yj]UdZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z ddl m Z mZmZddlmZmZmZmZddlmZejdZgdZgd Zd d gZgd Zeeed <e hdZ!e eed<e hdZ"e eed<dZ#de de$fdZ%de fdZ&e hdZ'e hdZ(e hdZ)e hdZ*de fdZ+de fdZ,de fdZ-de fdZ.d edefd!Z/d eddfd"Z0d eddfd#Z1d ede fd$Z2d ede$fd%Z3d edeefd&Z4de$fd'Z5dpd ed(eedee fd)Z6d ede$fd*Z7de ddfd+Z8d,edeefd-Z9d.Z:de;eeffd/Zfd2Z?de de>fd3Z@de de$fd4ZAiZBe;ee>eCeCeDffed5<d6ZEd7e deCfd8ZFde deDfd9ZGde de fd:ZHde de;fd;ZIddd<de d=eed>ee$ddfd?ZJdee=fd@ZKdAe$deeee ffdBZL dqd edDeedEe$dFe$dGe$dHe$d=eede fdIZMdrde dJe$dee;fdKZNdrdJe$deefdLZOdMede deeDfdNZPdMede ddfdOZQde ddfdPZRdrd edQe$de fdRZSd,eddfdSZTd,eddfdTZUd ede ddfdUZVde ddfdVZWdefdWZXd eddfdXZYdefdYZZdZe fd[Z[d\edZed]edefd^Z\dpd ed_ed`eeeefde fdaZ]dbedeefdcZ^dde dee ddfdfZ_dde de`efdgZadpdhed eede fdiZbdjedkedle ddfdmZcdjedkede fdnZdd,edefdoZedS)su_ Profile management for multiple isolated Hermes instances. Each profile is a fully independent HERMES_HOME directory with its own config.yaml, .env, memory, sessions, skills, gateway, cron, and logs. Profiles live under ``~/.hermes/profiles//`` by default. The "default" profile is ``~/.hermes`` itself — backward compatible, zero migration needed. Usage:: hermes profile create coder # fresh profile + bundled skills hermes profile create coder --clone # also copy config, .env, SOUL.md, skills hermes profile create coder --clone-all # full copy of source profile coder chat # use via wrapper alias hermes -p coder chat # or via flag hermes profile use coder # set as sticky default hermes profile delete coder # remove profile + alias + service N) dataclass)Path PurePosixPathPureWindowsPath)DictListOptionalTuple)is_excluded_skill_pathz^[a-z0-9][a-z0-9_-]{0,63}$) memoriessessionsskillsskinslogsplans workspacecronhome) config.yaml.envSOUL.mdzmemories/MEMORY.mdzmemories/USER.md) gateway.pidgateway_state.jsonprocesses.json_CLONE_ALL_STRIP>binprofiles node_modules .worktrees hermes-agent_CLONE_ALL_DEFAULT_EXCLUDE_ROOT>state-snapshotsbackupsr checkpointsstate.db state.db-shm state.db-wal_CLONE_ALL_HISTORY_EXCLUDE_ROOTz.no-bundled-skills profile_dirreturnc^ |tz S#t$rYdSwxYw)z>Return True if the profile opted out of bundled-skill seeding.F)NO_BUNDLED_SKILLS_MARKERexistsOSErrorr)s 9/home/ragecks/.hermes/hermes-agent/hermes_cli/profiles.pyhas_bundled_skills_opt_outr1sA66>>@@@ uus  ,, source_dirc|tkdtdttdttffd }|S)uWExclude infrastructure artifacts when cloning a profile via --clone-all. Three categories: 1. Root-level entries in ``_CLONE_ALL_HISTORY_EXCLUDE_ROOT`` — session history, backups, and snapshots that belong to the SOURCE profile and should never carry into a fresh clone. Applies to any source. 2. Root-level entries in ``_CLONE_ALL_DEFAULT_EXCLUDE_ROOT`` — known Hermes infrastructure directories that only the default profile (``~/.hermes``) ever contains. Gated on ``source_dir`` actually being the default profile so a named-profile source never has its own data silently dropped. 3. Universal exclusions at any depth — Python bytecode caches that are stale or regenerable (``__pycache__``, ``*.pyc``, ``*.pyo``) and runtime sockets / temp files (``*.sock``, ``*.tmp``). The export-side ignore (``_default_export_ignore``) uses the same two-tier pattern with the broader ``_DEFAULT_EXPORT_EXCLUDE_ROOT`` set because the export archive is a portable snapshot rather than a live clone. directorynamesr*czg}|D]}|dks|dr||3 t|k}n#tt f$rd}YnwxYw|r?|t vr||r|tvr|||S)N __pycache__)z.pycz.pyo.sock.tmpF)endswithappendrresolver. ValueErrorr(r!)r4r5ignoredentryat_rootis_default_sourcesource_resolveds r0_ignorez+_clone_all_copytree_ignore.._ignores * *E&&>>"CDD'u%%% y//1133FZ(       *;;;NN5)))$*2Q)Q)QNN5)))s%A  A65A6)r<_get_default_hermes_homestrr)r2rCrArBs @@r0_clone_all_copytree_ignorerFs|*!((**O'+C+E+E+M+M+O+OO3tCyT#Y6 N> auth.lock errors.log .update_check.hermes_historyhermes_state.dbresponse_store.dbresponse_store.db-shmresponse_store.db-walrrr sandboxes audio_cacher$ image_cacheractive_profiledocument_cachebrowser_screenshotsrr% auth.jsonrrr r&r'rr>USER.md AGENTS.md CLAUDE.md MEMORY.md todo.json .cursorrules desktop.jsonsystem_prompt.mdrrpluginsscriptsr r knowledge preferencesrr>tmprootsudotesthermesdefault>acpmcpchatrdumploginmodelsetuptoolsconfigdoctorhonchologoutrstatusupdategatewaypairingr_profileversioninsightsr whatsapp uninstallc$tdz S)aReturn the directory where named profiles are stored. Anchored to the hermes root, NOT to the current HERMES_HOME (which may itself be a profile). This ensures ``coder profile list`` can see all profiles. In Docker/custom deployments where HERMES_HOME points outside ``~/.hermes``, profiles live under ``HERMES_HOME/profiles/`` so they persist on the mounted volume. rrDrGr0_get_profiles_rootr s $ % % 22rGc"ddlm}|S)zReturn the default (pre-profile) HERMES_HOME path. In standard deployments this is ``~/.hermes``. In Docker/custom deployments where HERMES_HOME is outside ``~/.hermes`` (e.g. ``/opt/data``), returns HERMES_HOME directly. rget_default_hermes_root)hermes_constantsrrs r0rDrDs%988888 " " $ $$rGc$tdz S)z2Return the path to the sticky active_profile file.rSrrrGr0_get_active_profile_pathr$s # % %(8 88rGc4tjdz dz S)z)Return the directory for wrapper