ig> dZddlZddlZddlZddlZddlZddlZddlmZee j j Z ddl mZddlmZmZmZddlmZmZmZmZmZmZddlmZmZmZmZmZm Z m!Z!m"Z"ddl#m$Z$m%Z%d e&fd Z'd e(d e(dzfd Z)d e(d e*fdZ+d e(d e*fdZ,dXde&dzde*d e-fdZ. dYde*de&dzde*d e(fdZ/d e*fdZ0d e*fdZ1ddl2m3Z3m4Z4m5Z5d e*fdZ6d e*fdZ7d e*fdZ8d e*fdZ9dZ:dZ;d ed eed?e-e<d e-e<fd@ZWdAedtd?d@drdAdtdBdCddrdDdxdEdFddGdtgd|gZwdHexd e>D JJLLE !a(9(9*(E(E! (C )~&&#*> *KK+/dA    "$+"3"3"5"56677 HHSMMM& (AB &z'@A    zz %''E^fe,#$F A%%"M//11<<>>!!D JJLLE5zzQ58u+<+<!"%eAh--C"Qww $ )!!! D!!:#<=    D  KsnBD-.A DD-D(%D-'D((D--EEBH1.0HH1 H,)H1+H,,H11I  I rAc |dkrdS tjddddt|gddd }n#ttjf$rYdSwxYw|jd krdS|j}|sdS t| d }n#t$rYdSwxYw|d kr|ndS) z@Return the parent PID for ``pid``, or ``None`` when unavailable.Nps-ozppid=z-pTrrr) r+r,strr6r5r9r-r.r2r/r4)rAr=raw parent_pids rC_get_parent_pidrMks  axxt 4$C 1     z8 9tt At -    C t))"-335566 tt#a::T1s!*5AA=9B77 CC target_pidc|dkrdStj}t}|r8||vr4||krdS||t |pd}|r||v4dS)zHReturn True when ``target_pid`` is this process or one of its ancestors.rFT)osgetpidr)r3rM)rNrAseens rC#_is_pid_ancestor_of_current_processrSs~Qu )++CUUD (#T// *  4  c""'a (#T// 5cttdsdSt|sdS tj|tjn#t ttf$rYdSwxYwdS)z@Ask a running gateway ancestor to restart itself asynchronously.SIGUSR1FT) hasattrsignalrSrPkillrVProcessLookupErrorPermissionErrorOSError)rAs rC_request_gateway_self_restartr]sx 69 % %u .s 3 3u V^$$$$  9uu 4sA A%$A%F exclude_pids all_profilesc |p t fdtD}gd}ttt }|r|dnddtdtffd } tr'tj gdd d d }d|j d D]}| }| d r|td dC| dr|tdd}tfd|Drb|s |rU t!|} | t#jkr| |vr| vr|| n#t($rYnwxYwdntj gdd d d }|j d D]R}| } | rd| vrd} d| dd} t| dkr1 t!| d} | dn#t($rd} YnwxYw| s| } t| d krL| dr2t!| d} d| d d| | t#jks| |vs| vrtfd|Dr"|s |r|| Tn#t.tjf$rYnwxYw|S)aFind PIDs of running gateway processes. Args: exclude_pids: PIDs to exclude from the result (e.g. service-managed PIDs that should not be killed during a stale-process sweep). all_profiles: When ``True``, return gateway PIDs across **all** profiles (the pre-7923 global behaviour). ``hermes update`` needs this because a code update affects every profile. When ``False`` (default), only PIDs belonging to the current Hermes profile are returned. cg|]}|v| Srb).0rA_excludes rC z%find_gateway_pids..s# F F FC#X2E2EC2E2E2ErT)zhermes_cli.main gatewayzhermes_cli.main --profilezhermes_cli.main -pzhermes_cli/main.py gatewayzhermes_cli/main.py --profilezhermes_cli/main.py -pzhermes gatewayzgateway/run.pyrIcommandrcdrd|vp d|vpd|vSd|vsd|vrdSd|vr d|vrdSdS)N --profile z-p z HERMES_HOME=z -p FTrb)rg current_homecurrent_profile_names rC_matches_current_profilez3find_gateway_pids.._matches_current_profiles  3133w></-//7:<0,00G;  7 " "f&7&75 W $ $)F )F)Fg)U)U5trT)wmicprocessgetzProcessId,CommandLinez /FORMAT:LISTT r z CommandLine=Nz ProcessId=c3 K|]}|vV dSNrb)rcp current_cmds rC z$find_gateway_pids..s(>>1 +>>>>>>rT)rGz-AewwrHz pid=,command=greprFr(r c3 K|]}|vV dSrsrb)rcpatternrgs rCrvz$find_gateway_pids..s(BBgw')BBBBBBrT)r)rDrJr resolve _profile_argr0bool is_windowsr+r,r-r. startswithr:anyr2rPrQappendr4isdigitjoinr\r5)r^r_r;patternscurrent_profile_argrlr=r>pid_strrAstrippedr? aux_partsrdrgrurjrks @@@@@rCfind_gateway_pidsrs2$suuH F F F F,.. F F FD   H((002233L&|44>QY.4466r::WY # $       9 <<6 %^SSS#$FK ++D11 % %zz||??>22 %"&s>':':';';">>>X>>>>>!L!TlTlmxTyTy!!"%g,,C"bikk11coo#U]J]J] $ C 0 0 0)!!! D!"$K % ^:::# F  ++D11 % %::<<6X#5#5 tQ//u::??#!%(mm"'(%###"#; ( 0 0I9~~**y|/C/C/E/E*!)A,//"%((9RSS>":":;")++%%xBBBBBBBBB% %XpXpqxXyXy%KK$$$ Z. /      Ks^$CM#AGM# GM#GBM#I87M#8 JM#JCM##M<;M<forcec t||}d}|D]m} t|||dz }#t$rY&t$rt d|YCt $r}t d|d|Yd}~fd}~wwxYw|S) aKill any running gateway processes. Returns count killed. Args: force: Use the platform's force-kill mechanism instead of graceful terminate. exclude_pids: PIDs to skip (e.g. service-managed PIDs that were just restarted and should not be killed). all_profiles: When ``True``, kill across all profiles. Passed through to :func:`find_gateway_pids`. )r^r_rrrF"⚠ Permission denied to kill PID zFailed to kill PID : N)rrrZr[printr\)rr^r_r;killedrAexcs rCkill_gateway_processesrs ,\ R R RD F 6 6 6 #U + + + + aKFF!    D > > > /profiles/``, or a short hash for any other path. Works correctly in Docker (HERMES_HOME=/opt/data) and standard deployments. rNget_default_hermes_rootrfprofilesrF^[a-z0-9][a-z0-9_-]{0,63}$)hashlibrehermes_constantsrr r| relative_tor?r:matchr4sha256rJencode hexdigest)rrrhomedefault profiles_rootrelr?s rC_profile_suffixr|s'NNN III888888    $ $ & &D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?8O       >>#d))**,, - - 7 7 9 9"1" ==s+AB?? C  C  hermes_homecddl}ddlm}t|pt t }|}||krdS|dz } ||}|j}t|dkr'| d|dr d|dSn#t$rYnwxYwdS) aReturn ``--profile `` only when HERMES_HOME is a named profile. For ``~/.hermes/profiles/``, returns ``"--profile "``. For the default profile or hash-based custom paths, returns the empty string. Args: hermes_home: Optional explicit HERMES_HOME path. Defaults to the current ``get_hermes_home()`` value. Should be passed when generating a service definition for a different user (e.g. system service). rNrrfrrFrri) rrrrrJr r|rr?r:rr4)rrrrrrrr?s rCr}r}sIII888888  5s?#4#455 6 6 > > @ @D%%''//11G wrz)2244M }--  u::??rxx(EuQxPP?*a** *      2sAC C'&C'cHt}|stStd|S)aDerive a systemd service name scoped to this HERMES_HOME. Default ``~/.hermes`` returns ``hermes-gateway`` (backward compatible). Profile ``~/.hermes/profiles/coder`` returns ``hermes-gateway-coder``. Any other HERMES_HOME appends a short hash for uniqueness. -)r _SERVICE_BASEsuffixs rCget_service_namers1  F  & &f & &&rTsystemct}|rtd|dz Stjdz dz dz |dz S)Nz/etc/systemd/systemr"z.configsystemduser)rrr)rnames rCget_systemd_unit_pathrs[   D ?)**->->->>> 9;; "Y . 7T:K:K:K KKrTctj}dtjvr5d|}t|r|tjd<dtjvr]tjdd|}t|dz }|rd|tjd<dSdSdS)aEnsure DBUS_SESSION_BUS_ADDRESS and XDG_RUNTIME_DIR are set for systemctl --user. On headless servers (SSH sessions), these env vars may be missing even when the user's systemd instance is running (via linger). Without them, ``systemctl --user`` fails with "Failed to connect to bus: No medium found". We detect the standard socket path and set the vars so all subsequent subprocess calls inherit them. XDG_RUNTIME_DIRz /run/user/DBUS_SESSION_BUS_ADDRESSbusz unix:path=N)rPgetuidenvironrexistsro)uid runtime_dir xdg_runtimebus_paths rC_ensure_user_systemd_envrs )++C **(3((    # # % % 8,7BJ( )!33jnn%68JS8J8JKK  $$u, ??   