S 5 5U 5 5 5 566666s62D2D& D2&D**D2-D*.D22 EEc  t|dd}||dkrtdS|dkrtdS|dkrt|dd}t|dd}|r|mtdttd td td td t jd t ||dS|dkrttdS|dkrttdS|dkrtttdtj tj ttd}t}t\}}|s?|s=||kr7ttdtjtdS||krtd|d||r tdt#|dd|D}d|D} |r=tdt#|d|D]} td| d| rztdt#| d | D]W} | d!g} | r!d"d#| dd$d%nd&} td| d| Xtt)d'd(} t| d)s| d*r'ttd+tj| d,rCt| d,D],}ttd-|tj-tdS|d.krtttd/tj tj tt\}}||krtd|d0n.ttd|d|d1tjtttd2tj t,D]O}t/|rtd3|$ttd4|d5tjPtttd6tj t2D]\}}t/|rtd3|'|d!g} | r dd#| dd$nd&} ttd7|| tjt}|rUtttd8t#|d9tjtd:tdStd;|ttd<td=td>td?td@tdAtdBtdCt jd dS)DzHandle config subcommands.config_commandNshoweditrorrz&Usage: hermes config set z Examples:z3 hermes config set model anthropic/claude-sonnet-4z+ hermes config set terminal.backend dockerz0 hermes config set OPENROUTER_API_KEY sk-or-...rrzenv-pathmigrateu*🔄 Checking configuration for updates...Fru ✓ Configuration is up to date!z Config version: rrz1 new config option(s) will be added with defaultsc<g|]}|d|S)r(rrs rgrz"config_command.. s)KKK!aeeM6J6JKAKKKricfg|].}|d|d,|/S)r(rrrs rgrz"config_command.. sN   55'' 01j0A0A    riu ⚠️ z required API key(s) missing:u • r'u ℹ️ z$ optional API key(s) not configured:rz (enables: rrrZT)rrrru✓ Configuration updated!ru ⚠️ checku📋 Configuration Statusu ✓z (update available)z Required:u ✓ u ✗ z (missing)z Optional:u ○ rz new config option(s) availablez+ Run 'hermes config migrate' to add themzUnknown config command: zAvailable commands:z4 hermes config Show current configurationz/ hermes config edit Open config in editorz6 hermes config set Set a config valuez; hermes config check Check for missing/outdated configz8 hermes config migrate Update config with new optionsz/ hermes config path Show config file pathz- hermes config env-path Show .env file path)getattrrrr|r}exitr)rrrLrKrrr0rErtGREENrrarr5YELLOWr)r+REDr-r*r)argssubcmdrrr*r0rr required_missingoptional_missingrLr tools_strrrr/rs rgr+r+ sA T+T 2 2F ~6)) 6   5dE4((gt,, em : ; ; ; GGG +    G H H H ? @ @ @ D E E E HQKKKe$$$$$ 6   o     :   lnn 9    e@&+v{[[\\\ +??? 244"6"8"8 Z > kZ6O6O %:FLII J J J GGG F  # # E{EEEE F F F  a _^,,___ ` ` `KK{KKK  "     1 U%5!6!6UUU V V V' 1 1/#f+//0000  < \%5!6!6\\\ ] ] ]' < <,,EJRA$))E"1"I*>*>AAAAPR :#f+:y::;;;; !T???  ;  E7>#: E %4flCC D D D :  D GGG":. D De222FMBBCCCC  7    e/fkJJKKK "6"8"8 Z * $ $ 8{888 9 9 9 9 %^[^^z^^^`f`mnn o o o  eM6;//000) J JHX&& J+++,,,,e;x;;;VZHHIIII  eM6;//000/5577 K KNHdX&& K+++,,,,"-->CK:DIIeBQBi$8$8::: e>>  ri)rs)rx)FrK)TF)grr[platformrFrrr}r dataclassesrpathlibrtypingrrrrr systemrgcompiler frozensetrprThermes_cli.colorsrKrLhermes_cli.default_soulrMr_r`rrhboolrmrprrrwrr7rrrbrrrrrrrrrrDrrrr)r-r0r;rErNr`rdrqrtr_VALID_CUSTOM_PROVIDER_FIELDSrrxrrrr5r9rArOrRrrCrarb_COMMENTED_SECTIONSrrnrprirrrrrrrrrr+rrrr)r+rlrirgrIs "      !!!!!!33333333333333ho9, 2:9::)4 ++++++++333333,     HSM    ,D,,,,HSM;C;;;; 3s8;;#;;;;*$****d-,,,,,-----&d&&&&2$2222   4t2   $$4&&&0"d"""",x Rxx"x!" x  x    "$ !'$'$'5 xF%7%f% s% 3 % 2% D% b% b!%" R#%$ C%%& E'%* +%, D-%. %/%0 1%8 "9%> (?%H DI%%GxT! # "5   UxtuxD7ExH Ix\! $  %'!#&-  ]x@ AxZ "                        g::[xR &!&*!&#% SxxyxBeCxxL  ' /0  '      ->  3   3  MxN   [  *   Oxl !$  mx|}xT ,U x^   $!   _ x~    xZ R[ xd  e xr  bs xz { x@ "$ A xT U xd 2e xn  2o xx 2y xH I xxT        e o xxxBYXX "67EEE   --T#tCy.)a 6B a W&+"$78a &U,7 'a 6L"7 7a F;= Ga V$& Wa f.: ga v[& wa F=  Ga V=  Wa f5A ga v0 . wa F:; Ga V6(. Wa f)$' ga v3< wa F8#( Ga a V2> Wa f9+* ga v:F wa FD$7 Ga T@% Ua bW%> ca p`& qa @[B Aa P_B   Qa `"T9B $$aa pYO !!qa @V() Aa P7C Qa `U') aa p6B qa @o&7 Aa NK9 Oa a a ^W(, _a nX= oa ~g'0 a L _= M a \ XZ ] a l _ m a @ J  . A a P N$% . Q a ` F%' . a a p O= q a @ jM A a P o. Q a ` j+ a a p O+   q a @ T",;;; A a P n')$o6 Q a ` \*)$o6 a a a a p n')$o6 q a @ Y1$o6 A a N r&:$o6 O a ^ 9 "# _ a n 7"@MMM o a ~ I!+"$56  a NX:5'6 Oa ^M&' _a lP#, ma z\ 3 {a LG"'"# Ma \V@]a j;&' ka xl?) ya Fz1 Ga R@%< Sa `P> aa a a na6 oa |\/+}a NG/+Oa `L)/ aa nF( oa |SA !!}a J!z0 ##Ka X(c? **Ya fP)6 ga tL' ua BB1 Ca Pe= Qa ^s: _a n!\< ##oa ~Y= a Ng= Oa ^]' _a a a nh*) oa |c/ }a J c@ ""Ka X"F/$$Ya bG! ca nC$ oa zK${a DV*Ea NM&Oa XU#Ya b=(ca lT#ma vf0   wa FL2 Ga VHE Wa fA# ga vg# wa a Hu) yQ [. l0 K  u" S! X" WB WB ""`. %%i+ ''ua a a Nd38n9M,  #    4S#X#78"tDcN';""""P@@@ @@d38n @@@@F s tDcN?S    (,// T#s(^ $/ $sCx.////d eCHo    "!!! WVV  wwhtCH~&>w$}J]wwwwt00(4S>":0d0000.+4+4$sCx.)A+4T+4+4+4+4\kkkDkT#s(^kkkk\ ddt((tCH~$sCx.< S#X 4S>    "c3h$]T#s(^]]]]6 "J)XS#X:$sCx.:0t00000f*3****Z&S&&&&&&RCCCCCCCL5#5$5555p$$c$$$$$$$$""#""""s34S>C,sx}&C&C&&&&_ _ _ D///@T7#T7cT7T7T7T7vFFFFFri