scripts.z.localr)rrrrGr0_get_wrapper_dirr)s 9;; !E ))rGnamect|tst|}|}|std|dkrdS|S)uReturn the canonical profile id used on disk and in CLI ``-p`` argv. Named profiles are stored lowercase under ``profiles//``. The special alias ``default`` is matched case-insensitively (``Default`` → ``default``). Dashboards and tools may pass title-cased display labels; normalize before validation, assignment, and subprocess spawn (see issue #18498). zprofile name cannot be emptyrh) isinstancerEstripr=casefoldlower)rstrippeds r0normalize_profile_namer2sq dC 4yyzz||H 97888i''y >>  rGc|dkrdSt|std|d|tvrtd|ddS)uRaise ``ValueError`` if *name* is not a valid profile identifier. Validates the input as-given — strict lowercase match. Callers that accept mixed-case or title-cased input from users (dashboard UI, CLI args) should call :func:`normalize_profile_name` first. This separation keeps validate honest about what the on-disk directory name must look like, while ingress-point normalization handles UX flexibility (see #18498). Also rejects names in :data:`_RESERVED_NAMES` (``hermes``, ``test``, ``tmp``, ``root``, ``sudo``) that would create confusing on-disk collisions (a ``hermes`` profile inside ``~/.hermes/``) or get refused at alias-creation time anyway. ``default`` is a special pass-through — it's a valid alias for the built-in root profile. rhNzInvalid profile name %. Must match [a-z0-9][a-z0-9_-]{0,63}z Profile name uz is reserved — it collides with either the Hermes installation itself or a common system binary. Pick a different name.)_PROFILE_ID_REmatchr=_RESERVED_NAMESrs r0validate_profile_namerDs y    % %  *D * * *     &D & & &   rGc`t|std|ddS)uRaise ``ValueError`` if *name* is not a safe wrapper-alias identifier. The alias is used verbatim as a filename under :func:`_get_wrapper_dir` (``~/.local/bin``), so it must be a single safe command name with no path separators or traversal segments — otherwise a value like ``../../.bashrc`` would escape the wrapper directory and clobber arbitrary user files. We reuse the profile id regex, which already forbids ``/``, ``.``, and ``..``. zInvalid alias name rN)rrr=rs r0validate_alias_namerbsL    % %  *$ * * *     rGcjt|}|dkrtSt|z S)z4Resolve a profile name to its HERMES_HOME directory.rh)rrDrrcanons r0get_profile_dirrrs7 "4 ( (E ')))   % ''rGcrt|}|dkrdSt|S)z)Check whether a profile directory exists.rhT)rris_dirrs r0profile_existsrzs9 "4 ( (E t 5 ! ! ( ( * **rGct|} t|n&#t$r}t|cYd}~Sd}~wwxYw|tvrd|dS|t vrd|dSt }tjdk} tj |rdnd|gddd d d }|j d kr|j d }||r|dn|z }|t|kr. |d }d|vrdSn#t $rYnwxYwd|d|dSn#t"tjf$rYnwxYwdS)zReturn a human-readable collision message, or None if the name is safe. Checks: alias-name validity, reserved names, hermes subcommands, existing binaries in PATH. N'z' is a reserved namez$' conflicts with a hermes subcommandwin32wherewhichTutf-8replace)capture_outputtextencodingerrorstimeoutr.batr hermes -pz&' conflicts with an existing command ())rrr=rEr_HERMES_SUBCOMMANDSrsysplatform subprocessrun returncodestdoutr splitlines read_text ExceptionFileNotFoundErrorTimeoutExpired) rrexc wrapper_dir is_windowsresult existing_pathexpectedcontents r0check_alias_collisionrs #4 ( (EE"""" 3xx .5.... ###>5>>>>#$$K(J " /WW 7dWYXY      ! !"M//11<<>>qAM" &MnnnnNHH --&00'0BBG"g--#t. DTuTTMTTT T " z8 9      4sN! A?AAA;D7DD7 D*'D7)D** D77EEctt}|tjddtjvS)z!Check if ~/.local/bin is in PATH.PATH)rErosenvirongetsplitpathsep)rs r0_is_wrapper_dir_in_pathrsA&(())K "*..44::2:FF FFrGtargetcrt|}|rt|n|}t|t} |ddn-#t$r }t d|d|Yd}~dSd}~wwxYwt jdk}|rS||dz } |d|d d |S#t$r }t d |d|Yd}~dSd}~wwxYw||z } tj d pd }|dtj |d|dd | |jtjztjztjz|S#t$r }t d |d|Yd}~dSd}~wwxYw)uCreate a shell wrapper script at ~/.local/bin/. The wrapper file is named after ``name`` (the alias). The profile it activates is ``target`` if given, otherwise ``name`` — this lets a custom alias name point at a differently-named profile without a post-hoc rewrite. On Windows, creates a ``.bat`` file instead of a POSIX shell script. Returns the path to the created wrapper, or None if creation failed. Tparentsexist_oku⚠ Could not create : Nrrz@echo off hermes -p z %* rru ⚠ Could not create wrapper at rgz#!/bin/sh exec z -p z "$@" )rrrmkdirr.printrr write_textshutilrshlexquotechmodstatst_modeS_IEXECS_IXGRPS_IXOTH) rrrryrer wrapper_path hermes_exes r0create_wrapper_scriptrs; #4 ( (E06A$V,,,EG"$$K$6666  8k88Q88999ttttt(J"^^^3    # #$Ng$N$N$NY` # a a a     H\HHQHH I I I44444 #U*  h//;8J  # #$du{:7N7N$d$dT[$d$d$dov # w w w   |0022:T\IDLX[_[gg h h h     H\HHQHH I I I44444 sIA B#A>>B!B>> C(C##C(1BF F6F11F6ct}t|} t|n#t$rYdSwxYwtjdk}||z g}|r|d||dz |D]Y}|rC |d}d|vr| dSI#t$rYUwxYwZdS) zARemove the wrapper script for a profile. Returns True if removed.FrrrrrrT) rrrr=rrinsertr-runlinkr)rrrr candidatesrrs r0remove_wrapper_scriptrs+"$$K "4 ( (EE"""" uu(J%&J;![e>>>9:::"        &00'0BB')) '')))44*      5s/ == .B?? C  C c(|dz }|sdS ddlm}m}ddlm}m}|t|} |\}}||kr |dd||dS#||wxYw#t$rYdSwxYw) uBring a copied profile config.yaml up to the current schema. Profile creation can clone a config file that predates schema tracking (no ``_config_version``) or that is simply older than the running Hermes. If we leave it untouched, the first desktop/doctor view of the new profile shows a scary ``v0 → latest`` warning even though we just created the profile. Scope the normal migration pipeline to the new profile and keep it non-interactive. rNr)reset_hermes_home_overrideset_hermes_home_override)check_config_versionmigrate_configFT) interactivequiet) r-rrrhermes_cli.configrrrEr) r) config_pathrrrrtoken current_ver latest_vers r0#_migrate_profile_config_if_outdatedrs -K      YYYYYYYYJJJJJJJJ(([)9)9:: .