M5L(5L5LBJ1 2 2 2 43 M MrTc4|st|rdgnddgS)Nrr)rrs rC_systemctl_cmdrs, # """" ?K==h(??rTc|rdgnddgS)N journalctlrrbrs rC_journalctl_cmdrs# AL>>,)AArTrargsc tjt||zfi|S#t$rt ddwxYw)a%Run a systemctl command, raising RuntimeError if systemctl is missing. Defense-in-depth: callers are gated by ``supports_systemd_services()``, but this ensures any future caller that bypasses the gate still gets a clear error instead of a raw ``FileNotFoundError`` traceback. z)systemctl is not available on this systemN)r+r,rr6 RuntimeError)rrkwargss rC_run_systemctlrs_~nV44t;FFvFFF  7   s!$?c|rdndS)Nrrrbrs rC_service_scope_labelrs )886)rTcg}t}dD]X\}}t|}||vr|r*||||Y|S)N))Fr)Trr)r)rrrr3)scopes seen_pathsrrB unit_paths rCget_installed_systemd_scopesrs FEEJ<&& )888  " "       & MM% NN9 % % % MrTc@ttdkS)NrF)r:rrbrTrChas_conflicting_systemd_unitsrs +-- . . 22rTc2t}t|dkrdSd|}td|dt dt dt dt dt d dS) Nr(z + z5Both user and system gateway services are installed (z).zF This is confusing and can make start/stop/status behavior ambiguous.zL Default gateway commands target the user service unless you pass --system.z Keep one of these:z hermes gateway uninstallz* sudo hermes gateway uninstall --system)rr:rrr)rrendered_scopess rC$print_systemd_scope_conflict_warningr s ) + +F 6{{Qjj((O]/]]]^^^WXXX]^^^%&&&-...;<<<<C C6C11C6rc|sdS|dD]K}|dr4|ddd}|pdcSLdS)Nutf-8encodingzUser==rF)r read_textr/rr0r.)rr>values rC_read_systemd_user_from_unitr7s     t##W#55@@BB!! ??7 # # !JJsA&&q)//11E=D  ! 4rTc tjdtjdtjdfD]F}|rB|r.|dkr|cSGdS)Nrrrr)rPr r.) candidates rC_default_system_service_userr"Bsi ,,bi.?.?9AUAUV%%  %** %y/@/@F/J/J??$$ $ $ $ 4rTcBtdgdd}dddd|S)Nz6 Choose how the gateway should run in the background:)zPUser service (no sudo; best for laptops/dev boxes; may need linger after logout)zGSystem service (starts on boot; requires sudo; still runs as your user)zSkip service install for nowrrrr)rrFr()r)choices rC"prompt_linux_gateway_install_scoper&IsD @   F(t , ,V 44rTct}|dS|dkrt}tjdkrFt d|rt d|nt dt d|dfS|s; t d d }|pd }|rntd :t|d ||d fSt|d|d fS)NNFrrzY System service install requires sudo, so Hermes can't create it from this user session.zG After setup, run: sudo hermes gateway install --system --run-as-user zR After setup, run: sudo hermes gateway install --system --run-as-user z8 Then start it with: sudo hermes gateway start --systemFTz/ Run the system gateway service as which user?rfr$z Enter a username.rrr)rr) r&r"rPrrrrr.rsystemd_install)rscopers rC install_linux_gateway_from_setupr,Vs- . 0 0E }{ 244 :<<1   u v v v qreprrssssoppp Q R R R%<  3 3$%V`bccc *0b7799 1222  3 eDkJJJJd{%.... $;rTctrdStsdSddl}|jdsdSt jdpt jd}|sB ddl}|t jj }n#t$rYd SwxYw tj dd |d d gd d dd}n(#t$r}dt|fcYd}~Sd}~wwxYw|jdkr0|jp|jp d|j}d|pdfS|jpd}|dvrdS|dvrdS|pd}dd|fS)zReturn systemd linger status for the current user. Returns: (True, "") when linger is enabled. (False, "") when linger is disabled. (None, detail) when the status could not be determined. )Nznot supported in Termux)Nznot supported on this platformrNloginctl)Nloginctl not foundrr)Nz could not determine current userz show-userz--property=Lingerr$TFrprr checkr!exit zloginctl query failedrf>1yestrue)Trf>0nofalse)Frfzzunexpected loginctl output: )rrrrrPr r getpwuidrpw_name Exceptionr+r,rJr9stderrr-r.r)rrr r=rdetailrrendereds rCget_systemd_linger_statusr?us{{/.. ::655MMM 6< # #*))y  8BIi$8$8H < < JJJ||BIKK008HH < < <;;; <  h0CY O     SVV|A-O6=O4OF If you want the gateway user service to survive logout, run:z# sudo loginctl enable-linger $USERN)r?r)linger_enabled linger_details rCprint_systemd_linger_guidancerGs$=$?$?!NM GHHHHH 5  RSSS 899999 FmFFFGGG NOOO 344444rTczddl}t|tjjS)zReturn the real macOS user home for launchd artifacts. Profile-mode Hermes often sets ``HOME`` to a profile-scoped directory, but launchd user agents still live under the actual account home. rN)r rr9rPrr)r s rC_launchd_user_homerIs0 JJJ  RY[[))0 1 11rTcdt}|rd|nd}tdz dz |dz S)uReturn the launchd plist path, scoped per profile. Default ``~/.hermes`` → ``ai.hermes.gateway.plist`` (backward compatible). Profile ``~/.hermes/profiles/coder`` → ``ai.hermes.gateway-coder.plist``. ai.hermes.gateway-ai.hermes.gatewayLibrary LaunchAgentsz.plist)rrI)rrs rCget_launchd_plist_pathrOsI   F,2 K ( ( ( (8KD   ) +n <$ NNrTcrtjtjkr/ttj}|r|St jd}|r%t|}|r|SdD]$}t|z }|r|cS%dS)abDetect the active virtualenv directory. Checks ``sys.prefix`` first (works regardless of the directory name), then ``VIRTUAL_ENV`` env var (covers uv-managed environments where sys.prefix == sys.base_prefix), then falls back to probing common directory names under PROJECT_ROOT. Returns ``None`` when no virtualenv can be found. VIRTUAL_ENV)z.venvvenvN) rprefix base_prefixris_dirrPrro PROJECT_ROOT)rR _virtual_envr!s rC_detect_venv_dirrXs zS_$$CJ ;;== K :>>-00LL!! ;;== K' i' ;;== KKK  4rTct}|Btr |dz dz }n|dz dz }|rt|StjS)NScriptsz python.exebinpython)rXrrrJr executable)rR venv_pythons rCget_python_pathr_sh   D  << 2*\9KK,1K      ${## # >rTr path_entriesct|dz dz t|dz dz t|dz dz t|dz dz g}fd|DS)zKReturn user-local bin dirs that exist and aren't already in *path_entries*.z.localr[z.cargogoz .npm-globalc^g|])}|vt|'|*Srb)rr)rcrtr`s rCrez+_build_user_local_paths..s8 P P P!Ql%:%:tAww~~?O?O%:A%:%:%:rT)rJ)rr` candidatess ` rC_build_user_local_pathsresz D8Oe #$$ D8Oe #$$ D4K%    D= 5 ()) J Q P P Pz P P PPrTpathtarget_home_dirctj}t|} ||}t t||z S#t $rt |cYSwxYw)aZRemap *path* from the current user's home to *target_home_dir*. If *path* lives under ``Path.home()`` the corresponding prefix is swapped to *target_home_dir*; otherwise the path is returned unchanged. /root/.hermes/hermes-agent -> /home/alice/.hermes/hermes-agent /opt/hermes -> /opt/hermes (kept as-is) Note: this function intentionally does NOT resolve symlinks. A venv's ``bin/python`` is typically a symlink to the base interpreter (e.g. a uv-managed CPython at ``~/.local/share/uv/python/.../python3.11``); resolving that symlink swaps the unit's ``ExecStart`` to a bare Python that has none of the venv's site-packages, so the service crashes on the first ``import``. Keep the symlinked path so the venv activates its own environment. Lexical expansion only via ``expanduser``. )rr expanduserrrJr4)rfrgrjrtrelatives rC_remap_path_for_userrks"9;;L T A==..4((83444 1vv s3A**BBcnt}tjdz }t|dz }||krt |S ||}t ||z S#t $rt |cYSwxYw)uRemap the current HERMES_HOME to the equivalent under a target user's home. When installing a system service via sudo, get_hermes_home() resolves to root's home. This translates it to the target user's equivalent path: /root/.hermes → /home/alice/.hermes /root/.hermes/profiles/coder → /home/alice/.hermes/profiles/coder /opt/custom-hermes → /opt/custom-hermes (kept as-is) z.hermes)r r|rrrJrr4)rgcurrent_hermescurrent_defaulttarget_defaultrjs rC_hermes_home_for_target_userrp s%&&..00Ny{{Y.7799O/**Y6N((>"""#!