,jNUdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z m Z ddlmZmZddlmZejdZgdZgd Zd d gZgd Zeeed <ehdZeeed<dZde defdZ de fdZ!ehdZ"ehdZ#ehdZ$de fdZ%de fdZ&de fdZ'de fdZ(dedefdZ)deddfdZ*dede fd Z+dedefd!Z,dedeefd"Z-defd#Z.dZded$eedee fd%Z/dedefd&Z0d'edeefd(Z1e Gd)d*Z2de de3fd+Z4de de3fd,Z5de defd-Z6de de7fd.Z8de de fd/Z9de de:fd0Z;ddd1de d2eed3eeddfd4Zd\de d=edee:fd>Z?d\ded?ede fd@Z@d'eddfdAZAd'eddfdBZBdede ddfdCZCde ddfdDZDdefdEZEdeddfdFZFdefdGZGdHe fdIZHdedJede fdKZIdLedeefdMZJdNe dOe ddfdPZKdNe deLefdQZMdZdRedeede fdSZNdTedUedVe ddfdWZOdTedUede fdXZPd'edefdYZQdS)]u_ Profile management for multiple isolated Hermes instances. Each profile is a fully independent HERMES_HOME directory with its own config.yaml, .env, memory, sessions, skills, gateway, cron, and logs. Profiles live under ``~/.hermes/profiles//`` by default. The "default" profile is ``~/.hermes`` itself — backward compatible, zero migration needed. Usage:: hermes profile create coder # fresh profile + bundled skills hermes profile create coder --clone # also copy config, .env, SOUL.md, skills hermes profile create coder --clone-all # full copy of source profile coder chat # use via wrapper alias hermes -p coder chat # or via flag hermes profile use coder # set as sticky default hermes profile delete coder # remove profile + alias + service N) dataclass)Path PurePosixPathPureWindowsPath)ListOptional)is_excluded_skill_pathz^[a-z0-9][a-z0-9_-]{0,63}$) memoriessessionsskillsskinslogsplans workspacecronhome) config.yaml.envSOUL.mdzmemories/MEMORY.mdzmemories/USER.md) gateway.pidgateway_state.jsonprocesses.json_CLONE_ALL_STRIP>binprofiles node_modules .worktrees hermes-agent_CLONE_ALL_DEFAULT_EXCLUDE_ROOTz.no-bundled-skills profile_dirreturnc^ |tz S#t$rYdSwxYw)z>Return True if the profile opted out of bundled-skill seeding.F)NO_BUNDLED_SKILLS_MARKERexistsOSErrorr s 8/home/ubuntu/.hermes/hermes-agent/hermes_cli/profiles.pyhas_bundled_skills_opt_outr(osA66>>@@@ uus  ,, source_dirc|tkdtdttdttffd }|S)uoExclude infrastructure artifacts when cloning a profile via --clone-all. Two categories: 1. Root-level entries in ``_CLONE_ALL_DEFAULT_EXCLUDE_ROOT`` — known Hermes infrastructure directories that only the default profile (``~/.hermes``) ever contains. Gated on ``source_dir`` actually being the default profile so a named-profile source never has its own data silently dropped. 2. Universal exclusions at any depth — Python bytecode caches that are stale or regenerable (``__pycache__``, ``*.pyc``, ``*.pyo``) and runtime sockets / temp files (``*.sock``, ``*.tmp``). The export-side ignore (``_default_export_ignore``) uses the same two-tier pattern with the broader ``_DEFAULT_EXPORT_EXCLUDE_ROOT`` set because the export archive is a portable snapshot rather than a live clone. directorynamesr!c4g}|D]}|dks|dr||3r\ t|kr|tvr||z#t t f$rYwxYw|S)N __pycache__)z.pycz.pyo.sock.tmp)endswithappendrresolverr% ValueError)r+r,ignoredentryis_default_sourcesource_resolveds r'_ignorez+_clone_all_copytree_ignore.._ignores  E&&>>"CDD'u%%% I..00OCC $CCC#NN5111,D  sABBB)r3_get_default_hermes_homestrr)r)r9r7r8s @@r'_clone_all_copytree_ignorer<ws|$!