&:&:&<&< #KZ''5==== & &u - - - - - & &u - - - -       s)(B A3& B3 BB BB profile_namec^tt|S)uReturn the alias name of the wrapper that activates *profile_name*, or None. A wrapper created by :func:`create_wrapper_script` is a file named after the alias whose body invokes ``hermes -p ``. When the alias name equals the profile name this is trivial, but a custom alias (``hermes profile alias --name ``) produces a differently-named file — so the display side cannot assume ``wrapper == profile`` and must reverse-look-up. A custom alias (name != profile) is preferred over the profile-named wrapper so ``profile list``/``show`` surface the command the user actually typed. Results are sorted for deterministic output when several aliases match. For listing ALL profiles at once, prefer :func:`build_alias_map` — calling this per-profile re-reads every wrapper file N times (O(N*M)); on a wrapper dir like ``~/.local/bin`` that also holds large unrelated binaries (ffmpeg etc.) that meant multi-second ``list_profiles`` latency and desktop timeouts. )build_alias_maprr)rs r0find_alias_for_profilers'$    !7 !E!E F FFrGi cXt}i}|s|Stjdk}d}t |D]N}|s|r |jdkr&|s|jr0 t|ddd5}| t}dddn #1swxYwYn#ttf$rYwxYw| |}|d kr||t|zd}|r.|dd d nd } | s t#| } |r|jn|j} | | kr|| | I| || <P|S) aSingle-pass reverse map ``{canonical_profile -> alias_name}``. Scans the wrapper dir ONCE (vs. :func:`find_alias_for_profile` per profile) and reads only a small head slice of each candidate wrapper, skipping binaries. A custom alias (file name != profile) wins over the profile-named wrapper, matching ``find_alias_for_profile``'s preference; deterministic via sorted iteration. rz hermes -p rrrstrict)rrNrr)rrrrsortediterdiris_filesuffixopenread_WRAPPER_READ_LIMITr.UnicodeDecodeErrorfindlenrrrstemr setdefault) rrrprefixr?fridxrestraliass r0rr<s#$$KF      (J F ++--..""}}    %,&00  el   eS78DDD 6&&!455 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6+,    H ll6"" "99 sS[[())*26**,,F 4##A&,,...B  &u--(8 ej E>>   eU + + + +!F5MM Ms6 CC9 CC C C CC%$C%c*eZdZUdZeed<eed<eed<eed<dZe eed<dZ e eed<d Z eed <d Z e ed <dZe eed <dZe eed<dZe eed<dZe eed<dZe eed<dZeed<d Zeed<dS) ProfileInfoz$Summary information about a profile.rpath is_defaultgateway_runningNrnproviderFhas_envr skill_count alias_path alias_namedistribution_namedistribution_versiondistribution_sourcer descriptiondescription_auto)__name__ __module__ __qualname____doc__rE__annotations__rboolrnr rrrintrrrrrrr rrGr0rrqs.. III JJJE8C="Hhsm"""GTK!%J%%%!%J $$$'+x}+++*.(3-...)-#--- K #d"""""rGrc|dz }|sdS ddl}t|dd5}||pi}dddn #1swxYwYt |t sdS|d|d |d fS#t$rYdSwxYw) uReturn ``(name, version, source)`` from the profile's ``distribution.yaml`` if present; ``(None, None, None)`` otherwise. Failures (missing file, bad YAML) are swallowed — a bad manifest should never break ``hermes profile list`` for an unrelated profile. zdistribution.yaml)NNNrNrrrrrzsource)ryamlr safe_loadrdictrr)r)mf_pathr*rdatas r0_read_distribution_metar/s'//G ??      '3 1 1 1 +Q>>!$$*D + + + + + + + + + + + + + + +$%% $## HHV   HHY   HHX        s:B7A B7AB7AB79=B77 CCc|dz }|sdS ddlm}||}|di}t |t r|dfSt |t r?|dp|d|dfSdS#t$rYdSwxYw) zLRead model/provider from a profile's config.yaml. Returns (model, provider).r)NNr)read_user_config_rawrnNrhr)r-rr1rrrEr,r)r)rr1cfg model_cfgs r0_read_config_modelr4s -K     z  ;:::::"";//GGGR(( i % % #d? " i & & a==++Ey}}W/E/Ey}}U_G`G`` `z zzs?B3AB33 CCc ddlm}||dz d dSn#t$rYnwxYw ddlm}m}||d z }||| duS#t$rYdSwxYw) uCheck if a gateway is running for a given profile directory. Primary signal is the profile's ``gateway.pid`` (verified against the runtime lock). That check fails closed whenever the lock isn't held by *this* reader — which is exactly the case for a dashboard process that is a separate s6 service from the gateway it's reporting on (Docker), or any launch-service-managed gateway that left a fresh ``gateway_state.json`` but no live PID file. In those cases fall back to validating the PID recorded in the profile's own ``gateway_state.json`` against the live process table, mirroring the ``/api/status`` sidebar's liveness logic so the two surfaces agree. Parameterized by ``profile_dir`` so it never mutates ``HERMES_HOME``. r)get_running_pidrF) cleanup_staleNT)get_runtime_status_running_pidread_runtime_statusr) expected_home)gateway.statusr6rr8r9)r)r6r8r9runtimes r0_check_gateway_runningr=s 222222 OK-7u M M M 4               &%k4H&HII--g[QQQY]]] uus ))$A A A _SKILL_COUNT_CACHEg>@ skills_dircz |j}n#t$rYdSwxYw tj|5}|D]L} |dr#|dj}||kr|}=#t$rYIwxYw dddn #1swxYwYn#t$rYnwxYw|S)a\Cheap change-signature for a skills tree. Max mtime of ``skills_dir`` and its immediate children (category dirs). Adding/removing a category bumps ``skills_dir``'s mtime; adding/removing