--o>>>H,--- ###>"""""#s1&BB43B4cTt}tt}t}|rt|nttdz }|rt|dz nttdz dz }ttdz dz }||g}t jd} | rLtt | j} | |vr| | gd} tdttpd} |r't|\} }t}t|}t!|}t!|}t!|}t!|}t!|}fd |D}|t%t ||| d |}d t(d | d |d|d|rd|ndd|dd| d| d|d|d|dt*d| dStt-}t|}|t%t j||| d |}d t(d|d|rd|ndd|d|d|d|dt*d| dS)NrRr[ node_modules.binnode)z/usr/local/sbinz/usr/local/binz /usr/sbinz/usr/binz/sbinz/bin<rc0g|]}t|Srb)rk)rcrthome_dirs rCrez)generate_systemd_unit..Xs$PPPa,Q99PPPrT:z[Unit] Description=z After=network-online.target Wants=network-online.target StartLimitIntervalSec=600 StartLimitBurst=5 [Service] Type=simple User=z Group=z ExecStart=z -m hermes_cli.mainryrfz( gateway run --replace WorkingDirectory=z Environment="HOME=z" Environment="USER=z" Environment="LOGNAME=z" Environment="PATH=z" Environment="VIRTUAL_ENV=z" Environment="HERMES_HOME=z:" Restart=on-failure RestartSec=30 RestartForceExitStatus=zV KillMode=mixed KillSignal=SIGTERM ExecReload=/bin/kill -USR1 $MAINPID TimeoutStopSec=zT StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target zc After=network.target StartLimitIntervalSec=600 StartLimitBurst=5 [Service] Type=simple ExecStart=z Environment="PATH=zQ StandardOutput=journal StandardError=journal [Install] WantedBy=default.target )r_rJrVrXrrrr|parentrmaxr2_get_restart_drain_timeoutrrpr}rkextendrerSERVICE_DESCRIPTIONrr r)rr python_path working_dir detected_venvvenv_dirvenv_binnode_binr` resolved_noderesolved_node_dircommon_bin_pathsrestart_timeoutrrr profile_arg sane_pathrws @rCgenerate_systemd_unitr:s&!##Kl##K$&&M%2Rs=!!!L6">"C!DDEEO /)A+)N)N&*h28<< ";// +;AA *;AA '(;;'(;;'(;;PPPP<PPP 3DNNLQQRRR,---HH\**   AL+S+<{+<+<+K|]}|VdSrs)rstrip)rcr>s rCrvz0_normalize_service_definition..s*IItT[[]]IIIIIIrT)rr.r/)r s rC_normalize_service_definitionrs7 99IItzz||/F/F/H/HIII I IIrTcdddl}t|}|dd||jS)a`Normalize launchd plist text for staleness checks. The generated plist intentionally captures a broad PATH assembled from the invoking shell so user-installed tools remain reachable under launchd. That makes raw text comparison unstable across shells, so ignore the PATH payload when deciding whether the installed plist is stale. rNz,(PATH\s*)(.*?)()z\1__HERMES_PATH__\3)flags)rrsubS)r r normalizeds rC'_normalize_launchd_plist_for_comparisonrsCIII.t44J 667d   rTct|}|sdS|d}|rt|nd}t ||}t |t |kS)NrFrrrr)rrrrrr)rr installed expected_userexpecteds rCsystemd_unit_is_currentrs%V444I     u##W#55I?EO0;;;4M$F NNNH ( 3 37TU]7^7^ ^^rTcLt|}|rt|rdS|rt|nd}|t ||dt dg|dd td t|d dS) zMRewrite the installed systemd unit when the generated definition has changed.rFNrrr daemon-reloadTrr1r!u↻ Updated gateway z7 service definition to match the current Hermes install) rrrr write_textrrrr)rrrs rCrefresh_systemd_unit_if_neededrs%V444I     !8!G!G!Gu?EO0;;;4M .f-XXXcjkkkO$V4LLLL v!5f!=!= v v vwww 4rTrr=cZttd|rtd|ttdtd|ttdtdtdtdS)NuI⚠ Linger not enabled — gateway may stop when you close this terminal.z Auto-enable failed: z1 On headless servers (VPS, cloud instances) run:z sudo loginctl enable-linger  Then restart the gateway:z systemctl --user restart r")rr)rr=s rC_print_linger_enable_warningrs GGG UVVV 1 /v//000 GGG =>>> 7X 7 7888 GGG '((( F*:*<*< F F FGGG GGGGGrTctstsdSddl}ddl}|}t d|}|rtddSt\}}|durtddS|j dst||pddStd tj dd |gddd d }n5#t$r(}t|t|Yd}~dSd}~wwxYw|jdkrtd dS|jp|jp d|j}t||p|dS)z@Enable linger when possible so the user gateway survives logout.Nrz/var/lib/systemd/linger/rATr.r/z5Enabling linger so the gateway survives SSH logout...z enable-lingerFrr0u8✓ Linger enabled — gateway will persist after logoutr2)rrrrr rrrr?rrr+r,r;rJr9r<r-r.) rrr linger_filerErFr=rr=s rC_ensure_linger_enabledrs{{(**NNNMMM  H<(<<==K GHHH$=$?$?!NM GHHH 6< # #$X}/T@TUUU ABBB  ( 3     $Xs1vv666A HIIImKv}K0K8I0K0K R R T TF 6+B]CCCCCs C)) D3DDc|rdStdo"td S)NTrF)rrrs rC_select_systemd_scoper sM t  - - - 4 4 6 6 k?T\a?b?b?b?i?i?k?k;kkrTc8tjdd}|sct}t |t r|dini}t|dt}t|S)z?Return the configured gateway restart drain timeout in seconds.HERMES_RESTART_DRAIN_TIMEOUTrfagentrestart_drain_timeout) rPr r.r isinstancedictrorJrr)rKcfg agent_cfgs rCr{r{s )2B 7 7 = = ? ?C  ,6sD,A,AICGGGR(((r  MM')N     's + ++rTc4|rtdt|}|rdnd}|r|st|st dt |d|t |tdtg|dd t d t | d dSt d |t ddS|j ddt dt |d|| t||dtdg|dd tdtg|dd t t d t | dt t dt d|rdndd|dt d|rdndd|dt d|rdndd td!t |r$t|}|rt d"|ntt!dS)#Ninstallr --systemrfu↻ Repairing outdated z systemd service at: enableTrr✓ z service definition updatedService already installed at: Use --force to reinstallparentsexist_okz Installing z systemd service to: rrrrz service installed and enabled! Next steps: sudo hermes gateway startz! # Start the servicezhermes gateway statusz # Check statusrzjournalctl --userz -u z -f # View logsConfigured to run as: )rrrrrrrrr capitalizerymkdirrrrrr)rrrr scope_flagconfigured_users rCr*r*s 4(333%V444I &.BJ % &f555  j,@,H,Hjj_hjj k k k *& 9 9 9 9 H&6&8&89&PT^` a a a a _-f55@@BB___ ` ` ` F :y::;;; ())) 4$777 V,V44 V V9 V VWWW .f+VVVahiiiO$V4LLLLH.001&VXYYYY GGG [%f--88:: [ [ [\\\ GGG - k&(wwb k kj k k klll f&(wwb f fz f f fggg hv>||+> h hDTDVDV h h hiii GGG !6yAA  > >T[TT'TTTUUU-/@A     JJqMMMiikkH$$" ^[#..#$F}""$$00<[<<<===1    D   h; h h*08wwb h h;A*I))r h hNQ h h h   ')9););rErs rCsystemd_statusrsy "6 * *F%V444I &.BJ      4555 U61rUUUUVVV$&&,...  "& 1 1 1 DEEE p61rpppppqqq  #%%|4  &(()  F] " "F  [)&11<<>>[[[\\\\ [)&11<<>>[[[\\\ S61rSSzSSTTTAGQ29===TO: 888999)++M  &'''!  D +t++     > RSSSS >%''''577 T ! ! K L L L L u $ $ V W W W < = = = s  nv..$8H8J8JDRVXd1eeoqrrrrrrssrTc0t}|rd|ndS)z5Return the launchd service label, scoped per profile.rKrL)rrs rCr8r8s'   F,2 K ( ( ( (8KKrTc.ddl}d|jS)Nrzgui/)rPr)rPs rC_launchd_domainrs! III )")++  rTct}tt}tt}tdz }|ddt }t|}t}|rt|dz nttdz dz }|rt|nttdz }ttdz dz } || g} tj d} | rLtt| j } | | vr| | d t| d t"jd d d Dz} d |dddg}|r0|D]}| d |d|gdd|}d|d|d|d| d|d|d|d|dS)NlogsTrr[rRrrrsrtrxcg|]}||Srbrbrcrts rCrez*generate_launchd_plist..$s&]&]&]Q[\&]q&]&]&]rTPATHrfzz z-mz hermes_cli.main)zgatewayzrunz--replacez z Label z? ProgramArguments z? WorkingDirectory zf EnvironmentVariables PATH z9 VIRTUAL_ENV z9 HERMES_HOME z RunAtLoad KeepAlive SuccessfulExit StandardOutPath zH/gateway.log StandardErrorPath z-/gateway.error.log )r_rJrVr r|rr8r}rXrrrryrrrfromkeysrPrror0r|)r~rrlog_dirrBrrrrr priority_dirsrrr prog_argspart prog_args_xmls rCgenerate_launchd_plistr s!