((**O'+C+E+E+M+M+O+OO3tCyT#Y. N>state.db auth.lock errors.log state.db-shm state.db-wal .update_check.hermes_historyhermes_state.dbresponse_store.dbresponse_store.db-shmresponse_store.db-walrrr sandboxes audio_cache checkpoints image_cacheractive_profiledocument_cachebrowser_screenshotsr auth.jsonrrrrr>tmprootsudotesthermesdefault>acpmcpchatrdumploginmodelsetuptoolsconfigdoctorhonchologoutr statusupdategatewaypairingpluginsprofileversioninsightsr whatsapp uninstallc$tdz S)aReturn the directory where named profiles are stored. Anchored to the hermes root, NOT to the current HERMES_HOME (which may itself be a profile). This ensures ``coder profile list`` can see all profiles. In Docker/custom deployments where HERMES_HOME points outside ``~/.hermes``, profiles live under ``HERMES_HOME/profiles/`` so they persist on the mounted volume. rr:r=r'_get_profiles_rootrps $ % % 22r=c"ddlm}|S)zReturn the default (pre-profile) HERMES_HOME path. In standard deployments this is ``~/.hermes``. In Docker/custom deployments where HERMES_HOME is outside ``~/.hermes`` (e.g. ``/opt/data``), returns HERMES_HOME directly. rget_default_hermes_root)hermes_constantsrsrrs r'r:r:s%988888 " " $ $$r=c$tdz S)z2Return the path to the sticky active_profile file.rMrnror=r'_get_active_profile_pathrvs # % %(8 88r=c4tjdz dz S)z)Return the directory for wrapper scripts.z.localr)rrror=r'_get_wrapper_dirrxs 9;; !E ))r=namect|tst|}|}|std|dkrdS|S)uReturn the canonical profile id used on disk and in CLI ``-p`` argv. Named profiles are stored lowercase under ``profiles//``. The special alias ``default`` is matched case-insensitively (``Default`` → ``default``). Dashboards and tools may pass title-cased display labels; normalize before validation, assignment, and subprocess spawn (see issue #18498). zprofile name cannot be emptyrV) isinstancer;stripr4casefoldlower)rystrippeds r'normalize_profile_namersq dC 4yyzz||H 97888i''y >>  r=c|dkrdSt|std|d|tvrtd|ddS)uRaise ``ValueError`` if *name* is not a valid profile identifier. Validates the input as-given — strict lowercase match. Callers that accept mixed-case or title-cased input from users (dashboard UI, CLI args) should call :func:`normalize_profile_name` first. This separation keeps validate honest about what the on-disk directory name must look like, while ingress-point normalization handles UX flexibility (see #18498). Also rejects names in :data:`_RESERVED_NAMES` (``hermes``, ``test``, ``tmp``, ``root``, ``sudo``) that would create confusing on-disk collisions (a ``hermes`` profile inside ``~/.hermes/``) or get refused at alias-creation time anyway. ``default`` is a special pass-through — it's a valid alias for the built-in root profile. rVNzInvalid profile name z%. Must match [a-z0-9][a-z0-9_-]{0,63}z Profile name uz is reserved — it collides with either the Hermes installation itself or a common system binary. Pick a different name.)