a skill inside a category bumps that category dir's mtime. One ``scandir`` (not a recursive walk) keeps this O(#categories), not O(#files). gF)follow_symlinksN)rst_mtimer.rscandirr)r?sigitr?ms r0_skills_dir_signaturerGs@oo( ss  Z # # r  ||E|::$!JJuJ==Fs77"#CH                       Jse **B+B9BB B BBB B+B##B+&B#'B++ B87B8c|dz }|sdSt|}t|}tj}t|}|(|d|kr||dz t kr|dSd}|dD]}t|r|dz }|||ft|<|S)zECount installed skills in a profile (cached by skills-dir signature).rrNrzSKILL.md) rrErGtimer>r_SKILL_COUNT_TTL_SECONDSrglobr )r)r?key signaturenowcachedcountmds r0 _count_skillsrSsx'J     q j//C%j11I )++C  # #C ( (F 1I " " 6!9_ 8 8 8ay Ez** !" % %    (#u5s LrGc |dz S)Nz profile.yamlrr/s r0_profile_yaml_pathrU/s  ''rGct|}|sdddS ddl}t|dd5}||pi}dddn #1swxYwYn#t $rdddcYSwxYwt |tsdddSt| d pd t| d ddS) uRead ``/profile.yaml`` and return a dict. Returns ``{"description": "", "description_auto": False}`` when the file is missing or unreadable. Never raises — a corrupt profile.yaml on an unrelated profile must not break ``hermes profile list``. rFrr rNrrrrr ) rUrr*rr+rrr,rErrr&)r)rr*rr.s r0read_profile_metarX3s[ k * *D <<>>>!u===> $g . . . +!>>!$$*D + + + + + + + + + + + + + + + >>>!u=====> dD ! !>!u===488M228b99??AA */profile.yaml`` in place. Only the explicitly passed fields are overwritten; unspecified fields preserve existing values. Creates the file if missing. Profile directory itself must exist. z"profile directory does not exist: rNrrrrr )atomic_yaml_writeF) sort_keys)rrr*rUrrr+rr,rrr&utilsrZ) r)rr r*rexistingrloadedrZs r0write_profile_metar_Ls     T R[ R RSSSKKK k * *DH ||~~ dC'222 1a**0b 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1&$'' "!   HHH "-"3"3"5"5#'+,<'='=#$('''''dH666666s6B*#B; B*B  B*B B** B98B9c6g}t}t}|rt|\}}t |\}}}t |}|td|dt||||dz t||||| dd| dd t} | rt} t| D]X} | s| j} | dkr&t"| sAt| \}}| t'| } | rt(jd k}||r| d n| z }nd }t | \}}}t | }|t| | dt| ||| dz t| |r| r|nd | |||| dd| dd Z|S) z4Return info for all profiles, including the default.rhTrrrr F) rrrrrnrrrrrrrr rrN)rrrrrnrrrrrrrrrr )rrDrr4r/rXr;rr=r-rSrrrrrrrrrrr)rr default_homernr dist_name dist_version dist_sourcemeta profiles_root alias_mapr?rrrrs r0 list_profilesrhusH"$$K,--L ,\::x/F|/T/T, < .. 2<@@!F*2244%l33'!- +33!XX&8%@@      "'((M&$%% M113344! ! E<<>> :Dy  !''-- 077OE8"'=d'C'CDDJ " \W4 (:,]z,?,?,?,?S]^ ! 3J53Q3Q 0I|[$U++D OOK 6u = =!//11)%00*4W9J9J9L9LW::SW%"+%1$/ HH]B77!%*> :Dy  !''--  LL$ ' ' ' ' LrGF clone_from clone_all clone_configno_alias no_skillsc|r||s|rtdt|}t||dkrtdt|}|rt d|d|d} ||s|rk|ddlm} | } n-t|}t|t|} | std |pd d | |rL| rJtj | |d t|  tD]} || z d nB|d d t D]} || z d d | t"D]o} | | z }|rT|| z }tj||| dkr4 t'jt+|d_#t,$rYkwxYwp| dz }|rtj ||dz d d t.D]Q}| |z }|r6||z }|jd d tj||R|dz }|sK |ddt'jt+|dn#t,$rYnwxYw|dz }|s/ ddlm}||dn#t8$rYnwxYw|r1 |t:z ddn#t,$rYnwxYw|st=||rJ|r6 tA||dn#t8$rYnwxYwtC||S)aCreate a new profile directory. Parameters ---------- name: Profile identifier (lowercase, alphanumeric, hyphens, underscores). clone_from: Source profile to clone from. If ``None`` and clone_config/clone_all is True, defaults to the currently active profile. clone_all: If True, do a full copytree of the source (all state). clone_config: If True, copy config files (config.yaml, .env, SOUL.md), installed skills, and selected profile identity files from the source profile. no_alias: If True, skip wrapper script creation. no_skills: If True, create an empty profile with no bundled skills, and write a marker file so ``hermes update`` skips re-seeding this profile's skills. Mutually exclusive with ``clone_config``/``clone_all`` (those explicitly copy skills from the source). Returns ------- Path The newly created profile directory. Nz--no-skills is mutually exclusive with --clone / --clone-from / --clone-all (cloning explicitly copies skills from the source profile).rhuSCannot create a profile named 'default' — it is the built-in profile (~/.hermes). Profile '' already exists at rget_hermes_homezSource profile 'rlz' does not exist at Tsymlinksignore missing_okrrr)rz dirs_exist_ok# Per-profile secrets for this Hermes profile. # API keys and tokens set here override the shell environment. # Behavioral settings belong in config.yaml, not here. rrr)DEFAULT_SOUL_MDzThis profile opted out of bundled-skill seeding (`hermes profile create --no-skills`). Delete this file to re-enable sync on the next `hermes update`. FrW)"r=rrrr-FileExistsErrorrrxrrrcopytreerFrrr _PROFILE_DIRS_CLONE_CONFIG_FILEScopy2rrrEr._CLONE_SUBDIR_FILESparentrhermes_cli.default_soulrrr,rrr__maybe_register_gateway_service)rrorprqrrrsrrr)r2rxstalesubdirfilenamesrcdst source_skillsrelpathenv_path soul_pathrs r0create_profilersZH j, , , J    #4 ( (E%     a   "%((KTR%RR[RRSSSJl   8 8 8 8 8 8(**JJ/ ;;J !* - - -(44J  "" #[:#9[[z[[ 0+Z0+  -j99     & : :E 5 ( (D ( 9 9 9 9 : $666# F FF 6 ! ( ( ( E E E E  !/ ! ! 8+::<< !%0CLc***  6))!HSXXu5555&!!! D!'1M##%% j {X/EPTdhiiii/ + + 7*::<<+%/CJ$$TD$AAALc***V#H ??       K!     HS]]E * * * *    D  i'I       ? ? ? ? ? ?  7 C C C C    D     3 3 ? ?T! @         D  9+K888 {((**  '--//!&          D $E*** sZ"G(( G54G5 9K K'&K'L"" L/.L/5M M"!M" $N22 N?