##Kl##Ko''//1122K&(G MM$M...   E{++K %&&M-:bs=5()))LSYDY\aDa@b@bH%2Rs=!!!L6???<<<<<< =ttvv = = =>>>>>rTc&t}t}tjddt d|gdd|r&|td|tddS) Nr%rrFrrru✓ Service uninstalled)rOr8r+r,rrrrrs rClaunchd_uninstallrs'))J   ENK/@/@,J,J5,J,JKSXbdeeee+ )Z))*** #$$$$$rTc t}t}|std|jdd|tdtj ddtt|gdd tj dd td |gdd td dSt tj dd td |gdd n#tj $r}|jd vrtdtj ddtt|gdd tj dd td |gdd Yd}~nd}~wwxYwtd dS)Nu:↻ launchd plist missing; regenerating service definitionTrrrr%rrr kickstartru✓ Service startedr'qu:↻ launchd job was unloaded; reloading service definition)rOr8rrryrrrr+r,rrJrCalledProcessErrorr9)rrBrs rC launchd_startr s'))J   E      JKKKt<<<466III [/2C2CS__U]akmnnnn [_5F5F2P2P2P2PQY]gijjjj #$$$#%%%k [_5F5F2P2P2P2PQY]gijjjjj  (kkk +D**F;9A8F66F;ct}td|} tjdd|gddn'#tj$r}|jdvrnYd}~nd}~wwxYwt dd td dS) Nrr%rTrrr$@@r! force_afteru✓ Service stopped)r8rr+r,r r9_wait_for_gateway_exitr)rBtargetrs rC launchd_stoprs   E!! + +E + +F  Y7tRPPPPP  ( <8 # #   DDDD 4S9999      s>A" AA"r rr!rc4ddl}ddlm}||z}|||znd}d}||kr|}|dS|`|s^||krF t |dt d|dn#t ttf$rYdSwxYwd}| d ||k|}|t d|d |d dSdS) uWait for the gateway process (by saved PID) to exit. Uses the PID from the gateway.pid file — not launchd labels — so this works correctly when multiple gateway instances run under separate HERMES_HOME directories. Args: timeout: Total seconds to wait before giving up. force_after: Seconds of graceful waiting before escalating to force-kill. rNrFTru⚠ Gateway PID z& did not exit gracefully; sent SIGKILLg333333?z still running after us — restart may fail) rrr monotonicrrrZr[r\r) r!rrrrforce_deadline force_sentrA remaining_pids rCrrslKKK......~~')H9D9Pdnn&&44VZNJ ..  X % %o ;4  ": "$..:J:Jn:\:\ c....TTTTUUUU&A   tt J 3 ..  X % %"$O%%M  dddWdddeeeu 4s$B''CCc t}td|}t}ddlm} |}| t |rt ddS|[ t|dn#tttf$rd}YnwxYw|'t|d}|st d|d d tj d d d |gddt ddS#tj$r}|jdvrt dt!}tj d dtt#|gddtj d d |gddt dYd}~dSd}~wwxYw)Nrrru✓ Service restart requestedFrru"⚠ Gateway drain timed out after z.0fus — forcing launchd restartr%rz-kTrru✓ Service restartedru'↻ launchd job was unloaded; reloadingrr)r8rr{rrr]rrrZr[r\rr+r,r r9rOrJ)rBr drain_timeoutrrAexitedrrs rClaunchd_restartrs   E!! + +E + +F.00M......'o ? ⚠ Without message.channels the bot will ONLY work in DMs!uI5. Install to Workspace: Settings → Install App → copy xoxb-... tokenz56. Reinstall the app after any scope or event changesuJ7. Find your user ID: click your profile → three dots → Copy member IDz/8. Invite the bot to channels: /invite @YourBotzBot Token (xoxb-...)z&Paste the bot token from step 3 above.SLACK_APP_TOKENzApp Token (xapp-...)z,Paste the app-level token from step 4 above.SLACK_ALLOWED_USERSz'Paste your member ID from step 7 above.matrixMatrixu🔐MATRIX_ACCESS_TOKEN)zX1. Works with any Matrix homeserver (self-hosted Synapse/Conduit/Dendrite or matrix.org)z@2. Create a bot user on your homeserver, or use your own accountuN3. Get an access token: Element → Settings → Help & About → Access TokenzI Or via API: curl -X POST https://your-server/_matrix/client/v3/login \zK -d '{"type":"m.login.password","user":"@bot:server","password":"..."}'zL4. Alternatively, provide user ID + password and Hermes will log in directlyzT5. For E2EE: set MATRIX_ENCRYPTION=true (requires pip install 'mautrix[encryption]')zN6. To find your user ID: it's @username:your-server (shown in Element profile)MATRIX_HOMESERVERz0Homeserver URL (e.g. https://matrix.example.org)z@Your Matrix homeserver URL. Works with any self-hosted instance.z8Access token (leave empty to use password login instead)zMPaste your access token, or leave empty and provide user ID + password below.MATRIX_USER_IDu5User ID (@bot:server — required for password login)z4Full Matrix user ID, e.g. @hermes:matrix.example.orgMATRIX_ALLOWED_USERSz4Allowed user IDs (comma-separated, e.g. @you:server)z.Matrix user IDs who can interact with the bot.MATRIX_HOME_ROOMzSHome room ID (for cron/notification delivery, or empty to set later with /set-home)zLRoom ID (e.g. !abc123:server) for delivering cron results and notifications. mattermost MattermostMATTERMOST_TOKEN)uC1. In Mattermost: Integrations → Bot Accounts → Add Bot AccountuE (System Console → Integrations → Bot Accounts must be enabled)z:2. Give it a username (e.g. hermes) and copy the bot tokenuK3. Works with any self-hosted Mattermost instance — enter your server URLuA4. To find your user ID: click your avatar (top-left) → Profileu8 Your user ID is displayed there — click it to copy.uI ⚠ This is NOT your username — it's a 26-character alphanumeric ID.uL5. To get a channel ID: click the channel name → View Info → copy the IDMATTERMOST_URLz(Server URL (e.g. https://mm.example.com)z@Your Mattermost server URL. Works with any self-hosted instance.z&Paste the bot token from step 2 above.MATTERMOST_ALLOWED_USERSz*Your Mattermost user ID from step 4 above.MATTERMOST_HOME_CHANNELz@Channel ID where Hermes delivers cron results and notifications.MATTERMOST_REPLY_MODEuTReply mode — 'off' for flat messages, 'thread' for threaded replies (default: off)zFoff = flat channel messages, thread = replies nest under your message.whatsappWhatsAppu📲WHATSAPP_ENABLED)r9rBr:r;rXSignalu📡SIGNAL_HTTP_URLemailEmailu📧 EMAIL_ADDRESS)z61. Use a dedicated email account for your Hermes agentz82. For Gmail: enable 2FA, then create an App Password atz, https://myaccount.google.com/apppasswordszH3. For other providers: use your email password or app-specific passwordz-4. IMAP must be enabled on your email accountz Email addressz;The email address Hermes will use (e.g., hermes@gmail.com).EMAIL_PASSWORDz Email password (or app password)z;For Gmail, use an App Password (not your regular password).EMAIL_IMAP_HOSTz IMAP hostzBe.g., imap.gmail.com for Gmail, outlook.office365.com for Outlook.EMAIL_SMTP_HOSTz SMTP hostz?e.g., smtp.gmail.com for Gmail, smtp.office365.com for Outlook.EMAIL_ALLOWED_USERSz'Allowed sender emails (comma-separated)z3Only emails from these addresses will be processed.smsz SMS (Twilio)TWILIO_ACCOUNT_SID)z51. Create a Twilio account at https://www.twilio.com/zH2. Get your Account SID and Auth Token from the Twilio Console dashboardz93. Buy or configure a phone number capable of sending SMSz+4. Set up your webhook URL for inbound SMS:uF Twilio Console → Phone Numbers → Active Numbers → your numberu` → Messaging → A MESSAGE COMES IN → Webhook → https://your-server:8080/webhooks/twiliozTwilio Account SIDz&Found on the Twilio Console dashboard.TWILIO_AUTH_TOKENzTwilio Auth Tokenz8Found on