_PROFILE_ID_REmatchr4_RESERVED_NAMES)rys r'validate_profile_namer s y    % %  *D * * *     &D & & &   r=cjt|}|dkrtSt|z S)z4Resolve a profile name to its HERMES_HOME directory.rV)rr:rprycanons r'get_profile_dirr+s7 "4 ( (E ')))   % ''r=crt|}|dkrdSt|S)z)Check whether a profile directory exists.rVT)rris_dirrs r'profile_existsr3s9 "4 ( (E t 5 ! ! ( ( * **r=c4t|}|tvrd|dS|tvrd|dSt}tjdk} t j|rdnd|gddd }|jd kr|j d }||r|d n|z }|t|kr, | }d |vrd Sn#t$rYnwxYwd|d|dSn#tt jf$rYnwxYwd S)zReturn a human-readable collision message, or None if the name is safe. Checks: reserved names, hermes subcommands, existing binaries in PATH. 'z' is a reserved namez$' conflicts with a hermes subcommandwin32wherewhichT)capture_outputtexttimeoutr.bat hermes -pNz&' conflicts with an existing command ())rr_HERMES_SUBCOMMANDSrxsysplatform subprocessrun returncodestdoutr| splitlinesr; read_text ExceptionFileNotFoundErrorTimeoutExpired)ryr wrapper_dir is_windowsresult existing_pathexpectedcontents r'check_alias_collisionr?s #4 ( (E .5.... ###>5>>>>#$$K(J " /WW 7dA      ! !"M//11<<>>qAM" &MnnnnNHH --&0022G"g--#t. DTuTTMTTT T " z8 9      4s7 A9C<C"!C<" C/,C<.C// C<<DDctt}|tjddtjvS)z!Check if ~/.local/bin is in PATH.PATH)r;rxosenvirongetsplitpathsep)rs r'_is_wrapper_dir_in_pathrdsA&(())K "*..44::2:FF FFr=targetct|}|rt|n|}t} |ddn-#t$r }t d|d|Yd}~dSd}~wwxYwt jdk}|rQ||dz } |d|d |S#t$r }t d |d|Yd}~dSd}~wwxYw||z } |d |d || j tj ztj ztj z|S#t$r }t d |d|Yd}~dSd}~wwxYw) uCreate a shell wrapper script at ~/.local/bin/. The wrapper file is named after ``name`` (the alias). The profile it activates is ``target`` if given, otherwise ``name`` — this lets a custom alias name point at a differently-named profile without a post-hoc rewrite. On Windows, creates a ``.bat`` file instead of a POSIX shell script. Returns the path to the created wrapper, or None if creation failed. Tparentsexist_oku⚠ Could not create : Nrrz@echo off hermes -p z %* u ⚠ Could not create wrapper at z#!/bin/sh exec hermes -p z "$@" )rrxmkdirr%printrr write_textchmodstatst_modeS_IEXECS_IXGRPS_IXOTH)ryrrrhrer wrapper_paths r'create_wrapper_scriptrjs #4 ( (E06A$V,,,EG"$$K$6666  8k88Q88999ttttt(J"^^^3    # #$Ng$N$N$N O O O     H\HHQHH I I I44444 #U*    # #$Q$Q$Q$Q R R R   |0022:T\IDLX[_[gg h h h     H\HHQHH I I I44444 sHA A4A//A4B-- C7CC A-E E8E33E8c\t}t|}tjdk}||z g}|r|d||dz |D]W}|rA |}d|vr|dSG#t$rYSwxYwXdS)zARemove the wrapper script for a profile. Returns True if removed.rrrrTF) rxrrrinsertr$runlinkr)ryrrr candidatesrrs r'remove_wrapper_scriptrs"$$K "4 ( (E(J%&J;![e>>>9:::"        &0022')) '')))44*      5s+,B B('B( profile_namect}|sdSt|}tjdk}d|}d}d}t |D]~}|s|r |jdkr%|s|jr/ | }n#ttf$rYXwxYw||vra|r|j n|j } | |kr| }z|| }||n|S)uReturn the alias name of the wrapper that activates *profile_name*, or None. A wrapper created by :func:`create_wrapper_script` is a file named after the alias whose body invokes ``hermes -p ``. When the alias name equals the profile name this is trivial, but a custom alias (``hermes profile alias --name ``) produces a differently-named file — so the display side cannot assume ``wrapper == profile`` and must reverse-look-up. A custom alias (name != profile) is preferred over the profile-named wrapper so ``profile list``/``show`` surface the command the user actually typed. Results are sorted for deterministic output when several aliases match. Nrz hermes -p r)rxrrrrsortediterdiris_filesuffixrr%UnicodeDecodeErrorstemry) rrrrneedlecustom profile_namedr6raliass r'find_alias_for_profilers?