>N?rc :t|rgggddSttjj} t jtjddgitj dt|it|ddddd }|j d krD|j r+tj|j S|sat#d |j |jr1t#d |jd dd S#t j$r|st#dYd St($r}|st#d|Yd }~d Sd }~wwxYw)uSeed bundled skills into a profile via subprocess. Uses subprocess because sync_skills() caches HERMES_HOME at module level. Returns the sync result dict, or None on failure. Profiles that opted out of bundled skills (via ``hermes profile create --no-skills`` — which writes ``.no-bundled-skills`` to the profile root) are skipped and get an empty-result dict so callers can report "opted out" instead of "failed". T)copiedupdated user_modifiedskipped_opt_outz-cziimport json; from tools.skills_sync import sync_skills; r = sync_skills(quiet=True); print(json.dumps(r)) HERMES_HOMErr<)envcwdrrrrrru%⚠ Skill seeding returned exit code z Nu!⚠ Skill seeding timed out (60s)u⚠ Skill seeding failed: )r1r__file__rr<rrr executablerrrErrrjsonloadsrstderrrr)r)r project_rootrrs r0seed_profile_skillsrs"+.. #    >>(/7799L ^TA B@2:?}c+.>.>??L!!dWYXZ       ! !fm&9&9&;&; !:fm113344 4 : M&:KMM N N N}""$$ :86=..00#688999t  $ 7 5 6 6 6tt  4 2q22 3 3 3ttttts&B!E*A#E F2 F;FFcg}t}|s|Stdz }t|D]}|rt |js7|jdkrC|dz }|r] | rtj ||n| ddtjt|d||j#t"$r'}|st%d|jd|Yd }~d }~wwxYw|S) uGive every named profile that predates per-profile ``.env`` files one. Profiles created before the dashboard/CLI started seeding a ``.env`` (PR #44792) have none, so once the Channels/Keys endpoints became profile-scoped those profiles stopped inheriting the root install's credentials and showed everything as unconfigured. To avoid breaking anyone on update, copy the DEFAULT install's ``.env`` into each named profile that lacks one — that preserves the effective credentials those profiles were already running with (they previously read the root ``.env`` via the process environment). Users can then diverge per profile from there. Falls back to the placeholder header when the default install has no ``.env`` itself. Never overwrites an existing profile ``.env``. Returns the list of profile names that received a backfilled ``.env``. rrhrrrr~u%⚠ Could not seed .env for profile 'z': N)rrrDrrrrrr-rrrrrrrEr;r.r)r backfilledrf default_envr?rrs r0backfill_profile_envsrs$J&((M    ! !*,,v5K --//00RR||~~ ^%9%9%*%E%E   : " " 6> ??     R""$$  [(3333##O% $ HS]]E * * *   ej ) ) ) ) R R R RPejPPQPPQQQ R s7A=D55 E&?E!!E&rc ddl}n#t$rgcYSwxYw |}n#t$r|}YnwxYwt jh} |t j}|0||j |}|0n#t$rYnwxYw |t j }n#t$rd}YnwxYwhd}d}g} | gdD]4} | j } | d} | | |vr'|| d|krC| dpg} | s]d | tj| d}t%fd |Dp|d kp|d }|sd | D}||zsd }t)| D]\}}|dvr7|dzt+| kr!t-| |dz|krd}nH@|dr1t-|ddd|krd}n|se | pi dd}|r't3||krd}n#t$rYnwxYw|r| |  #|j|j|jf$rY&t$rY2wxYw| S)uPIDs of running Hermes *backends* bound to this profile. The ``gateway.pid`` file only tracks the messaging gateway. A Desktop app spawns a headless ``serve`` (or legacy ``dashboard --no-open``) backend per profile that holds the profile's SQLite connection open and keeps writing sessions/WAL/sandbox files — the writer that makes ``rmtree`` hit ``ENOTEMPTY`` (and, pre-fix, resurrected the tree). ``gateway.pid`` never names it, so find it by inspection: a Hermes backend subcommand (``serve``/``dashboard``/``gateway``) that is bound to *this* profile either by a ``--profile `` / ``-p `` selector or by a ``HERMES_HOME`` that resolves to ``profile_dir``. Best-effort and tightly scoped: current-user processes only, backend subcommands only (never an interactive ``chat``/``tui``), and never this process or its ancestors. Returns an empty list if ``psutil`` can't inspect anything. rN>rmrw dashboard)zhermes_cli.mainzhermes-gateway tui_gateway)pidrusernamecmdlinerrr c3 K|]}|vV dSNr).0markerjoineds r0 z._profile_bound_backend_pids..Js(BBFf$BBBBBBrGrgc6h|]}|Sr)r)rtoks r0 z._profile_bound_backend_pids..Ss 222cciikk222rGF>-p --profilerTz --profile==rr)psutilrr<r.rgetpidProcessraddrr process_iterinforjoinrbasenamerany startswith enumerater rrrrr; NoSuchProcess AccessDenied ZombieProcess)rr)r resolved_dirskipr current_userbackend_tokenshermes_markerspidsprocrrargvexe_name is_hermestokensboundirenv_homers @r0_profile_bound_backend_pidsrs:$  #"**,, ###" # ikk]D  ,,3355 HHVZ ]]__F       ~~bikk22;;==  766NIND##$J$J$JKK;;: 9D((5//C{cTkk'DHHZ,@,@L,P,P88I&&,"D XXd^^Fw''Q006688HBBBB>BBBBB1x'1&&x00   32T222F^+ E#D//  3---!a%#d))2C2C-d1q5k::eCC $D^^L11-ciiQ.?.?.BCCuLL $  $  4"99-LLH%DNN$:$:$<$< $L$L $ D  ! C   $f&96;OP    H    H  Ks 0 ??A*C CC8D DD"M $M M BM M 1BM  AL M  L-*M ,L--M  M0# M0/M0cbt||}|sdS ddlmm}n#t$rYdSwxYw|D]+} ||#t t tf$rY(wxYwtjdz}tj|krGtfd|Dsn+tj dtj|kG|D]9}|r, ||d#t t tf$rY5wxYw:td t|d dS) aTerminate any Desktop-spawned / stray backends bound to this profile. Complements ``_stop_gateway_process`` (which only knows ``gateway.pid``): without this, a live ``serve``/``dashboard`` backend keeps creating files under the profile dir while ``rmtree`` walks it, so the final ``rmdir`` fails with ``ENOTEMPTY`` and the delete doesn't converge. Best-effort: any failure is reported and swallowed so it never makes delete worse. Nr) _pid_exists terminate_pidg$@c3.K|]}|VdSrr)rrrs r0rz)_stop_profile_backends..s-44;;s##444444rG?Tforceu ✓ Stopped z profile backend process(es)) rr;rrrProcessLookupErrorPermissionErrorr.rJrsleeprr )rr)r_terminate_pidrdeadliners @r0_stop_profile_backendsrxs 'uk : :D OOOOOOOOO   N3    "OW=    H