the Twilio Console dashboard (click to reveal).TWILIO_PHONE_NUMBERz5Twilio phone number (E.164 format, e.g. +15551234567)z)The Twilio phone number to send SMS from.SMS_ALLOWED_USERSz5Allowed phone numbers (comma-separated, E.164 format)z9Only messages from these phone numbers will be processed.SMS_HOME_CHANNELzDHome channel phone number (for cron/notification delivery, or empty)z>Phone number to deliver cron job results and notifications to.dingtalkDingTalkDINGTALK_CLIENT_ID)u=1. Go to https://open-dev.dingtalk.com → Create ApplicationzQ2. Under 'Credentials', copy the AppKey (Client ID) and AppSecret (Client Secret)z.3. Enable 'Stream Mode' under the bot settingsz54. Add the bot to a group chat or message it directlyzAppKey (Client ID)z6The AppKey from your DingTalk application credentials.DINGTALK_CLIENT_SECRETzAppSecret (Client Secret)z9The AppSecret from your DingTalk application credentials.feishuz Feishu / Larku🪽 FEISHU_APP_ID)zJ1. Go to https://open.feishu.cn/ (or https://open.larksuite.com/ for Lark)z32. Create an app and copy the App ID and App Secretz(3. Enable the Bot capability for the appz<4. Choose WebSocket (recommended) or Webhook connection modez55. Add the bot to a group chat or message it directlyz?6. Restrict access with FEISHU_ALLOWED_USERS for production usezApp IDz-The App ID from your Feishu/Lark application.FEISHU_APP_SECRETz App Secretz1The App Secret from your Feishu/Lark application. FEISHU_DOMAINu+Domain — feishu or lark (default: feishu)z@Use 'feishu' for Feishu China, or 'lark' for Lark international.FEISHU_CONNECTION_MODEu=Connection mode — websocket or webhook (default: websocket)zCwebsocket is recommended unless you specifically need webhook mode.FEISHU_ALLOWED_USERSz,Allowed user IDs (comma-separated, or empty)z;Restrict which Feishu/Lark users can interact with the bot.FEISHU_HOME_CHANNELz/Home chat ID (optional, for cron/notifications)z0Chat ID for scheduled results and notifications.wecomzWeCom (Enterprise WeChat) WECOM_BOT_ID)u?1. Go to WeCom Admin Console → Applications → Create AI Botz=2. Copy the Bot ID and Secret from the bot's credentials pageu?3. The bot connects via WebSocket — no public endpoint neededz>4. Add the bot to a group chat or message it directly in WeComz>5. Restrict access with WECOM_ALLOWED_USERS for production usezBot IDz"The Bot ID from your WeCom AI Bot. WECOM_SECRETSecretz"The secret from your WeCom AI Bot.WECOM_ALLOWED_USERSz5Restrict which WeCom users can interact with the bot.WECOM_HOME_CHANNELwecom_callbackzWeCom Callback (Self-Built App)WECOM_CALLBACK_CORP_ID)uG1. Go to WeCom Admin Console → Applications → Create Self-Built AppzC2. Note the Corp ID (top of admin console) and create a Corp SecretzM3. Under Receive Messages, configure the callback URL to point to your serverzD4. Copy the Token and EncodingAESKey from the callback configurationuN5. The adapter runs an HTTP server — ensure the port is reachable from WeComzG6. Restrict access with WECOM_CALLBACK_ALLOWED_USERS for production usezCorp IDzYour WeCom enterprise Corp ID.WECOM_CALLBACK_CORP_SECRETz Corp Secretz+The secret for your self-built application.WECOM_CALLBACK_AGENT_IDzAgent IDz,The Agent ID of your self-built application.WECOM_CALLBACK_TOKENzCallback Tokenz1The Token from your WeCom callback configuration.WECOM_CALLBACK_ENCODING_AES_KEYzEncoding AES Keyz:The EncodingAESKey from your WeCom callback configuration.WECOM_CALLBACK_PORTz$Callback server port (default: 8645)z"Port for the HTTP callback server.WECOM_CALLBACK_ALLOWED_USERSz5Restrict which WeCom users can interact with the app.weixinzWeixin / WeChatWEIXIN_ACCOUNT_ID bluebubbleszBlueBubbles (iMessage)BLUEBUBBLES_SERVER_URL) zF1. Install BlueBubbles on a Mac that will act as your iMessage server:z https://bluebubbles.app/uG2. Complete the BlueBubbles setup wizard — sign in with your Apple IDuD3. In BlueBubbles Settings → API, note the Server URL and passwordz84. The server URL is typically http://:1234z<5. Hermes connects via the BlueBubbles REST API and receivesz( incoming messages via a local webhookzJ6. To authorize users, use DM pairing: hermes pairing generate bluebubblesuD Share the code — the user sends it via iMessage to get approvedz6BlueBubbles server URL (e.g. http://192.168.1.10:1234)u.The URL shown in BlueBubbles Settings → API.BLUEBUBBLES_PASSWORDzBlueBubbles server passwordu3The password shown in BlueBubbles Settings → API.BLUEBUBBLES_ALLOWED_USERSz]Pre-authorized phone numbers or iMessage IDs (comma-separated, or leave empty for DM pairing)u_Optional — pre-authorize specific users. Leave empty to use DM pairing instead (recommended).BLUEBUBBLES_HOME_CHANNELzKHome channel (phone number or iMessage ID for cron/notifications, or empty)zFPhone number or Apple ID to deliver cron results and notifications to.qqbotzQQ Botu🐧 QQ_APP_ID)z,1. Register a QQ Bot application at q.qq.comz<2. Note your App ID and App Secret from the application pagez;3. Enable the required intents (C2C, Group, Guild messages)z'4. Configure sandbox or publish the botz QQ Bot App IDz!Your QQ Bot App ID from q.qq.com.QQ_CLIENT_SECRETzQQ Bot App Secretz%Your QQ Bot App Secret from q.qq.com.QQ_ALLOWED_USERSzCAllowed user OpenIDs (comma-separated, leave empty for open access)u9Optional — restrict DM access to specific user OpenIDs.QQ_HOME_CHANNELz>>> * $ $/?ZM&Q'' SSS5SSSTTTT ) # # # ?+??@@@ Ls  c " |d}|d}|d}tttd|d|dtj|d}|r%t|D]}t d|t |}|r6tt|d td |d d sd Sd }|dD]}tt d|dt |d} | r|d|krt d| |drt dt dt dtd|dd } | r%| dd} d|dvrg} | dD]} | } | dr=| dr(| dd} |  dr | dd } | r| | d| } t)|d| td | }n}tgd!}t+d"|d#}|d$kr t)d%d&t-d'n4|d#krtd(t d)nt d*btd|d|d+d } | r0t)|d| td,|d|d|krt-d-|d.d St d/|d0}t |}|rm|sk|d1kre| dd$ }|r6td2|d3d4r"t)||td5|tt|d|d6d S)7z2Interactive setup for Telegram, Discord, or Slack.r:rBr;u ─── ryu Setup ───r<rz is already configured.z Reconfigure ?FNr=r5rz Current: r77 The gateway DENIES all users by default for security.z7 Enter user IDs to create an allowlist, or leave emptyz- and you'll be asked about open access next.rr4rfDISCORD,z<@>z<@!zuser:ru7 Saved — only these users can interact with the bot.)z/Enable open access (anyone can message the bot)zXUse DM pairing (unknown users request access, you approve with 'hermes pairing approve')z7Skip for now (bot will deny all users until configured)z+ How should unauthorized users be handled?rFrGATEWAY_ALLOW_ALL_USERSr5u2 Open access enabled — anyone can use your bot!uB DM pairing mode — users will receive a code to request access.z8 Approve with: hermes pairing approve u9 Skipped — configure later with 'hermes gateway setup'r4z Saved u Skipped — z won't work without this.z Skipped (can configure later) _HOME_CHANNELr2z Use your user ID () as the home channel?T Home channel set to z configured!)rrrCYANrorrrrrr%r0r.rr1lstriprrrrr rrupper)rr:rBr; instructionsr>existing_tokenallowed_val_setvarexistingrcleanedr?raccess_choices access_idxhome_varhome_valfirst_ids rC_setup_standard_platformr0s W E W E%I GGG %>u>>u>>> L LMMM<< 455L$   $ $D {D{{ # # # #"9--N 7778886e666>>  FO9:9: %F %%&&& V--  1F y00 /X// 0 0 0 77> " "'  P Q Q Q P Q Q Q F G G G/H //%@@@E! \--R00F ++E&}}S11..!iikk>>$//@CLL4E4E@"%**U"3"3":":3"?"