#$$K     t "< 0 0E(J !% ! !F F#'M ++--..}}    %,&00  el   oo''GG+,    H   (8 ej E>>!MM ^F'66]:sB33CCc*eZdZUdZeed<eed<eed<eed<dZe eed<dZ e eed<d Z eed <d Z e ed <dZe eed <dZe eed<dZe eed<dZe eed<dZe eed<dZeed<d Zeed<dS) ProfileInfoz$Summary information about a profile.rypath is_defaultgateway_runningNr\providerFhas_envr skill_count alias_path alias_namedistribution_namedistribution_versiondistribution_sourcer descriptiondescription_auto)__name__ __module__ __qualname____doc__r;__annotations__rboolr\rrrrintrrrrrrrror=r'rrs.. III JJJE8C="Hhsm"""GTK!%J%%%!%J $$$'+x}+++*.(3-...)-#--- K #d"""""r=rc|dz }|sdS ddl}t|dd5}||pi}dddn #1swxYwYt |t sdS|d|d |d fS#t$rYdSwxYw) uReturn ``(name, version, source)`` from the profile's ``distribution.yaml`` if present; ``(None, None, None)`` otherwise. Failures (missing file, bad YAML) are swallowed — a bad manifest should never break ``hermes profile list`` for an unrelated profile. zdistribution.yaml)NNNrNrutf-8encodingryrisource)ryamlopen safe_loadr{dictrr)r mf_pathrfdatas r'_read_distribution_metars'//G ??      '3 1 1 1 +Q>>!$$*D + + + + + + + + + + + + + + +$%% $## HHV   HHY   HHX        s:B7A B7AB7AB79=B77 CCc|dz }|sdS ddl}t|dd5}||pi}dddn #1swxYwY|di}t |t r|dfSt |tr?|d p|d|d fSdS#t$rYdSwxYw) zLRead model/provider from a profile's config.yaml. Returns (model, provider).r)NNrNrrrr\rVr) r$rrrrr{r;rr)r config_pathrrcfg model_cfgs r'_read_config_modelrsN -K     z  +sW 5 5 5 *..##)rC * * * * * * * * * * * * * * *GGGR(( i % % #d? " i & & a==++Ey}}W/E/Ey}}U_G`G`` `z zzs;C'A C'AC'A1C'AC'' C54C5cV ddlm}||dz dduS#t$rYdSwxYw)z/profile.yaml`` and return a dict. Returns ``{"description": "", "description_auto": False}`` when the file is missing or unreadable. Never raises — a corrupt profile.yaml on an unrelated profile must not break ``hermes profile list``. rFrrrNrrrrr) rrrrrrr{rr;rr|r)r rrrrs r'read_profile_metarNs[ k * *D <<>>>!u===> $g . . . +!>>!$$*D + + + + + + + + + + + + + + + >>>!u=====> dD ! !>!u===488M228b99??AA */profile.yaml`` in place. Only the explicitly passed fields are overwritten; unspecified fields preserve existing values. Creates the file if missing. Profile directory itself must exist. z"profile directory does not exist: rNrrrrrwF) sort_keysdefault_flow_style) rrrrrrrr{rrr|r safe_dump)r rrrrexistingrloadeds r'write_profile_metargs     T R[ R RSSSKKK k * *DH ||~~ dC'222 1a**0b 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1&$'' "!   HHH "-"3"3"5"5#'+,<'='=#$ dC' * * *Oa xeNNNOOOOOOOOOOOOOOOOOOsHB*#B; B*B  B*B B** B98B9;D""D&)D&cg}t}t}|rt|\}}t |\}}}t |}|td|dt||||dz t||||| dd| dd t} | rht| D]E} | s| j} | dkr&t | sAt| \}}t%| } | rt&jd k} || r| d n| z }nd }t | \}}}t | }|t| | dt| ||| dz t| |r| r|nd | |||| dd| dd G|S) z4Return info for all profiles, including the default.rVTrrrrF) ryrrrr\rrrrrrrrrrN)ryrrrr\rrrrrrrrrr)rxr:rrrrr2rrr$r rrprrryrrrrr)rr default_homer\r dist_name dist_version dist_sourcemeta profiles_rootr6ryrrrs r' list_profilesr"sH"$$K,--L ,\::x/F|/T/T, < .. 2<@@!F*2244%l33'!- +33!XX&8%@@      "'((M"M113344! ! E<<>> :Dy  !''