y{{T!H )++ 4444t44444   3 )++  ;s    s$/////&A       @T @ @ @AAAAAs/ .. AAA# C11D  D cjd}d}t|D]} tj||n&#t$rtj||YnwxYwdS#t$rJ}|}|sYd}~dS||dz krt jd|dzzYd}~d}~wwxYw||dS)a``shutil.rmtree`` with a short retry loop for transient races. Even after stopping the gateway and profile backends, a just-terminated process can leave in-flight writes (SQLite ``-wal``/``-shm`` checkpoints, sandbox temp files) that land after ``rmtree`` has walked past a directory, surfacing as ``ENOTEMPTY`` (POSIX) or a transient ``PermissionError`` (Windows file lock still releasing). A few spaced retries let those settle instead of failing the whole delete on a race the next attempt would win. N)onexc)onerrorrg333333?)rangerrmtree TypeErrorr.r-rJr)r) onexc_handlerattemptslast_excattemptrs r0_rmtree_with_retryrsH#H?? 0 0 0 B k????? B B B k=AAAAAA B FF 0 0 0H%%'' A%% 3'A+.///  0 s8/A AAAA B,"B'?#B''B,yesct|}t||dkrtdt|}|st d|dt |\}}t|}t|}t|\}} } td|td||rtd||rd|d nd z|rtd ||r+td |d | pd| rtd| dg} t|z } | } | r| d| d td| D]}td||rtd|stt td|d}n(#t t"f$rtd|cYSwxYw||krtd|St%||t'||rt)|t+||| r!t-|rtd| d} d}t/||td|n.#t0$r!}td|d||}Yd}~nd}~wwxYw t3}||krt5dtdn#t0$rYnwxYw|t7d|d||td |d!|S)"zDelete a profile, its wrapper script, and its gateway service. Stops the gateway if running. Disables systemd/launchd service first to prevent auto-restart. Returns the path that was removed. rhzZCannot delete the default profile (~/.hermes). To remove everything, use: hermes uninstallru' does not exist.z Profile: z Path: z Model: z (rrz Skills: zDistribution: @?zInstalled from: z;All config, API keys, memories, sessions, skills, cron jobszCommand alias (z This will permanently delete:u • u0 ⚠ Gateway is running — it will be stopped.zType 'z' to confirm: z Cancelled.z Cancelled.u ✓ Removed Ncddl}t|tr|d}t|tr t j|t j|j|jzn#t$rYnwxYwtj |}|rF t j|t j|j|jzn#t$rYnwxYw||dS)aonexc/onerror handler: add +w on PermissionError so rmtree can proceed. Handles two cases on NixOS (and other systems with read-only copies from immutable stores): 1. The path itself isn't writable (e.g. a file with mode 0444) 2. The *parent* directory isn't writable (e.g. mode 0555) Compatible with both the ``onexc`` API (3.12+, receives an exception instance) and the ``onerror`` API (3.11-, receives ``sys.exc_info()`` tuple). rNr) rrtuplerrrrS_IWUSRr.rdirname)funcrr_statrs r0_make_writablez&delete_profile.._make_writables ! #u%% !f#// HT274==#85=#HIIIID..)@5=)PQQQQ"T s#4A-- A:9A:4C C! C!u⚠ Could not remove ru#✓ Active profile reset to defaultz#Could not remove profile directory z Profile 'z ' deleted.)rrr=rrrr4r=rSr/rrr-r;inputrKeyboardInterruptEOFError_cleanup_gateway_service!_maybe_unregister_gateway_service_stop_gateway_processrrrrget_active_profileset_active_profile RuntimeError)rrrr)rnr gw_runningrrbrcrditemsr has_wrapperitemconfirm remove_errorrrrls r0delete_profilers #4 ( (E%     :   "%((K     F DE D D DEEE)55OE8' 44J ,,K+B;+O+O(I|[       #k # #$$$ L !%!!%I%5(%5%5%5%5rJKKK) '+''(((4 @y@@<+>3@@AAA  4 2[22 3 3 3 F E $%%-L%%''K8 6|666777 +,,, otooB @AAA    :U:::;;AACCGG!8,    . ! ! !     e   ,    UK000&e,,,+k***5+...1  ' ' 1 /// 0 0 0&*L*# # # J ;777 *[**++++  8k88Q88999   #%% U?? y ) ) ) 7 8 8 8      ^^^P\^^__eqq ) ) ) )*** s<<%G"""HH%J-- K7KK2L LLcX ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||ddS#t$rYdSt$r}td|Yd}~dSd}~wwxYw) uRegister a profile's gateway with s6 inside the container. No-op on host (systemd/launchd/windows) — those backends raise ``NotImplementedError`` on ``register_profile_gateway`` and the existing per-profile unit-generation paths handle lifecycle. Best-effort: any error (no backend detected, s6 not yet ready, etc.) is logged and swallowed so profile creation doesn't fail because the s6 supervision tree is in a weird state. The user can re-register manually later via the gateway start command, which goes through the same dispatch path. Port selection: each supervised profile gateway loads its own ``HERMES_HOME`` and binds the port resolved by ``gateway/config.py`` from that profile's environment — ``API_SERVER_PORT`` (or ``platforms.api_server.extra.port`` in the profile's ``config.yaml``), defaulting to 8642. There is no ``[gateway] port`` key and no Python-side allocator (PR #30136 review item I5 retired the SHA-256-derived range [9200, 9800) as dead code), so two profiles that both leave the port at its default will both try to bind 8642 — give each profile a distinct ``API_SERVER_PORT`` in its ``.env``. Host short-circuit: check ``detect_service_manager()`` first and return immediately if it isn't ``"s6"``. This keeps host (systemd/launchd/windows) profile creation completely silent — no ``get_service_manager()`` call, no exception path, no chance of the ``⚠ Could not register s6 gateway service`` warning ever rendering on a non-container machine. The earlier ``supports_runtime_registration()`` check still catches the case where detection somehow returns ``"s6"`` but the backend isn't actually the S6 one. rdetect_service_managers6Nget_service_managerF) start_nowu+⚠ Could not register s6 gateway service: ) hermes_cli.service_managerrrrrsupports_runtime_registrationregister_profile_gatewayr=rrrrmgrrs r0rrVs9D EEEEEE ! ! # #t + + FBBBBBB!!