?C99;;11'::*"%abb'C.!LL---!hhuooGs6{G444WXXX")""" ++XZhjkll ??"# > > GGGU00U00011111rTcTddlm}ddl}||dS)z-Delegate to the existing WhatsApp setup flow.r) cmd_whatsappN)hermes_cli.mainrargparse Namespace)rrs rC_setup_whatsapprs?,,,,,,OOOL##%%&&&&&rTc`tdtD}t|dS)z0Configure Email via the standard platform setup.c32K|]}|ddk|VdS)r9r[Nrbrs rCrvz_setup_email..0GG1U8w3F3F!3F3F3F3FGGrTNnext _PLATFORMSr)email_platforms rC _setup_emailr2GGZGGGGGN^,,,,,rTc`tdtD}t|dS)z7Configure SMS (Twilio) via the standard platform setup.c32K|]}|ddk|VdS)r9rbNrbrs rCrvz_setup_sms..s0CCa5U1B1B1B1B1B1BCCrTNr) sms_platforms rC _setup_smsrs2CC:CCCCCL\*****rTc`tdtD}t|dS)z3Configure DingTalk via the standard platform setup.c32K|]}|ddk|VdS)r9rhNrbrs rCrvz"_setup_dingtalk..s0MM1ah*6L6LQ6L6L6L6LMMrTNr)dingtalk_platforms rC_setup_dingtalkrs4MM MMMMM./////rTc`tdtD}t|dS)zDConfigure WeCom (Enterprise WeChat) via the standard platform setup.c32K|]}|ddk|VdS)r9rsNrbrs rCrvz_setup_wecom..rrTNr)wecom_platforms rC _setup_wecomrrrTctrDtdp!tdStr t SdS)z6Check if the gateway is installed as a system service.FrT)r*rrr7rOrbrTrC_is_service_installedrst ""1$E22299;;j?T\`?a?a?a?h?h?j?jj 1%''..000 5rTc\trtd}td}|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYw|r_ tdt gdddd}|jdkrdSn#ttj f$rYnwxYwdStritrI tj dd tgddd }|jd kS#tj $rYdSwxYwtt!d kS) z2Check if the gateway service is currently running.FrTrrprrr%r&rr)r*rrrrr-r.rr+r5r7rOr,r8r9r:r)user_unit_existssystem_unit_existsr=s rC_is_service_runningrs  ""#0>>>EEGG2$???FFHH   ' "2"4"45 D"=&&((H4445 *";<       ' "2"4"454=&&((H4445 *";<    u .007799 ^f&7&9&9:#$F$) )(   55   "" # #a ''s6?BB21B28?C::DD1E99F  F c$ tttdtjtt dt dt dt dt d}t d}|r1|r/tt dtd d sd S d d lm }m }n9#t$r,}td|t dYd }~d Sd }~wwxYw|s tdt dd Sttddst dd Sd d l } |j|tt!}nS#t"$r!tt%dYd St$r}td|Yd }~d Sd }~wwxYw|st%dd S|dd}|dd}|dd} |dd} t)d|t)d|| rt)d| t)dt dpdtgd } t+d!| d } | d krOt)d"d#t)d$d%t)d&dt d't d(n| d)kr@t)d"d*t)d$d+t)d&dt%d,n| d-krj| pd} t-d.| d /d0d}t)d"d1t)d$d%t)d&|t d2n?t)d"d3t)d$d%t)d&dt%d4tgd5}t+d6|d }|d kr0t)d7d3t)d8dt d9n|d)kr0t)d7d*t)d8dt%d:nUt-d;dd /d0d}t)d7d1t)d8|t d<| rDttd=| d>dr"t)d?| t d@| tt dAt dB|| rt dC| d Sd S)Dz8Interactive setup for Weixin / WeChat personal accounts.u0 ─── 💬 Weixin / WeChat Setup ───z> 1. Hermes will open Tencent iLink QR login in this terminal.z0 2. Use WeChat to scan and confirm the QR code.zG 3. Hermes will store the returned account_id/token in ~/.hermes/.env.zL 4. This adapter supports native text, image, video, and document delivery.rrzWeixin is already configured.z Reconfigure Weixin?FNr)check_weixin_requirementsqr_loginz Weixin adapter import failed: z1 Install gateway dependencies first, then retry.z> Missing dependencies: Weixin needs aiohttp and cryptography.z2 Install them, then rerun `hermes gateway setup`.z Start QR login now?Tz Cancelled.z Weixin setup cancelled.z QR login failed: z QR login did not complete. account_idrfrbase_urluser_idWEIXIN_BASE_URLWEIXIN_CDN_BASE_URLz%https://novac2c.cdn.weixin.qq.com/c2c)%Use DM pairing approval (recommended)Allow all direct messagesOnly allow listed user IDszDisable direct messages+ How should direct messages be authorized?WEIXIN_DM_POLICYpairingWEIXIN_ALLOW_ALL_USERSr8WEIXIN_ALLOWED_USERS DM pairing enabled.zY Unknown DM users can request access and you approve them with `hermes pairing approve`.rFopenr5z$ Open DM access enabled for Weixin.r(z+ Allowed Weixin user IDs (comma-separated)rry allowlistz Weixin allowlist saved.disabledz Direct messages disabled.)z!Disable group chats (recommended)zAllow all group chatsz Only allow listed group chat IDs$ How should group chats be handled?WEIXIN_GROUP_POLICYWEIXIN_GROUP_ALLOWED_USERS Group chats disabled.z All group chats enabled.z* Allowed group chat IDs (comma-separated)z Group allowlist saved.z Use your Weixin user ID (rWEIXIN_HOME_CHANNELrzWeixin configured!z Account ID: z User ID: )rrrrrrrrgateway.platforms.weixinrrr;rr.r,rJr KeyboardInterruptrror rrr%)existing_accountrrrrr. credentialsrrrrrr default_allowr group_choices group_idx allow_groupss rC _setup_weixinr sa GGG %BFK P PQQQ GGGOPPPABBBXYYY]^^^$%899">22NN 56664e<<  FPPPPPPPPP """NNN!gk((3/@/@+A+A"B"BCC  1222 /#//000 4555r22J OOGR ( (Ez2..Hooi,,G& 333>5)))4((333(-8M*N*N*yRyzzz GGGN Ln^_``JQ)9555/999-r222-...noooo q)6222/888-r222<==== q 2 H-bghhhppqtvxyy );777/999-y99912222):666/999-r2223444 GGGM DmUVWWIA~~,j9993R888,---- a,f5553R88823333JBY^___gghkmopp ,k:::3\BBB0111>  VwVVVX\ ] ] > 0' : : : <7<< = = = GGG&''', ,,---,***+++++,,s6C D%!D  D22F%%'G5 G5G00G5c* tttdtjt d}t d}|r1|r/tt dt ddsdStdd g}td |d }d}d}|d kr d d lm }n+#t$r}td |d}Yd}~nd}~wwxYw|^ |}nR#t$r!ttdYdSt$r}td|Yd}~nd}~wwxYw|rd}|std|s$ttdtdttdd}|stddStdd} | stddSddg} td| d } | dkrdnd} d} d dlm}||| | }|r*|d } t d!| pd"ntd#n)#t$r}td$|Yd}~nd}~wwxYw|| | d| d%}|d&}|d'} |d(d} |d)}|d } t%d|t%d| t%d*| |rd+}n`td,d-g}td.|d }|dkrd/nd+}|d/kr-td0td1td2t%d3|| r tt d4| tgd5}td6|d }|d kr?t%d7d8t%d9d:t d;td<n|dkr0t%d7d=t%d9d:td>nYt%d7d8|pd:}td?