-- 077OE8/55J " \W4 (:,]z,?,?,?,?S]^ ! 3J53Q3Q 0I|[$U++D OOK 6u = =!//11)%00*4W9J9J9L9LW::SW%"+%1$/ HH]B77!%*>(/7799L ^TA B@2:?}c+.>.>??L!!dB       ! !fm&9&9&;&; !:fm113344 4 : M&:KMM N N N}""$$ :86=..00#688999t  $ 7 5 6 6 6tt  4 2q22 3 3 3ttttts&BE (A#E F0 F9FFyesct|}t||dkrtdt|}|st d|dt |\}}t|}t|}t|\}} } td|td||rtd||rd|d nd z|rtd ||r+td |d | pd| rtd| dg} t|z } | } | r| d| d td| D]}td||rtd|stt td|d}n(#t t"f$rtd|cYSwxYw||krtd|St%||t'||rt)|| r!t+|rtd| d} d} t-j||n&#t0$rt-j||YnwxYwtd|n.#t2$r!}td|d||}Yd}~nd}~wwxYw t5}||krt7dtd n#t2$rYnwxYw|t9d!|d||td"|d#|S)$zDelete a profile, its wrapper script, and its gateway service. Stops the gateway if running. Disables systemd/launchd service first to prevent auto-restart. Returns the path that was removed. rVzZCannot delete the default profile (~/.hermes). To remove everything, use: hermes uninstallr)' does not exist.z Profile: z Path: z Model: z (rrz Skills: zDistribution: @?zInstalled from: z;All config, API keys, memories, sessions, skills, cron jobszCommand alias (z This will permanently delete:u • u0 ⚠ Gateway is running — it will be stopped.zType 'z' to confirm: z Cancelled.z Cancelled.u ✓ Removed Ncddl}t|tr|d}t|tr t j|t j|j|jzn#t$rYnwxYwtj |}|rF t j|t j|j|jzn#t$rYnwxYw||dS)aonexc/onerror handler: add +w on PermissionError so rmtree can proceed. Handles two cases on NixOS (and other systems with read-only copies from immutable stores): 1. The path itself isn't writable (e.g. a file with mode 0444) 2. The *parent* directory isn't writable (e.g. mode 0555) Compatible with both the ``onexc`` API (3.12+, receives an exception instance) and the ``onerror`` API (3.11-, receives ``sys.exc_info()`` tuple). rNr) rr{tuplePermissionErrorrrrS_IWUSRr%rdirname)funcrexc_statr;s r'_make_writablez&delete_profile.._make_writable s ! #u%% !f#// HT274==#85=#HIIIID..)@5=)PQQQQ"T s#4A-- A:9A:4C C! C!)onexc)onerroru⚠ Could not remove ru#✓ Active profile reset to defaultz#Could not remove profile directory z Profile 'z ' deleted.)rrr4rrrrrr rrrxr$r2inputr|KeyboardInterruptEOFError_cleanup_gateway_service!_maybe_unregister_gateway_service_stop_gateway_processrr5rmtree TypeErrorrget_active_profileset_active_profile RuntimeError)ryrZrr r\r gw_runningrrrritemsr has_wrapperitemconfirm remove_errorrgrr-s r'delete_profiler{s #4 ( (E%     :   "%((K     F DE D D DEEE)55OE8' 44J ,,K+B;+O+O(I|[       #k # #$$$ L !%!!%I%5(%5%5%5%5rJKKK) '+''(((4 @y@@<+>3@@AAA  4 2[22 3 3 3 F E $%%-L%%''K8 6|666777 ,--- otooC ABBB    :U:::;;AACCGG!8,    . ! ! !     e   ,    UK000&e,,,+k***1  ' ' 1 /// 0 0 0&*L.# # # L ? M+^ < < < < < ? ? ? M+~ > > > > > > ? *[**++++  8k88Q88999   #%% U?? y ) ) ) 7 8 8 8      ^^^P\^^__eqq ) ) ) )*** s`<%G"""HH7K ;JK  J52K 4J55K K6K11K6:2L-- L:9L:cT ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||dS#t$rYdSt$r}td|Yd}~dSd}~wwxYw)uxRegister a profile's gateway with s6 inside the container. No-op on host (systemd/launchd/windows) — those backends raise ``NotImplementedError`` on ``register_profile_gateway`` and the existing per-profile unit-generation paths handle lifecycle. Best-effort: any error (no backend detected, s6 not yet ready, etc.) is logged and swallowed so profile