##      , , . .C $$\U$CCCCC      CCC ACAABBBBBBBBBCs6)) A AAA66 B) B) B$$B)c< ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||dS#t$r}td|Yd}~dSd}~wwxYw)uTear down a profile's s6 gateway service inside the container. No-op on host. Idempotent: absent services are silently skipped by ``unregister_profile_gateway``. Same host short-circuit as :func:`_maybe_register_gateway_service` — see that docstring. rrrNru-⚠ Could not unregister s6 gateway service: )rrrrrrunregister_profile_gatewayrrs r0rrs EEEEEE ! ! # #t + + FBBBBBB!!##    , , . .E &&|44444 EEE CcCCDDDDDDDDDEs0)) A AAA44 B>BBc\ddl}tjd} t |tjd<ddlm}m}|dkr|}tj dz dz dz |d z }| r{tj d d d |gd ddtj d d d|gd dd|d tj gdd ddtd|dn|dkrk|}| rMtj ddt |gd dd|d tdn)#t $r} td| Yd} ~ nd} ~ wwxYw||tjd<dSdtjvrtjd=dSdS#||tjd<ndtjvr tjd=wxYw)z9Disable and remove systemd/launchd service for a profile.rNr)get_service_nameget_launchd_plist_pathLinuxz.configsystemduserz.service systemctl--userdisableTF )rcheckrstopr|)r#r$z daemon-reloadu ✓ Service z removedDarwin launchctlunloadu✓ Launchd service removedu⚠ Service cleanup: )rrrrrEhermes_cli.gatewayrrsystemrrr-rrrrr) rr) _platformold_homerrsvc_namesvc_file plist_pathrs r0rrs    z~~m,,H&*$' $4$4 =!OOOOOOOO      ( (''))Hy{{Y.:VCF[F[F[[H   9 (Ix@#'ub (FH=#'ub4000<<<#'ub7X777888     8 + +//11J  "" 5 (C OO<#'ub!!T!2223444 +++ )a))********+  (0BJ} % % % bj ( ( =)))) (  (0BJ} % % bj ( ( =) ) ) ) )s0E;F! G<! G+G=G<GG<>AAct|}t||dkr$t|std|d|t }|jdd|dkr|dd S|d}| |dzd | |d S) zlSet the sticky active profile. Writes to ``~/.hermes/active_profile``. Use ``"default"`` to clear. rhru8' does not exist. Create it with: hermes profile create Trr|r9 rrN) rrrrrrrr with_suffixrr)rrrrcs r0rrs #4 ( (E%    ."7"7 = = =5: = =   $ % %DKdT222  t $$$$$v&& ut|g666 DrGcddlm}|}|}t}||krdSt } ||}|j}t|dkr(t |dr|dSn#t$rYnwxYwdS)a%Infer the current profile name from HERMES_HOME. Returns ``"default"`` if HERMES_HOME is not set or points to ``~/.hermes``. Returns the profile name if HERMES_HOME points into ``~/.hermes/profiles/``. Returns ``"custom"`` if HERMES_HOME is set to an unrecognized path. rrwrhrcustom) rrxr<rDr relative_topartsr rrr=)rx hermes_homeresolveddefault_resolvedrfrelrBs r0rkrk0s100000!/##K""$$H/1199;;###y&((0022M ""=11  u::??~33E!H==?8O       8s.AC CCroot_dirc>dtdtdtffd }|S)uReturn an *ignore* callable for :func:`shutil.copytree`. Two-tier filtering: * **Root-level allow-list** — only entries whose name appears in ``_DEFAULT_EXPORT_INCLUDE_ROOT`` survive. Everything else (such as an unrelated ``x11-dev/`` directory in a Docker deployment where HERMES_HOME equals the cwd) is excluded. Blacklisting was tried first and proved unable to anticipate every non-Hermes file the user may have lying alongside HERMES_HOME (#58394). * **Universal exclusions at any depth** — ``__pycache__``, sockets, temp files; plus npm lockfiles, which may appear at the root. All other profile artifacts are copied through untouched. r4contentsr*c&t}|D]L}|dks|dr||3|dvr||Mt|kr|d|D|S)Nr7)r8r9> package.jsonpackage-lock.jsonc3,K|]}|tv |VdSr)_DEFAULT_EXPORT_INCLUDE_ROOT)rr?s r0rz:_default_export_ignore.._ignore..ls6ur?rGs r0rCz'_default_export_ignore.._ignore`suu # #E %%8I)J)J% E""""??? E"""  ??h & & NN#+   rG)rElistrO)rGrCs` r0_default_export_ignorerQOs="3$3" NrGbasebase_dircddl}|d}||d|j5}|t t ||z |dddn #1swxYwY|S)uCreate ``.tar.gz`` of ``root_dir/base_dir`` — GNU tar format. Not :func:`shutil.make_archive`: that writes PAX (Python's tarfile default since 3.8), whose fractional-mtime records macOS Archive Utility rejects — double-clicking an exported profile threw "Error 94 - Bad message." GNU format keeps long paths working (longlink extensions) and stays integer- mtime, so Finder, bsdtar, and gnutar all extract it. rN.tar.gzzw:gz)format)arcname)tarfiler GNU_FORMATrrEr)rRrGrSrX archive_pathtfs r0_make_profile_archiver\tsNNN###L lF73E F FA" s4>>H,--x@@@AAAAAAAAAAAAAAA s5A((A,/A, output_path extra_filesc  ddl}t|}t|t|}|st d|dt |}t|dd}dt ddffd }|d kr| 5} t | d z } tj || d t| || t|| d } t | cdddS#1swxYwY| 5} t | |z } d dh tj || d fd || t|| |} t | cdddS#1swxYwYdS)u0Export a profile to a tar.gz archive. ``extra_files`` maps root-relative filenames (e.g. ``desktop.json``) to text content staged into the archive alongside the profile's own files — the desktop app uses it to bundle its appearance/interface overlay. Returns the output file path. rNrurrUz.tgzstagedr*cpiD]Q\}}t|}|j|}|jdd||dRdS)NTrrr)r  _normalize_profile_archive_partsjoinpathrrr)r`rFrrBrr^s r0 _stage_extrasz%export_profile.._stage_extrass(.B5577 9 9LC4S99E$V_e,F M  t  < < <   g  8 8 8 8  9 9rGrhTryrVrc(t|zSr)rO)drI_CREDENTIAL_FILESs r0z export_profile..s'83x=='HrG)tempfilerrrrrrrE removesuffixTemporaryDirectoryrrrQr\) rr]r^rirr)outputrRrdtmpdirr`rrgs ` @r0export_profilernsOOO "4 ( (E%   !%((K     F DE D D DEEE +  F v;; # #I . . ; ;F C CD9d9t999999  ( ( * * f&\\I-F O-k::      M& ! ! !*4CCF<<   $ $ & & &f%(&1  HHHH      f&tVU;;F||                  s&A"D77D;>D;AF??GG member_namecp|dd}t|}t|}|r/|s|s|jrt d|d|jD}|rtd|Drt d||S)z4Return safe path parts for a profile archive member.