|dd@d:}t%d9|t dAtdBdCg}tdD|d }|d kr t%dEdFtdGnt%dEdHtdIttdJd}|r"t%dK|t dL|tt dMtdN|tdO| | rtdP| dSdS)QuMInteractive setup for Feishu / Lark — scan-to-create or manual credentials.u. ─── 🪽 Feishu / Lark Setup ───rmrnz$Feishu / Lark is already configured.z Reconfigure Feishu / Lark?FNz : !!4lAFF'/1}}))+ i ' ' J K K K h i i i k l l l+_===4 222333 GGGN Ln^_``JQ/999-r222-..._```` q/888-r222CDDDD/999 2 A=[`aaaiijmoqrr -y999*+++ GGG>MDmUVWWIA~~,f555DEEEE,j999,--- GGGMX]^^^L?,l;;;=|==>>> GGG2333$F$$%%%$F$$%%%)'X''((((())sO5B<< C$CC$* C55'E E(D??EAI I8I33I8c2 ddl}tttdtjt d}t d}|r1|r/tt dtddsdSt|jd rt d ntd td td tdtdtdttdtdtdtttd|pd} td|d p|}n'#ttf$rtdYdSwxYwtd ddl}||ddd}|jdkrt dn*td |jd!td"dsdSnB#t&$r5}td#|d$|td%d&sYd}~dSYd}~nd}~wwxYwt)d|ttd'td(|pd)} td*|rd+|d,nd)d$ } | s|} n'#ttf$rtdYdSwxYw| st+d-dSt)d| ttd.td/t d0pd)} | p| } td1| d p| } n'#ttf$rtdYdSwxYwt)d0| ttd2drttd3t d4pd)} td5| pd6d p| pd6}n'#ttf$rtdYdSwxYwt)d4|tt d7td8|td9| td:td;t d4rdz'Interactive setup for Signal messenger.rNu' ─── 📡 Signal Setup ───rZrzSignal is already configured.z Reconfigure Signal?Fz signal-clizsignal-cli found on PATH.zsignal-cli not found on PATH.z7 Signal requires signal-cli running as an HTTP daemon.z Install options:zF Linux: download from https://github.com/AsamK/signal-cli/releasesz# macOS: brew install signal-cliz) Docker: bbernhard/signal-cli-rest-apiz; After installing, link your account and start the daemon:z$ signal-cli link -n "HermesAgent"zA signal-cli --account +YOURNUMBER daemon --http 127.0.0.1:8080z8 Enter the URL where signal-cli HTTP daemon is running.zhttp://127.0.0.1:8080z HTTP URL [z]: z Setup cancelled.z Testing connection...rz /api/v1/checkr rz! signal-cli daemon is reachable!z# signal-cli responded with status .z Continue anyway?z Could not reach signal-cli at rz8 Save this URL anyway? (you can start signal-cli later)Tz9 Enter your Signal account phone number in E.164 format.z Example: +15551234567rfz Account numberz []z Account number is required.rzB Enter phone numbers or UUIDs of allowed users (comma-separated).SIGNAL_ALLOWED_USERSz Allowed users [z< Enable group messaging? (disabled by default for security)z0 Enter group IDs to allow, or * for all groups.SIGNAL_GROUP_ALLOWED_USERSz Group IDs [*zSignal configured!z URL: z Account: z0 DM auth: via SIGNAL_ALLOWED_USERS + DM pairingz Groups: enabledr)rrrrrrrrrrrinputr.EOFErrorrhttpxror status_coder;r r)r existing_urlr default_urlurlr4resprdefault_accountrexisting_alloweddefault_allowedallowedexisting_groupsgroupss rC _setup_signalr@ sMMM GGG %96; G GHHH !233L$%566( 56664e<<  F GGGv|L!! 122225666LMMM'((([\\\8999>??? PQQQ;<<<VWWW  GGGIJJJ9"9K3;33344::<<K  ' ( $%%% ()))  yyCJJsOO:::DyII  s " " = > > > > S@PSSS T T T !5u==  CCCCCDDDWY]^^  FFFFF      $c*** GGGJKKK()))&,"Oao+]+B+B+B+B+B[]aaabbhhjj &%G ' ( $%%% 3444#W--- GGGHIIISTTT$%;<<B&1'O@O@@@AAGGII\_ ' ( $%%%)7333 GGGSUZ[[ = EFFF'(DEEK F?+AcFFFGGMMOOiSbifiFF+,    ( ) ) ) FF  3V<<< GGG&'''&W&&'''ABBBf7S)T)TdIIZdffgggggsa>'F&& G  G A4I J%JJ1L L-,L-'N== O! O!+Q-- RRc@trtddStttdtjttdtjttdtjttdtjttdtjttdtjtt }t}tr*trtt|r|rtd n|rtd td d ri trtntrt!nM#t"j$r}t'd |Yd}~n'd}~wwxYwnt)dt)d tt+dg}t,D]2}t/|}||dd|d3|dt3d|t5|dz }|t5t,krnt,|}|ddkrt7n`|ddkrt9nE|ddkrt;n*|ddkrt=nt?|2tAdt,Dp&tCdpd"dk}|rtttd tj#t }t}|rtd!d r trtIn:trtKntMt)d"n!#t"j$r}t'd#|Yd}~nd}~wwxYwn|r}td$d rk trtntrt!n#t"j$r}t'd%|Yd}~n{d}~wwxYwnqttstrqtrd&nd'} tOrd(nd} td)| d*| d+d r d} d,} trtQd,-\} } ntSd,-d } t| rqtd.d ra trt| d/k0nt!n.#t"j$r}t'd%|Yd}~nd}~wwxYwnO#t"j$r,}t'd1|t)d2Yd}~nd}~wwxYwt)d3trt)d4t)d5ntOr=t)d6t)d7t)d8t)d9ntUr@d:d;l+m,} t)d<t)d7t)d=| d>n│ Press Ctrl+C at any time to exit. │r*z)Gateway service is installed and running.z-Gateway service is installed but not running.z Start it now?Tz Failed to start: z%Gateway service is not installed yet.z. sQ U8z ! ! ]1[> * *++ ! ! ! !rTrXrfr5u──────────────────────────────────────────────────────────z) Restart the gateway to pick up changes?zStart manually: hermes gatewayz Restart failed: z Start the gateway service?z Start failed: rlaunchdz. (note: services may not survive WSL restarts)z Install the gateway as a z service?z% (runs in background, starts on boot)Frz Start the service now?rrz Install failed: z. You can try manually: hermes gateway installz/ You can install later: hermes gateway installzA Or as a boot-time service: sudo hermes gateway install --systemz+ Or run in foreground: hermes gateway runz* WSL detected but systemd is not running.z' Run in foreground: hermes gateway runz< For persistence: tmux new -s hermes 'hermes gateway run'zM To enable systemd: add systemd=true to /etc/wsl.conf, then 'wsl --shutdown'rrz/ Termux does not use systemd/launchd services.zR Or start it manually in the background (best effort): nohup hermes gateway run >z/logs/gateway.log 2>&1 &z1 Service install not supported on this platform.z?No platforms configured. Run 'hermes gateway setup' when ready.)-r r rrrMAGENTArrr*rrrrrrr7r r+r rrrrrrrr:rr@r r)rrrrDIMrrrrr,rrrr)service_installedservice_runningr menu_itemsplatrr%rany_configured platform_namewsl_noteinstalled_scope did_installrs rC gateway_setuprP s||)*** GGG %DFLFT U UVVV %RTZTb c cddd %DFLFT U UVVV %QSYSa b bccc %PRXR` a abbb %DFLFT U UVVV GGG-//)++O ""'D'F'F,... S_SABBBB  SEFFF *D 1 1 7 7,..$!OOOOZZ$!OOO0 7 7 75!5566666666 7  7 :;;;QRRR/ *+++  > >D%d++F   g<<6<<< = = = =&!!!@*cR\oo`aNabb S__ $ $ f% E?j ( (      e_ ( ( OOOO e_ ( ( OOOO e_ ( ( OOOO $X . . .5/:E * + + 1r 8 8 : :f D  JV  eJ ++,,,133-// A JH$OO : :022E'))))!E')))),..."#CDDD!4::: 8Q 8 899999999: :5 J;TBB 88022(%!(%!4888 61 6 6777777778  8 GGG(*** Jhjj* J-F-H-H W i OUxx_KK]_ "G}"G"GW_"G"G"GIMNNNU*.&+ 466/;[bg;h;h;h8O[[+%8888*.K&D=9SUY+Z+ZDD#<#>#>!4$1H9T$U$U$U$U$U$1OOO#-#@DDD +,Bq,B,B C C C C C C C CD%8UUU#$<$<$<==="#STTTTTTTTUPQQQ022h"#fgggLMMMM JGHHHDEEEYZZZjkkkk;;JLLLLLLPQQQHIII Utxtxtztz U U UVVVVRSSSHIIII TUUU GGGGGs09G**H9HHAQ//R>RR39S..T=TTAY1XYX< X72Y7X<<YY<!Y77Y<c t|dd}||dkrGt|dd}t|dd}t|dd}t||| dS|d krtdS|d krgtrt d dSt|d d}t|dd}t|dd}t r2t dt dtjdtr]tr;tdtdtdt t|||dStrt|dStr~t dt dt dt t dt dt dtjddSt!r}t dt dt t dt d t t d!tjddSt d"t d#tjddS|d$krAtrt d%dSt|dd}t r2t d&t d'tjdtrt#|(dStrt%dSt!r`t d)t d*t t d+t d,tjddSt d-tjddS|d.kr"t|dd}t|d/d}|r6t'd01} | r$t d2| d3t)d4d56t r2t d7t dtjdtrt+|(dStrt-dStrt d8t d9t t dt dt dt t d:tjddSt!r}t d;t d<t t d=t d>t t d?tjddSt d-tjddS|d@kr]t|d/d} t|dd}| rd} trmt/d(s"t/d0(r) t3|(d0} nj#t4j$rYnYwxYwtrGt9r' t;d0} n#t4j$rYnwxYwt'd01} | | rdndz} | rt dA| dBdSt dCdSd} trmt/d(s"t/d0(r) t3|(d0} nj#t4j$rYnYwxYwtrGt9r' t;d0} n#t4j$rYnwxYw| s0t=rt dDdSt dEdSt dAt?dFdS|dGkr)d} t|dd}t|d/d} d}| rd}trmt/d(s"t/d0(r) t3|(d0}nj#t4j$rYnYwxYwtrGt9r' t;d0}n#t4j$rYnwxYwt'd01} | |rdndz} | rt dA| dBt)d4d56t dHtrUt/d(s"t/d0(rt+|(nMtr/t9rt-ntdIdStrot/d(s"t/d0(r+d0} tA|(d0} nl#t4j$rYn[wxYwtrIt9r)d0} tCd0} n#t4j$rYnwxYw| sUtrtE\}}|d0urddl#}|$}t t dJt dKt t dL|t t dMt dNdS|rOt t dOt dPt dQtjdt=rt dDt)d4d56t dHtdIdSdS|dRkrt|dSd}t|dd}trWt/d(s"t/d0(rtK||(dStr1t9rtM|dStO}|r4t dTdU(tStT|dVt dWtW}|r4t t dX|D]}t dY|t t r t dZt d[dStr/t d\t d]t d^dSt d_t d`t dadSt dbtW}|r4t t dX|D]}t dY|t t dct ddt rt dedStr t dt ddSt dft dgdSdS)hzHandle gateway subcommands.gateway_commandNr,r#rr$Fr%)r$r%setuprz*install gateway service (managed by NixOS)rrrz8Gateway service installation is not supported on Termux.zRun