creation doesn't fail because the s6 supervision tree is in a weird state. The user can re-register manually later via the gateway start command, which goes through the same dispatch path. Port selection is governed by the profile's ``config.yaml`` (``[gateway] port = …``) — there is no Python-side allocator (PR #30136 review item I5 retired the SHA-256-derived range [9200, 9800) because it was dead code through the entire stack). Host short-circuit: check ``detect_service_manager()`` first and return immediately if it isn't ``"s6"``. This keeps host (systemd/launchd/windows) profile creation completely silent — no ``get_service_manager()`` call, no exception path, no chance of the ``⚠ Could not register s6 gateway service`` warning ever rendering on a non-container machine. The earlier ``supports_runtime_registration()`` check still catches the case where detection somehow returns ``"s6"`` but the backend isn't actually the S6 one. rdetect_service_managers6Nget_service_manageru+⚠ Could not register s6 gateway service: ) hermes_cli.service_managerr~rrtrsupports_runtime_registrationregister_profile_gatewayr4rrr~rmgrres r'r=r=Is38 EEEEEE ! ! # #t + + FBBBBBB!!##      , , . .C $$\22222      CCC ACAABBBBBBBBBCs6)) A AAA44 B' B' B""B'c< ddlm}|dkrdSddlm}|}n#t$rYdSt$rYdSwxYw|sdS ||dS#t$r}td|Yd}~dSd}~wwxYw)uTear down a profile's s6 gateway service inside the container. No-op on host. Idempotent: absent services are silently skipped by ``unregister_profile_gateway``. Same host short-circuit as :func:`_maybe_register_gateway_service` — see that docstring. rr}rNru-⚠ Could not unregister s6 gateway service: )rr~rrtrrunregister_profile_gatewayrrs r'rnrns EEEEEE ! ! # #t + + FBBBBBB!!##    , , . .E &&|44444 EEE CcCCDDDDDDDDDEs0)) A AAA44 B>BBc\ddl}tjd} t |tjd<ddlm}m}|dkr|}tj dz dz dz |d z }| r{tj d d d |gd ddtj d d d|gd dd|d tj gdd ddtd|dn|dkrk|}| rMtj ddt |gd dd|d tdn)#t $r} td| Yd} ~ nd} ~ wwxYw||tjd<dSdtjvrtjd=dSdS#||tjd<ndtjvr tjd=wxYw)z9Disable and remove systemd/launchd service for a profile.rNrN)get_service_nameget_launchd_plist_pathLinuxz.configsystemduserz.service systemctl--userdisableTF )rcheckrstopr0)rrz daemon-reloadu ✓ Service z removedDarwin launchctlunloadu✓ Launchd service removedu⚠ Service cleanup: )rrrrr;hermes_cli.gatewayrrsystemrrr$rrrrr) ryr _platformold_homerrsvc_namesvc_file plist_pathrs r'rmrms    z~~m,,H&*$' $4$4 =!OOOOOOOO      ( (''))Hy{{Y.:VCF[F[F[[H   9 (Ix@#'ub (FH=#'ub4000<<<#'ub7X777888     8 + +//11J  "" 6 (C OO<#'ub!!T!2224555 +++ )a))********+  (0BJ} % % % bj ( ( =)))) (  (0BJ} % % bj ( ( =) ) ) ) )s0E;F! G<! G+G=G<GG<``. Returns ``"custom"`` if HERMES_HOME is set to an unrecognized path. rr+rVrr) rtr,r3r:rp relative_topartslenrrr4)r, hermes_homeresolveddefault_resolvedr!relrs r'get_active_profile_namers100000!/##K""$$H/1199;;###y&((0022M ""=11  u::??