\/zUnsafe archive member path: cg|]}|dv| S)>r.rrparts r0 z4_normalize_profile_archive_parts..s" H H Hd$i2G2GT2G2G2GrGc3"K|] }|dkV dS)z..Nrrus r0rz3_normalize_profile_archive_parts..s&77 777777rG)rrr is_absolutedriver=rBr)ronormalized_name posix_path windows_pathrBs r0rbrbs!))$44O//J";//L G  ! ! # #G  # # % %G   G E EEFFF H Hj. H H HE GC7777777GE EEFFF LrGarchive destinationc *ddl}||d5}|D]H}t|j}|j|}|r|ddM|std|j|j dd| |}|td|j|5t|d5}tj ||dddn #1swxYwYdddn #1swxYwY tj||jd z9#t"$rYFwxYw ddddS#1swxYwYdS) zAExtract a profile archive without allowing path escapes or links.rNr:gzTrz!Unsupported archive member type: zCannot read archive member: wbi)rXr getmembersrbrrcisdirrisfiler=r extractfiler copyfileobjrrmoder.) r~rrXr[memberrBr extractedrs r0_safe_extract_profile_archiversoNNN gv & &"mmoo  F4V[AAE)[)51F||~~  TD 999==??  E EE M  t  < < <v..I  !M !M!MNNN 3 3D.. 3#"9c222 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 u!45555    / s~CF4D>D'  D>'D+ +D>.D+ /D>2 F>E FE F E)'F) E73F6E77FF F cddl}||d5}d|D}|sd|D}dddn #1swxYwY|S)aReturn the archive's top-level directory names. Profile imports expect exactly one root directory. Inspecting the archive before extraction lets us stage the import safely instead of mutating a live profile tree first and reconciling names later. rNrch|]E}t|j}t|dks|=|dFS)rr)rbrr r)rrrBs r0rz1_inspect_profile_archive_roots..sP   :6;GG5zzA~~~ !H~~rGcjh|]0}|t|jd1S)r)rrbr)rrs r0rz1_inspect_profile_archive_roots..sE<<>>0==a@rG)rXrr)r~rXr[top_dirss r0_inspect_profile_archive_rootsrsNNN gv & & "  --//      mmooH                Os?A&&A*-A*rZcddl}t|}|std|t |}t |dkr|nd}|p|}|std|tdt|}t||dkrtdt|}|rtd |d |t} | d d |d 5} t| } t|| | |z } | std|| } ||kr| |z } | | t%jt)| t)|dddn #1swxYwY|S)zImport a profile from a tar.gz archive. If *name* is not given, infers it from the archive's top-level directory. Returns the imported profile directory. rNzArchive not found: rzpCannot determine profile name from archive. Specify it explicitly: hermes profile import --name z=Profile archive must contain exactly one top-level directory.rhuCannot import as 'default' — that is the built-in root profile (~/.hermes). Specify a different name: hermes profile import --name rurvTrhermes_profile_import_)r z,Profile archive root is missing or invalid: )rirr-rrr popr=rrrrrrrkrrrenamermoverE)rZrrir~r archive_root inferred_namerr)rfrm staging_rootr final_sources r0import_profiler sz OOO<  G >>  A ?g ? ?@@@-g66H%(]]a%7%78<<>>>TL(LM   S    K    #= 1 1E%     V   "%((KTR%RR[RRSSS&((Mt444  $ $,D $ E E9F|| %g|<<< </ !! M|MM ! 5 '%/L   \ * * * C %%s;'7'7888999999999999999" s>BG&&G*-G*old_namenew_namenew_dirc d|}d|}d|}|dz tdz tjdz dz g}t}|D]4} |} n#t $r|} YnwxYw| |vs|sD||  tj | d} n#t tj f$rYwxYw| d} t| ts|| vr|n|} | | vr|| vrtd |d || | } t| tr]d | vrY| dr| d d d }n"d| vr| dd d n| }|| d <| | | |<||jdz} |tj| dddzd||n9#t $r, |dn#t $rYnwxYwYwxYwtd| d|6dS)zGRename Honcho host blocks for a renamed profile without changing peers.hermes_zhermes.z honcho.jsonz.honchoz config.jsonrrhostsu$⚠ Honcho host block not migrated: z already exists in aiPeerr9rrtr9rIF)indent ensure_asciir=Tr|u✓ Honcho host updated:  → N)rDrrrOr<r.rrrrrJSONDecodeErrorrrr,rrrrr>rrdumpsrr)rrrold_hostlegacy_old_hostnew_hostrseenrrDr8r source_hostblockbarercs r0_migrate_honcho_profile_hostrOs-###H***O###H - ""]2 i-/J eeD,H,H ||~~HH   HHH  t  4<<>>    *T^^W^==>>CC-.    H   %&&  "*e"3"3hh e # #  u   \\\VZ\\ ] ] ] k" eT " " #xu'<'<%%i00 ["((a0037:k7I7I{((a0033{"E(O))K00ht{V344  NN4:c!%HHH4OZaN b b b KK         d ++++     H   F+FFHFFGGGGY,H,Hs[A'' A65A6((CC*)C*/AH44 I*?II* I# I*"I##I*)I*ct|}t|}t|t||dkrtd|dkrtdt|}t|}|st d|d|rtd|dt|rt||t|| |td|j d|j t|||t|t!|}|s"t#|td |ntd |d | t%|kr!t'|td |n#t($rYnwxYw|S) zrRename a profile: directory, wrapper script, service, active_profile. Returns the new profile directory. rhz"Cannot rename the default profile.u.Cannot rename to 'default' — it is reserved.rurz' already exists.u ✓ Renamed ru✓ Alias updated: u⚠ Cannot create alias 'u' — u✓ Active profile updated: )rrr=rrrr-rr=rrrrrrrrrrrr)rr old_canon new_canonold_dirr collisions r0rename_profilers- 'x00I&x00I)$$$)$$$I=>>>IIJJJi((Gi((G >>  J HI H H HIII~~HF)FFFGGGg&&' G444g&&& NN7 : : :GL : :;;;!Iw???)$$$%i00I Hi((( /I//0000 F)FF9FFGGG   9 , , y ) ) ) <<< = = =       Ns3G GGct|}t|t|}|dkr)|st d|d|t |S)zResolve a profile name to a HERMES_HOME path string. Called early in the CLI entry point, before any hermes modules are imported, to set the HERMES_HOME environment variable. rhrur<)rrrrrrE)rrr)s r0resolve_profile_envrs #< 0 0E%   !%((K +"4"4"6"6 = = =5: = =   {  rGr)NFFFFN)F)fr$rrrerrrrrrJ dataclassesrpathlibrrrtypingrrr r agent.skill_utilsr compilerrrrrrPrEr% frozensetr!r(r,r&r1rF_DEFAULT_EXPORT_EXCLUDE_ROOTrNrrrrDrrrrrrrrrrrrrrr,rrrr/r4r=r>floatr'rKrGrSrUrXr_rhrnrrrrrrrrrrrrrrkrQr\rnrbrrOrrrrrrrGr0rs *  !!!!!!8888888888............4444449:: "$s),3<)===333,3<)===333 0DT343333t )y***  B )y * * *  )  i!!! 3D 3 3 3 3%$%%%%9$9999 *$****$      <  c  d     (#($((((++++++'' ''''TGGGGG (((Xc](htn((((V< T d    >GG#GGGG6.c3h....j ####### #@  %    2DU(R;=DeE5#$5667<<<du6tP(D(T((((4D8"&'+ "7"7"7"7#"7tn "7  "7"7"7"7REtK(EEEEP&&$uS$Y/?*@&&&&V!%!%~~ ~ ~~ ~  ~  ~#~ ~~~~B**T*$*8D>****Z111$s)1111hmsmm$s)mmmm`&B#&BD&BT&B&B&B&BRDD"T""""Jscc"77737Xd3PS8n=U7ae7777t#$s)(4dt@DSX2<<<HSM<T<<<<F9H39H#9H9HQU9H9H9H9Hx4S4C4D4444vccrG