manually: hermes gatewayrFu?WSL detected — systemd services may not survive WSL restarts.z< Consider running in foreground instead: hermes gateway runzM Or use tmux/screen for persistence: tmux new -s hermes 'hermes gateway run'r)z(WSL detected but systemd is not running.zIEither enable systemd (add systemd=true to /etc/wsl.conf and restart WSL)z&or run the gateway in foreground mode:zE hermes gateway run # direct foregroundzG tmux new -s hermes 'hermes gateway run' # persistent via tmuxzL nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # backgroundz=Service installation is not needed inside a Docker container.uVThe container runtime is your service manager — use Docker restart policies instead:zJ docker run --restart unless-stopped ... # auto-restart on crash/rebootz< docker restart # manual restartz&To run the gateway: hermes gateway runz4Service installation not supported on this platform.z Run manually: hermes gateway runrz,uninstall gateway service (managed by NixOS)zcGateway service uninstall is not supported on Termux because there is no managed service to remove.z*Stop manual runs with: hermes gateway stoprz>Service uninstall is not applicable inside a Docker container.z2To stop the gateway, stop or remove the container:z docker stop z docker rm zNot supported on this platform.rrT)r_u ✓ Killed z. stale gateway process(es) across all profilesr rrz\Gateway service start is not supported on Termux because there is no system service manager.z*WSL detected but systemd is not available.z+Run the gateway in foreground mode instead:z^To enable systemd: add systemd=true to /etc/wsl.conf and run 'wsl --shutdown' from PowerShell.z:Service start is not applicable inside a Docker container.z1The gateway runs as the container's main process.z: docker start # start a stopped containerz< docker restart # restart a running containerz/Or run the gateway directly: hermes gateway runru ✓ Stopped z( gateway process(es) across all profilesu✗ No gateway processes foundu$✓ Stopped gateway for this profileu'✗ No gateway running for this profilez servicerzStarting gateway...)r#uB⚠ Cannot restart gateway as a service — linger is not enabled.zK The gateway user service requires linger to function on headless servers.z$ Run: sudo loginctl enable-linger rz hermes gateway restartu#✗ Gateway service restart failed.zL The service definition exists, but the service manager did not recover it.z3 Fix the service, then retry: hermes gateway startrru✓ Gateway is running (PID: z, rDz- (Running manually, not as a system service)rrz Termux note:z; Android may stop background jobs when Termux is suspendedz WSL note:zI The gateway is running in foreground/manual mode (recommended for WSL).z< Use tmux or screen for persistence across terminal closes.zTo install as a service:z hermes gateway installz& sudo hermes gateway install --systemu✗ Gateway is not runningz To start:z- hermes gateway run # Run in foregroundz^ nohup hermes gateway run > ~/.hermes/logs/gateway.log 2>&1 & # Best-effort background startz3 hermes gateway install # Install as user servicezM sudo hermes gateway install --system # Install as boot-time system service),getattrr0rPr r rrrrr*rrrr*r7rrrrrrrr rrrr+r rOrrrrrr?rr rr"rrmaprJr)rsubcmdr#r$r%rrr start_allrstop_allservice_availabletotal restart_allservice_configuredservice_stopped linger_ok_detailr _usernamerr;rr>s rCrRrR s T,d 3 3F~5$ 1--gu--$ 511G5'::::  <<  F G G G Fgu--x//dM488 ;;  L M M M 0 1 1 1 HQKKK $ & & xx _```YZZZjkkk %K P P P P P P ZZ  E " " " " " XX  < = = = ] ^ ^ ^ : ; ; ; GGG Y Z Z Z [ \ \ \ ` a a a HQKKKKK ^^  Q R R R j k k k GGG ^ _ _ _ P Q Q Q GGG : ; ; ; HQKKKKK H I I I 4 5 5 5 HQKKKKK ;   <<  H I I I Fx// ;;  w x x x > ? ? ? HQKKK $ & &  V , , , , , , ZZ        ^^  R S S S F G G G GGG - . . . + , , , HQKKKKK 3 4 4 4 HQKKKKK 7  x//D%//  F+>>>F FZFZZZ[[[&tEEEE ;;  p q q q 0 1 1 1 HQKKK $ & &   ( ( ( ( ( ( ZZ  OOOOO XX  > ? ? ? ? @ @ @ GGG Y Z Z Z [ \ \ \ ` a a a GGG r s s s HQKKKKK ^^  N O O O E F F F GGG N O O O P Q Q Q GGG C D D D HQKKKKK 3 4 4 4 HQKKKKK 6  4..x// , C % (** 0EU0S0S0S0Z0Z0\0\ `u~BaCaCaCaJaJaLaL  ////(,%%!4D  6 8 8 ? ? A A  NNN(,%%!4D+>>>F#4;aa!>>F?9aa:E VTUTTTUUU "4S A A A A ' ( ( ((** '0EU0S0S0S0Z0Z0\0\ '`u~BaCaCaCaJaJaLaL 'V,,,,, ' 6 8 8 ? ? A A 'A&&&& F $ & & ,A,O,O,O,V,V,X,X \qy}\~\~\~]F]F]H]H !%  v....$(!!0     ZZ 244;;== !%  !!!$(!!0    ! #(** %>%@%@" 7D(("NNN ' 1 1IGGG^___ghhhGGGLLLMMMGGG78886777F! ;<<<deeeKLLL $%% ><=== "4S A A A A ' ( ( (  " " " " " "A # #D 8  tVU++x// % & &. k,A,O,O,O,V,V,X,X. k\qy}\~\~\~]F]F]H]H. k 4 / / / / / / ZZ, k244;;==, k 4 %&&D' kRdiiC6O6ORRRSSSEFFF 5 7 7  +GGG2333 -++k4kk****;; D.)))WXXXXXXXD+&&&efffXYYYYY45554555BCCCCC2333 5 7 7  +GGG2333 -++k4kk****k"""EFFF;;kz{{{{{XXkcdddhiiiiiOPPPijjjjjg  s[**[<;[<.\??]]*_==``aa$#a$?ee$#e$f''f98f9l$$l65l6*m;;n  n r()FNFrs)F)rN)FN)FFN)FF)r r)rFF)__doc__r.rPrrXr+rpathlibr__file__ryr|rVrrgateway.restartrrrhermes_cli.configrr r r r r hermes_cli.setuprrrrrrrrhermes_cli.colorsrrr)rDr2rMr~rSr]r&rrrrrrrrrr*r7rrr}rJrr}rrrrrCompletedProcessrrrrrrtuplerrr"r&r,r?rGrIrOrXr_rerkrprrrrrrrrfloatr{r*rrrrrr8rrrrrrr rrrr"r0rrrrrrrrrrrrr r)r@rPrRrbrTrCrks   tH~~$+3355 (((((( ,+++++++<3<<<<~22t22222 C D     s t    eeC$JeTeVZeeeePLP05$cDj)-:=:"d""""J,$,,,,=<<<<<<<<<$$4$$$$$$#D####! M>>>>>6cDjC8 '# ' ' ' 'LL$L4LLLLMMMM,@@4@DI@@@@ BBDBT#YBBBB7<   c t *Je    ***#**** d3i    3t3333 = = = =ST 22#*2c3PSm@T2222.DS4ZcDj 5C$J 5 5 5 5DU3:tCS=T>0;5c)9#:0;0;0;0;f 5 5 5 52D2222OOOOO$+B      Q$Qd3iQDIQQQQsSS4########4aa$aS4ZaSVaaaaFJJJJJJ##&__D_T____  4 D       3  d  d     )D)D)D)DXll$l4llll ,E , , , ,)+)+4)+)+CRVJ)+)+)+)+XRRdRRRR"NN$NNNNNNNNNNCPCPDCPCPCPCPNDsDsDstDsDsDsDsVL3LLLL      VVVVVps$ssss(??4????6 % % %!!!2!!!"''E'ut|'VZ''''T'''@$G$G$G$G$G$GVL)   *[dF H H-9]kp!< > >-9Q_dg i i  ,(    )KT9 ; ;,8iw|!< > >,8P^c[ ] ]  %:&   "'2HVZ= ? ?&2HVZC E E*6Zhm!> @ @  +@*    )4ftyW Y Y*6pCd f f%1hv{K M M+7m|A!E G G(4IW\c e e  <'    &1[inW Y Y';D= ? ?/;_mr!A C C/;SafW Y Y,9O]b] _ _  <' & $   %UR T T%1SaeR T T&+5Y [ [&+5V X X*6_mr!J L L  6)   *5IW\= ? ?(4GUYO Q Q*6m|A@ B B(4ky~!P R R(3yHMU W W  8)   *5IW\M O O-9TbfP R R & $   %eD F F(LdH J J$0]kpW Y Y-9xGLZ \ \+7esx!R T T+6guzG I I <,#   $xU9 ; ;#xT9 ; ;*6drw!L N N*5ftyG I I  2 2-   .PU5 7 71]X\B D D.*RWC E E+7GUYH J J6BTbfQ S S*6\jo9 ; ;3?m|A!L N N @"( )-    .9q@EE G G+7TbfJ L L0=\jo!v x x0 >'3xGL!P R R'2pDK M M  i k \ 2t22222j tCy    F_2t_2_2_2_2D'''--- +++ 000 --- t'(T'('('('(T|,|,|,~i)i)i)XohohohdW W W |zkzkzkzkzkrT