~33E!H==?8O       8s.AC CCroot_dirc>dtdtdtffd }|S)zReturn an *ignore* callable for :func:`shutil.copytree`. At the root level it excludes everything in ``_DEFAULT_EXPORT_EXCLUDE_ROOT``. At all levels it excludes ``__pycache__``, sockets, and temp files. r+contentsr!c&t}|D]L}|dks|dr||3|dvr||Mt|kr|d|D|S)Nr.)r/r0> package.jsonpackage-lock.jsonc3,K|]}|tv |VdSN)_DEFAULT_EXPORT_EXCLUDE_ROOT).0cs r' z:_default_export_ignore.._ignore..Ns-TT!7S2S2S12S2S2S2STTr=)setr1addrrd)r+rr5r6rs r'r9z'_default_export_ignore.._ignoreCsuu # #E %%8I)J)J% E""""??? E"""  ??h & & NNTThTTT T T Tr=)r;listr)rr9s` r'_default_export_ignorer<s= 3 $ 3       Nr= output_pathc` ddl}t|}t|t|}|st d|dt |}t|dd}|dkr| 5}t |dz }tj ||t|tj |d |d} t | cdddS#1swxYwY| 5}t ||z }d d h tj || fd tj |d ||} t | cdddS#1swxYwYdS) zMExport a profile to a tar.gz archive. Returns the output file path. rNr)r\z.tar.gzz.tgzrVr.gztarrPrc(t|zSr)r)dr_CREDENTIAL_FILESs r'z export_profile..zs'83x=='Hr=)tempfilerrrrrrr; removesuffixTemporaryDirectoryr5r6r make_archive) ryrrrr outputbasetmpdirstagedrrs @r'export_profilerTsF OOO "4 ( (E%   !%((K     F DE D D DEEE +  F v;; # #I . . ; ;F C CD  ( ( * * f&\\I-F O-k::     (w JJF<<                  $ $ & & &f%(&1  HHHH    $T7FEBBF||                  s&8AD!!D%(D%AF##F'*F' member_namecp|dd}t|}t|}|r/|s|s|jrt d|d|jD}|rtd|Drt d||S)z4Return safe path parts for a profile archive member.\/zUnsafe archive member path: cg|]}|dv| S)>r.rorparts r' z4_normalize_profile_archive_parts..s" H H Hd$i2G2GT2G2G2Gr=c3"K|] }|dkV dS)z..Nrors r'rz3_normalize_profile_archive_parts..s&77 777777r=)rrr is_absolutedriver4rany)rnormalized_name posix_path windows_pathrs r' _normalize_profile_archive_partsrs!))$44O//J";//L G  ! ! # #G  # # % %G   G E EEFFF H Hj. H H HE GC7777777GE EEFFF Lr=archive destinationc *ddl}||d5}|D]H}t|j}|j|}|r|ddM|std|j|j dd| |}|td|j|5t|d5}tj ||dddn #1swxYwYdddn #1swxYwY tj||jd z9#t"$rYFwxYw ddddS#1swxYwYdS) zAExtract a profile archive without allowing path escapes or links.rNr:gzTrz!Unsupported archive member type: zCannot read archive member: wbi)tarfiler getmembersrryjoinpathisdirrisfiler4r; extractfiler5 copyfileobjrrmoder%) rrrtfmemberrr extractedrBs r'_safe_extract_profile_archiversoNNN gv & &"mmoo  F4V[AAE)[)51F||~~  TD 999==??  E EE M  t  < < <v..I  !M !M!MNNN 3 3D.. 3#"9c222 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 u!45555    / s~CF4D>D'  D>'D+ +D>.D+ /D>2 F>E FE F E)'F) E73F6E77FF F cddl}||d5}d|D}|sd|D}dddn #1swxYwY|S)aReturn the archive's top-level directory names. Profile imports expect exactly one root directory. Inspecting the archive before extraction lets us stage the import safely instead of mutating a live profile tree first and reconciling names later. rNrch|]E}t|j}t|dks|=|dFS)rr)rryrr)rrrs r' z1_inspect_profile_archive_roots..sP   :6;GG5zzA~~~ !H~~r=cjh|]0}|t|jd1S)r)rrry)rrs r'rz1_inspect_profile_archive_roots..sE<<>>0==a@r=)rrr)rrrtop_dirss r'_inspect_profile_archive_rootsrsNNN gv & & "  --//      mmooH                Os?A&&A*-A* archive_pathcddl}t|}|std|t |}t |dkr|nd}|p|}|std|tdt|}t||dkrtdt|}|rtd |d |t} | d d |d 5} t| } t|| | |z } | std|| } ||kr| |z } | | t%jt)| t)|dddn #1swxYwY|S)zImport a profile from a tar.gz archive. If *name* is not given, infers it from the archive's top-level directory. Returns the imported profile directory. rNzArchive not found: rzpCannot determine profile name from archive. Specify it explicitly: hermes profile import --name z=Profile archive must contain exactly one top-level directory.rVuCannot import as 'default' — that is the built-in root profile (~/.hermes). Specify a different name: hermes profile import --name r)r*Trhermes_profile_import_)prefixz,Profile archive root is missing or invalid: )rrr$rrrpopr4rrrr4rprrrrrenamer5mover;)rryrrr archive_root inferred_namerr r!r staging_rootr final_sources r'import_profilersz OOO<  G >>  A ?g ? ?@@@-g66H%(]]a%7%78<<>>>TL(LM   S    K    #= 1 1E%     V   "%((KTR%RR[RRSSS&((Mt444  $ $,D $ E E9F|| %g|<<< </ !! M|MM ! 5 '%/L   \ * * * C %%s;'7'7888999999999999999" s>BG&&G*-G*old_namenew_namenew_dirc d|}d|}d|}|dz tdz tjdz dz g}t}|D]4} |} n#t $r|} YnwxYw| |vs|sD||  tj | d} n#t tj f$rYwxYw| d} t| ts|| vr|n|} | | vr|| vrtd |d || | } t| tr]d | vrY| dr| d d d }n"d| vr| dd d n| }|| d <| | | |<||jdz} |tj| dddzd||n9#t $r, |dn#t $rYnwxYwYwxYwtd| d|6dS)zGRename Honcho host blocks for a renamed profile without changing peers.hermes_zhermes.z honcho.jsonz.honchoz config.jsonrrhostsu$⚠ Honcho host block not migrated: z already exists in aiPeerrrrr0F)indent ensure_asciirTr0u✓ Honcho host updated:  → N)r:rrrr3r%rrrUrVrJSONDecodeErrorrr{rrrrr rrrdumpsrr)rrrold_hostlegacy_old_hostnew_hostrseenrrrr source_hostblockbarerQs r'_migrate_honcho_profile_hostr's-###H***O###H - ""]2 i-/J eeD,H,H ||~~HH   HHH  t  4<<>>    *T^^W^==>>CC-.    H   %&&  "*e"3"3hh e # #  u   \\\VZ\\ ] ] ] k" eT " " #xu'<'<%%i00 ["((a0037:k7I7I{((a0033{"E(O))K00ht{V344  NN4:c!%HHH4OZaN b b b KK         d ++++     H   F+FFHFFGGGGY,H,Hs[A'' A65A6((CC*)C*/AH44 I*?II* I# I*"I##I*)I*ct|}t|}t|t||dkrtd|dkrtdt|}t|}|st d|d|rtd|dt|rt||t|| |td|j d|j t|||t|t!|}|s"t#|td |ntd |d | t%|kr!t'|td |n#t($rYnwxYw|S) zrRename a profile: directory, wrapper script, service, active_profile. Returns the new profile directory. rVz"Cannot rename the default profile.u.Cannot rename to 'default' — it is reserved.r)r\z' already exists.u ✓ Renamed ru✓ Alias updated: u⚠ Cannot create alias 'u' — u✓ Active profile updated: )rrr4rrrr$r4rrmror rryr'rrrrrrsr)rr old_canon new_canonold_dirr collisions r'rename_profiler-Ls- 'x00I&x00I)$$$)$$$I=>>>IIJJJi((Gi((G >>  J HI H H HIII~~HF)FFFGGGg&&' G444g&&& NN7 : : :GL : :;;;!Iw???)$$$%i00I Hi((( /I//0000 F)FF9FFGGG   9 , , y ) ) ) <<< = = =       Ns3G GGct|}t|t|}|dkr)|st d|d|t |S)zResolve a profile name to a HERMES_HOME path string. Called early in the CLI entry point, before any hermes modules are imported, to set the HERMES_HOME environment variable. rVr)r)rrrrrr;)rrr s r'resolve_profile_envr/s #< 0 0E%   !%((K +"4"4"6"6 = = =5: = =   {  r=r)NFFFFN)F)RrrUrrer5rrr dataclassesrpathlibrrrtypingrragent.skill_utilsr compilerr7r8r:rrr;r frozensetrr#rr(r<rrrrpr:rvrxrrrrrrrrrrr`rrrrr rrrrr"rGrYr{r=rnrmrorrrsrrrrrrrrr'r-r/ror=r'r7s*  !!!!!!8888888888!!!!!!!!4444449:: "$s),3<)===3330DT,4,,,,f )y***  2)  i!!! 3D 3 3 3 3%$%%%%9$9999 *$****$      <(#($((((++++++"" """"JGGGGG $$$Xc]$htn$$$$N0););#););););` ####### #@  %    2DU& t     6(D(T((((4D8"&'+ OOOO#Otn O  OOOOJAtK(AAAAL!%!%uu u uu u  u  u#u uuuup**T*$*8D>****ZQQQ4QDQQQQh3C#3C$3C3C3C3ClECEDEEEE6-*3-*T-*d-*-*-*-*`$2t$2$2$2$2$2V C    ST2>T0))3)4))))X#$s)(4dt@DSX2<<<HSM<T<<<<F9H39H#9H9HQU9H9H9H9Hx4S4C4D4444vccr=